Security Testing Research Articles

The EEG signals encryption algorithm with K-sine-transform-based coupling chaotic system

Telemedicine provides remote online services for digital diagnosis and treatment via the Internet. However, there is a risk of data leakage during transmission. Therefore, data protection is an important challenge for telemedicine. Chaos is widely used in image, audio, and EEG encryption because of its unique characteristics of unpredictability, nonlinearity, and sensitivity to an initial state. However, some chaotic maps have various security issues. To solve these problems, this paper proposes a K-sine-transform-based coupled chaotic system (K-STBCCS), combining any two one-dimensional chaotic mappings to generate a new chaos mapping. To demonstrate the reliability of the system, this paper generates three new chaotic mappings using K-STBCCS and analyzes their performance. Using the chaotic mapping generated by K-STBCCS, this paper further proposes an EEG signal encryption scheme based on the confusion-diffusion principle. The purpose of confusion is to separate adjacent EEG signals, while the purpose of diffusion is to change the value of EEG signals. Among them, the diffusion operation uses positive and negative diffusion to reduce the correlation between the ciphertext and the original signals. The experimental results and security analysis show that the proposed EEG signal encryption scheme performs well and passes the rigorous cryptographic security test.

Donor and non-donor perspectives on receiving information from routine genomic testing of donor blood.

Genomic testing is already used by blood collection agencies (BCAs) to identify rare blood types and ensure the best possible matching of blood. With ongoing technological developments, broader applications, such as the identification of genetic markers relevant to blood donor health, will become feasible. However, the perspectives of blood donors (and potential blood donors) on routine genomic testing of donor blood are under-researched. Eight online Focus Groups were conducted: four with donors and four with non-donors. Participants were presented with three hypothetical scenarios about the current and possible future applications of genomic testing: Performing rare blood type testing; identifying donors with genetic markers associated with iron metabolism; and identifying donors with genetic markers associated with bowel cancer. Testing to identify rare blood types was perceived to be an appropriate application for the BCA to undertake, while identifying markers associated with iron metabolism and cancer genetic markers were only partially supported. Participants raised concerns about the boundaries of acceptable testing and the implications of testing for privacy, data security, and health insurance. Perspectives of donors and non-donors on all scenarios were similar. The principles of who benefits from genomic testing and the perceived role of BCAs were key in shaping participants' perspectives. Participants generally agreed that testing should be directly related to blood donation or be of benefit to the recipient or donor. Findings indicate that consent and communication are key to the acceptability of current and expanded genomic testing.

Accelerated key distribution method for endogenously secure optical communication by synchronized chaotic system based on fiber channel feature

Security key is necessary for data encryption while transmitting amounts of confidential information. For existing strategies of key distribution, it is the primary challenge that the rate and distance limit, insufficient security, and difficulty of deployment. To solve these problems, we propose an accelerated key distribution method for endogenously secure optical communication by synchronized chaotic system based on BER feature of fiber channel. First, synchronized chaotic equation systems are innovatively realized by identical hardware equipment, chaotic equation, initial value, and micro interference. Then, the synchronization keeping with micro interference of proposed chaotic systems are obtained based on identical BER feature of fiber loop. Innovatively, all synchronous operation controls to proposed chaotic systems are guaranteed by deterministic rule of algorithm operation, and are not limited by amplifier or fiber length. Experimental result demonstrates that proposed chaotic systems are synchronized under long term operation. The key distribution rate (KDR) can reach a rate of 100Gbit/s at 100% key consistency rate. And, the KDR can be augmented by extending hardware resources of key distribution. Simulation is conducted to illustrate the security of chaotic systems by the bifurcation diagram, scatter plot diagram, and initial value sensitive phenomenon. NIST security test suite demonstrates that generated secret key sequences pass the test. Moreover, possible attacks are analysed for the security robustness of proposed scheme. The results illustrate proposed system is a reliable, secure and cost-effective solution for high-speed and long-haul key distribution.

