首页 > 最新文献

2014 Third International Conference on Cyber Security, Cyber Warfare and Digital Forensic (CyberSec)最新文献

英文 中文
On the power of quantum cryptography and computers 量子密码学和计算机的力量
H. A. E. Zouka, Mustafa M. Hosni
It is well known that threats and attacks to information on the digital network environment are growing rapidly, putting extra pressure on individuals and businesses to protect their privacy and intellectual property. For this reason, many cryptographic security protocols have been developed over the past decades in an attempt to protect the privacy between communicating parties and to reduce the risk of malicious attacks. However, most of the cryptographic algorithms developed so far are based on mathematical models and suffer from many security defects, such as: a brute force attack, factorization problem, and many others. Thus, most of these proposed cryptographic systems are not proven to be completely secure against the main threats of modern networking technologies and computing systems. In this paper, a security framework model for quantum cryptography system which is based on the physical properties of light particles is proposed and all security requirements to assist in ensuring confidentiality between communicating parties are incorporated. The research work in this paper is based on a series of experiments which have been advocated recently by some agencies and researchers who used the quantum technology as a more effective method for solving the key distribution problem. The results of the proposed method is demonstrated and validated by experimental results.
众所周知,对数字网络环境中信息的威胁和攻击正在迅速增长,这给个人和企业带来了更大的保护隐私和知识产权的压力。因此,过去几十年来,人们开发了许多加密安全协议,试图保护通信双方的隐私,降低恶意攻击的风险。然而,迄今为止开发的大多数加密算法都是基于数学模型,存在许多安全缺陷,如:暴力攻击、因式分解问题等。因此,这些提出的加密系统大多无法完全安全地抵御现代网络技术和计算系统的主要威胁。本文提出了一种基于光粒子物理特性的量子密码学系统安全框架模型,并纳入了所有安全要求,以协助确保通信各方之间的保密性。本文的研究工作基于最近一些机构和研究人员倡导的一系列实验,这些机构和研究人员将量子技术作为解决密钥分发问题的更有效方法。实验结果展示并验证了所提出方法的成果。
{"title":"On the power of quantum cryptography and computers","authors":"H. A. E. Zouka, Mustafa M. Hosni","doi":"10.1109/CyberSec.2014.6913972","DOIUrl":"https://doi.org/10.1109/CyberSec.2014.6913972","url":null,"abstract":"It is well known that threats and attacks to information on the digital network environment are growing rapidly, putting extra pressure on individuals and businesses to protect their privacy and intellectual property. For this reason, many cryptographic security protocols have been developed over the past decades in an attempt to protect the privacy between communicating parties and to reduce the risk of malicious attacks. However, most of the cryptographic algorithms developed so far are based on mathematical models and suffer from many security defects, such as: a brute force attack, factorization problem, and many others. Thus, most of these proposed cryptographic systems are not proven to be completely secure against the main threats of modern networking technologies and computing systems. In this paper, a security framework model for quantum cryptography system which is based on the physical properties of light particles is proposed and all security requirements to assist in ensuring confidentiality between communicating parties are incorporated. The research work in this paper is based on a series of experiments which have been advocated recently by some agencies and researchers who used the quantum technology as a more effective method for solving the key distribution problem. The results of the proposed method is demonstrated and validated by experimental results.","PeriodicalId":383642,"journal":{"name":"2014 Third International Conference on Cyber Security, Cyber Warfare and Digital Forensic (CyberSec)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-10-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129770564","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Mobile forensic data acquisition in Firefox OS Firefox OS中的移动取证数据采集
M. N. Yusoff, R. Mahmod, Mohd Taufik Abdullah, A. Dehghantanha
Mozilla Corporation has recently released a Linux-based open source operating system, namely Firefox OS. The arrival of this Firefox OS has created new challenges, concentrations and opportunities for digital investigators. Currently, Firefox OS is still not fully supported by most of the existing mobile forensic tools. Even when the phone is detected as Android, only pictures from removable card was able to be captured. Furthermore, the internal data acquisition is still not working. Therefore, there are very huge opportunities to explore the Firefox OS on every stages of mobile forensic procedures. This paper will present an approach for mobile forensic data acquisition in a forensically sound manner from a Firefox OS running device. This approach will largely use the UNIX dd command to create a forensic image from the Firefox OS running device.
