User Data Integrity Research Articles

Development of Mathematical Algorithm for Detecting XSS Attacks on Web Applications

The widespread usage of web applications has led to an increase in security threats, with Cross-Site Scripting (XSS) attacks being one of the most prevalent and damaging. Detecting and mitigating XSS attacks is crucial to ensure the integrity and confidentiality of sensitive user data. This article presents the mathematical algorithm and a way to identify XSS attacks using a bounded function from below, which depends on the input string, and highlights its potential impact in bolstering web application security. To construct this function, we used special characters and keywords that are frequently found in the construction of XSS attacks.

Perbandingan Evaluasi Kerentanan Menggunakan Tenable Nessus Scanner dan Owasp Zed Attack Proxy untuk Meningkatkan Keamanan Sistem Informasi Kepegawaian di Universitas Merdeka Malang

This study aims to compare the vulnerability analysis between Tenable Nessus Scanner and OWASP Zed Attack Proxy (ZAP) for improving the security of the Human Resource Information System (HRIS) website at Universitas Merdeka Malang. The research methodology includes the use of both Nessus and OWASP ZAP tools to scan the HRIS website for potential vulnerabilities. The findings of this research indicate that OWASP ZAP identified several critical web application vulnerabilities such as the absence of Anti-CSRF tokens, lack of Content Security Policy (CSP) headers, and missing Anti-Clickjacking headers, which are essential for maintaining the security and integrity of user data. On the other hand, Nessus Scanner focused more on network and server infrastructure vulnerabilities. The results suggest that OWASP ZAP is more effective for web application security in this context. Recommendations are provided to address the identified vulnerabilities and enhance the overall security of the HRIS website.

Development of Mathematical Algorithm for Detecting XSS Attacks on Web Applications

The widespread usage of web applications has led to an increase in security threats, with Cross-Site Scripting (XSS) attacks being one of the most prevalent and damaging. Detecting and mitigating XSS attacks is crucial to ensure the integrity and confidentiality of sensitive user data. This article presents the mathematical algorithm and a way to identify XSS attacks using a bounded function from below, which depends on the input string, and highlights its potential impact in bolstering web application security. To construct this function, we used special characters and keywords that are frequently found in the construction of XSS attacks.

Encrypted Chat Application

In today's cyber landscape, the protection of digital communication channels stands as a paramount concern. This abstract dissects the cyber resilience strategies underpinning the development of secure chat applications, with a particular focus on user interface design using Jetpack Compose and encryption integration leveraging Kotlin. The examination commences with an in-depth analysis of the cyber defence mechanisms ingrained within chat interfaces crafted through Jetpack Compose, the cutting-edge toolkit tailored for native Android UI construction. By meticulously adhering to Material Design principles, developers fortify chat interfaces against cyber intrusions, placing a premium on real-time messaging functionalities and multimedia integration to foster user engagement while deterring malicious exploitation.The abstract plunges into the cornerstone role of encryption in fortifying cybersecurity, spotlighting Kotlin's robust encryption capabilities. Through the adept utilization of Kotlin AES encryption algorithms, developers erect an impregnable bastion around user messages, guaranteeing both confidentiality and integrity. Synergizing encryption with Firebase Firestore for fortified data storage and Firebase Authentication for resilient user validation fortifies the application's cyber defense, thereby ensuring user data remains impervious to cyber threats. By amalgamating Jetpack Composes resilient UI design tools with Kotlin's encryption prowess, developers erect a formidable cybersecurity fortress around chat applications. This symbiotic alliance not only safeguards user privacy and data integrity but also reinforces communication channels against the relentless onslaught of cyber adversaries in the ever-evolving cyber landscape Key Words: Encryption Integration, Secure Chat Application, Cyber Resilience Strategies, Cyber Defense Mechanism.

Exploring Challenges and Solutions in Cloud Computing: A Review of Data Security and Privacy Concerns

As organizations transition towards cloud computing environments, the significance of security and privacy concerns escalates. This research report conducts a systematic exploration of diverse challenges and vulnerabilities inherent in cloud computing, with a particular emphasis on security and privacy issues. The study extensively evaluates potential threats ranging from data breaches to unauthorized access, and it evaluates the repercussions of these challenges on user trust and data integrity within cloud infrastructure. Moreover, it proposes and discusses effective strategies and solutions aimed at mitigating security risks and safeguarding user privacy in cloud computing. This paper contributes to the ongoing discourse on cloud security and privacy, offering both practitioners and researchers a valuable reference for navigating the dynamic landscape of cloud-based services.

