Security-related Data Research Articles

Towards data-driven decision support for organizational IT security audits

Abstract As the IT landscape of organizations increasingly needs to comply with various laws and regulations, organizations manage a plethora of security-related data and have to verify the adequacy and effectiveness of their security controls through internal and external audits. Existing Governance, Risk and Compliance (GRC) approaches provide little support for auditors or are tailored to the needs of auditors and do not fully support required management activities of the auditee. To address this gap and move towards a holistic solution, a data-driven approach is proposed. Following the design science research paradigm, a data-driven approach for audit data management and analytics that addresses organizational needs as well as requirements for audit data analytics was developed. We contribute workflow support and associated data models to support auditing and security decision making processes. The evaluation shows the viability of the proposed IT artifact and its potential to reduce costs and complexity of security management processes and IT security audits. By developing a model and associated decision support workflows for the entire IT security audit lifecycle, we present a solution for both the auditee and the auditor. This is useful to developers of GRC tools, vendors, auditors and organizational decision makers.

Explanatory Server Protection Problem for Automated Wireless System

Many sorts of servers exists which incorporates both openly available servers and inside servers, for example, mail servers, web servers, application servers, assemble and test servers and so forth., that store numerous private and delicate data. Giving security to such servers has turned out to be one of the center necessities in this day and age as they are under danger of assault. The information put away on the server can go from hierarchical data, for example, classified client related records, extend subtle elements, company's product source code to private media data, individual information, national security related data, patients database, address papers of the focused exams and so forth. On the off chance that such delicate information gets into wrong hands, it can be abused. Along these lines the business and the notoriety of the association would beat stake. It can likewise posture risk to countries. The fundamental reasons of security break in servers is because of the utilization of versatile stockpiling gadgets, for example, pen drives, hard circles, and so on., which can be potential transporters of malware and Trojans. At the point when tainted by such infection, these compact stockpiling gadgets can bring about serious harm. Physically keeping up and securing servers would be extremely troublesome and can likewise prompt tremendous authoritative overhead. Henceforth the requirement for computerized security system to distinguish, keep and shield the servers from the aggressors. Security strategies assume a critical part in keeping the trade off of system security which would influence the server security.

A Survey on Network Security-Related Data Collection Technologies

Security threats and economic loss caused by network attacks, intrusions, and vulnerabilities have motivated intensive studies on network security. Normally, data collected in a network system can reflect or can be used to detect security threats. We define these data as network security-related data. Studying and analyzing security-related data can help detect network attacks and intrusions, thus making it possible to further measure the security level of the whole network system. Obviously, the first step in detecting network attacks and intrusions is to collect security-related data. However, in the context of big data and 5G, there exist a number of challenges in collecting these security-related data. In this paper, we first briefly introduce network security-related data, including its definition and characteristics, and the applications of network data collection. We then provide the requirements and objectives for security-related data collection and present a taxonomy of data collection technologies. Moreover, we review existing collection nodes, collection tools, and collection mechanisms in terms of network data collection and analyze them based on the proposed requirements and objectives toward high quality security-related data collection. Finally, we discuss open research issues and conclude with suggestions for future research directions.

Electric Security Data Integration Framework based on Ontology Reasoning

Compared with ordinary information systems, power information systems are characterized by high complexity, strong real-time performance, high dynamics, and high-security requirements. The security-related data is varied. It is helpful to integrate the different types of data from multiple resources to support the further analysis such as abnormal detection or damage prediction. Considering the data complexity, this paper proposes a framework to automatically integrate security-related data in an electric system using ontology reasoning. In this paper, we try to determine the relationship between the ontology or between the local ontology and the global ontology through certain reasoning rules to help establish the data structure automatically. The experiment results demonstrate the effectiveness of the proposed method.

