2013 9th International Conference on Information Assurance and Security (IAS)最新文献

Quantitative penetration testing with item response theory 基于项目反应理论的定量渗透测试

2013 9th International Conference on Information Assurance and Security (IAS) Pub Date : 2013-12-06 DOI: 10.1109/ISIAS.2013.6947732

F. Arnold, W. Pieters, M. Stoelinga

{"title":"Quantitative penetration testing with item response theory","authors":"F. Arnold, W. Pieters, M. Stoelinga","doi":"10.1109/ISIAS.2013.6947732","DOIUrl":"https://doi.org/10.1109/ISIAS.2013.6947732","url":null,"abstract":"Existing penetration testing approaches assess the vulnerability of a system by determining whether certain attack paths are possible in practice. Thus, penetration testing has so far been used as a qualitative research method. To enable quantitative approaches to security risk management, including decision support based on the cost-effectiveness of countermeasures, one needs quantitative measures of the feasibility of an attack. Also, when physical or social attack steps are involved, the binary view on whether a vulnerability is present or not is insufficient, and one needs some viability metric. When penetration tests are performed anyway, it is very easy for the testers to keep track of, for example, the time they spend on each attack step. Therefore, this paper proposes the concept of quantitative penetration testing to determine the difficulty rather than the possibility of attacks based on such measurements. We do this by step-wise updates of expected time and probability of success for all steps in an attack scenario. In addition, we show how the skill of the testers can be included to improve the accuracy of the metrics, based on the framework of item response theory (Elo ratings). We prove the feasibility of the approach by means of simulations, and discuss application possibilities.","PeriodicalId":370107,"journal":{"name":"2013 9th International Conference on Information Assurance and Security (IAS)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-12-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130637920","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 9

Hierarchical object log format for normalisation of security events 用于安全事件规范化的分层对象日志格式

2013 9th International Conference on Information Assurance and Security (IAS) Pub Date : 2013-12-01 DOI: 10.1109/ISIAS.2013.6947748

Andrey Sapegin, David Jaeger, Amir Azodi, Marian Gawron, Feng Cheng, C. Meinel

引用次数: 30

A wavelet network speech recognition system to control an augmented reality object 一种控制增强现实对象的小波网络语音识别系统

2013 9th International Conference on Information Assurance and Security (IAS) Pub Date : 2013-12-01 DOI: 10.1109/ISIAS.2013.6947744

Dhekra Bousnina, R. Ejbali, M. Zaied, C. Amar

引用次数: 3

Flexibility vs. security in linked enterprise data access control graphs 链接企业数据访问控制图中的灵活性与安全性

2013 9th International Conference on Information Assurance and Security (IAS) Pub Date : 2013-12-01 DOI: 10.1109/ISIAS.2013.6947746

Markus Graube, P. Órtiz, M. Carnerero, Ó. Lázaro, Mikel Uriarte, L. Urbas

{"title":"Flexibility vs. security in linked enterprise data access control graphs","authors":"Markus Graube, P. Órtiz, M. Carnerero, Ó. Lázaro, Mikel Uriarte, L. Urbas","doi":"10.1109/ISIAS.2013.6947746","DOIUrl":"https://doi.org/10.1109/ISIAS.2013.6947746","url":null,"abstract":"Linked Data offers easy extensibility and interoperability of information spaces. This provides a great potential for industrial companies allowing to share information with partners in a virtual enterprise. Hence, together they can become faster and more flexible which results in an advantage in the market. However, there is still the barrier to protect own information with a fine grain. Access control graphs are an approach for this issue. Information is put into different views by executing infer mechanisms on role-based policy rules. Afterwards queries are automatically rewritten at runtime in order to match the generated views and provide only data from views that should be accessible by the authenticated role. This paper demonstrates the balance between flexibility and security using this approach. The amount and complexity of the policy rules are highly dependent on the information model used. However, a moderate restriction of the huge flexibility in the information modelling allows for few rules but those are powerful ones. Additionally, the approach allows can also be leveraged for consistency checking of Linked Data data structures. Thus, clients can rely on these information invariants and the information provider can rely on the fact that fine grained access is granted.","PeriodicalId":370107,"journal":{"name":"2013 9th International Conference on Information Assurance and Security (IAS)","volume":"64 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129827607","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

How to grant less permissions to facebook applications 如何向facebook应用程序授予更少的权限

2013 9th International Conference on Information Assurance and Security (IAS) Pub Date : 2013-12-01 DOI: 10.1109/ISIAS.2013.6947733

