2019 IEEE Conference on Application, Information and Network Security (AINS)最新文献

Real-Time Detection System Against Malicious Tools by Monitoring DLL on Client Computers 通过监控客户端计算机上的DLL来实时检测恶意工具

2019 IEEE Conference on Application, Information and Network Security (AINS) Pub Date : 2019-11-01 DOI: 10.1109/AINS47559.2019.8968697

Wataru Matsuda, Mariko Fujimoto, Takuho Mitsunaga

{"title":"Real-Time Detection System Against Malicious Tools by Monitoring DLL on Client Computers","authors":"Wataru Matsuda, Mariko Fujimoto, Takuho Mitsunaga","doi":"10.1109/AINS47559.2019.8968697","DOIUrl":"https://doi.org/10.1109/AINS47559.2019.8968697","url":null,"abstract":"The targeted attacks cause severe damage worldwide. Detecting targeted attacks are challenging because the attack methods are very sophisticated. Network-based solutions such as Firewall, Proxy Server, and Intrusion Detection System (IDS) have been widely used. In addition to this, recently, detection methods for malicious programs by monitoring behavior on the endpoints called Endpoint Detection and Response (EDR) have been proposed. Also, some researchers introduce detection methods using DLLs by analyzing suspicious files on the sandbox, such as Cuckoo. Using Cuckoo is one of the solutions for analyzing files that are already identified as malicious. In this research, we propose a real-time detection method of malicious tools using DLL information collected by System Monitor (Sysmon): a free logging tool provided by Microsoft. The purpose of our method is detecting new malicious processes in the production environment. We focus on DLLs commonly loaded by malicious tools regardless of the environments, then propose “the common DLL lists” for detection. Moreover, we introduce a practical detection method that utilizes Elastic Stack as Security Information and Event Management (SIEM). By using Elastic Stack, DLL information loaded on computers can be uniformly monitored and enables real-time detection by comparing logs with the common DLL lists. We evaluate the effectivity of the proposed method using four free malicious tools introduced by US-CERT: China Chopper, Mimikatz, PowerShell Empire, and HUC Packet Transmitter. As a result, our method detected China Chopper, Mimikatz, PowerShell Empire with 100% accuracy. A few false positive occurred for HUC Packet Transmitter, and false positive rate was 0.55%. We confirmed that the common DLL lists are useful for detecting malicious tools in real-time using Elastic Stack.","PeriodicalId":309381,"journal":{"name":"2019 IEEE Conference on Application, Information and Network Security (AINS)","volume":"60 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124369933","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 4

A Dynamical Behavior Measurement Algorithm for Smart Meter Data: An Analytical Study 智能电表数据动态行为测量算法的分析研究

2019 IEEE Conference on Application, Information and Network Security (AINS) Pub Date : 2019-11-01 DOI: 10.1109/AINS47559.2019.8968701

Abbas M. Al-Ghaili, Hasventhran Baskaran, Z. Ibrahim, Fiza Abdul Rahim, Syazwani Arissa Shah Hairi

{"title":"A Dynamical Behavior Measurement Algorithm for Smart Meter Data: An Analytical Study","authors":"Abbas M. Al-Ghaili, Hasventhran Baskaran, Z. Ibrahim, Fiza Abdul Rahim, Syazwani Arissa Shah Hairi","doi":"10.1109/AINS47559.2019.8968701","DOIUrl":"https://doi.org/10.1109/AINS47559.2019.8968701","url":null,"abstract":"Smart Meter Data (SMD) has been considered by many as sensitive due to many reasons. One of these reasons is the security issue possessed by the SMD. With the raising popularity of the smart meter deployment around the world have raised new issues regarding the security of the SMD. Attacker with malicious intention and equip with certain capability can directly inject a false reading to the actual consumption of the SMD. Because of this reason, the protection and privacy of SMD have become a consideration in many researches. In order to protect and secure SMD, it is very important to understand the pattern of the SMD behavior. The studied from SMD can expose the past event that happened to the actual data as any direct manipulation to the SMD. In order to track any changes to the SMD, this paper has proposed a Dynamical Behavior Measurement Algorithm (DBMA), which involves a number of mathematical operations in order to understand and highlight in graphs the behavior of SMD and the mechanism of numbers’ changing. The obtained results from DBMA would be useful to track the SMD if there is any form of malicious data being injected to the actual SMD thus can help in enhancing the SMD security. An experimental work has been conducted where 43200 samples have been tested and analysed using the proposed DBMA. The analysis evaluation of this work has been presented in this paper.","PeriodicalId":309381,"journal":{"name":"2019 IEEE Conference on Application, Information and Network Security (AINS)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130292211","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Ontology for Reactive Techniques in Digital Forensics 数字取证中反应技术的本体