ANALISIS KEAMANAN WEB NEW KUTA GOLF MENGGUNAKAN METODE VULNERABILITY ASSESSMENTS DAN PERHITUNGAN SECURITY METRIKS

Various crimes that are security threats that can occur when we are socially networked, one of them is virtual theft. New Kuta Golf has tournament standard field and the first course with a layout model link. Large mobility companies also make data processing even bigger and more web sites that are concerned with transactions and promotional media. This is a reference to obtain information about the security of the New Kuta Golf website. The data that has been obtained are carried out for the project work step, are: (1) To conduct a Vulnerability assessment. (2) Analyze the results of the scan. (3) Calculate security metrics from the results obtained from the scanning process. (4) Documentation of the installation process, and calculating security metrics. The results of the research then analyzed and discussed with a review of the theory that was embraced. From the results of the tests, the following results are obtained: (1) In carrying out website security testing can be done by Vulnerability Assessment uses the acunetix application to find detailed results. (2) Determining the security of a website can be determined using security metrics. (3) The results of the vulnerability assessment on http://newkutagolf.co.id has a high value.

Cybersecurity Testing for Automotive Domain: A Survey

Modern vehicles are more complex and interconnected than ever before, which also means that attack surfaces for vehicles have increased significantly. Malicious cyberattacks will not only exploit personal privacy and property, but also affect the functional safety of electrical/electronic (E/E) safety-critical systems by controlling the driving functionality, which is life-threatening. Therefore, it is necessary to conduct cybersecurity testing on vehicles to reveal and address relevant security threats and vulnerabilities. Cybersecurity standards and regulations issued in recent years, such as ISO/SAE 21434 and UNECE WP.29 regulations (R155 and R156), also emphasize the indispensability of cybersecurity verification and validation in the development lifecycle but lack specific technical details. Thus, this paper conducts a systematic and comprehensive review of the research and practice in the field of automotive cybersecurity testing, which can provide reference and advice for automotive security researchers and testers. We classify and discuss the security testing methods and testbeds in automotive engineering. Furthermore, we identify gaps and limitations in existing research and point out future challenges.

Phytochemical Analysis of the Antioxidant Compounds of Baper Tea and Its Potential as an Immunomodulatory agent and Candidate for Standardized Herbal Medicine

The antioxidant content of Baper tea was determined using phytochemical testing, and the potential of these contents as immunomodulatory agents and candidates for standardized herbal medications was investigated. A randomized design was used in this experimental study. Phytochemical assays are used to determine the antioxidant content of Baper tea, whereas organoleptic studies are performed using hedonic tests. A literature review was used to assess the content's potential as an immunomodulatory agent and candidate for standardized herbal medicine. The study lasted four months at the Biology and National Food and Drug Agency Laboratory in Bali Province. Data analysis is based on descriptive methods. Baper tea is prepared in a 2.1.1 ratio. According to the hedonic test results, 41 panelists (87.23 %) prefer Baper tea products based on their color assessment, flavor, aroma, community reception, and acceptability. The matrix and security test revealed a water content of 4.43 %, an IC50 of 24.27 ppm, α-glucosidase inhibitors of 12.18 ppm, a total phenolic content of 28.00 %, and a total flavonoid content of 15.57 %. Baper tea raw materials contain components that have the potential to act as immunomodulatory agents and candidates for standardized herbal medications based on local wisdom.
 HIGHLIGHTS
 
 There are very few standardized herbal medicinal products that are efficacious as immunomodulators in the market
 Shallot skin (Allium Cepa), morel berry leaves (Physalis angulata), and small gooseberry leaves (Phyllanthus urinaria) packaged in Baper Tea preparations contain bioactive compounds that have the potential to be used as immunomodulatory agents and candidate for standardized herbal medicine
 Baper tea contains very active antioxidant compounds at a formulation ratio of 2:1:1. With panelists' acceptance of Baper Tea reaching 87.23 %
 
 GRAPHICAL ABSTRACT

Mission-Based Cybersecurity Test and Evaluation of Weapon Systems in Association with Risk Management Framework