Exploring Challenges and Solutions in Cloud Computing: A Review of Data Security and Privacy Concerns

As organizations transition towards cloud computing environments, the significance of security and privacy concerns escalates. This research report conducts a systematic exploration of diverse challenges and vulnerabilities inherent in cloud computing, with a particular emphasis on security and privacy issues. The study extensively evaluates potential threats ranging from data breaches to unauthorized access, and it evaluates the repercussions of these challenges on user trust and data integrity within cloud infrastructure. Moreover, it proposes and discusses effective strategies and solutions aimed at mitigating security risks and safeguarding user privacy in cloud computing. This paper contributes to the ongoing discourse on cloud security and privacy, offering both practitioners and researchers a valuable reference for navigating the dynamic landscape of cloud-based services.

An efficient artificial intelligence approach for early detection of cross-site scripting attacks

Cross-Site Scripting (XSS) attacks continue to pose a significant threat to web applications, compromising the security and integrity of user data. XSS is a web application vulnerability where malicious scripts are injected into websites, allowing attackers to execute arbitrary code in the victim’s browser. The consequences of XSS attacks can be severe, ranging from financial losses to compromising sensitive user information. XSS attacks enable attackers to deface websites, distribute malware, or launch phishing campaigns, compromising the trust and reputation of affected organizations. This study proposes an efficient artificial intelligence approach for the early detection of XSS attacks, utilizing machine learning and deep learning approaches, including Long Short-Term Memory (LSTM). Additionally, advanced feature engineering techniques, such as the Term Frequency-Inverse Document Frequency (TFIDF), are applied and compared to evaluate results. We introduce a novel approach named LSTM-TFIDF (LSTF) for feature extraction, which combines temporal and TFIDF features from the cross-site scripting dataset, resulting in a new feature set. Extensive research experiments demonstrate that the random forest method achieved a high performance of 0.99, outperforming state-of-the-art approaches using the proposed features. A k-fold cross-validation mechanism is utilized to validate the performance of applied methods, and hyperparameter tuning further enhances the performance of XSS attack detection. We have applied Explainable Artificial Intelligence (XAI) to understand the interpretability and transparency of the proposed model in detecting XSS attacks. This study makes a valuable contribution to the growing body of knowledge on XSS attacks and provides an efficient model for developers and security practitioners to enhance the security of web applications.

A Blockchain-Based Decentralized Public Key Infrastructure Using the Web of Trust

Internet applications rely on Secure Socket Layer (SSL)/Transport Security Layer (TSL) certifications to establish secure communication. However, the centralized nature of certificate authorities (CAs) poses a risk, as malicious third parties could exploit the CA to issue fake certificates to malicious web servers, potentially compromising the privacy and integrity of user data. In this paper, we demonstrate how the utilization of decentralized certificate verification with blockchain technology can effectively address and mitigate such attacks. We present a decentralized public key infrastructure (PKI) based on a distributed trust model, e.g., Web of Trust (WoT) and blockchain technologies, to overcome vulnerabilities like single points of failure and to prevent tampering with existing certificates. In addition, our infrastructure establishes a trusted key-ring network that decouples the authentication process from CAs in order to enhance secure certificate issuance and accelerate the revocation process. Furthermore, as a proof of concept, we present the implementation of our proposed system in the Ethereum blockchain, confirming that the proposed framework meets the five identified requirements. Our experimental results demonstrate the effectiveness of our proposed system in practice, albeit with additional overhead compared to conventional PKIs.