Mozilla公司最近发布了一个基于linux的开源操作系统,即Firefox OS。Firefox OS的到来为数字调查人员带来了新的挑战、集中和机会。目前,大多数现有的移动取证工具仍然不完全支持Firefox OS。即使手机被检测为安卓系统,也只能捕获可移动卡上的照片。此外,内部数据采集仍然不能正常工作。因此,在移动取证程序的每个阶段探索Firefox OS的机会非常大。本文将介绍一种从运行Firefox OS的设备上以法医声音方式获取移动法医数据的方法。这种方法将主要使用UNIX dd命令从Firefox OS运行设备创建一个取证映像。
{"title":"Mobile forensic data acquisition in Firefox OS","authors":"M. N. Yusoff, R. Mahmod, Mohd Taufik Abdullah, A. Dehghantanha","doi":"10.1109/CyberSec.2014.6913967","DOIUrl":"https://doi.org/10.1109/CyberSec.2014.6913967","url":null,"abstract":"Mozilla Corporation has recently released a Linux-based open source operating system, namely Firefox OS. The arrival of this Firefox OS has created new challenges, concentrations and opportunities for digital investigators. Currently, Firefox OS is still not fully supported by most of the existing mobile forensic tools. Even when the phone is detected as Android, only pictures from removable card was able to be captured. Furthermore, the internal data acquisition is still not working. Therefore, there are very huge opportunities to explore the Firefox OS on every stages of mobile forensic procedures. This paper will present an approach for mobile forensic data acquisition in a forensically sound manner from a Firefox OS running device. This approach will largely use the UNIX dd command to create a forensic image from the Firefox OS running device.","PeriodicalId":383642,"journal":{"name":"2014 Third International Conference on Cyber Security, Cyber Warfare and Digital Forensic (CyberSec)","volume":"88 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-10-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124029561","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 9
A cognitive approach for botnet detection using Artificial Immune System in the cloud 一种基于云端人工免疫系统的僵尸网络检测认知方法
V. Kebande, H. Venter
The advent of cloud computing has given a provision for both good and malicious opportunities. Virtualization itself as a component of Cloud computing, has provided users with an immediate way of accessing limitless resource infrastructures. Botnets have evolved to be the most dangerous group of remote-operated zombie computers given the open cloud environment. They happen to be the dark side of computing due to the ability to run illegal activities through remote installations, attacks and propagations through exploiting vulnerabilities. The problem that this paper addresses is that botnet technology is advancing each day and detection in the cloud is becoming hard. In this paper, therefore, the authors' presents an approach for detecting an infection of a robot network in the cloud environment. The authors proposed a detection mechanism using Artificial Immune System (AIS). The results show that this research is significant.