Abnormal Detection of Electric Security Data based on Scenario Modeling

Abnormal detection is an important task to ensure the stable running of the electric power system. In this paper, an abnormal detection framework for electric security data is proposed based on scenario modeling that supplies the descriptions of typical security issues. In this framework, the electric power system security-related data is first collected from different resources in real time. Then we create a scenario model based on the historical data for the typical security issues such as warning, system error or fatal error using the association rule mining algorithms. Then multiple scenario models are tagged with indicators that are observable from the sensors or monitors. Finally, the real-time data is analyzed to detect the defined indicators based on which the possible security scenarios are predicted and corresponding operation or protection will be activated automatically. The experiment results suggest that the proposed method can effectively identify and prevent the many of the common issues in the electric system.

The quest for complete security: An empirical analysis of users’ multi-layered protection from security threats

Individuals can perform many different behaviors to protect themselves from computer security threats. Research, however, generally explores computer security behaviors in isolation, typically looking at one behavior per study, such as usage of malware or strong passwords. However, defense in depth requires that multiple behaviors be performed concurrently for one’s computer to be protected. Addressing this gap in prior research, this study measures 279 individuals’ computer security behaviors and analyzes them with multi-dimensional scaling. We examined three security threats: security related performance degradation, identify theft, and data loss. The results present a mapping of security behaviors performed together with other behaviors on two dimensions for each of these threats. Using expert reviews of the resulting dimensions, the study proposes that response efficacy and response cost help explain why people perform certain behaviors together. These findings can help explain inconsistent results in prior information security research because they focused on one behavior only whereas people perform various security behaviors together in an effort to mitigate specific security threats. The study informs research and practice by identifying security threat-response pairs via expert interviews, surveying individuals on how they perform multiple security behaviors concurrently to mitigate security threats, identifying why certain behaviors are performed together, and using these findings to identify reasons why IS security research has confounding results based on specific individual threat-response pairs used in prior studies.

Security assurance assessment methodology for hybrid clouds

The emergence of the cloud computing paradigm has altered the delivery models for ICT services. Unfortunately, the widespread use of the cloud has a cost, in terms of reduced transparency and control over a user's information and services. In addition, there are a number of well-understood security and privacy challenges that are specific to this environment. These drawbacks are particularly problematic to operators of critical information infrastructures that want to leverage the benefits of cloud. To improve transparency and provide assurances that measures are in place to ensure security, novel approaches to security evaluation are needed. To evaluate the security of services that are deployed in the cloud requires an evaluation of complex multi-layered systems and services, including their interdependencies. This is a challenging task that involves significant effort, in terms of both computational and human resources. With these challenges in mind, we propose a novel security assessment methodology for analysing the security of critical services that are deployed in cloud environments. Our methodology offers flexibility, in that tailored policy-driven security assessments can be defined based on a user's requirements, relevant standards, policies, and guidelines. We have implemented and evaluated a system that supports online assessments using our methodology, which acquires and processes large volumes of security-related data without affecting the performance of the services in a cloud environment.

A Novel Approach to Detect Malware Based on API Call Sequence Analysis

In the era of ubiquitous sensors and smart devices, detecting malware is becoming an endless battle between ever-evolving malware and antivirus programs that need to process ever-increasing security related data. For malware detection, various approaches have been proposed. Among them, dynamic analysis is known to be effective in terms of providing behavioral information. As malware authors increasingly use obfuscation techniques, it becomes more important to monitor how malware behaves for its detection. In this paper, we propose a novel approach for dynamic analysis of malware. We adopt DNA sequence alignment algorithms and extract common API call sequence patterns of malicious function from malware in different categories. We find that certain malicious functions are commonly included in malware even in different categories. From checking the existence of certain functions or API call sequence patterns matched, we can even detect new unknown malware. The result of our experiment shows high enough F-measure and accuracy. API call sequence can be extracted from most of the modern devices; therefore, we believe that our method can detect the malware for all types of the ubiquitous devices.