Gianpiero Costantino, F. Martinelli, D. Sgandurra

引用次数: 2

Finger verification Using SVD features 使用SVD特征的手指验证

2013 9th International Conference on Information Assurance and Security (IAS) Pub Date : 2013-12-01 DOI: 10.1109/ISIAS.2013.6947728

A. Balti, M. Sayadi, F. Fnaiech

引用次数: 1

Developing ECC applications in Java Card 在Java Card中开发ECC应用程序

2013 9th International Conference on Information Assurance and Security (IAS) Pub Date : 2013-12-01 DOI: 10.1109/ISIAS.2013.6947743

V. G. Martínez, L. H. Encinas

引用次数: 2

Enhanced P2P botnets detection framework architecture with hybrid analyzer: Host-based and network-based 基于混合分析器的增强P2P僵尸网络检测框架架构:基于主机和基于网络

2013 9th International Conference on Information Assurance and Security (IAS) Pub Date : 2013-12-01 DOI: 10.1109/ISIAS.2013.6947736

R. Abdullah, M. Faizal, Z. Noh, S. R. Selamat, M. Z. Mas'ud, S. Shahrin

{"title":"Enhanced P2P botnets detection framework architecture with hybrid analyzer: Host-based and network-based","authors":"R. Abdullah, M. Faizal, Z. Noh, S. R. Selamat, M. Z. Mas'ud, S. Shahrin","doi":"10.1109/ISIAS.2013.6947736","DOIUrl":"https://doi.org/10.1109/ISIAS.2013.6947736","url":null,"abstract":"Nowadays, botnets are the most advanced cybercrime as being powerful threaten to the internet infrastructure by risking the Internet stability and security. Millions of computers have been hijacking and infecting by botnets especially during peak activity. The P2P botnets exploit users and dominating the P2P technology which make botnets are harder to detect and terminated. As P2P botnets issues been highlighted as it's dramatically evolvement, this paper addresses on current problems relate to P2P botnets faced by users and recommending the improvement. Also, this paper concentrated on proposing P2P botnets detection framework. Also, an in-depth analysis of P2P botnets has been conducted to understand and cope with their behaviors and characteristics. The new improvement has been introduced at the propose botnets framework architecture to improve the effectiveness of P2P detection analysis. The framework architecture has been structuralized with hybrid analyzer through the marriage of host-based and network based. Prior to this matter, this research has proposed a new enhancement on framework architecture that has been reinforced by hybrid detection technique to improve the effectiveness and efficiency of P2P botnets detection.","PeriodicalId":370107,"journal":{"name":"2013 9th International Conference on Information Assurance and Security (IAS)","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125146567","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Trusted integration of cloud-based NFC transaction players 基于云的NFC交易播放器的可信集成

2013 9th International Conference on Information Assurance and Security (IAS) Pub Date : 2013-12-01 DOI: 10.1109/ISIAS.2013.6947745

Pardis Pourghomi, M. Saeed, G. Ghinea

{"title":"Trusted integration of cloud-based NFC transaction players","authors":"Pardis Pourghomi, M. Saeed, G. Ghinea","doi":"10.1109/ISIAS.2013.6947745","DOIUrl":"https://doi.org/10.1109/ISIAS.2013.6947745","url":null,"abstract":"Near Field Communication (NFC) is a short range wireless technology that provides contactless transmission of data between devices. With an NFC enabled device, users can exchange information from one device to another, make payments and use their NFC enabled device as their identity. As the main payment ecosystem players such as service providers and secure element issuers have crucial roles in a multi-application mobile environment similar to NFC, managing such an environment has become very challenging. One of the technologies that can be used to ensure secure NFC transaction is cloud computing which offers wide range of advantages compare to the use of a Secure Element (SE) as a single entity in an NFC enabled phone. This approach provides a comprehensive leadership of the cloud provider towards managing and controlling customer's information where it allows the SE which is stored within an NFC phone to deal with authentication mechanisms rather than storing and managing sensitive transaction information. This paper discusses the NFC cloud Wallet model which has been proposed by us previously [1] and introduces a different insight that defines a new integrated framework based on a trusted relationship between the vendor and the Mobile Network Operator (MNO). We then carry out an analysis of such a relationship to investigate different possibilities that arise from this approach.","PeriodicalId":370107,"journal":{"name":"2013 9th International Conference on Information Assurance and Security (IAS)","volume":"55 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128376920","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

The state of the art of risk assessment and management for information systems 信息系统风险评估和管理的现状

2013 9th International Conference on Information Assurance and Security (IAS) Pub Date : 2013-12-01 DOI: 10.1109/ISIAS.2013.6947735

Lulu Liang, Wang Ren, Jing Song, Huaming Hu, Qiang He, Shuo Fang

引用次数: 8