云计算的出现为好的和恶意的机会提供了条件。虚拟化本身作为云计算的一个组成部分,为用户提供了一种访问无限资源基础设施的直接方式。在开放的云环境下,僵尸网络已经发展成为最危险的远程操作僵尸计算机。它们恰好是计算的黑暗面,因为它们能够通过远程安装、攻击和利用漏洞进行传播来运行非法活动。本文要解决的问题是,僵尸网络技术每天都在进步,在云中检测变得越来越困难。因此,在本文中,作者提出了一种在云环境中检测机器人网络感染的方法。作者提出了一种利用人工免疫系统(AIS)的检测机制。结果表明,本研究具有重要意义。
{"title":"A cognitive approach for botnet detection using Artificial Immune System in the cloud","authors":"V. Kebande, H. Venter","doi":"10.1109/CyberSec.2014.6913971","DOIUrl":"https://doi.org/10.1109/CyberSec.2014.6913971","url":null,"abstract":"The advent of cloud computing has given a provision for both good and malicious opportunities. Virtualization itself as a component of Cloud computing, has provided users with an immediate way of accessing limitless resource infrastructures. Botnets have evolved to be the most dangerous group of remote-operated zombie computers given the open cloud environment. They happen to be the dark side of computing due to the ability to run illegal activities through remote installations, attacks and propagations through exploiting vulnerabilities. The problem that this paper addresses is that botnet technology is advancing each day and detection in the cloud is becoming hard. In this paper, therefore, the authors' presents an approach for detecting an infection of a robot network in the cloud environment. The authors proposed a detection mechanism using Artificial Immune System (AIS). The results show that this research is significant.","PeriodicalId":383642,"journal":{"name":"2014 Third International Conference on Cyber Security, Cyber Warfare and Digital Forensic (CyberSec)","volume":"37 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-10-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134261866","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 26
An enhancement of traceability model based-on scenario for digital forensic investigation process 基于场景的数字取证溯源模型的改进
Iman Ahmeid Mohamed, A. Manaf
Digital forensic investigation process is about identifying and tracing the cause of the incident, whereby traceability is very important process during the investigation by searching for the evidence. However, the traceability model of digital forensic investigation process is enhanced based on scenario with proven literature and justification.
数字取证调查过程是对事件原因进行识别和追溯的过程,可追溯性是取证过程中非常重要的环节。然而,数字法医调查过程的可追溯性模型是基于经过验证的文献和理由的场景来增强的。
{"title":"An enhancement of traceability model based-on scenario for digital forensic investigation process","authors":"Iman Ahmeid Mohamed, A. Manaf","doi":"10.1109/CyberSec.2014.6913964","DOIUrl":"https://doi.org/10.1109/CyberSec.2014.6913964","url":null,"abstract":"Digital forensic investigation process is about identifying and tracing the cause of the incident, whereby traceability is very important process during the investigation by searching for the evidence. However, the traceability model of digital forensic investigation process is enhanced based on scenario with proven literature and justification.","PeriodicalId":383642,"journal":{"name":"2014 Third International Conference on Cyber Security, Cyber Warfare and Digital Forensic (CyberSec)","volume":"70 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-10-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129635260","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Autonomous integrity monitoring for GNSS localization using informational approach and iono-free measurements 利用信息方法和无离子测量进行GNSS定位的自主完整性监测
M. Kaddour, Nourdine Ait Tmazirte, Maan El Badaoui El Najjar, Z. Naja, N. Moubayed
The Receiver Autonomous Integrity Monitoring (RAIM) is used to improve positioning system safety. This paper proposes a new RAIM approach to detect and exclude multi-faults of GNSS measurements before position estimation. The new approach uses the information filter for position estimation and information test to faults diagnosis. This test is based on exponential convergence of the information filter measured using the mutual information. Results with real data of GNSS measurements (C/A code and L1 phase) show the benefits of the proposed approach in improving the GNSS receiver integrity positioning.
