Password Security Research Articles

Identification of Exploited Unreliable Account Passwords in the Information Infrastructure Using Machine Learning Methods

Accounts are an integral part of most modern information systems and provide their owners with the ability to authenticate within the system. This paper presents an analysis of existing methods for detecting simple account passwords in automated systems. Their advantages and disadvantages are listed. A method was developed to detect simple exploitable passwords that administrators can use to supplement other existing methods to increase the overall security of automated systems against threats from accounts potentially compromised by attackers. The method was based on the analysis of commands executed in automated or manual modes with the indication of credentials in plain text. Minimum password strength requirements are provided based on the security level. A special case was considered in which all passwords analyzed in this way were found explicitly in the system logs. We developed a unified definition of the classification of passwords into simple and strong, and also developed machine learning technology for their classification. The method offers a flexible adaptation to a specific system, taking into account the level of significance of the information being processed and the password policy adopted, expressed in the possibility of retraining the machine learning model. The experimental method using machine learning algorithms, namely the ensemble of decision trees, for classifying passwords into strong and potentially compromised by attackers based on flexible password strength criteria, showed high results. The performance of the method is also compared against other machine learning algorithms, specifically XGBoost, Random Forest, and Naive Bayes. The presented approach also solves the problem of detecting events related to the use and storage of credentials in plain text. We used the dataset of approximately 770,000 passwords, allowing the machine learning model to accurately classify 98% of the passwords by their significance levels.

Leveraging the Power of Storytelling to Encourage and Empower Children towards Strong Passwords

With the increasing use of computer and smartphones by children, their online safety has been of major concern due to their limited security knowledge and skills. User authentication is pivotal for their security protection, where a body of work focused on children's password practices. The insights from these studies highlight children's lack of awareness and skills in creating a strong password. However, there is a dearth in existing literature to understand the scopes of designs for encouraging and empowering children towards strong passwords. As we begin to address this gap, we leveraged the power of storytelling to foster user attachment, encouragement, and empowerment. To this end, we adopted a systematic approach through a series of studies. First, a focus group session with three experts whose research primarily focuses on children contributed to build the narrative of a story, followed by a participatory design study with 20 children (aged between 8 and 12) to understand their preferences and perceptions of design components for the visual depiction of that narrative. The insights from focus group and participatory design led to the design of 'Story', a digital storytelling based design representing password advice for children. We also created the baseline designs and compared them with Story in a within-subject survey with 44 children aged between 8 and 12. The findings from our study unpack the efficacy of storytelling, leading us to offer guidelines for future research in these directions.

The Effect of Domain Terms on Password Security

The predominant authentication method still relies on usernames and passwords. To enhance memorability, domain terms may have been opted to include as part of passwords. However, there is little analysis of the extent to which such practice affects password security, so there is a lack of guidance on how users use domain terms on websites with different domain characteristics. To address the problem, we propose a novel approach to analyze the security effect of using domain terms in passwords. The methodology primarily consists of three stages. Firstly, we utilize Web crawlers to harvest domain vocabularies, subsequently leveraging the TextRank algorithm to rank their importance. Afterward, we propose an algorithm for constructing a simulated domain-specific password dataset by replacing password elements with domain terms. Finally, password guessing experiments are done on the dataset using PCFG and Markov model to evaluate the impact of domain terms on password security. The experimental results indicate that, for systems without clear domain, 20% domain terms replacement in the test set can reduce the cracking rate by up to 5.45%. In contrast, for domain-specific systems, 20% domain terms replacement in the training set can increase the cracking rate by 6.45%. These findings provide practical guidance on the application of domain knowledge in password creation for different types of systems. In summary, this study offers a novel perspective for exploring the security implications of passwords influenced by specific domains.

