M. Diloy, Joan Katherine N. Romasanta, Marco Paulo J. Burgos, C. O. Loyola, L. R. De Luna, Geanne Ross L. Franco
{"title":"haydIT : An Encryptor and Decryptor Application","authors":"M. Diloy, Joan Katherine N. Romasanta, Marco Paulo J. Burgos, C. O. Loyola, L. R. De Luna, Geanne Ross L. Franco","doi":"10.1109/CSP58884.2023.00039","DOIUrl":"https://doi.org/10.1109/CSP58884.2023.00039","url":null,"abstract":"Encryption is a method of hiding data so that it cannot be read by anyone who does not know the key. The key is used to lock and unlock data. In a hack-prone society like ours now, this method would prevent unauthorized individuals from understanding your most protected correspondences. Hence, the development of an encryptor and decryptor is necessary. haydIT offers a user-friendly interface using intuitive icons that most of us are familiar with. Users can encrypt data, generate private key that serves as a unique lock of encryption, and send it thru any means to its recipient. Receivers can also use the same system to decrypt the data using the private key that must be manually entered to the system. haydIT prides itself in supporting the conversion of different language scriptures, providing asymmetrical way of data conversion through double encryption of randomly selected characters. It also supports multi- level of encryption and applies parity checking for data integrity. Thus, provides a virtually- pattern-less way of encoding and decoding data. The developers utilized the Spiral Methodology in developing the project. It combines the elements of both design and prototyping-in-stages, in an effort to combine advantages of top- down and bottom-up concepts. The developed PC app was tested by 15 IT Professionals based on several metrics and proved that haydIT is performing efficiently as expected with a grand mean of 4.75 interpreted as Excellent. With haydIT, everyone can guarantee that messages will be understood only by its intended reader.","PeriodicalId":255083,"journal":{"name":"2023 7th International Conference on Cryptography, Security and Privacy (CSP)","volume":"94 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126223777","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Generating t-Closed Partitions of Datasets with Multiple Sensitive Attributes","authors":"Vikas Thammanna Gowda, R. Bagai","doi":"10.1109/CSP58884.2023.00024","DOIUrl":"https://doi.org/10.1109/CSP58884.2023.00024","url":null,"abstract":"The popular t-closeness privacy model requires the “distance” between the distribution of sensitive attribute values in any given raw dataset and their distribution in every equivalence class created to not exceed some privacy threshold t. While most existing methods for achieving t-closeness handle data with just a single sensitive attribute, datasets with multiple sensitive attributes are very common in the real world. Here we demonstrate a technique for creating equivalence classes from a dataset containing multiple sensitive attributes. The equivalence classes generated by our method satisfy t-closeness without taking any $t$ values as input. While generalization of quasi-identifier attributes leads to information loss, the size of generated classes is roughly identical and differs by at most one, which results in a lower information loss. Generating classes with minimum information loss for a given value of $t$ is NP-hard, the equivalence classes generated by our method takes O(r log r) time.","PeriodicalId":255083,"journal":{"name":"2023 7th International Conference on Cryptography, Security and Privacy (CSP)","volume":"19 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125049901","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"An Application Service for Supporting Security Management In Software-Defined Networks","authors":"M. O. Ben Miloud, Jun Liu","doi":"10.1109/CSP58884.2023.00028","DOIUrl":"https://doi.org/10.1109/CSP58884.2023.00028","url":null,"abstract":"Network softwarization is the new approach of transforming traditional telecommunication technology to software-defined networking (SDN) environment to facilitate dynamic and flexible connections. Network functions in software-defined networks have been decoupled into a control plane and a data plane. The control plane has become a new target of network attacks. This paper introduces an application service, also called portal service layer, for dynamically changing the association between an SDN switch and its designated SDN controller without changing the configuration of an SDN system. A portal service layer is deployed between the control plane and the data plane of an SDN system and functions as a communication mesh to forward the communications between the two planes in an SDN system. Portal service layer also consists of its own data plane and control plane. The control plane of the service mesh provides the data plane of the service mesh with up-to-date routing paths within the communication mesh. The data plane of the service mesh enforces the decision of association between an SDN switch and its current designated SDN controller based on the decision made by the control plane of the service mesh.","PeriodicalId":255083,"journal":{"name":"2023 7th International Conference on Cryptography, Security and Privacy (CSP)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129050018","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Tong Wu, Qinbo Liu, Binchang Li, Feng Luo, Weilong Li, Yang Liu