接收机自主完整性监测(RAIM)是提高定位系统安全性的重要手段。本文提出了一种新的RAIM方法,用于在位置估计之前检测和排除GNSS测量中的多故障。该方法利用信息滤波进行位置估计,利用信息测试进行故障诊断。这个测试是基于指数收敛的信息滤波器测量使用互信息。实际GNSS测量数据(C/A码和L1相位)的结果表明,该方法可以提高GNSS接收机的完整性定位。
{"title":"Autonomous integrity monitoring for GNSS localization using informational approach and iono-free measurements","authors":"M. Kaddour, Nourdine Ait Tmazirte, Maan El Badaoui El Najjar, Z. Naja, N. Moubayed","doi":"10.1109/CyberSec.2014.6913973","DOIUrl":"https://doi.org/10.1109/CyberSec.2014.6913973","url":null,"abstract":"The Receiver Autonomous Integrity Monitoring (RAIM) is used to improve positioning system safety. This paper proposes a new RAIM approach to detect and exclude multi-faults of GNSS measurements before position estimation. The new approach uses the information filter for position estimation and information test to faults diagnosis. This test is based on exponential convergence of the information filter measured using the mutual information. Results with real data of GNSS measurements (C/A code and L1 phase) show the benefits of the proposed approach in improving the GNSS receiver integrity positioning.","PeriodicalId":383642,"journal":{"name":"2014 Third International Conference on Cyber Security, Cyber Warfare and Digital Forensic (CyberSec)","volume":"43 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-10-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132233363","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
The importance of mandatory data breach notification to identity crime 强制数据泄露通知对身份犯罪的重要性
E. Holm, G. Mackenzie
The relationship between data breaches and identity crime has been scarcely explored in current literature. However, there is an important relationship between the misuse of personal identification information and identity crime as the former is in many respects the catalyst for the latter. Data breaches are one of the ways in which this personal identification information is obtained by identity criminals, and thereby any response to data breaches is likely to impact the incidence of identity crime. Initiatives around data breach notification have become increasingly prevalent and are now seen in many State legislatures in the United States and overseas. The Australian Government is currently in the process of introducing mandatory data breach notification laws. This paper explores the introduction of mandatory data breach notification in Australia, and lessons learned from the experience in the US, particularly noting the link between data breaches and identity crime. The paper proposes that through the introduction of such laws, identity crimes are likely to be reduced.
数据泄露和身份犯罪之间的关系在目前的文献中很少被探讨。然而,滥用个人身份信息与身份犯罪之间存在着重要的关系,因为前者在许多方面是后者的催化剂。数据泄露是身份犯罪分子获取这些个人身份信息的方式之一,因此对数据泄露的任何应对措施都可能影响身份犯罪的发生率。围绕数据泄露通知的举措已经变得越来越普遍,现在在美国和海外的许多州立法机构都可以看到。澳大利亚政府目前正在引入强制性数据泄露通知法。本文探讨了强制性数据泄露通知在澳大利亚的引入,以及从美国的经验中吸取的教训,特别是注意到数据泄露与身份犯罪之间的联系。本文提出,通过引入这些法律,身份犯罪可能会减少。
{"title":"The importance of mandatory data breach notification to identity crime","authors":"E. Holm, G. Mackenzie","doi":"10.1109/CyberSec.2014.6913963","DOIUrl":"https://doi.org/10.1109/CyberSec.2014.6913963","url":null,"abstract":"The relationship between data breaches and identity crime has been scarcely explored in current literature. However, there is an important relationship between the misuse of personal identification information and identity crime as the former is in many respects the catalyst for the latter. Data breaches are one of the ways in which this personal identification information is obtained by identity criminals, and thereby any response to data breaches is likely to impact the incidence of identity crime. Initiatives around data breach notification have become increasingly prevalent and are now seen in many State legislatures in the United States and overseas. The Australian Government is currently in the process of introducing mandatory data breach notification laws. This paper explores the introduction of mandatory data breach notification in Australia, and lessons learned from the experience in the US, particularly noting the link between data breaches and identity crime. The paper proposes that through the introduction of such laws, identity crimes are likely to be reduced.","PeriodicalId":383642,"journal":{"name":"2014 Third International Conference on Cyber Security, Cyber Warfare and Digital Forensic (CyberSec)","volume":"98 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-10-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125336287","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Modifying authentication techniques in mobile communication systems 修改移动通信系统中的认证技术
Zakaria Zakaria Hassan, Talaat A. Elgarf, A. Zekry
Milenage algorithm applies the block cipher Rijnadael (AES) with 128 bit key and 128 bit block size. This algorithm is used in the 3GPP authentication and key generation functions (f1, f1*, f2, f3, f4, f5 and f5*) for mobile communication systems (GSM/UMTS/LTE). In this paper a modification of Milenage algorithm is proposed through a dynamic change of S-box in AES depending on secret key. To get a new secret key for every authentication process we add the random number (RAND) transmitted from the authentication center (AUC) to the contents of the fixed stored secret key (Ki) and thus the initialization of the AES will be different each new authentication process. For every change in secret key a new S-box is derived from the standard one by permuting its rows and columns with the help of a new designed PN sequence generator. A complete simulation of modified Milenage and PN sequence generator is done using Microcontroller (PIC18F452). Security analysis is applied using Avalanche test to compare between the original and modified Milenage. Tests proved that the modified algorithm is more secure than the original one due to the dynamic behavior of S-box with every change of the secret key and immunity against linear and differential cryptanalysis using Avalanche tests. This makes the modified Milenage more suitable for the applications of authentication techniques specially for mobile communication systems.