Data Security Using Decomposition

Protection of privacy from unauthorized access is one of the primary concerns in data use, from national security to business transactions. It brings out a new branch of data mining, known as Privacy Preserving Data Mining (PPDM). Privacy-Preserving is a major concern in the application of data mining techniques to datasets containing personal, sensitive, or confidential information. Data distortion is a critical component to preserve privacy in security-related data mining applications; we propose a QR Decomposition method for data distortion. We focus primarily on privacy preserving data clustering. As the distorted data occupies small amount of storage space, the memory requirement becomes low. Finally, we evaluate the effectiveness of the method in terms of misclassification error rate. Our experiments on several data sets reveal that the classification error rate varies as a result of security. However, the method has much less computational cost, especially when new data items are inserted dynamically.

A dual-mode energy efficient encryption protocol for wireless sensor networks

This paper presents a novel link-layer encryption protocol for wireless sensor networks. The protocol design aims to reduce energy consumption by reducing security related communication overhead. This is done by merging security related data of consecutive packets. The merging (or combining packets) based on simple mathematical operations helps to reduce energy consumption by eliminating the requirement to send security related fields in headers and trailers. We name our protocol as the Compact Security Protocol referred to as C-Sec. In addition to energy savings, the C-Sec protocol also includes a unique security feature of hiding the packet header information. This feature makes it more difficult to trace the flow of wireless communication, and helps to minimize the cost of defending against replay attacks. We performed rigorous testing of the C-Sec protocol and compared it with well-known protocols including TinySec, MiniSec, SNEP and Zigbee. Our performance evaluation demonstrates that the C-Sec protocol outperforms other protocols in terms of energy savings. We also evaluated our protocol with respect to other performance metrics including queuing delay and error probability.

A Survey of Visualization Systems for Network Security

Security Visualization is a very young term. It expresses the idea that common visualization techniques have been designed for use cases that are not supportive of security-related data, demanding novel techniques fine tuned for the purpose of thorough analysis. Significant amount of work has been published in this area, but little work has been done to study this emerging visualization discipline. We offer a comprehensive review of network security visualization and provide a taxonomy in the form of five use-case classes encompassing nearly all recent works in this area. We outline the incorporated visualization techniques and data sources and provide an informative table to display our findings. From the analysis of these systems, we examine issues and concerns regarding network security visualization and provide guidelines and directions for future researchers and visual system developers.

UWB Communication System Based on Bipolar PPM with Orthogonal Waveforms

In many classic Ultra Wide Band communication systems, only Gaussian and monocycle pulses associate to PPM modulation are used. In this paper, an original communication system based on orthogonal functions and the Bipolar PPM modulation is proposed. This system allows good performances in terms of Bit Error Rate (BER) and high data rate. This study concerns new applications, such as Vehicle to Vehicle (V2V) and Vehicle to Infrastructure (V2I) communication systems or a wireless link between computers. These applications need high reliability to transmit security-related information and high data rate to exchange multimedia data. With the emergence of the orthogonal wave-forms, the performances of the UWB communication system will be more interesting in terms of BER and data rate. In this paper, two kinds of improvement are proposed. The first improvement permits us to decrease the Bit Error Rate using the original waveforms. The second allows improving the data rate via novel modulation method. The last parameter study, in this paper, concerns the problem of synchronization between the different users. We will study the performances of the proposed system in multiusers environment in synchronous and asynchronous cases. In the first stage, the theoretical and simulation results will be presented for the proposed system. The simulation results obtained by comparing the classic UWB system and the proposed system show that our solution gives good performances in terms of BER and data rate. The theoretical results of BER values will be given for our proposed solution. In the second stage, we will compute BER values for different jitter effects. Theses studies report theoretical and simulation performances evaluation in the case of two users

The role of vehicles’ identification techniques in transportation planning – Modeling concept