With the advancement of information technology (IT), the importance of cyber security is increasing because of the expansion of software utilization in the development of weapon systems. Civilian embedded systems and military weapon systems have cybersecurity-related symmetry that can increase vulnerabilities in the process of advanced information technology. Many countries, including the United States, are exploring ways to improve cybersecurity throughout the lifecycle of a weapon system. The South Korean military is applying the U.S. standard risk management framework (RMF) to some weapon systems to improve cybersecurity, but the need for a model that is more suitable for the South Korean military has been emphasized. This paper presents the results of a mission-based cybersecurity test, along with an evaluation model that can be applied to South Korean military weapon systems in parallel with the RMF. This study first examined the related international research trends, and proposed a test and evaluation method that could be utilized with the RMF throughout the entire life cycle of a weapon system. The weapon system was divided into asset, function, operational task, and mission layers based on the mission, and a mutually complementary model was proposed by linking the RMF and cybersecurity test and evaluation according to the domestic situation. In order to verify the proposed cybersecurity test and evaluation model, a simulation was developed and performed targeting the Close Air Support (CAS) mission support system, which is a virtual weapon system. In this simulation, the nodes performances by layer before and after a cyberattack were calculated, and the vulnerabilities and protection measures identified in the cyber security test and evaluation were quantified. This simulation made it possible to evaluate and derive protection measures in consideration of mission performance. It is believed that the proposed model could be used with some modifications, depending on the circumstances of each country developing weapon systems in the future.

The Importance of Security Is in the Eye of the Beholder: Cultural, Organizational, and Personal Factors Affecting the Implementation of Security by Design

Security by design is a recommended approach, addressing end-to-end security and privacy in the design of software systems. To realize this approach, proactive security behavior is required from software developers. This research follows results from previous studies that suggest that personal and organizational characteristics influence security-related behaviors during the software design process. The research is aimed at gaining an in-depth understanding of proactive security behavior and the factors affecting it. Leveraging organization climate theory from organizational psychology, we propose a theoretical model, detailing different factors and their relations with proactive security behavior and test it in empirical settings. The empirical study was conducted in collaboration with an internationally distributed information technology enterprise and included a survey questionnaire completed by 499 software developers working in seven countries. The results of the survey confirm the moderation-mediation relations in the proposed model, revealing that organizational security climate and security self-efficacy are both positively associated with proactive security behavior, organizational security climate is positively associated with security self-efficacy, and cultures promoting individualism moderate the relationship between organizational security climate and security self-efficacy, thus impeding proactive security behavior. The body of knowledge of organizational psychology points to directions that can effectively be activated for improvement.

A New 4D Chaos System with an Encryption Algorithm for Color and Grayscale Images

In this paper, a new 4D chaos system is introduced based on the mathematical structure through composing and transferring. The behavior of the proposed chaotic system is studied using different tests, such as Lyapunov exponent, bifurcation diagram and histogram. In order to show the advantage of the new chaos system, the proposed system is used for image encryption. In the proposed algorithm, in addition to the new chaos system, cellular automata is also used to improve the security of the algorithm. The proposed algorithm has a separate structure for encryption key, which increases the security of the proposed algorithm. The security of the proposed environment which is evaluated using different types of security tests shows the efficiency of the proposed algorithm.

Analisis Keamanan Website SMA Negeri 2 Sumbawa Besar Menggunakan Metode Penetration Testing (Pentest)

Website security is becoming a very important aspect along with the increasing volume of data exchanged on the internet. High School 2 Sumbawa Besar provides information on a website, both information for school introductions or information related to schools can be through several media. Some time ago the school's website was attacked by information criminals who caused the appearance of the website to change and steal some important school data. Weak website security systems can be easy targets for cyber criminals. They know various ways to get into the website security system and perform various actions that can harm the organization. Based on the conditions that occurred on the school's website, a research was conducted to analyze the level of security and look for loopholes in the weaknesses of the High School 2 Sumbawa Besar website. In this analysis, researchers tested the school's website using the Penetration Testing method. Test is carried out in several stages, namely Footprinting, Scanning Fingerprinting, Exploit and Reporting. The process of testing the website security of High School 2 Sumbawa Besar found several loopholes that detected 13 sub-file vulnerabilities with low and medium status. Results of this study are the results of security testing in the form of a list of vulnerabilities that can be a recommendation for the school in improving website security.