Comparative study of password storing using hash function with MD5, SHA1, SHA2, and SHA3 algorithm

<span>The main purpose of passwords is to prevent unauthorized people from accessing the system. The rise in internet users has led to an increase in password hacking, which has resulted in a variety of problems. These issues include opponents stealing a company's or nation's private information and harming the economy or the organization's security. Password hacking is a common tool used by hackers for illegal purposes. Password security against hackers is essential. There are several ways to hack passwords, including traffic interception, social engineering, credential stuffing, and password spraying. In an attempt to prevent hacking, hashing algorithms are therefore mostly employed to hash passwords, making password cracking more difficult. In the suggested work, several hashing techniques, including message digest (MD5), secure hash algorithms (SHA1, SHA2, and SHA3) have been used. They have become vulnerable as a result of being used to store passwords. A rainbow table attack is conceivable. Passwords produced with different hash algorithms can have their hash values attacked with the help of the Hashcat program. It is proven that the SHA3 algorithm can help with more secure password storage when compared to other algorithms.</span>

Practical and Secure Password Authentication and Key-Agreement-Scheme-Based Dual Server for IoT Devices in 5G Network

Practical and Secure Password Authentication and Key-Agreement-Scheme-Based Dual Server for IoT Devices in 5G Network

Analysis and Design of Efficient Authentication Techniques for Password Entry with the Qwerty Keyboard for VR Environments.

Authentication in digital security relies heavily on text-based passwords, even with other available methods like biometrics and graphical passwords. While virtual reality (VR) keyboards are typically invisible to onlookers, the presence of inconspicuous sensors, including accelerometers, gyroscopes, and barometers, poses a potential risk of unauthorized observation and recording. Traditional defense shoulder-surfing attack methods typically involve breaking apart the Qwerty layout, which destroys the user's inherent familiarity with the layout. This research addresses the need for secure password entry in VR environments while retaining the Qwerty layout. We explore three keyboard-related position alteration strategies to ensure security while mitigating the decline in user experience. These strategies involve moving the entire keyboard, cursor, and keys. Our theoretical study assesses the effectiveness of these strategies against shoulder-surfing attacks. Two user studies, employing ray-based and position-based text entry methods, respectively, evaluate the practical effectiveness of the three strategies in resisting shoulder-surfing attacks, as well as their impact on typing performance and user experience. Our findings demonstrate that the three strategies achieve shoulder-surfing attack resistance comparable to a random layout keyboard. Moreover, compared to a random layout, the two strategies involving the movement of the entire keyboard and the repositioning of keys support faster entry rates and enhanced user experience.

Enhancing Multi-Class Password Strength Prediction Through Machine Learning and Ensemble Techniques

Enhancing Multi-Class Password Strength Prediction Through Machine Learning and Ensemble Techniques

Cyberverse: A Game-Based Learning Application for Cyber Security

Abstract: Games are becoming more frequent in educational settings, and various technologies have been established to meet the needs of designing an education as a game. Aside from education, game-based learning is rising in popularity in various areas, including professional development and networking sites. By incorporating gaming components into the training process, educational platforms that use games will increase student engagement, motivation, and productivity. One of the most defining characteristics of game-based learning environments is their ability to produce innovative and engaging learning experiences (Gee, J. P. 2020; Hamari, J., et al 2021). Games-based learning integrates instruction with authentic gaming experiences. Scientific and popular interest in severe goal games has increased tremendously (Huang, W. H.-Y. et al. 2021; Kapp, K. M. 2020; Zhang, Y. et al. 2023). Cybersecurity refers to the practice of protecting systems, networks, and programs from digital attacks, damage, or unauthorized access. With the increasing reliance on technology and the internet, the significance of cybersecurity has grown tremendously. It encompasses various measures, including: Threat Prevention, Incident Response, Data Protection, Awareness and Training and Compliance (Kshetri, N. 2021; Stallings, W., et al 2022; Kaspersky, E. 2020). Cyber security occupies a major part of society today. Cyber security educational games are a popular form of hands-on exercises that use gamification to train information security skills and enhance cyber security awareness. The objectives of the game application are to (1) create awareness of the necessity of the importance and function of cyber security such as password security, phishing awareness, identity theft, encryption, and network security among others. (2) to distinguish between the various topics of cyber security while playing the game application (3) to determine the evaluation tool to use in the assessment of the cognitive abilities of gamers. A quantitative research design was used to determine the process of the application while the Agile model is commonly used in game development due to its iterative and flexible nature. Technical Aspect which is the ISO 25010 and Game Aspect Method was used for the Evaluation with 60 respondents. The study can identify the genders of the respondents as male and female. The mechanics of the game can make the gamers use and test their knowledge about cyber security. Evaluation results of gamer respondents show the average mean of both males and females are interpreted as "Strongly Agree". This means that they strongly agree that cognitive abilities are used when playing the application. Meanwhile, evaluation results of technical respondents' average mean for both males and females are interpreted as also "Strongly Agree". This means that they strongly agree on all the technical aspects of the application. Overall, evaluation results of all respondents whether gamer or technical are interpreted as "Strongly Agree".