Decentralization of Webhosting Using Blockchain

Abstract: This paper introduces a ground breaking approach to web hosting, leveraging the decentralized infrastructure of the Interplanetary File System (IPFS) and the secure framework of the Ethereum blockchain. In this novel model, Ethereum smart contracts govern the IPFS network and hosting services, ensuring robust management and reliability. IPFS serves as the backbone for data storage and website hosting, with storage miner nodes providing essential pinning services to maintain the longevity of stored content. Additionally, these nodes facilitate the Interplanetary Name Space (IPNS) service, enabling the creation and maintenance of mutable links to IPFS contents, thus enhancing accessibility and ease of updates. DNS TXT records are employed to seamlessly map domain names to IPNS addresses, seamlessly integrating decentralized hosting with traditional web infrastructure. To safeguard user privacy and data integrity, websites deploy advanced encryption algorithms, ensuring confidentiality in the decentralized environment. The proposed model represents a fusion of IPFS and blockchain networks, creating a robust platform for decentralized web hosting. Through experimental validation, the efficacy of this approach is demonstrated, showcasing its ability to surpass traditional web hosting models in terms of confidentiality, integrity, and availability. This innovative solution not only addresses existing challenges in web hosting but also heralds a new era of decentralized, secure, and accessible internet infrastructure

Comparative Analysis of Machine Learning Models for Android Malware Detection

The rapid growth of Android devices has led to increased security concerns, especially from malicious software. This study extensively compares machine-learning algorithms for effective Android malware detection. Traditional models, such as random forest (RF) and support vector machines (SVM), alongside advanced approaches, such as convolutional neural networks (CNN) and XGBoost, were evaluated. Leveraging the NATICUSdroid dataset containing 29,332 records and 86 traces, the results highlight the superiority of RF with 97.1% and XGBoost with 97.2% accuracy. However, evolving malware and real-world unpredictability require a cautious interpretation. Promising as they are, our findings stress the need for continuous innovation in malware detection to ensure robust Android user security and data integrity.

User Management System using Admin Panel

This project aims at creating a simple user management system that is required by every website where multiple users can login. This let new user registration , login & logout for every user. A User Management System implemented with JavaScript and PHP is a vital component of web applications that facilitates user registration, authentication, authorization, and profile management. This abstract outlines the key features and components of such a system, focusing on the synergy between JavaScript and PHP to deliver a secure, interactive, and efficient user experience. The system allows users to create accounts, log in securely, and manage their profiles while administrators can oversee and administer user accounts. Robust security measures, including data validation and protection against common web vulnerabilities, ensure the integrity of user data and the application's overall security. The system empowers web applications to efficiently manage and serve a diverse user base, ensuring a seamless and secure user experience.

USER MANAGEMENT SYSTEM USING ADMIN PANEL

This project aims at creating a simple user management system that is required by every website where multiple users can login. This let new user registration , login & logout for every user. A User Management System implemented with JavaScript and PHP is a vital component of web applications that facilitates user registration, authentication, authorization, and profile management. This abstract outlines the key features and components of such a system, focusing on the synergy between JavaScript and PHP to deliver a secure, interactive, and efficient user experience. The system allows users to create accounts, log in securely, and manage their profiles while administrators can oversee and administer user accounts.Robust security measures, including data validation and protection against common web vulnerabilities, ensure the integrity of user data and the application's overall security. The system empowers web applications to efficiently manage and serve a diverse user base, ensuring a seamless and secure user experience.

Cybersecurity Approaches for Securing Digital Marketing Data

SecureDigitalGuard offers a holistic security solution, integrating advanced security technology with stringent data protection protocols to deliver comprehensive protection. This ensures the longevity of online marketing endeavors. Key components of this system include the AAC algorithm, the HPG program, and the BTD algorithm, each playing a pivotal role. HPG manages privacy-centric analytics, while the BTD system promptly identifies abnormal user behavior. Additionally, the AAC system employs risk assessments to restrict access effectively. Test results affirm SecureDigitalGuard's capability to combat evolving cyber threats, rendering previously employed cybersecurity measures obsolete. By seamlessly integrating cutting-edge security measures with robust data protection protocols, SecureDigitalGuard not only safeguards online marketing initiatives but also ensures user privacy and data integrity. Its ability to detect and respond to emerging threats underscores its effectiveness in safeguarding digital assets and mitigating potential risks in today's dynamic cybersecurity landscape.