2019 IEEE Conference on Application, Information and Network Security (AINS) Pub Date : 2019-11-01 DOI: 10.1109/AINS47559.2019.8968696

Dagney Ellison, R. Ikuesan, H. Venter

{"title":"Ontology for Reactive Techniques in Digital Forensics","authors":"Dagney Ellison, R. Ikuesan, H. Venter","doi":"10.1109/AINS47559.2019.8968696","DOIUrl":"https://doi.org/10.1109/AINS47559.2019.8968696","url":null,"abstract":"Techniques applied in response to detrimental digital incidents vary in many respects according to their attributes. Models of techniques exist in current research but are typically restricted to some subset with regards to the discipline of the incident. An enormous collection of techniques is actually available for use. There is no single model representing all these techniques. There is no current categorisation of digital forensics reactive techniques that classify techniques according to the attribute of function and nor is there an attempt to classify techniques in a means that goes beyond a subset. In this paper, an ontology that depicts digital forensic reactive techniques classified by function is presented. The ontology itself contains additional information for each technique useful for merging into a cognate system where the relationship between techniques and other facets of the digital investigative process can be defined. A number of existing techniques were collected and described according to their function – a verb. The function then guided the placement and classification of the techniques in the ontology according to the ontology development process. The ontology contributes to a knowledge base for digital forensics – essentially useful as a resource for the various people operating in the field of digital forensics. The benefit of this that the information can be queried, assumptions can be made explicit, and there is a one-stop-shop for digital forensics reactive techniques with their place in the investigation detailed.","PeriodicalId":309381,"journal":{"name":"2019 IEEE Conference on Application, Information and Network Security (AINS)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128424787","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 12

A policy driven, human oriented information security model: a case study in UAE banking sector 政策驱动、以人为本的信息安全模型:阿联酋银行业的案例研究

2019 IEEE Conference on Application, Information and Network Security (AINS) Pub Date : 2019-11-01 DOI: 10.1109/AINS47559.2019.8968705

Khalid Eisa Haidar Abdalla Alhosani, S. K. A. Khalid, N. Samsudin, Sapiee Jamel, Kamaruddin Malik Bin Mohamad

{"title":"A policy driven, human oriented information security model: a case study in UAE banking sector","authors":"Khalid Eisa Haidar Abdalla Alhosani, S. K. A. Khalid, N. Samsudin, Sapiee Jamel, Kamaruddin Malik Bin Mohamad","doi":"10.1109/AINS47559.2019.8968705","DOIUrl":"https://doi.org/10.1109/AINS47559.2019.8968705","url":null,"abstract":"As companies continue to invest in information security, human weaknesses continue to remain a root cause of data breaches in organisations. Several security models have been proposed in the literature but largely remain ineffective at addressing this human vulnerability. In this paper, a policy-driven, human-oriented information security model is proposed. By adopting an information security policy, organizations set strong foundations on which sound security practices can be disseminated and enforced within the organisation. Instead of viewing human as the source of problem, it is a model that put human as the primary source of effectiveness to implement security policy. In this model, staffs in an organization will collectively secure an organisation from attacks. From existing literature and interviews conducted with selected banks in UAE, three primary factors, namely information security policy awareness, security training, and computer & security technology proficiency have been identified and incorporated into the new security model.","PeriodicalId":309381,"journal":{"name":"2019 IEEE Conference on Application, Information and Network Security (AINS)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130384483","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Adaptive Authentication to determine login attempt penalty from multiple input sources 自适应身份验证以确定来自多个输入源的登录尝试惩罚

2019 IEEE Conference on Application, Information and Network Security (AINS) Pub Date : 2019-11-01 DOI: 10.1109/AINS47559.2019.8968704

N. Daud, G. R. Haron, Dahlia Din

引用次数: 2

Criteria Prioritization in Adaptive Security Activities Selection, ASAS Model using Analytic Network Process, ANP 自适应安全活动选择中的标准优先排序，使用分析网络过程的ASAS模型，ANP

2019 IEEE Conference on Application, Information and Network Security (AINS) Pub Date : 2019-11-01 DOI: 10.1109/AINS47559.2019.8968709