A secure interoperable method for electronic health records exchange on cross platform blockchain network

An Electronic Health Record (EHR) store essential and sensitive patient's medical information. Since health information is highly confidential data, it should be accessible with the consent of the patient. Blockchain based EHR management system offers improvised privacy and patient-centric approach. EHR management systems are available with multiple blockchain platforms. Generally, EHRs are maintained at several independent blockchain platforms. EHR management systems should be capable of securely exchange data on cross platform blockchain network. The interoperability in such blockchain platforms should facilitate seamless cross-chain interaction and information exchange. This article proposes a method that facilitates secure EHR exchange on Ethereum and Hyperledger fabric network using hepatitis dataset. The key contributions of the proposed method include:•Hash lock based interoperable cross-chain method for EHR exchange across Ethereum and Hyperledger fabric.•Additional security to the EHR is ensured by partitioning EHR as on-chain (blockchain platform) and off-chain InterPlanetary File System (IPFS)•Secure Password Authentication-Based Key Exchange (SPAKE) based session management for EHR exchange across two parties.The proposed patient centric method is validated to ensures the successful exchange of patient EHR across Ethereum and Hyperledger fabric.

Adaptive Cybersecurity in the Digital Age: Emerging Threat Vectors and Next-Generation Defense Strategies

Abstract: This article examines the rapidly evolving landscape of cybersecurity, focusing on emerging threats and innovative defense mechanisms. We analyze four key threat vectors: Advanced Persistent Threats (APTs), ransomware, Internet of Things (IoT) vulnerabilities, and social engineering attacks. These threats pose significant risks to organizations, including data breaches, financial losses, and operational disruptions. In response, we explore cutting-edge defense mechanisms such as Artificial Intelligence and Machine Learning for threat detection, Zero Trust Architecture for access control, blockchain for data integrity, behavioral analytics for insider threat detection, and quantum cryptography for enhanced encryption. The article also outlines best practices for cybersecurity, including regular software updates, strong password policies, employee training, and security audits. By synthesizing current research and industry trends, this article provides a comprehensive overview of the cybersecurity landscape, emphasizing the need for continuous adaptation and vigilance in the face of evolving cyber threats

Evaluating applied security controls for safeguarding medical device‐integrated electronic medical records

AbstractRationale, Aims, and ObjectivesMedical device‐integrated electronic medical records (MDI‐EMR) pose significant challenges in ensuring effective usage, data security and patient safety. The complexities of MDI‐EMR necessitate applying various security mechanisms to safeguard against cyber threats. Therefore, we evaluated cyber threats to MDI‐EMR and the effectiveness of applied security controls using a proposed framework from sociotechnical and risk assessment perspectives.MethodWe conducted a qualitative case study evaluation in a general hospital in Saudi Arabia using interviews, observation, and document analysis from the perspectives of major MDI‐EMR stakeholders, including healthcare providers, IT professionals and cybersecurity specialists.ResultsThe results showed the interplay among physical, technical and administrative security controls that maintained a secure posture of MDI‐EMR. The effectiveness of security controls is highly influenced by the staff's cybersecurity awareness and training. The perceived effectiveness of security controls varied among users, with some expressing satisfaction with the ease of use and reliability, while others highlighting challenges such as password complexity and access procedures. Understanding these diverse perspectives is crucial for tailoring security measures to meet the needs of different stakeholders effectively.ConclusionCollaboration among the key stakeholders is crucial for implementing security controls for MDI‐EMR. Balancing security measures with usability concerns is essential, as highlighted by challenges in implementing technical controls. A comprehensive approach encompassing physical, technical and administrative controls, continuous education and awareness initiatives are significant to empower staff in recognising and mitigating cyber threats effectively to safeguard medical data and ensure the integrity of healthcare systems.