A Computationally Efficient Method for Increasing Confidentiality in Smart Electricity Networks

Safeguarding the data collected by smart meters is essential because the disclosure of this information may threaten the privacy of the consumer. By obtaining them, hackers can find out the behavior of the person and use that information for malicious purposes. Therefore, the anonymity of such information can prevent the occurrence of risks. Given the paramount significance of user privacy and data integrity, this paper primarily investigates the confidentiality, integrity, and anonymity of messages. This paper aims to develop a platform for determining dynamic pricing to coordinate supply and demand, thereby maximizing the efficiency of facilities. In the previous research, the operation center was not authenticated for the customer in the first step, and they also had a heavy computational cost. But this paper has endeavored to develop an efficient and comprehensive privacy-preserving solution for the smart electricity network. Also, it has tried to cover all the required security objectives by dealing with authenticity, confidentiality, and irrefutability. The method of the research is that two entities mutually authenticate each other and reach a key agreement so that if the operation center wants to send a control command, it can send control commands directly to the meter with less time complexity. The power company sends control commands and requests to the smart meters until the analyzed and collected energy consumption data are transmitted. The data aggregator node gathers the data from the meters. The results showed that the proposed method reduced the computational complexity and communication overhead to a satisfactory level and is also resistant to various attacks.

Enhancing Organizational Data Security on Employee-Connected Devices Using BYOD Policy

To address a business need, most organizations allow employees to use their own devices to enhance productivity and job satisfaction. For this purpose, the Bring Your Own Device (BYOD) policy provides controllable access for employees to organize data through their personal devices. Although the BYOD practice implies plenty of advantages, this also opens the door to a variety of security risks. This study investigates these security risks and proposes a complementary encryption approach with a digital signature that uses symmetric and asymmetric algorithms, depending on the organization’s digital certificate, to secure sensitive information stored in employees’ devices within the framework of BYOD policies. The method uses Advanced Encryption System (AES), Blowfish, RSA and ElGamal with a digital signature to achieve strong encryption and address critical security considerations such as user authentication, confidentiality and data integrity. The proposed encryption approach offers a robust and effective cryptographic solution for securing sensitive information in organizational settings that involve BYOD policies. The study includes experimental results demonstrating the proposed approach’s efficiency and performance, with reasonable encryption and decryption times for different key and file sizes. The results of the study revealed that AES and Blowfish have the best execution time. AES has a good balance of security and performance. RSA performs better than ElGamal in encryption and signature verification, while RSA is slower than ElGamal in decryption. The study also provides a comparative analysis with previous studies of the four encryption algorithms, highlighting the strengths and weaknesses of each approach.

A Comprehensive Review of IoT Networking Technologies for Smart Home Automation Applications

The expediential increase in Internet communication technologies leads to its expansion to interests beyond computer networks. MEMS (Micro Electro Mechanical Systems) can now be smaller with higher performance, leading to tiny sensors and actuators with enhanced capabilities. WSN (Wireless Sensor Networks) and IoT (Internet of Things) have become a way for devices to communicate, share their data, and control them remotely. Machine-to-Machine (M2M) scenarios can be easily implemented as the cost of the components needed in that network is now affordable. Some of these solutions seem to be more affordable but lack important features, while other ones provide them but at a higher cost. Furthermore, there are ones that can cover great distances and surpass the limits of a Smart Home, while others are more specialized for operation in small areas. As there is a variety of choices available, a more consolidated view of their characteristics is needed to figure out the pros and cons of each of these technologies. As there are a great number of technologies examined in this paper, they are presented regarding their connectivity: Wired, Wireless, and Dual mode (Wired and Wireless). Their oddities are examined with metrics based on user interaction, technical characteristics, data integrity, and cost factor. In the last part of this article, a comparison of these technologies is presented as an effort to assist home automation users, administrators, or installers in making the right choice among them.

