首页 > 最新文献

International Journal of Security and Its Applications最新文献

英文 中文
Integration of Security Non-Functional Requirements and Architectural Design: A Comparative Analysis 安全非功能需求与建筑设计的集成:比较分析
Pub Date : 2017-10-31 DOI: 10.14257/ijsia.2017.11.10.05
M. Babar, Shahid Azeem, F. Arif
For the last few decades, security in software has gained too much attention by the industries. Developing secure software needs to emphasis on the functional and non-functional requirements both. Functional requirements are taken into account during the early stages of development while unfortunately the non-functional requirements are either ignored or less considered which results in the high cost of maintenance after delivery of the software. This article presents a detailed and comprehensive survey with regard to the integration of security non-functional requirements into architectural design. This paper thoroughly analyzes the existing approaches which are dealing the non-functional requirements at architecture level. The architectural design can be integrated with general non-functional requirements, but the scope of this particular article is only the security related non-functional requirements. The approaches which are comprehensively described and analyzed are use case/misuse cases, goal-based analysis, scenario-based, reused-based, pattern-based, and aspect-based. We have evaluated each approach by some parameters which are described based on the existing literature and comparison has been made between the current approaches thorough proper evaluation.
在过去的几十年里,软件的安全性受到了业界的太多关注。开发安全软件需要同时强调功能和非功能需求。在开发的早期阶段,功能需求被考虑在内,而不幸的是,非功能需求要么被忽视,要么被较少考虑,这导致软件交付后的维护成本很高。本文详细而全面地介绍了将安全性非功能性需求集成到架构设计中的情况。本文深入分析了现有的在体系结构层次上处理非功能需求的方法。体系结构设计可以与一般的非功能性需求集成,但本文的范围仅限于与安全相关的非功能需求。全面描述和分析的方法有用例/误用用例、基于目标的分析、基于场景的分析、重用的分析、模式的分析和方面的分析。我们根据现有文献描述的一些参数对每种方法进行了评估,并通过适当的评估对当前方法进行了比较。
{"title":"Integration of Security Non-Functional Requirements and Architectural Design: A Comparative Analysis","authors":"M. Babar, Shahid Azeem, F. Arif","doi":"10.14257/ijsia.2017.11.10.05","DOIUrl":"https://doi.org/10.14257/ijsia.2017.11.10.05","url":null,"abstract":"For the last few decades, security in software has gained too much attention by the industries. Developing secure software needs to emphasis on the functional and non-functional requirements both. Functional requirements are taken into account during the early stages of development while unfortunately the non-functional requirements are either ignored or less considered which results in the high cost of maintenance after delivery of the software. This article presents a detailed and comprehensive survey with regard to the integration of security non-functional requirements into architectural design. This paper thoroughly analyzes the existing approaches which are dealing the non-functional requirements at architecture level. The architectural design can be integrated with general non-functional requirements, but the scope of this particular article is only the security related non-functional requirements. The approaches which are comprehensively described and analyzed are use case/misuse cases, goal-based analysis, scenario-based, reused-based, pattern-based, and aspect-based. We have evaluated each approach by some parameters which are described based on the existing literature and comparison has been made between the current approaches thorough proper evaluation.","PeriodicalId":46187,"journal":{"name":"International Journal of Security and Its Applications","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2017-10-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"49134228","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Design of a Secure Dynamic Identity Authentication Scheme for Health Internet of Things 健康物联网安全动态身份认证方案设计
Pub Date : 2017-09-30 DOI: 10.14257/IJSIA.2017.11.9.04
Chengqi Wang, Xiao Zhang, Lijia Xie, Zhiming Zheng
To satisfy the security requirements of patients’ privacy and data’s security for health Internet of Things (IoT), various authentication schemes are proposed as guaranteed countermeasures. In particular, Wang et al. built an identity-based authentication scheme with extended Chebyshev chaotic maps. Nevertheless, considering service misuse attack and Denial-of-Service attack, Wang et al.’s method works inadequately. Also it is insufficient to provide efficient password change phase, fast error detection and session key agreement. As a remedy, we propose a novel dynamic identity authenticated key agreement scheme. Our scheme achieves resistance to the known attacks in order to meet the desirable security requirements. Furthermore, the presented scheme practically enables both user revocation/re-registration and biometric information protection, which are significant features ignored by most previous schemes. We confirm the effectiveness of our scheme via comprehensive comparisons in terms of resistance, functionality and performance.