Mazni Mohamed Jakeri, M. Hassan

{"title":"Criteria Prioritization in Adaptive Security Activities Selection, ASAS Model using Analytic Network Process, ANP","authors":"Mazni Mohamed Jakeri, M. Hassan","doi":"10.1109/AINS47559.2019.8968709","DOIUrl":"https://doi.org/10.1109/AINS47559.2019.8968709","url":null,"abstract":"Organizations have proposed the best practices of security activities in software development life cycle as guidance for development team. However, the implementation of the security activities are influenced by criteria which are interdependent to each other and dynamic. Those criteria are experience, skill and knowledge; teams workload; development team size; development timeline; and cost/budget. Therefore, the selection of security activities must be based on the priority of the criteria and adaptive. This paper addresses the adaptive security activities selection model as a multi-criteria decision making (MCDM) issue. Analytic Network Process (ANP) is proposed for weight calculation and criteria prioritization. Hypothetical examples were presented based on hard constraints faced by in-house web-based application development team in two different scenarios. The Decision Maker made the judgement by using the online ASAS model. The results show that experience, skill and knowledge get the highest priority in the first scenario while budget/ cost get the highest priority in the second scenario. These prioritization will be used as a major requirement in security activities selection.","PeriodicalId":309381,"journal":{"name":"2019 IEEE Conference on Application, Information and Network Security (AINS)","volume":"263 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123068516","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Detecting Fake News with Tweets’ Properties 用推特属性检测假新闻

2019 IEEE Conference on Application, Information and Network Security (AINS) Pub Date : 2019-11-01 DOI: 10.1109/AINS47559.2019.8968706

Ning Xin Nyow, Hui Na Chua

{"title":"Detecting Fake News with Tweets’ Properties","authors":"Ning Xin Nyow, Hui Na Chua","doi":"10.1109/AINS47559.2019.8968706","DOIUrl":"https://doi.org/10.1109/AINS47559.2019.8968706","url":null,"abstract":"Social media has replaced the traditional media and become one of the main platforms for spreading news [1]. News on social media tends to travel faster and easier than traditional news sources due to the internet accessibility and convenience. However, not all the news published on social media are genuine and/or came from unverified sources. False information can be created and spread easily through social media and this false news can potentially or deliberately mislead or misinform readers. The extensive spread of fake news brings negative impact to not only individual but also society [2]. Consequently, fake news may affect how readers perceive an online news on social media and indirectly mislead the way they respond to real news [2] [11]. Though there are some existing manual fact-checking websites developed to examine if a news is authentic, it does not scale with the volume of the fast spread online information, especially on social media. To overcome this problem, there are automated fact-checking applications were developed to tackle the need for automation and scalability. However, the existing application approaches lack an inclusive dataset with derived multi-dimension information for detecting fake news characteristics to achieve higher accuracy of machine learning classification model performance. To solve this limitation, we derived and transformed social media Twitter’s data to identify additional significant attributes that influence the accuracy of machine learning methods to classify if a news is real or fake using data mining approach. In this paper, we present the mechanisms of identifying the significant Tweets’ attributes and application architecture to systematically automate the classification of an online news.","PeriodicalId":309381,"journal":{"name":"2019 IEEE Conference on Application, Information and Network Security (AINS)","volume":"50 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129812883","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 27

Detecting attacks leveraging vulnerabilities fixed in MS17-010 from Event Log 从事件日志中检测利用MS17-010修复的漏洞的攻击

2019 IEEE Conference on Application, Information and Network Security (AINS) Pub Date : 2019-11-01 DOI: 10.1109/AINS47559.2019.8968703

Mariko Fujimoto, Wataru Matsuda, Takuho Mitsunaga

{"title":"Detecting attacks leveraging vulnerabilities fixed in MS17-010 from Event Log","authors":"Mariko Fujimoto, Wataru Matsuda, Takuho Mitsunaga","doi":"10.1109/AINS47559.2019.8968703","DOIUrl":"https://doi.org/10.1109/AINS47559.2019.8968703","url":null,"abstract":"Many organizations have experienced the damages of cyberattacks leveraging Windows vulnerabilities. Unpatched Windows have been used still now, especially in Industrial Control System (ICS) for operational reasons. In that case, attackers likely abuse them to expand infection. Especially vulnerabilities fixed in MS17-010 has been leveraged for spreading infection of malware such as the WannaCry ransomware and other malware for targeted attacks. Many systems (e.g., electric noticeboard, payment terminal, car production line) around the world were exploited by leveraging Windows vulnerabilities, leading to system failures of a variety of critical infrastructure. Attackers can easily exploit the vulnerabilities since convenient tools for attacking such as ”EternalBlue” or ”Eternal Romance” are published on the Internet. This tool abuses legitimate processes running on Windows systems. Thus operators may hardly notice the trace of attacks. Attacks leveraging vulnerabilities can be mitigated by applying security updates; however, sometimes applying security updates is difficult because of its long-term life cycle and a severe requirement for availability. There are several methods for detecting attacks leveraging vulnerabilities such as the Intrusion Detection System (IDS), but sometimes it is difficult to implement since it needs to alter the existing system structure. In this research, we propose a method for detecting attacks leveraging the vulnerabilities fixed in MS17-010 by analyzing Window’s built-in Event Logs. The proposed method can detect attacks against almost all supported versions of Windows. Furthermore, it can be easily integrated into a production environment since it only uses Windows standard functions.","PeriodicalId":309381,"journal":{"name":"2019 IEEE Conference on Application, Information and Network Security (AINS)","volume":"179 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124460590","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Quality Challenges in Internet of Things-based Services Implementation: An Exploratory Study 物联网服务实施中的质量挑战:探索性研究