Billing Barber Shop (An Implementation of GoodBarber App Builder)

The research objective is to develop a Billing Barbershop application by implementing GoodBarber App Builder in application development. The research method used in this study consists of 5 parts, namely the literature study method, data collection method, analysis method, design method, and the development method used is extreme programming. From the research results, a Billing Barber Shop application has been developed by implementing the GoodBarber App Builder which is designed to consist of login, home, billing, orders, product, and users forms. The test results are known in Usability testing, Compatibility testing, Interface testing, Low level resource, Performance testing, Operational testing, Installation testing, and Security testing stating very good with an average percentage above 80%. But in Service testing, choosing poor because Billing Barber Shop still uses the internet as a connection to data using Zapier Add-ons and Google Sheets.

Sistem Brankas Berbasis Internet Of Things Mengunakan Arduino Mega 2560

Safes in the market are usually doesn’t offer a system that can monitor the activities carried out by users on the safe. This becomes a problem when the safe has many users who can access it. We can't identify who, when or what other users are doing. In addition, safes generally have an authentication system that only offers passcodes and keys. That authentication system is considered outdated. In this study, a web-based safe monitoring system was created that uses a fingerprint sensor and passcode as authentication. In addition, this system can also send data about user activity to the website so that admins or other users can monitor anyone who accesses the safe. This system will be tested using black box testing. In the test, it was found that this safe system can only be opened if the user inputs a valid passcode and a finger print that has been registered in the system. In addition, the activity data has been successfully sent to the website. In security testing, it was found that if the safe door is opened forcibly, an alarm in the form of a buzzer will ring and a warning notification will be sent to the website.

Sistem Penentuan Paket Penjualan dengan Algoritma FP-Growth Serta Metode Up dan Cross Selling

The Car Spare Part Shop is one of the Car Spare Parts Shops in Tangerang Regency. Based on interviews conducted with shop owners at the Car Spare Parts Store, it was stated that there was a decrease in sales income every month, so there was limited capital in purchasing car spare parts products which resulted in difficulties in choosing which car spare parts products to order. The purpose of this study is to create a system to process and utilize sales transaction data using the FP-Growth algorithm as well as up selling and cross selling methods which will later be used to sell car spare parts that are purchased simultaneously in a sales package determination system. The sales transaction data used is 6,674 transaction data for 1 year of operation of the Car Spare Part Shop (July 2021 - June 2022) with 30,956 records in Microsoft Excel format. The prototype system uses the Python framework flask and mysql database. Validation test results ensure that the software that has been made is in accordance with the expected functional requirements specifications. The results of the system quality test with ISO 9126 can be concluded in the criteria of Very Good with a value of 98.59%. With the results of the Functionality aspect of 99.25%, the results of the Reliability aspect of 98.13%, the results of the Usability aspect of 98.33% and the results of the Efficiency aspect of 98.66%. The results of system security testing with Acunetix and LOIC software have been carried out and the system is still stable and the system is declared safe when used.

An improved image encryption algorithm based on Bézier coefficients matrix

In recent years, numerous images are engaged over various unprotected broad networks, causing safety and privacy threats to users. This is where image encryption plays a role in ensuring the secrecy of multimedia data. This article suggests a cryptosystem that employs Elliptic Curve Cryptosystem (ECC) on Hill Cipher matrix known as ECCHC and cubic Bezier coefficient matrix. The cubic Bezier coefficient matrix is utilized as an extra layer of security over ECCHC for image encryption and decryption. The proposed technique is designed to produce an efficient cryptosystem algorithm that provides a high level of security with no discernible difference in the decrypted image. The suggested approach will be subjected to a series of security tests to ensure its performance and efficiency. According to simulation outcomes, the suggested technique has a decent encryption and decryption impact. The proposed scheme includes more than 2100 key search, making it extremely difficult for unauthorized third parties to predict the keys in order to breach the proposed system. In statistical analysis, the image histograms are regularly distributed, and entropy value of the ciphered images are nearing 8, indicating that the ciphered images are extremely unpredictable. Finally, the PSNR values of the decrypted images of grayscale and RGB with additional noise intensities up to 0.1 are 10.6264 and 10.3707, respectively, demonstrating that the approach is capable of dealing with a certain degree of noise assault.