为了满足医疗物联网对患者隐私和数据安全的安全需求,提出了多种认证方案作为保障对策。特别是,Wang等人构建了一个基于身份的认证方案,该方案具有扩展的Chebyshev混沌映射。然而,考虑到服务滥用攻击和拒绝服务攻击,Wang等人的方法并不适用。此外,它还不足以提供高效的密码更改阶段、快速的错误检测和会话密钥协议。为此,我们提出了一种新的动态身份认证密钥协议方案。我们的方案实现了对已知攻击的抵抗,以满足期望的安全需求。此外,该方案实际地实现了用户撤销/重新注册和生物特征信息保护,这是大多数方案忽略的重要特征。我们通过在阻力,功能和性能方面的综合比较来确认我们方案的有效性。
{"title":"Design of a Secure Dynamic Identity Authentication Scheme for Health Internet of Things","authors":"Chengqi Wang, Xiao Zhang, Lijia Xie, Zhiming Zheng","doi":"10.14257/IJSIA.2017.11.9.04","DOIUrl":"https://doi.org/10.14257/IJSIA.2017.11.9.04","url":null,"abstract":"To satisfy the security requirements of patients’ privacy and data’s security for health Internet of Things (IoT), various authentication schemes are proposed as guaranteed countermeasures. In particular, Wang et al. built an identity-based authentication scheme with extended Chebyshev chaotic maps. Nevertheless, considering service misuse attack and Denial-of-Service attack, Wang et al.’s method works inadequately. Also it is insufficient to provide efficient password change phase, fast error detection and session key agreement. As a remedy, we propose a novel dynamic identity authenticated key agreement scheme. Our scheme achieves resistance to the known attacks in order to meet the desirable security requirements. Furthermore, the presented scheme practically enables both user revocation/re-registration and biometric information protection, which are significant features ignored by most previous schemes. We confirm the effectiveness of our scheme via comprehensive comparisons in terms of resistance, functionality and performance.","PeriodicalId":46187,"journal":{"name":"International Journal of Security and Its Applications","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2017-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"42969424","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Improved Detecting Host Based Intrusions Based On Hybrid SVM Using Grey Wolf Optimizer 基于混合SVM的改进型入侵检测算法
Pub Date : 2017-09-30 DOI: 10.14257/IJSIA.2017.11.9.05
Vidhya Sathish, P. Khader
The blooming of intrusion instance trace notified as grim threat as per internet industry is concerned. To overcome, detection methodologies are designed by adopting an extensive intense research in the internet industry. Based on the consideration of challenging task and performance existence of contemporary computational methodologies, the objective of this Proposed Research has developed the enhanced hybrid strategy by combining the Support Vector Machine approach from classifier-based techniques and the Grey Wolf Optimizer from evolutionary techniques to optimize the support vector machine parameter towards the accurate classification of Host based intrusions with high detection accuracy and minimal false leads.