What is the Effectiveness of Salt and Pepper in Preventing Rainbow Table Attacks in Modern Password Hashing Algorithms?

Password security remains a critical concern in the digital age, as attackers continuously evolve their techniques to crack password databases. Among the most effective defenses against these threats are salt and pepper, two cryptographic techniques used to enhance password hashing security. Salt introduces unique, random values to each password, ensuring that even identical passwords result in different hashes, while pepper adds a hidden system-wide secret to further complicate attacks. This paper explores how salt and pepper work together to defend against rainbow table attacks, significantly increasing the complexity for attackers attempting to reverse-engineer password hashes. While these techniques provide strong protection, they are not foolproof and must be paired with additional security measures such as key-stretching algorithms and multi-factor authentication (MFA) to offer comprehensive defense. The paper also examines the limitations of salt and pepper and suggests future advancements, such as post-quantum cryptography and passwordless authentication, as potential pathways to further improve password security.

Information security in remote work: Strategies and challenges in a post-pandemic world

The increasing prevalence of remote work, accelerated by the COVID-19 pandemic, has brought significant information security challenges to organizations. While remote work offers numerous benefits such as flexibility and increased productivity, it also introduces unique risks, particularly in safeguarding sensitive data. The absence of traditional office security measures and reliance on potentially insecure home and public networks heighten these risks. Organizations must implement robust strategies, including the use of Virtual Private Networks (VPNs) and multi-factor authentication (MFA), to ensure secure communications and access to corporate systems. Additionally, the protection of devices used in remote work is critical, necessitating clear security policies, regular updates, and employee training on recognizing threats like phishing and malware. Studies by Kolomoets (2022) and Alsayfi and Alsirhani (2023) highlight the importance of addressing the increased risks associated with remote work, particularly the potential for data breaches due to the lack of direct access to comprehensive security controls. These studies recommend best practices such as secure password management and regular employee training to mitigate these threats. Tanriverdi and Metin (2021) emphasize the need for renewed focus on security awareness and behavior as remote work becomes the norm. Furthermore, Rakha (2023) explores the legal implications and best practices for maintaining cybersecurity in remote settings, while Livshitz (2022) focuses on data privacy challenges, providing insights into regulatory compliance and security audits. In conclusion, safeguarding information security in remote work environments requires a holistic approach that integrates technology, continuous education, and stringent security policies. Organizations must prioritize these efforts to protect sensitive data and maintain privacy in an increasingly remote workforce.

Enhancing Cloud Data Security using Artificial Neural Networks for Users’ Account Hijacking Security Threats

Objectives: To ensure the security of passwords of cloud users' accounts that cannot be decrypted easily by any software or hackers. Methods: In this manuscript, we have designed an experimental setup using a feed-forward back-propagation algorithm of Artificial Neural Networks techniques to ensure cloud data security. For this purpose, we have utilized password-based datasets created by us. 70% of the datasets are allocated for training and 30% for testing and validation purposes. In this training, TRAINLM training function, LEARNGDM adaptive function, performance function is MSE, and PURELIN and TANSIG transfer function to transfer the neurons from input to hidden layer and hidden to the output layer has been used. The minimum learning rate is set to 0.001. Findings: A username and password are required to access cloud services. A cloud-based storage system is used to store login credentials. Due to inadequate security, attackers use hacking techniques to gain access to users’ accounts. Attackers steal data, resources, or services from these accounts. To ensure the security of passwords of cloud users' accounts, we have designed an experimental setup using a feed-forward back-propagation algorithm of neural network techniques. Through this approach, the passwords are stored in a weight matrix, which is a multi-dimensional structure. Novelty: The dimensions of the weight matrix are obscured, making it impossible for the hackers to determine its structure. As a result, we conclude that cloud data is effectively secured on the cloud server. Keywords: Artificial Neural Networks, Cloud Computing, Data Security, Feed-Forward Back-Propagation Algorithm, Machine Learning