An image layered scrambling encryption algorithm based on a novel discrete chaotic map

At present, the image encryption algorithm based on the bit-plane has the problem that the encryption speed and the encryption effect cannot be well balanced. To address the problem, an image layered scrambling encryption algorithm is proposed in this paper. First, a new one-dimensional Cosine Logistic compound chaotic map (1DCLC) is proposed. Several characteristics of the new chaotic map are analyzed by using various measures, such as bifurcation diagram, Lyapunov exponent, sample entropy etc. And the results show that the novel chaotic map has a better chaotic performance. Second, based on the chaotic map, an image encryption algorithm is proposed. The algorithm first performs an XOR encryption operation on the image. Second, the layered scrambling is applied to the XOR encrypted image. Then the layered and scrambled image is recombined for the second XOR encryption operation. In particular, in the layered scrambling, not only can the position of the pixel be changed but also the value of the pixel can be modified, which improves the security of the algorithm. In addition, in order to defend against various plaintext attacks and increase the security of the overall algorithm, the Hash function is introduced to update the key of the proposed algorithm. Finally, the original algorithm is improved and the improved algorithm's ability to resist differential attacks is analyzed. The experimental simulation and security test results show that the proposed encryption algorithm has a comparable encryption effect and a faster encryption speed.

Sexual happiness and satisfaction with sexual safety among German trans men who have sex with men: results from EMIS-2017.

IntroductionThe population of men‐who‐have‐sex‐with‐men (MSM) includes people who are on the masculine spectrum but were assigned female at birth (AFAB), that is trans MSM. This study aims to identify current circumstances regarding sexual happiness and safety among German trans MSM. To date, there is no health information about trans MSM in Germany, limiting the ability of MSM sexual health programmes to meet their needs.MethodsData were used from the European MSM Internet Survey (EMIS‐2017), where people identifying as men and/or trans men were recruited through dating apps for MSM, community websites and social media to participate in an online survey. We analysed parameters on sexual happiness and satisfaction with sexual safety among Germany‐based trans MSM and compared those to outcomes of MSM assigned male at birth (cis MSM) living in Germany using descriptive methods and logistic regression models adjusting for age.ResultsIn total, 23,001 participants from Germany were included, of which 122 (0.5%) indicated to be AFAB (i.e. trans MSM). Trans MSM were markedly younger than cis participants (median age: 28.5 vs. 39 years).Trans MSM more often reported being unhappy with their current sex life (adjusted odds ratio [aOR] = 1.82, 95% CI 1.24–2.67), had higher odds of disagreeing with the statements “the sex I have is always as safe as I want” ([aOR] = 1.82, 95% CI 1.24–2.67) and “I find it easy to say no to sex that I don't want” ([aOR] = 1.80, 95% CI 1.18–2.77).Trans MSM were more likely to not be living comfortably financially ([aOR] = 2.43, 95% CI 1.60–3.67) and to be living with severe anxiety and/or depression ([aOR] = 3.90, 95% CI 2.22–6.83). Trans MSM were less likely to have ever tested for HIV ([aOR] = 0.63, 95% CI 0.43–0.93).ConclusionsSexual happiness, control of sexual boundaries, satisfaction with sexual safety, financial security, mental wellbeing and HIV testing were all lower in German trans MSM compared with cis MSM. Tailored sexual health interventions, contextualized with regard to needs and vulnerabilities, could address this inequality.