入侵实例追踪的蓬勃发展被互联网行业视为严峻的威胁。为了克服这一问题,在互联网行业进行了广泛深入的研究,设计了检测方法。在考虑到当代计算方法具有挑战性的任务和性能存在的基础上,本拟议研究的目的是通过将基于分类器的技术中的支持向量机方法和进化技术中的灰太狼优化器相结合,开发出增强的混合策略,以优化支持向量机参数,实现对具有高检测精度和最小假引的基于主机的入侵的准确分类。
{"title":"Improved Detecting Host Based Intrusions Based On Hybrid SVM Using Grey Wolf Optimizer","authors":"Vidhya Sathish, P. Khader","doi":"10.14257/IJSIA.2017.11.9.05","DOIUrl":"https://doi.org/10.14257/IJSIA.2017.11.9.05","url":null,"abstract":"The blooming of intrusion instance trace notified as grim threat as per internet industry is concerned. To overcome, detection methodologies are designed by adopting an extensive intense research in the internet industry. Based on the consideration of challenging task and performance existence of contemporary computational methodologies, the objective of this Proposed Research has developed the enhanced hybrid strategy by combining the Support Vector Machine approach from classifier-based techniques and the Grey Wolf Optimizer from evolutionary techniques to optimize the support vector machine parameter towards the accurate classification of Host based intrusions with high detection accuracy and minimal false leads.","PeriodicalId":46187,"journal":{"name":"International Journal of Security and Its Applications","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2017-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"49368506","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
Cryptography Protocol: A Novel Multilingual Adaptive Encryption Technique with Phonetic Based Ciphering 密码协议:一种新的基于语音的多语言自适应加密技术
Pub Date : 2017-09-30 DOI: 10.14257/ijsia.2017.11.9.02
A. Mansour, M. Fouad
This paper proposes a novel hybrid encryption algorithm that utilizes the natural language phonetics significantly. The encryption process is based on two major aspects. The first is the phonetic difference between languages and their mapping into Human Machine interface tools such as the computer keyboard. The second aspect is the embedded ciphering process as a mean of private key exchange (PKE). Such a key will be used to determine all the ciphering parameters. The presented encryption protocol is an end-to-end process and the choices of languages and machine interface is completely user dependant. The creation of ciphering parameters such as the indicator, the key, the array and the operation are also user defined. This work explores several examples for each choice using the Arabic language as a model for the phonetic intermediate language. The keyboard character mapping is used based on the location of characters in the multilingual keyboard. Both fixed location mapping and variable location shifting are introduced.
本文提出了一种新的混合加密算法,该算法充分利用了自然语言语音。加密过程基于两个主要方面。第一个是语言之间的语音差异,以及它们在人机界面工具(如计算机键盘)中的映射。第二个方面是作为私钥交换(PKE)手段的嵌入式加密过程。这样的密钥将用于确定所有的加密参数。所提出的加密协议是一个端到端的过程,语言和机器接口的选择完全取决于用户。诸如指示符、密钥、数组和操作之类的加密参数的创建也是用户定义的。这项工作探索了每个选择的几个例子,使用阿拉伯语作为语音中间语言的模型。键盘字符映射是根据多语言键盘中字符的位置使用的。介绍了固定位置映射和可变位置移位。
{"title":"Cryptography Protocol: A Novel Multilingual Adaptive Encryption Technique with Phonetic Based Ciphering","authors":"A. Mansour, M. Fouad","doi":"10.14257/ijsia.2017.11.9.02","DOIUrl":"https://doi.org/10.14257/ijsia.2017.11.9.02","url":null,"abstract":"This paper proposes a novel hybrid encryption algorithm that utilizes the natural language phonetics significantly. The encryption process is based on two major aspects. The first is the phonetic difference between languages and their mapping into Human Machine interface tools such as the computer keyboard. The second aspect is the embedded ciphering process as a mean of private key exchange (PKE). Such a key will be used to determine all the ciphering parameters. The presented encryption protocol is an end-to-end process and the choices of languages and machine interface is completely user dependant. The creation of ciphering parameters such as the indicator, the key, the array and the operation are also user defined. This work explores several examples for each choice using the Arabic language as a model for the phonetic intermediate language. The keyboard character mapping is used based on the location of characters in the multilingual keyboard. Both fixed location mapping and variable location shifting are introduced.","PeriodicalId":46187,"journal":{"name":"International Journal of Security and Its Applications","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2017-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"48288168","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Vernam Conjugated Manipulation of Bit-plane Complexity Segmentation 位平面复杂度分割的Vernam共轭操作
Pub Date : 2017-09-30 DOI: 10.14257/ijsia.2017.11.9.01
A. Siahaan
Steganography has no protection to make the information hidden is safe from theft. This technique only tries to store information in the image purely. There are many ways to steal information from pixels stored in RGB colors. Bit-Plane Complexity Segmentation (BPCS) is one of the steganography technique is often performed to conceal data. But in BPCS method, a used pattern is not a classified anymore. It breaks down and changes the plain text structure into square information. BPCS has two types of area, informative and noise-like region. This division depends on the threshold value. The noise-like region is the only area that can store confidential information. It is an 8 x 8 matrix pattern. The plain text is turned into bits and finally kept in the matrix. Converting the bit-plane information is a technique for increasing the security of the vessel image. Vernam cipher can easily be occupied to modify the bit-plane structure with the predetermined blocks conjugation. The cipher block contains a new set of unbreakable characters. It increases the security level.