{"title":"Detection of Conflicts between APP's Privacy Policy and Actual Behavior: A Security Analysis System","authors":"Tong Wu, Qinbo Liu, Binchang Li, Feng Luo, Weilong Li, Yang Liu","doi":"10.1109/CSP58884.2023.00015","DOIUrl":"https://doi.org/10.1109/CSP58884.2023.00015","url":null,"abstract":"Leaks of user privacy in the mobile cloud environment have been common in recent years. Common APP stores require apps to have a user privacy policy that complies with applicable laws. Due to the problem of lengthy papers or difficult-to-understand sentences in privacy policies, users frequently skip reading them or fail to comprehend them. Moreover, there may be conflicts between the privacy policy and the actual behaviors. In order to alleviate these problems above, we design a security analysis system that employs natural language processing to detect conflicts between an APP's privacy policy and its actual behaviors. Experimental results show that the analysis accuracy is improved compared with existing methods.","PeriodicalId":255083,"journal":{"name":"2023 7th International Conference on Cryptography, Security and Privacy (CSP)","volume":"26 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127391489","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Verifiable Threshold Multiplication Protocol based on Oblivious Transfer","authors":"S. Ng, Tomás Tauber, Leslie Cheung","doi":"10.1109/CSP58884.2023.00029","DOIUrl":"https://doi.org/10.1109/CSP58884.2023.00029","url":null,"abstract":"Shamir Secrets Sharing (SSS) is a foundational element of many Multi-Party Computation (MPC) protocols. Although SSS has the ability to handle linear combinations of multiple secrets natively, its ability to handle the multiplication of secrets is limited. In general, the multiplication of secrets requires more participants, due to the increased “degree”. In this paper, we present a verifiable method for handling the multiplication of SSS without increasing its degree. Our method is based on the Gilboa Protocol or its variants, which are built on top of Oblivious Transfer (OT). We also provide a security analysis, demonstrating that the method is secure under the assumption of a malicious adversary security model. As an application use case, we present a new ECDSA threshold signature scheme built on top of our method.","PeriodicalId":255083,"journal":{"name":"2023 7th International Conference on Cryptography, Security and Privacy (CSP)","volume":"44 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128231588","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Cryptomining Traffic Detection Based on BiGRU and Attention Mechanism","authors":"Yijie Huang, Wei Ding, Yuxi Cheng","doi":"10.1109/CSP58884.2023.00013","DOIUrl":"https://doi.org/10.1109/CSP58884.2023.00013","url":null,"abstract":"The increasing popularity of cryptocurrencies has led to a rise in cryptomining attacks, where attackers unauthorizedly use the victim's computer resources to mine digital currency. This brings significant financial losses and security risks to both personal and professional life. Therefore, the detection of cryptomining attacks is of paramount importance. The conventional packet inspection technique is no longer effective due to the use of encryption. Moreover, the prevalent machine learning methods rely heavily on features extracted by professional experience, which is time-consuming. In this paper, we analyze the features of real-world campus cryptomining traffic and propose an end-to-end deep learning model for malicious mining detection. Our model, based on Bidirectional Gate Recurrent Unit (BiGRU) with an attention mechanism, extracts representative features from the raw flow. The results indicate that our approach outperforms benchmark models and previous methods on the large-scale imbalanced dataset, achieving a G-mean value of 0.99 with only 8 packets of a flow.","PeriodicalId":255083,"journal":{"name":"2023 7th International Conference on Cryptography, Security and Privacy (CSP)","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129644842","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"AES 128 Encrypted Image Classification","authors":"A. Irmanova, Martin Lukac","doi":"10.1109/CSP58884.2023.00038","DOIUrl":"https://doi.org/10.1109/CSP58884.2023.00038","url":null,"abstract":"The homomorphic cryptographic operations is an umbrella term for computation performed on encrypted data without explicit decryption. The purpose of these operations is to manipulate encrypted data without having to apply decryption first and therefore minimize the computational overhead, breach of anonymity, privacy and without having to disclose private content. One of the promising prospects of homomorphic cryptography is the data classification using neural networks mounted to the back-planes of computational clouds or IoT sensors. While