Improving the Usability of Graphical Authentication Systems Using Subject-Based Images

Recognition based graphical authentication systems rely on a system user’s ability to recognize previously chosen images and use those images to gain access into a computing systems, devices or application. Recognition based systems that utilise several types of images have been developed and studied. The déjà vu scheme depends on the use of abstract (meaningless) images. Images in the déjà vu scheme have no exact meaning. This scheme has also been actively studied. This article presents a between user study conducted on two recognition-based schemes using system prototypes. The Abstract Based Graphical Authentication (ABGA) was designed to simulate the déjà vu scheme. The performance of this system was compared with the performance of a novel system developed for this research. The novel system, called Subject Based Graphical Authentication (SBGA), in which the system used images from the various disciplines of the research participants. The researcher conducted a lab-based study with 100 participants, 50 participants for each of the prototypes. The study investigated the impact of using subject based images to enhance the usability and security of recognition-based graphical passwords. Two graphical models were thus developed and presented to the 100 participants, which comprised of staff and students from the departments of Computer Science, Mathematics, and Engineering. In the experiments, participants selected their graphical passwords from sets of images representing their various disciplines. The researcher observed that the memorability rate for graphical passwords consisting of subject based images aligned with participants' disciplines surpassed the rate for passwords with purely abstract images. The results indicated 81.7% successful login rate and 18.3% failure rate for Subject Based Graphical Authentication (SBGA). In contrast, Abstract Based Graphical Authentication (ABGP) exhibited a 51.5% successful login rate and a 48.7% failure rate. The findings provide significant insights for graphical password designers and developers seeking to enhance system memorability. Balancing image familiarity with security considerations can lead to more user-friendly and effective recognition-based authentication systems. This study provides valuable insights into the benefits of incorporating familiar images in recognition-based graphical passwords, showcasing a significant improvement in memorability and user authentication success. The findings underscore the importance of considering the user’s familiarity with portfolio images in the design of graphical authentication systems.

Cybersecurity Awareness Model with Methods: Analytical Hierarchy Process and Structural Equation Model

This era of revolution has influenced all sectors of society, including education, where technological advancements are now integral to online teaching and learning. However, not everyone fully understands the potential negative impacts of internet usage. The purpose of this research was to investigate and analyze cybersecurity awareness. The study focused on students at Aerospace Air Marshal Suryadarma University. The research employed a quantitative design, either descriptive (where subjects are typically measured once) or experimental (where subjects are measured multiple times). A descriptive study establishes a relationship between variables, while an experimental study determines causation. To analyze the collected data, SEM AMOS was utilized to measure students' awareness of cybersecurity. The study focused on five key areas: (a) regulation, (b) internet usage, (c) password security, (d) data security, and (e) cyberattacks. Based on the research framework and these focus areas, several indicators were developed for the study. The findings concluded that students are aware of cybersecurity issues.

Enhancing the Security of Information Systems Using Iot Technology

A medical patient information system is one of the systems that are currently in widespread use, and one of these is the psychiatric patient information system, which is used in clinics that treat patients who suffer from mental illnesses. It entails keeping track of the patients who visit these clinics for treatment and ensuring that they receive the necessary medications at the appropriate dosages. Patient information such as text, images, or others must be retained in this sort of system, and the reports that the system generates regularly for pharmaceuticals that are dispensed in various clinics separate this type of system from others. This study presents an innovative security strategy for accessing a managed care information system, emphasizing the use of IoT technology to enhance password security and protect sensitive patient information. Utilizing the Internet of Things (IoT) technology has enhanced the efficiency of creating secure passwords. The results of the tests showed that the goal of protecting patient information from people who didn't want to see it was very secure. This was shown in the literature.