Milenage算法采用密钥为128位、块大小为128位的分组密码AES (Rijnadael)。该算法用于移动通信系统(GSM/UMTS/LTE)的3GPP认证和密钥生成功能(f1、f1*、f2、f3、f4、f5和f5*)。本文提出了一种基于密钥动态改变AES中的S-box的Milenage算法的改进方案。为了获得每个认证过程的新密钥,我们将从认证中心(AUC)传输的随机数(RAND)添加到固定存储的密钥(Ki)的内容中,因此每个新认证过程的AES初始化将不同。在新设计的PN序列发生器的帮助下,对于密钥的每一次变化,通过对标准s盒的行和列进行排列,得到一个新的s盒。利用PIC18F452单片机对改进的Milenage和PN序列发生器进行了完整的仿真。采用Avalanche测试对原Milenage和修改后的Milenage进行了安全性分析比较。通过雪崩测试,改进后的算法由于s盒在每次密钥更改时的动态行为以及对线性和差分密码分析的免疫,比原算法具有更高的安全性。这使得改进的Milenage更适合于身份验证技术的应用,特别是针对移动通信系统。
{"title":"Modifying authentication techniques in mobile communication systems","authors":"Zakaria Zakaria Hassan, Talaat A. Elgarf, A. Zekry","doi":"10.1109/CyberSec.2014.6913969","DOIUrl":"https://doi.org/10.1109/CyberSec.2014.6913969","url":null,"abstract":"Milenage algorithm applies the block cipher Rijnadael (AES) with 128 bit key and 128 bit block size. This algorithm is used in the 3GPP authentication and key generation functions (f1, f1*, f2, f3, f4, f5 and f5*) for mobile communication systems (GSM/UMTS/LTE). In this paper a modification of Milenage algorithm is proposed through a dynamic change of S-box in AES depending on secret key. To get a new secret key for every authentication process we add the random number (RAND) transmitted from the authentication center (AUC) to the contents of the fixed stored secret key (Ki) and thus the initialization of the AES will be different each new authentication process. For every change in secret key a new S-box is derived from the standard one by permuting its rows and columns with the help of a new designed PN sequence generator. A complete simulation of modified Milenage and PN sequence generator is done using Microcontroller (PIC18F452). Security analysis is applied using Avalanche test to compare between the original and modified Milenage. Tests proved that the modified algorithm is more secure than the original one due to the dynamic behavior of S-box with every change of the secret key and immunity against linear and differential cryptanalysis using Avalanche tests. This makes the modified Milenage more suitable for the applications of authentication techniques specially for mobile communication systems.","PeriodicalId":383642,"journal":{"name":"2014 Third International Conference on Cyber Security, Cyber Warfare and Digital Forensic (CyberSec)","volume":"22 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-10-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125533353","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Comparison between Alloy and Timed Automata for modelling and analysing of access control specifications 合金与时间自动机在访问控制规范建模与分析中的比较
Emsaieb Geepalla
This paper presents a comparative study between Alloy and Timed Automata for modelling and analysing of access control specifications. In particular, this paper compares Alloy and Timed Automata for modelling and analysing of Access Control specifications in the context of Spatio-Temporal Role Based Access Control (STRBAC) from capability and performance points of view. To conduct the comparison study the same case study (SECURE bank system) is specified using Alloy and Timed Automata. In order to transform the specification of the Secure Bank system into Alloy and Timed Automata this paper makes use of our earlier methods AC2Alloy and AC2Uppaal respectively. The paper then identifies the most important advantages and disadvantages of Alloy and Timed Automata for modelling and analysing of access control specifications.