隐写术没有任何保护措施,使隐藏的信息不被窃取。这种技术只尝试将信息纯粹地存储在图像中。有许多方法可以从RGB颜色存储的像素中窃取信息。位平面复杂度分割(BPCS)是一种常用的隐写技术,用于隐藏数据。但是在BPCS方法中,使用的模式不再是分类的。它分解并将纯文本结构更改为方形信息。BPCS有两种类型的区域,信息区域和类噪声区域。这种划分取决于阈值。类似噪声的区域是唯一可以存储机密信息的区域。它是一个8 × 8的矩阵模式。纯文本被转换成位,最后保存在矩阵中。位平面信息的转换是提高船舶图像安全性的一种技术。利用预先确定的块共轭,可以很容易地利用Vernam密码修改位平面结构。密码块包含一组新的不可破解字符。它提高了安全级别。
{"title":"Vernam Conjugated Manipulation of Bit-plane Complexity Segmentation","authors":"A. Siahaan","doi":"10.14257/ijsia.2017.11.9.01","DOIUrl":"https://doi.org/10.14257/ijsia.2017.11.9.01","url":null,"abstract":"Steganography has no protection to make the information hidden is safe from theft. This technique only tries to store information in the image purely. There are many ways to steal information from pixels stored in RGB colors. Bit-Plane Complexity Segmentation (BPCS) is one of the steganography technique is often performed to conceal data. But in BPCS method, a used pattern is not a classified anymore. It breaks down and changes the plain text structure into square information. BPCS has two types of area, informative and noise-like region. This division depends on the threshold value. The noise-like region is the only area that can store confidential information. It is an 8 x 8 matrix pattern. The plain text is turned into bits and finally kept in the matrix. Converting the bit-plane information is a technique for increasing the security of the vessel image. Vernam cipher can easily be occupied to modify the bit-plane structure with the predetermined blocks conjugation. The cipher block contains a new set of unbreakable characters. It increases the security level.","PeriodicalId":46187,"journal":{"name":"International Journal of Security and Its Applications","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2017-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"45279862","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
A stream cipher method for RGB image encryption using PSO base key generation 一种基于PSO基密钥生成的RGB图像流加密方法
Pub Date : 2017-09-30 DOI: 10.14257/ijsia.2017.11.9.06
Sepideh Bahri-Laleh, M. Balafar, M. Feizi-Derakhshi
This paper introduces a novel approach based on a stream cipher to encrypt RGB images. In this regard, a Particle Swarm Optimization (PSO) based algorithm is used to generate the keystream for encryption. Red, green and blue channels of the RGB image are shown as texts and then a stream cipher is used to encrypt the resultant image. A method named PSO Key Generation Color image Encryption (PKGCE) algorithm uses 3 character code tables for each of the 3 channels of RGB image in order to encode the keys and the plain texts showing correspondent channel of the RGB image. A zigzag operation is done on the resultant image in each of the channels to provide more security in a way that the start point of the zigzag path is dependent on the key and channel size. The main advantages of this algorithm over the previously ones, are less number of keys needed to be stored and distributed and also the appropriate speed of the algorithm. Experimental results and the comparison of the proposed algorithm with other encryption algorithms are discussed in detail.
