Information Systems (IS) represent an integral part of our lives, both in the organizational and personal sphere. To use them securely, users must be properly trained. The main problem is that most ...training processes still use the one-size-fits-all approach where users receive the same kind of learning material. In addition, personalized training may be a more suitable approach however a comprehensive process for IS user profiling and personalized IS user training improvement has not been introduced yet. This paper proposes a novel approach for personalized user training for secure use of IS to fill in this gap. The proposed approach focuses on three key dimensions (i.e., the personalization process, selection of training tools and materials, and participants) and is composed of five phases covering the identification of key IS security elements, IS user profiling and personalization of IS security training. It is scalable to all company sizes and aims to lower both the IS training costs and optimization of outcomes. As a side-effect, it also helps to lower user resistance to participation in IS security training.
Steganalysis, a field devoted to detecting concealed information in various forms of digital media, including text, images, audio, and video files, has evolved significantly over time. This evolution ...aims to improve the accuracy of revealing potential hidden data. Traditional machine learning approaches, such as support vector machines (SVM) and ensemble classifiers (ECs), were previously employed in steganalysis. However, they demonstrated ineffective against contemporary and prevalent steganographic methods. The field of steganalysis has experienced noteworthy advancements by transitioning from traditional machine learning methods to deep learning techniques, resulting in superior outcomes. More specifically, deep learning-based steganalysis approaches exhibit rapid detection of steganographic payloads and demonstrate remarkable accuracy and efficiency across a spectrum of modern steganographic algorithms. This paper is dedicated to investigating recent developments in deep learning-based steganalysis schemes, exploring their evolution, and conducting a thorough analysis of the techniques incorporated in these schemes. Furthermore, the research aims to delve into the current trends in steganalysis, explicitly focusing on digital image steganography. By examining the latest techniques and methodologies, this work contributes to an enhanced understanding of the evolving landscape of steganalysis, shedding light on the advancements achieved through deep learning-based approaches.
The purpose of this paper consists of implementing an educational board game to evaluate the information security awareness level of healthcare personnel. The National Health Service Greater Glasgow ...and Clyde (NHSGGC) Information Security Acceptable Use Policy was used as a basis to generate the educational content of the board game and Lev Vygotsky’s social development theory was followed for the learning process of the participants. Two evaluations were carried out during this study. The results obtained during the first evaluation showed that it is fundamental to design the board game based on a set of rules in information security enacted by an organization to properly guide the participants with the knowledge they need to counter security incidents. The second evaluation showed that redesigning the content of the board game based on the information security policies of the NHSGGC, resulted in a more effective way of guiding participants on the procedures required for compliance with the policies of this health institution and offer them an understanding of the risks behind security incidents. This was demonstrated during this evaluation since the results obtained gave an approximation that it is possible to increase the level of awareness of information security in people regardless of their area of work or studies.
An electronic health (e-health) record system is a novel application that will bring great convenience in healthcare. The privacy and security of the sensitive personal information are the major ...concerns of the users, which could hinder further development and widely adoption of the systems. The searchable encryption (SE) scheme is a technology to incorporate security protection and favorable operability functions together, which can play an important role in the e-health record system. In this paper, we introduce a novel cryptographic primitive named as conjunctive keyword search with designated tester and timing enabled proxy reencryption function (Re-dtPECK), which is a kind of a time-dependent SE scheme. It could enable patients to delegate partial access rights to others to operate search functions over their records in a limited time period. The length of the time period for the delegatee to search and decrypt the delegator's encrypted documents can be controlled. Moreover, the delegatee could be automatically deprived of the access and search authority after a specified period of effective time. It can also support the conjunctive keywords search and resist the keyword guessing attacks. By the solution, only the designated tester is able to test the existence of certain keywords. We formulate a system model and a security model for the proposed Re-dtPECK scheme to show that it is an efficient scheme proved secure in the standard model. The comparison and extensive simulations demonstrate that it has a low computation and storage overhead.
As control-flow hijacking defenses gain adoption, it is important to understand the remaining capabilities of adversaries via memory exploits. Non-control data exploits are used to mount information ...leakage attacks or privilege escalation attacks program memory. Compared to control-flow hijacking attacks, such non-control data exploits have limited expressiveness, however, the question is: what is the real expressive power of non-control data attacks? In this paper we show that such attacks are Turing-complete. We present a systematic technique called data-oriented programming (DOP) to construct expressive non-control data exploits for arbitrary x86 programs. In the experimental evaluation using 9 programs, we identified 7518 data-oriented x86 gadgets and 5052 gadget dispatchers, which are the building blocks for DOP. 8 out of 9 real-world programs have gadgets to simulate arbitrary computations and 2 of them are confirmed to be able to build Turing-complete attacks. We build 3 end-to-end attacks to bypass randomization defenses without leaking addresses, to run a network bot which takes commands from the attacker, and to alter the memory permissions. All the attacks work in the presence of ASLR and DEP, demonstrating how the expressiveness offered by DOP significantly empowers the attacker.