several approaches already explored the classification of encrypted data on specific ciphers, it is yet not well known how well such tasks can be performed on the state of the art AES encryption which was never designed to be homomorphic. In order to provide some insight on this topic, we investigate three different aspects of the classification of AES encrypted data: end-to-end learning, transfer learning and the ability of learning the cipher in the context of classification. We compare the performance of network models trained using transfer learning with end-to-end trained models on encrypted data. We also evaluate the classification of encrypted images using Invertible Neural Network (INN) as a mean to learn and predict the encryption of the data, as well as to determine if the learned AES can be efficiently learned. Finally using INN, we evaluate the learning and memorization extent of the encryption: we perform cross-data validation on different combinations of MNIST datasets such as handwritten digits, fashion images and handwritten letters.","PeriodicalId":255083,"journal":{"name":"2023 7th International Conference on Cryptography, Security and Privacy (CSP)","volume":"5 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117299459","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A Personal Privacy Risk Assessment Framework Based on Disclosed PII","authors":"Ningning Wu, Robinson Tamilselvan","doi":"10.1109/CSP58884.2023.00021","DOIUrl":"https://doi.org/10.1109/CSP58884.2023.00021","url":null,"abstract":"Protecting personal identifiable information (PII) is essential for privacy and data protection. The leakage of PII can lead to privacy and safety issues like personal embarrassment, workplace discrimination, and identity theft. Driven by privacy laws and regulations, business is becoming more diligent in privacy protection when handling PII. Individual users, on the other hand, are free to produce and share content online that might contain sensitive information. This paper proposed a personal privacy risk assessment framework from the user's perspective. The risk score would help PII owners assess their privacy risks so that they can more actively control their information release and protect their privacy.","PeriodicalId":255083,"journal":{"name":"2023 7th International Conference on Cryptography, Security and Privacy (CSP)","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124153582","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Mission-Oriented Security Framework: An Approach to Embrace Cyber Resilience in Design and Action","authors":"Xinli Xiong, Qian Yao, Qiankun Ren","doi":"10.1109/CSP58884.2023.00016","DOIUrl":"https://doi.org/10.1109/CSP58884.2023.00016","url":null,"abstract":"The rapid development in IT and OT system makes interactions among themselves and with humans immerse in the information flows from the physical to cyberspace. The traditional view of cyber-security faces challenges of deliberate cyber-attacks and unpredictable failures. Hence, cyber resilience is a fundamental property that protects critical missions. In this paper, we presented a mission-oriented security framework to establish and enhance cyber-resilience in design and action. The definition of mission-oriented security is given to extend CIA metrics of cyber-security, and the process of mission executions is analyzed to distinguish the critical factors of cyber-resilience. The cascading failures in inter-domain networks and false data injection in the cyber-physical system are analyzed in the case study to demonstrate how the mission-oriented security framework can enhance cyber resilience.","PeriodicalId":255083,"journal":{"name":"2023 7th International Conference on Cryptography, Security and Privacy (CSP)","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126664856","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A Related Key Attack on the Word-Oriented BeepBeep Stream Cipher","authors":"Zhiyi Liao, Lin Ding, Zheng Wu","doi":"10.1109/CSP58884.2023.00011","DOIUrl":"https://doi.org/10.1109/CSP58884.2023.00011","url":null,"abstract":"The word-oriented BeepBeep stream cipher, developed by Driscoll in FSE 2002, is proposed to provide integrity and confidentiality for embedded systems. There has been no attack on BeepBeep published until now. By exploiting a weakness of the BeepBeep stream cipher during its initialization, this paper presents a key recovery attack on the BeepBeep stream cipher in the related key setting. The attack recovers the 192-bit secret key of BeepBeep with a time complexity of $2^{128}$, requiring two related keys, $2^{32}$ chosen IVs and $2^{33}$ keystream words. This is the first cryptanalytic attack on BeepBeep which is significantly better than the exhaustive key search. The result shows that the BeepBeep stream cipher is vulnerable against the related key attack and can not provide the 192-bit security.","PeriodicalId":255083,"journal":{"name":"2023 7th International Conference on Cryptography, Security and Privacy (CSP)","volume":"18 10","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132334732","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}