Every day, new development projects are coming to cope with the growing population and their corresponding life activities, and this is translated in a higher travel demand and disastrous congestion in most cities of the world, especially the private transport oriented societies. Traffic impact studies became a must for the construction of new developments. But, in many cases, the scope of such studies is limited to a close proximity, while the developments impact remains much more beyond the site vicinity.Transportation studies that have been carried till now have a sizable margin of approximation as a result of two main deficiencies that are obvious for people involved in the field of traffic modeling and transportation planning:(1)Is that there is no common, comprehensive, accurate and up-to-date source of information that can be relied on by the on-going transportation studies.(2)The second deficiency is that in spite of exhausting congestion, people are still sticking to their private cars for doing their daily activities.Focusing on the mentioned deficiencies and their negative consequences, the main purpose of this research is to introduce and implement through a set of developed interfaces the concept of real-time transportation modeling, and justify the need and importance of Radio Frequency Identification (RFID) Technique in achieving a comprehensive database for strategic planning parameters that can affect passengers’ travel behavior and consequently the transport modal split.However, the research concept and applications are flexible to deal with other floating data collection techniques such as mobile phones data analysis, as well as license plate recognition and other systems. The paper explains the role of floating traffic data collection techniques in providing accurate real-time statistics for the following types of information: origin/destination data, traffic composition, trip rates, parking rates, parking turnover data, traffic contraventions, traffic growth factors, link traffic volumes, turning movement traffic volumes, vehicles’ classification, and security related data regarding suspected vehicles.The research modeling work is based on PTV-Vision software, VISUM and VISSIM that are currently used in most of the international research studies. The research applications are programming in Microsoft excel and visual basic and thus are compatible with any modeling software.

Secure Network Recovery from Base Station Failure of Surveillance WSN in Hostile Environment

Securing surveillance wireless sensor networks (WSNs) in hostile environments such as borders, perimeters and battlefields during Base Station (BS) failure is challenging. Surveillance WSNs are highly vulnerable to BS failure. The attackers can render the network useless by only destroying the BS as the needed efforts to destroy the BS is much less than that is needed to destroy the network. This attack scenario will give the attackers the best chance to compromise many legitimate nodes. Previous works have tackled BS failure by deploying a mobile BS or by using multiple BSs. Despite the best electronic countermeasures, intrusion tolerance and anti-traffic analysis strategies to protect the BSs, an adversary still can destroy them. This paper proposes a novel security architecture called Surveillance Security (SurvSec) for secure and reliable network recovery from single BS failure of surveillance WSN with single BS. SurvSec relies on a set of sensor nodes serve as Security Managers for management and storage of the security related data of all sensor nodes. SurvSec security architecture provides methodology for choosing and changing the security managers of the surveillance WSN. SurvSec has four components: (1) Sensor nodes serve as Security Managers, (2) Data Storage System, (3) Data Recovery System, (4) Security for the Data Storage System. Furthermore, both the frame format of the stored data is carefully built and the security threats are encoded to allow minimum overheads for SurvSec security architecture. In this paper, we provide detailed specifications of SurvSec security architecture along with its security system for secure and reliable network recovery from single BS failure. We evaluate our designed security architecture for reliable network recovery from BS failure. Our evaluation shows that the proposed new security architecture can meet all the desiredspecifications and our analysis shows that the provided Security Managers are capable of network recovery from BS failure.

SurvSec: A New Security Architecture for Reliable Network Recovery from Base Station Failure of Surveillance WSN

Abstract Securing surveillance wireless sensor networks (WSNs) in hostile environments such as borders, perimeters and battlefields during Base Station (BS) failure is challenging. Surveillance WSNs are highly vulnerable to BS failure. The attackers can render the network useless by only destroying the BS as the needed efforts to destroy the BS is much less than that is needed to destroy the network. This attack scenario will give the attackers the best chance to compromise many legitimate nodes. Previous works have tackled BS failure by deploying a mobile BS or by using multiple BSs. Despite the best electronic countermeasures, intrusion tolerance and anti-traffic analysis strategies to protect the BSs, an adversary still can destroy them. This paper proposes a novel security architecture called Surveillance Security (SurvSec) for reliable network recovery from single BS failure of surveillance WSN with single BS. SurvSec relies on a set of sensor nodes serve as Security Managers for management and storage of the security related data of all sensor nodes. SurvSec security architecture provides methodologies for choosing and changing the security managers of the surveillance WSN. SurvSec has three components: (1) Sensor nodes serve as Security Managers, (2) Data Storage System, (3) Data Recovery System. Furthermore, both the frame format of the stored data is carefully built and the security threats are encoded to allow minimum overheads for SurvSec security architecture. In this paper, we provide detailed specifications of SurvSec security architecture. We evaluate our designed security architecture for reliable network recovery from BS failure. Our evaluation shows that the proposed new security architecture can meet all the desired specifications and our analysis shows that the provided Security Managers are capable of network recovery from BS failure.