The initial contribution in this paper begins with proposing a robust and secure DWT, DCT and SVD based multiple watermarking techniques for protecting digital contents over unsecure social networks. ...The proposed technique initially decomposes the host image into third level DWT where the vertical frequency band (LH2) at second level and low frequency band (LL3) at the third level DWT is selected for embedding image and text watermark respectively. Further, the proposed method addresses the issue of ownership identity authentication, multiple watermarks are embedded instead of single watermark into the same multimedia objects simultaneously, which offer the extra level of security and reduced storage and bandwidth requirements in the important applications areas such as E-health, secure multimedia contents on online social network, secured E-Voting systems, digital cinema, education and insurance companies, driver’s license /passport. Moreover, the robustness image watermark is also enhanced by using Back Propagation Neural Network (BPNN), which is applied on extracted watermark to minimize the distortion effects on the watermarked image. In addition, the method addresses the issue of channel noise distortions in the identity information. This has been achieved using error correcting codes (ECCs) for encoding the text watermark before embedding into the host image. The effects of Hamming and BCH codes on the robustness of personal identity information in the form of text watermark and the cover image quality have been investigated. Further, to enhance the security of the host and watermarks the selective encryption is applied on watermarked image, where only the important multimedia data is encrypted. The proposed method has been extensively tested and analyzed against known attacks. Based on experimental results, it is established that the proposed technique achieves superior performance in respect of, robustness, security and capacity with acceptable visual quality of the watermarked image as compared to reported techniques. Finally, we have evaluated the image quality of the watermarked image by subjective method. Therefore, the proposed method may find potential solutions in prevention of personal identity theft and unauthorized multimedia content sharing on online social networks/open channel.
Attributing Cyber Attacks Rid, Thomas; Buchanan, Ben
Journal of strategic studies,
01/2015, Volume:
38, Issue:
1-2
Journal Article
Peer reviewed
Open access
Who did it? Attribution is fundamental. Human lives and the security of the state may depend on ascribing agency to an agent. In the context of computer network intrusions, attribution is commonly ...seen as one of the most intractable technical problems, as either solvable or not solvable, and as dependent mainly on the available forensic evidence. But is it? Is this a productive understanding of attribution? - This article argues that attribution is what states make of it. To show how, we introduce the Q Model: designed to explain, guide, and improve the making of attribution. Matching an offender to an offence is an exercise in minimising uncertainty on three levels: tactically, attribution is an art as well as a science; operationally, attribution is a nuanced process not a black-and-white problem; and strategically, attribution is a function of what is at stake politically. Successful attribution requires a range of skills on all levels, careful management, time, leadership, stress-testing, prudent communication, and recognising limitations and challenges.
Objective: Early diagnosis of cardiovascular diseases is a crucial task in medical practice. With the application of computer audition in the healthcare field, artificial intelligence (AI) has been ...applied to clinical non-invasive intelligent auscultation of heart sounds to provide rapid and effective pre-screening. However, AI models generally require large amounts of data which may cause privacy issues. Unfortunately, it is difficult to collect large amounts of healthcare data from a single centre. Methods: In this study, we propose federated learning (FL) optimisation strategies for the practical application in multi-centre institutional heart sound databases. The horizontal FL is mainly employed to tackle the privacy problem by aligning the feature spaces of FL participating institutions without information leakage. In addition, techniques based on deep learning have poor interpretability due to their "black-box" property, which limits the feasibility of AI in real medical data. To this end, vertical FL is utilised to address the issues of model interpretability and data scarcity. Conclusion: Experimental results demonstrate that, the proposed FL framework can achieve good performance for heart sound abnormality detection by taking the personal privacy protection into account. Moreover, using the federated feature space is beneficial to balance the interpretability of the vertical FL and the privacy of the data. Significance: This work realises the potential of FL from research to clinical practice, and is expected to have extensive application in the federated smart medical system.
It is currently urgent to improve the technical characteristics and increase the efficiency of telecommunication networks because of the global problem of ensuring the reliable transmission, ...processing and protection of commercial information in telecommunication networks. The aim of this study is to assess the reliability indicators of telecommunication networks and analyse the level of their development. The aim was achieved through the methods that were used to assess the reliability of the entire network: the generalized method of analytical assessment of the telecommunication network reliability; connection-based metrics; scaling of telecommunication networks, and application of unified reliability indicators to routine control, operation and maintenance. As a result of the research, the indicators of telecommunication networks were studied with and without using connection-based metrics. As a result, the network metrics were also divided into distribution and generation/transmission reliability and telecommunication network metrics – into connection-, performance-, and condition-based metrics, which showed improvements in network performance and reliability. As a prospect for further research, studying and improving the telecommunication network reliability indicators is suggested.
PDF