本文介绍了在访问控制规范建模和分析方面,合金自动机和时间自动机的比较研究。特别地,本文从能力和性能的角度比较了合金和时间自动机在基于时空角色的访问控制(STRBAC)背景下对访问控制规范的建模和分析。为了进行比较研究,使用Alloy和定时自动机指定了相同的案例研究(安全银行系统)。为了将安全银行系统的规范转换为合金和时间自动机,本文分别利用了我们以前的方法AC2Alloy和AC2Uppaal。然后,本文确定了合金自动机和时间自动机对访问控制规范建模和分析的最重要的优点和缺点。
{"title":"Comparison between Alloy and Timed Automata for modelling and analysing of access control specifications","authors":"Emsaieb Geepalla","doi":"10.1109/CyberSec.2014.6913965","DOIUrl":"https://doi.org/10.1109/CyberSec.2014.6913965","url":null,"abstract":"This paper presents a comparative study between Alloy and Timed Automata for modelling and analysing of access control specifications. In particular, this paper compares Alloy and Timed Automata for modelling and analysing of Access Control specifications in the context of Spatio-Temporal Role Based Access Control (STRBAC) from capability and performance points of view. To conduct the comparison study the same case study (SECURE bank system) is specified using Alloy and Timed Automata. In order to transform the specification of the Secure Bank system into Alloy and Timed Automata this paper makes use of our earlier methods AC2Alloy and AC2Uppaal respectively. The paper then identifies the most important advantages and disadvantages of Alloy and Timed Automata for modelling and analysing of access control specifications.","PeriodicalId":383642,"journal":{"name":"2014 Third International Conference on Cyber Security, Cyber Warfare and Digital Forensic (CyberSec)","volume":"78 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-10-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129260084","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Modeling the propagation of security threats: An e-learning case study 安全威胁的传播建模:一个电子学习案例研究
N. Rjaibi, Nawel Gannouni, Latifa Ben Arfa Rabai, Anis Ben Aissa
In this paper, we propose a novel linear model for modeling the propagation of security threats among the system's architectural components which is the Threats Propagation model (TP). Our model is based on the Mean Failure Cost cyber-security model (MFC) and applied to an e-learning system. The Threats propagation model (TP) enables to show if a threat can propagate to other e-learning systems components. Then, it provides an efficient diagnostic about the most critical threats in order to make the best decision and to establish the suitable countermeasures to avoid them. Our proposed model is useful to implement a safe and secure e-learning environment.