SVDC: Preserving Privacy in Clustering using Singular Value Decomposition

AbstractProtecting privacy from unauthorized access is one of the primary concerns in data use, from national security to business transactions. It creates a new branch of data mining known as Privacy Preserving Data Mining (PPDM). Privacy-Preserving is a major concern in the application of data mining techniques to datasets containing personal, sensitive, or confidential information. Data distortion is a critical component to preserve privacy in security-related data mining applications; we propose a Singular Value Decomposition (SVD) method for data distortion. We focus primarily on privacy preserving data clustering. Our proposed method, Singular Value Decomposition Clustering (SVDC) distorts only confidential numerical attributes to meet privacy requirements, while preserving general features for clustering analysis.

The semantics of an extended referential integrity for a multilevel secure relational data model

To prevent information leakage in multilevel secure data models, the concept of polyinstantiation was inevitably introduced. Unfortunately, when it comes to references through foreign key in multilevel relational data models, the polyinstantiation causes referential ambiguities. To resolve this problem, this paper proposes an extended referential integrity semantics for a multilevel relational data model, Multilevel Secure Referential Integrity Semantics (MLS-RIS). The MLS-RIS distinguishes foreign key into two types of references, i.e. value-based and entity-based reference. For each type, it defines the referential integrity to be held between two multilevel relations, and provides resolution rules for the referential ambiguities. In addition, the MLS-RIS specifies the semantics of referential actions of the SQL update operations so as to preserve the referential integrity.

Implementing Belief-Consistent Multilevel Secure Relational Data Model: Issues and Solutions

This paper summarizes our efforts in implementing a working multi-level secure database prototype. We have chosen Belief-Consistent Multilevel Secure Relational Data Model (BCMLS) as a basis for our prototype because of its comprehensive semantics for interpreting all stored information. While semantically superior to other models, this model has not been implemented as a working system before. Our prototype, which was created on an Informix database server with a PHP web client, enables insertion, deletion and update of multi-level data while addressing the underlying model complexities through a number of original solutions.

A belief-consistent multilevel secure relational data model

Multilevel relations, based on the current multilevel secure (MLS) relational data models, can present a user with information that is difficult to interpret and may display an inconsistent outlook about the views of other users. Such ambiguity is due to the lack of a comprehensive method for asserting and interpreting beliefs about information at lower security levels. In this paper we present a belief-consistent MLS relational database model which provides an unambiguous interpretation of all visible information and gives the user access to the beliefs of users at lower security levels, neither of which was possible in any of the existing models. We identify different beliefs that can be held by users at higher security levels about information at lower security levels, and introduce a mechanism for asserting beliefs about all accessible tuples. This mechanism provides every user with an unambiguous interpretation of all viewable information and presents a consistent account of the views at all levels visible to the user. In order to implement this assertion mechanism, new database operations, such as verify true and verify false, are presented. We specify the constraints for the write operations, such as update and delete, that maintain belief consistency and redefine the relational algebra operations, such as select, project, union, difference and join.

Asserting beliefs in MLS relational models

Multilevel relations, based on the current multilevel secure (MLS) relational data models, can present a user with information that is difficult to interpret and may display an inconsistent outlook about the views of other users. Such ambiguity is due to the lack of a comprehensive method for asserting and interpreting beliefs about lower level information. In this paper we identify different beliefs that can be held by higher level users about lower level information, and we introduce the new concept of a mirage tuple. We present a mechanism for asserting beliefs about all accessible tuples, including lower level tuples. This mechanism provides every user of an MLS database with an unambiguous interpretation of all viewable information and presents a consistent account of the views at all levels below the user's level.