介绍了一种基于流密码的RGB图像加密方法。为此,采用基于粒子群算法(PSO)生成加密密钥流。RGB图像的红、绿、蓝通道被显示为文本,然后使用流密码对生成的图像进行加密。一种名为PSO密钥生成彩色图像加密(PKGCE)算法的方法使用3个字符编码表对RGB图像的3个通道中的每个通道进行编码,以便对显示RGB图像对应通道的密钥和明文进行编码。在每个通道中对生成的图像进行之字形操作,以提供更多的安全性,因为之字形路径的起点取决于密钥和通道大小。与之前的算法相比,该算法的主要优点是需要存储和分发的密钥数量较少,并且算法的速度合适。对实验结果进行了详细的讨论,并与其他加密算法进行了比较。
{"title":"A stream cipher method for RGB image encryption using PSO base key generation","authors":"Sepideh Bahri-Laleh, M. Balafar, M. Feizi-Derakhshi","doi":"10.14257/ijsia.2017.11.9.06","DOIUrl":"https://doi.org/10.14257/ijsia.2017.11.9.06","url":null,"abstract":"This paper introduces a novel approach based on a stream cipher to encrypt RGB images. In this regard, a Particle Swarm Optimization (PSO) based algorithm is used to generate the keystream for encryption. Red, green and blue channels of the RGB image are shown as texts and then a stream cipher is used to encrypt the resultant image. A method named PSO Key Generation Color image Encryption (PKGCE) algorithm uses 3 character code tables for each of the 3 channels of RGB image in order to encode the keys and the plain texts showing correspondent channel of the RGB image. A zigzag operation is done on the resultant image in each of the channels to provide more security in a way that the start point of the zigzag path is dependent on the key and channel size. The main advantages of this algorithm over the previously ones, are less number of keys needed to be stored and distributed and also the appropriate speed of the algorithm. Experimental results and the comparison of the proposed algorithm with other encryption algorithms are discussed in detail.","PeriodicalId":46187,"journal":{"name":"International Journal of Security and Its Applications","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2017-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://sci-hub-pdf.com/10.14257/ijsia.2017.11.9.06","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"42974763","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
A Monitor System for Software Version Request in Offline Environments 离线环境下软件版本请求监控系统
Pub Date : 2017-09-30 DOI: 10.14257/IJSIA.2017.11.9.03
Shin-Yan Chiou, Chia-Chun Lin
While the Internet allows licensees to easily disseminate digital content, it also facilitates misappropriation of such content along with violations of personal privacy. Digital rights management (DRM) measures were developed to address such problems. However, DRM can only be used to verify data correctness from software, but cannot be used to verify software soundness from data. In addition, although trusted platform modules (TPM) can be used to achieve system security, such measures to not provide DRM protection. We thus propose a version request system not only achieves DRM functions, but can also conduct version requests for software from data. In this system’s version checking restrictions, only a secure operation system and application can store the cryptography component’s secret key, which is then used to protect and manage the right object (RO).