在本文中,我们提出了一种新的线性模型来模拟安全威胁在系统架构组件之间的传播,即威胁传播模型(TP)。我们的模型是基于平均失效成本网络安全模型(MFC),并应用于一个电子学习系统。威胁传播模型(TP)可以显示威胁是否可以传播到其他电子学习系统组件。然后,它提供了对最关键威胁的有效诊断,以便做出最佳决策,并建立适当的对策来避免它们。我们提出的模型对于实现一个安全可靠的电子学习环境是有用的。
{"title":"Modeling the propagation of security threats: An e-learning case study","authors":"N. Rjaibi, Nawel Gannouni, Latifa Ben Arfa Rabai, Anis Ben Aissa","doi":"10.1109/CyberSec.2014.6913968","DOIUrl":"https://doi.org/10.1109/CyberSec.2014.6913968","url":null,"abstract":"In this paper, we propose a novel linear model for modeling the propagation of security threats among the system's architectural components which is the Threats Propagation model (TP). Our model is based on the Mean Failure Cost cyber-security model (MFC) and applied to an e-learning system. The Threats propagation model (TP) enables to show if a threat can propagate to other e-learning systems components. Then, it provides an efficient diagnostic about the most critical threats in order to make the best decision and to establish the suitable countermeasures to avoid them. Our proposed model is useful to implement a safe and secure e-learning environment.","PeriodicalId":383642,"journal":{"name":"2014 Third International Conference on Cyber Security, Cyber Warfare and Digital Forensic (CyberSec)","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-10-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134372789","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Challenges pertaining to cyber war under international law 国际法下的网络战挑战
M. Watney
State-level intrusion in the cyberspace of another country seriously threatens a state's peace and security. Consequently many types of cyberspace intrusion are being referred to as cyber war with scant regard to the legal position under international law. This is but one of the challenges facing state-level cyber intrusion. The current rules of international law prohibit certain types of intrusion. However, international law does not define which intrusion fall within the prohibited category of intrusion nor when the threshold of intrusion is surpassed. International lawyers have to determine the type of intrusion and threshold on a case-by-case basis. The Tallinn Manual may serve as guideline in this assessment, but determination of the type of intrusion and attribution to a specific state is not easily established. The current rules of international law do not prohibit all intrusion which on statelevel may be highly invasive and destructive. Unrestrained cyber intrusion may result in cyberspace becoming a battle space in which state(s) with strong cyber abilities dominate cyberspace resulting in resentment and fear among other states. The latter may be prevented on an international level by involving all states on an equal and transparent manner in cyberspace governance.
国家层面侵入他国网络空间,严重威胁本国的和平与安全。因此,许多类型的网络空间入侵被称为网络战争,很少考虑国际法下的法律地位。这只是国家级网络入侵面临的挑战之一。现行的国际法规则禁止某些类型的入侵。但是,国际法并没有规定哪些侵犯属于被禁止的侵犯范畴,也没有规定何时超过侵犯的门槛。国际律师必须根据具体情况确定入侵的类型和门槛。《塔林手册》可以作为这一评估的指导方针,但确定入侵的类型和归属于特定国家并不容易。目前的国际法规则并没有禁止所有在国家层面上可能具有高度侵入性和破坏性的入侵。无节制的网络入侵可能导致网络空间成为网络能力强的国家主导网络空间的战争空间,引发其他国家的怨恨和恐惧。通过让所有国家以平等和透明的方式参与网络空间治理,可以在国际层面上防止网络空间滥用。
{"title":"Challenges pertaining to cyber war under international law","authors":"M. Watney","doi":"10.1109/CyberSec.2014.6913962","DOIUrl":"https://doi.org/10.1109/CyberSec.2014.6913962","url":null,"abstract":"State-level intrusion in the cyberspace of another country seriously threatens a state's peace and security. Consequently many types of cyberspace intrusion are being referred to as cyber war with scant regard to the legal position under international law. This is but one of the challenges facing state-level cyber intrusion. The current rules of international law prohibit certain types of intrusion. However, international law does not define which intrusion fall within the prohibited category of intrusion nor when the threshold of intrusion is surpassed. International lawyers have to determine the type of intrusion and threshold on a case-by-case basis. The Tallinn Manual may serve as guideline in this assessment, but determination of the type of intrusion and attribution to a specific state is not easily established. The current rules of international law do not prohibit all intrusion which on statelevel may be highly invasive and destructive. Unrestrained cyber intrusion may result in cyberspace becoming a battle space in which state(s) with strong cyber abilities dominate cyberspace resulting in resentment and fear among other states. The latter may be prevented on an international level by involving all states on an equal and transparent manner in cyberspace governance.","PeriodicalId":383642,"journal":{"name":"2014 Third International Conference on Cyber Security, Cyber Warfare and Digital Forensic (CyberSec)","volume":"321 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-10-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124542275","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
期刊
2014 Third International Conference on Cyber Security, Cyber Warfare and Digital Forensic (CyberSec)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1