Design and Development of Cybersecurity Suite

Protecting personal, corporate and government data in the digital age requires cybersecurity. Traditional cybersecurity methods sometimes lack comprehensive and dynamic protection mechanisms as cyber-attacks change and become more sophisticated. A new cybersecurity suite is proposed in this study. It integrates various advanced security technologies into a single user-friendly platform interaction. This paper specifically combines techniques for real-time phishing detection, strong password management, safe encryption and decryption services and an interactive module to promote user awareness and behaviours to improve digital security for individuals and organization. Rapid prototyping is used in iterative and incremental development phases to adapt to changing security needs and user input. This method allows the platform to be constantly improved to satisfy the current cybersecurity standards and react to new threats. The prototyped developed provides proactive digital defence, a complete cybersecurity platform that equips users to defend their digital presence. With the intuitive design and advanced feature set, the prototype aspires to democratize cybersecurity. Empirical testing of the prototype revealed that makes an effective protection of a wider audience without the complexities of security software. This paper contributes in the advances cybersecurity technology and shaping the digital protection measures.

New Test to Detect Clustered Graphical Passwords in Passpoints Based on the Perimeter of the Convex Hull

This research paper presents a new test based on a novel approach for identifying clustered graphical passwords within the Passpoints scenario. Clustered graphical passwords are considered a weakness of graphical authentication systems, introduced by users during the registration phase, and thus it is necessary to have methods for the detection and prevention of such weaknesses. Graphical authentication methods serve as a viable alternative to the conventional alphanumeric password-based authentication method, which is susceptible to known weaknesses arising from user-generated passwords of this nature. The test proposed in this study is based on estimating the distributions of the perimeter of the convex hull, based on the hypothesis that the perimeter of the convex hull of a set of five clustered points is smaller than the one formed by random points. This convex hull is computed based on the points that users select as passwords within an image measuring 1920 × 1080 pixels, using the built-in function convhull in Matlab R2018a relying on the Qhull algorithm. The test was formulated by choosing the optimal distribution that fits the data from a total of 54 distributions, evaluated using the Kolmogorov–Smirnov, Anderson–Darling, and Chi-squared tests, thus achieving the highest reliability. Evaluating the effectiveness of the proposed test involves estimating type I and II errors, for five levels of significance α∈{0.01,0.02,0.05,0.1,0.2}, by simulating datasets of random and clustered graphical passwords with different levels of clustering. In this study, we compare the effectiveness and efficiency of the proposed test with existing tests from the literature that can detect this type of pattern in Passpoints graphical passwords. Our findings indicate that the new test demonstrates a significant improvement in effectiveness compared to previously published tests. Furthermore, the joint application of the two tests also shows improvement. Depending on the significance level determined by the user or system, the enhancement results in a higher detection rate of clustered passwords, ranging from 0.1% to 8% compared to the most effective previous methods. This improvement leads to a decrease in the estimated probability of committing a type II error. In terms of efficiency, the proposed test outperforms several previous tests; however, it falls short of being the most efficient, using computation time measured in seconds as a metric. It can be concluded that the newly developed test demonstrates the highest effectiveness and the second-highest efficiency level compared to the other tests available in the existing literature for the same purpose. The test was designed to be implemented in graphical authentication systems to prevent users from selecting weak graphical passwords, enhance password strength, and improve system security.

Penyalahgunaan Data Pribadi Sebagai Bentuk Kejahatan Sempurna Dalam Perspektlf Hukum Siber

The misuse of personal data has become a highly relevant issue in the digital age, where cases of privacy violations are increasing sharply. Personal data such as contact information, transaction history, and online activities have become prime targets for cybercriminals to use for fraud, identity theft, and even political manipulation. These crimes often occur in various locations around the world, taking advantage of regulatory breaks and jurisdictional differences, making law enforcement difficult. To address this problem, a multi-dimensional approach is required. Stricter regulations, such as the General Data Protection Regulation (GDPR) in the European Union, are needed to protect personal data with strict sanctions for violations. In addition, international collaboration is essential as cybercrime often crosses national borders, requiring close cooperation between countries to track and apprehend perpetrators. Public awareness and education are also key components in reducing the risk of cybercrime. People should be encouraged to take proactive measures such as the use of strong passwords and two-step verification. Companies and service providers also need to take responsibility for customer data security by implementing strong protection measures and transparency in data management. In conclusion, the use of personal data as a form of perfect crime is a complex issue, requiring strict regulation, international collaboration, and awareness raising to create a safer digital environment.