虽然互联网允许被许可人很容易地传播数字内容,但它也助长了对这些内容的盗用以及对个人隐私的侵犯。数字版权管理(DRM)措施的制定就是为了解决这些问题。但是,DRM只能从软件上验证数据的正确性,而不能从数据上验证软件的可靠性。此外,虽然可以使用可信平台模块(TPM)来实现系统安全,但此类措施无法提供DRM保护。因此,我们提出了一个版本请求系统,既可以实现DRM功能,又可以从数据中对软件进行版本请求。在该系统的版本检查限制下,只有安全的操作系统和应用程序才能存储加密组件的密钥,然后使用密钥对正确对象(RO)进行保护和管理。
{"title":"A Monitor System for Software Version Request in Offline Environments","authors":"Shin-Yan Chiou, Chia-Chun Lin","doi":"10.14257/IJSIA.2017.11.9.03","DOIUrl":"https://doi.org/10.14257/IJSIA.2017.11.9.03","url":null,"abstract":"While the Internet allows licensees to easily disseminate digital content, it also facilitates misappropriation of such content along with violations of personal privacy. Digital rights management (DRM) measures were developed to address such problems. However, DRM can only be used to verify data correctness from software, but cannot be used to verify software soundness from data. In addition, although trusted platform modules (TPM) can be used to achieve system security, such measures to not provide DRM protection. We thus propose a version request system not only achieves DRM functions, but can also conduct version requests for software from data. In this system’s version checking restrictions, only a secure operation system and application can store the cryptography component’s secret key, which is then used to protect and manage the right object (RO).","PeriodicalId":46187,"journal":{"name":"International Journal of Security and Its Applications","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2017-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"48271739","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Information Security in Healthcare Organizations using Low-Interaction Honeypot Intrusion Detection System 低交互蜜罐入侵检测系统在医疗机构信息安全中的应用
Pub Date : 2017-09-30 DOI: 10.14257/IJSIA.2017.11.9.07
Aastha Yadav, Sarthak Raisurana, H. Balaji, P. Lalitha, Ronnie D. Caytiles, N. Iyengar
Healthcare Organizations have seen an alarming rise in cyber-attacks in the recent years. One way a hacker could get control was by breaking into a medical network to gain access over the active medical devices that patients rely on for their survival. Our network model proposes a low-interaction and a medium-interaction honeypot based intrusion detection system using Dionaea and Kippo SSH to secure our internal network and study the activities of the intruders. We also look at a possible Metasploit attack and Brute force attack logged by Dionaea and Kippo SSH which prepares the Malware Analysis report of the suspicious file downloaded.
近年来,医疗保健组织的网络攻击数量惊人地增加。黑客获得控制权的一种方法是闯入医疗网络,访问患者赖以生存的活跃医疗设备。我们的网络模型提出了一个基于低交互和中等交互蜜罐的入侵检测系统,该系统使用Dioaea和Kippo SSH来保护我们的内部网络并研究入侵者的活动。我们还查看了Dioaea和Kippo SSH记录的可能的Metasploit攻击和Brute force攻击,该SSH准备下载的可疑文件的恶意软件分析报告。
{"title":"Information Security in Healthcare Organizations using Low-Interaction Honeypot Intrusion Detection System","authors":"Aastha Yadav, Sarthak Raisurana, H. Balaji, P. Lalitha, Ronnie D. Caytiles, N. Iyengar","doi":"10.14257/IJSIA.2017.11.9.07","DOIUrl":"https://doi.org/10.14257/IJSIA.2017.11.9.07","url":null,"abstract":"Healthcare Organizations have seen an alarming rise in cyber-attacks in the recent years. One way a hacker could get control was by breaking into a medical network to gain access over the active medical devices that patients rely on for their survival. Our network model proposes a low-interaction and a medium-interaction honeypot based intrusion detection system using Dionaea and Kippo SSH to secure our internal network and study the activities of the intruders. We also look at a possible Metasploit attack and Brute force attack logged by Dionaea and Kippo SSH which prepares the Malware Analysis report of the suspicious file downloaded.","PeriodicalId":46187,"journal":{"name":"International Journal of Security and Its Applications","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2017-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"44886736","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Double Length Sponge Construction DLP-Sponge 双长度海绵结构dlp海绵
Pub Date : 2017-08-31 DOI: 10.14257/ijsia.2017.11.8.04
B. T. Hammad, N. Jamil, M. Rusli, M. Z’aba
In this paper, a new sponge construction called DLP-Sponge is proposed, which takes an arbitrary length of input and yields an output of random length. We prove that this construction is resistant against generic attacks such as multicollision attacks with a better complexity 2 2(c+3)/2 even when a small capacity is used, i.e. lightweight cryptography, where c is the capacity. Furthermore, it is used in building other cryptographic primitives such as block cipher, cryptographic hash functions and Message Authentication Codes (MACs).