2019 IEEE Conference on Application, Information and Network Security (AINS) Pub Date : 2019-11-01 DOI: 10.1109/AINS47559.2019.8968702

Norliza Sidek, Nor'ashikin Ali

{"title":"Quality Challenges in Internet of Things-based Services Implementation: An Exploratory Study","authors":"Norliza Sidek, Nor'ashikin Ali","doi":"10.1109/AINS47559.2019.8968702","DOIUrl":"https://doi.org/10.1109/AINS47559.2019.8968702","url":null,"abstract":"The real value of using Internet of Things-based services (IoTbS) comes from the establishments of services through effective utilization of technologies. However, during the implementation of IoTbS, Government Agencies (GA) are expected to overcome several challenges in dealing with employees who are reluctant to use the technology due to poor security system and overall quality. The primary aim of this research is to discover the quality factors that influence the successful use of IoTbS in Malaysian GA. Using the qualitative approach, the exploration has been made through a systematic literature review and a semi-structured interview with Government IoT Experts. The data have been analysed using Deductive Qualitative Analysis and coded using NVivo12 software. Primary data has discovered 23 quality factors that can be categorised under ‘Information System Quality’ themes. The paper analyses these quality factors in detail and proposes a set of recommendations to overcome the challenges in order to ensure a successful implementation of IoTbS in GA. Accordingly, the paper proposes on how these quality factors could be overcome while making a worthwhile contribution to both theories and practices. In the future, these quality factors can be analysed on its suitability as a set of IoTbS implementation criteria towards the successful use of IoTbS in GA.","PeriodicalId":309381,"journal":{"name":"2019 IEEE Conference on Application, Information and Network Security (AINS)","volume":"37 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124963924","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Detecting Centralized Architecture-Based Botnets using Travelling Salesperson Non-Deterministic Polynomial-Hard problem-TSP-NP Technique 基于移动销售员非确定性多项式难题tsp - np技术的集中式僵尸网络检测

2019 IEEE Conference on Application, Information and Network Security (AINS) Pub Date : 2019-11-01 DOI: 10.1109/AINS47559.2019.8968710

V. Kebande, Nickson M. Karie, A. Ikuesan, A. Al-Ghushami, H. Venter

{"title":"Detecting Centralized Architecture-Based Botnets using Travelling Salesperson Non-Deterministic Polynomial-Hard problem-TSP-NP Technique","authors":"V. Kebande, Nickson M. Karie, A. Ikuesan, A. Al-Ghushami, H. Venter","doi":"10.1109/AINS47559.2019.8968710","DOIUrl":"https://doi.org/10.1109/AINS47559.2019.8968710","url":null,"abstract":"The threats posed by botnets in the cyber-space continues to grow each day and it has become very hard to detect or infiltrate bots given that the botnet developers each day keep changing the propagation and attack techniques. Currently, most of these attacks have been centered on stealing computing energy, theft of personal information and Distributed Denial of Service (DDoS attacks). In this paper, the authors propose a novel technique that uses the Non-Deterministic Polynomial-Time Hardness (NP-Hard Problem) based on the Traveling Salesperson Person (TSP) that depicts that a given bot, bj, is able to visit each host on a network environment, NE, and then it returns to the botmaster in form of instruction(command) through optimal minimization of the hosts that are or may be attacked. Given that bj represents a piece of malicious code and based on TSP-NP Hard Problem which forms part of combinatorial optimization, the authors present an effective approach for the detection of the botnet. It is worth noting that the concentration of this study is basically on the centralized botnet architecture. This holistic approach shows that botnet detection accuracy can be increased with a degree of certainty and potentially decrease the chances of false positives. Nevertheless, a discussion on the possible applicability and implementation has also been given in this paper.","PeriodicalId":309381,"journal":{"name":"2019 IEEE Conference on Application, Information and Network Security (AINS)","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129728105","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1