Comparative analysis of the effectiveness of OWASP ZAP, Burp Suite, Nikto and Skipfish in testing the security of web applications

Application security is one of the key aspects necessary for its proper functioning. Ensuring security consists primarily in conducting regular penetration tests and checking the vulnerability of the application to various types of attacks. The recommended solution is to use tools dedicated to detecting security holes in applications. Choosing the right tool from among those available on the market can be difficult. This article presents a comparative analysis of the effectiveness of popular application security testing tools in terms of the number of detected vulnerabilities. The analysis was based on the obtained results of scanning two Internet applications containing a number of security vulnerabilities, used to learn ethical hacking.

Automated Penetration Testing Framework for Smart-Home-Based IoT Devices

Security testing is fundamental to identifying security vulnerabilities on smart home-based IoT devices. For this, penetration testing is the most prominent and effective solution. However, testing the IoT manually is cumbersome and time-consuming. In addition, penetration testing requires a deep knowledge of the possible attacks and the available hacking tools. Therefore, this study emphasises building an automated penetration testing framework to discover the most common vulnerabilities in smart home-based IoT devices. This research involves exploring (studying) different IoT devices to select five devices for testing. Then, the common vulnerabilities for the five selected smart home-based IoT devices are examined, and the corresponding penetration testing tools required for the detection of these vulnerabilities are identified. The top five vulnerabilities are identified from the most common vulnerabilities, and accordingly, the corresponding tools for these vulnerabilities are discovered. These tools are combined using a script which is then implemented into a framework written in Python 3.6. The selected IoT devices are tested individually for known vulnerabilities using the proposed framework. For each vulnerability discovered in the device, the Common Vulnerability Scoring System (CVSS) Base score is calculated and the summation of these scores is taken to calculate the total score (for each device). In our experiment, we found that the Tp-Link Smart Bulb and the Tp-Link Smart Camera had the highest score and were the most vulnerable and the Google Home Mini had the least score and was the most secure device of all the devices. Finally, we conclude that our framework does not require technical expertise and thus can be used by common people. This will help improve the field of IoT security and ensure the security of smart homes to build a safe and secure future.

Machine learning in software security testing: a literature survey

As the use of software systems permeate diverse areas of the society, there is a need to ensure that not only does the software provide the needed functionality but it is also of high security, providing confidentiality, integrity and availability of the underlying data. Software security testing is one among the approaches towards detecting vulnerabilities and flaws in software which contribute to software insecurity. As machine learning finds success in other areas of computing, it has also gained interest in the field of software security testing. A review of the application of various machine learning techniques, including current trends in software security testing is of high value both to research and practice. This research provides an overview of how machine learning has been applied in software security testing and especially in the different phases of the testing cycle. Basic and recent developments of machine learning application in static analysis testing, dynamic analysis testing, symbolic execution and fuzz testing are discussed. The research followed a literature survey approach where existing literature on the subject were reviewed. A comparative performance of various machine learning techniques in the different phases of security testing is provided.

LESCA: LightwEight Stream Cipher Algorithm for emerging systems

Recently, there has been a dire need for lightweight cryptographic solutions, which exhibit low computational complexity and require few resources. In this paper, we present LESCA, a novel dynamic key-dependent lightweight stream cipher, which consists of two main functions, a typical round function based on cryptographic primitives, and a function that updates these primitives. The update is performed in a selective (partial) manner while encrypting a block, and in full after each δ blocks/iterations. As such, LESCA consumes minimal resources and introduces a very low latency. The originality of this solution stems from the fact that the cryptographic primitives get updated even when encrypting the same message. Several performance and security tests were performed to confirm that the proposed cipher is robust and efficient, especially for limited devices and real-time applications. The proposed cipher achieves a high throughput; for example, when implemented on a Raspberry Pi (RPI4) device, LESCA provides an enhancement of at least 343% when compared to the Advanced Encryption Standard (AES), 72% over a recent one-round cipher scheme, and 43% improvement compared to a recent LORCA stream cipher that outperforms the Simon and Speck algorithms.