本文提出了一种新的海绵结构,称为DLP-Sponge,它采用任意长度的输入,产生随机长度的输出。我们证明,即使使用较小的容量(即轻量级加密,其中c为容量),这种结构也可以抵抗诸如多重碰撞攻击之类的通用攻击,并且具有更好的复杂度22 (c+3)/2。此外,它还用于构建其他加密原语,如分组密码、加密散列函数和消息认证码(mac)。
{"title":"Double Length Sponge Construction DLP-Sponge","authors":"B. T. Hammad, N. Jamil, M. Rusli, M. Z’aba","doi":"10.14257/ijsia.2017.11.8.04","DOIUrl":"https://doi.org/10.14257/ijsia.2017.11.8.04","url":null,"abstract":"In this paper, a new sponge construction called DLP-Sponge is proposed, which takes an arbitrary length of input and yields an output of random length. We prove that this construction is resistant against generic attacks such as multicollision attacks with a better complexity 2 2(c+3)/2 even when a small capacity is used, i.e. lightweight cryptography, where c is the capacity. Furthermore, it is used in building other cryptographic primitives such as block cipher, cryptographic hash functions and Message Authentication Codes (MACs).","PeriodicalId":46187,"journal":{"name":"International Journal of Security and Its Applications","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2017-08-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"45587862","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Extended Design and Implementation of Certificate Authorities 证书颁发机构的扩展设计和实现
Pub Date : 2017-08-31 DOI: 10.14257/IJSIA.2017.11.8.02
Sarvesh Tanwar, Anil Kumar
The most important security services of Public Key Infrastructure (PKI) such as e authentication, integrity, confidentiality and non- repudiation enables its clients to maintain a level of trust. It enables clients to exchange information over unsecure public network such as Internet. PKI proves the identity of an individual or an organization via digital certificates which binds information of client and public key. Public keys are store in public key directory. A PKI system works by having a Certificate Authority (CA) that is responsible for issuing and revoking certificates. Certificates are basic source of trust in online transactions. The aim of this paper is to design and implement a CA that can create and manage public key certificates. We have proposed a trusted hierarchical trust model which is extension of work done by Janabi et al.. [4]. The proposed system is designed and implemented using JAVA programming language, MYSQL database server and Apache web server.
公钥基础设施(PKI)最重要的安全服务,如身份验证、完整性、机密性和不可抵赖性,使其客户端能够保持一定程度的信任。它使客户端能够通过不安全的公共网络(如Internet)交换信息。PKI通过绑定客户端信息和公钥的数字证书来证明个人或组织的身份。公钥存储在公钥目录中。PKI系统的工作原理是由证书颁发机构(CA)负责颁发和吊销证书。证书是在线交易中信任的基本来源。本文的目的是设计和实现一个可以创建和管理公钥证书的CA。我们提出了一个可信的分层信任模型,它是Janabi等人[4]工作的扩展。该系统采用JAVA编程语言、MYSQL数据库服务器和Apache web服务器进行设计和实现。
{"title":"Extended Design and Implementation of Certificate Authorities","authors":"Sarvesh Tanwar, Anil Kumar","doi":"10.14257/IJSIA.2017.11.8.02","DOIUrl":"https://doi.org/10.14257/IJSIA.2017.11.8.02","url":null,"abstract":"The most important security services of Public Key Infrastructure (PKI) such as e authentication, integrity, confidentiality and non- repudiation enables its clients to maintain a level of trust. It enables clients to exchange information over unsecure public network such as Internet. PKI proves the identity of an individual or an organization via digital certificates which binds information of client and public key. Public keys are store in public key directory. A PKI system works by having a Certificate Authority (CA) that is responsible for issuing and revoking certificates. Certificates are basic source of trust in online transactions. The aim of this paper is to design and implement a CA that can create and manage public key certificates. We have proposed a trusted hierarchical trust model which is extension of work done by Janabi et al.. [4]. The proposed system is designed and implemented using JAVA programming language, MYSQL database server and Apache web server.","PeriodicalId":46187,"journal":{"name":"International Journal of Security and Its Applications","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2017-08-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"45572716","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
期刊
International Journal of Security and Its Applications
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1