A Proposal on How to Use Blockchain to Secure Communications in 5G Ecosystem

5G provides businesses with high-speed Internet access, faster bandwidth, and low latency. The use of IoT and 5G-enabled sensors provides new opportunities within networks. There are several use cases of 5G with IoT health care, agriculture, remote learning, logistics, manufacturing, government, and retail. However, some security and privacy problems must be addressed within the 5G ecosystem. There is a need to secure user and device associations and data integrity as 5G is becoming more and more popular. In this research-in-progress, we seek to solve security and privacy problems in 5G by applying Blockchain technology to secure 5G connections. The research will consist of an interdisciplinary team of researchers from Illinois State University (ISU) and non-academic-industry partners. During the study, we build a prototype that solves problems in agriculture and healthcare. A private 5G network is installed at ISU. Moisture sensors and IoT devices are installed at the university farm to monitor soil moisture. Tracking soil moisture helps to conserve water. Additionally, we also work with a local clinic and provide underserved patients with chronic illnesses with sensors and IoT devices that help them track and monitor their chronic conditions. The patients will have monitors that track blood pressure and blood sugar. The IoT devices and sensors send collected data to a database accessible by healthcare professionals at the clinic. This helps the patients receive care that helps them manage their conditions better. Blockchain will be applied during the proposed study to secure communications between the sensors at the university farm and the private 5G network. Blockchain is also be applied to secure communications between the patients and healthcare providers at the clinic. The collected results are analyzed to see if there is a significant difference in suspicious activities in agriculture and healthcare communications. The results have a broader impact, including helping underserved community members to receive good care in managing their chronic conditions. The results also help secure other use cases of 5G with IoT devices.

Multi-party co-signature scheme based on SM2.

Two-party collaborative signature scheme is an important cryptographic technology for user authentication and data integrity protection when using mobile devices for financial and securities transactions. However, the two-party collaboration scheme has the following shortcomings: firstly, it is not flexible enough, and it requires the collaborating parties to be secure and trusted; secondly, the two-party collaboration security still needs to be improved. Once a hacker obtains the signature private key and collaborative identity of a mobile device, it can construct a legitimate two-party collaborative signature. Third, the application scenario of two-party co-signature is limited and cannot meet the application scenario of multi-device co-signature. For this reason, this paper designs a multi-party collaborative signature scheme based on SM2 digital signature algorithm in the standard "SM2 Elliptic Curve Public Key Cryptography" of GM/T003-2012. This scheme consists of multiple (more than 2) participants to jointly generate the signature group public key and valid signature in an interactive manner, while ensuring that each user cannot know the signature key other than their own during the signing process. We implement this scheme based on the GMP library. The experimental results show that this scheme is not only flexible but also more secure and trustworthy to meet the application scenario of multi-device collaborative signing. In addition, the time for multiple participants to construct signatures in this scheme is similar, and the time for signature verification is less different from that of the original SM2 signature.

Spatial-Temporal Feature with Dual-Attention Mechanism for Encrypted Malicious Traffic Detection

While encryption ensures the confidentiality and integrity of user data, more and more attackers try to hide attack behaviours through encryption, which brings new challenges to malicious traffic identification. How to effectively detect encrypted malicious traffic without decrypting traffic and protecting user privacy has become an urgent problem to be solved. Most of the current research only uses a single CNN, RNN, and SAE network to detect encrypted malicious traffic, which does not consider the forward and backward correlation between data packets, so it is difficult to effectively identify malicious features in encrypted traffic. This study proposes an approach that combines spatial-temporal feature with dual-attention mechanism, which is called TLARNN. Specifically, first we use 1D-CNN and BiGRU to extract spatial features in encrypted traffic packets and temporal features between encrypted streams, respectively, which enriches the features of different dimensions, and then, the soft attention mechanism is focused on the encrypted data packets to extract features. Ultimately, the second layer of the soft attention mechanism is used for aggregating malicious features. Several comparative experiments are designed to prove the effectiveness of the proposed scheme. The experimental results demonstrate that the proposed scheme has a significant performance improvement compared to existing ones.

Digital Identity Using Blockchain Technology

In recent years, the development of blockchain technology has brought a wide spectrum of potential application scenarios from finance to healthcare, IoT, management and many more. This is because the blockchain, a distributed digital ledger, acts as an environment of trust and transparency. The subject of digital identity is getting more and more attention as it represents more than just replacing physical documents (e.g. ID cards, driver's license) with digital data. It would enable the digitalization and automation of the process of identification as well as protect people against identity theft and fraud. This paper proposes and implements a model for digital identity that relies on blockchain technology and cryptography to ensure the privacy, validity and integrity of personal user data. These are obtained with the help of cryptographic signatures, which are the digital representation of physical signatures or stamps. A set of trusted authorities are in charge of issuing cryptographic signatures and storing them on the blockchain. Through issued cryptographic signatures, the authorities account for the digital identity of the users, similar to how public institutions issue identity documents for their citizens which prove their identity. Using digital identity in multi-participant decision support systems improves the decision-making process through trust, anonymity and interoperability.