{"title":"Engineering secure software by modelling privacy and security requirements","authors":"M. N. Kreeger, I. Duncan","doi":"10.1109/CCST.2005.1594820","DOIUrl":"https://doi.org/10.1109/CCST.2005.1594820","url":null,"abstract":"Requirements are individual statements, usually expressed in a form of natural language, specifying the behaviour and constraints of a proposed system. Due to the intrinsic value of correct requirements, it is therefore essential for the process to be implemented correctly and that the requirements themselves reflect the true needs of the proposed system. The majority of developed systems introduce the concerns of privacy and security, however, traditional requirements engineering techniques have not addressed these issues appropriately. Further, the concepts of privacy, security, and the interrelated concept of trust, have not been accurately defined in terms of requirements engineering. Natural language is shown to be the most prevalent form of knowledge used to represent requirements, however, natural language introduces a number of inherent problems which can lead to ambiguity and specifications open to interpretation. When reasoning with privacy and security concerns the resulting specification should be both clear and concise in the stipulation of requirements. Therefore, before attempting to model privacy and security at the requirements engineering level, it is essential to have an understanding and appreciation of the issues involved. Consideration is given to the various concerns that would effect methodology development and once assessed a possible approach to modelling privacy and security requirements is highlighted.","PeriodicalId":411051,"journal":{"name":"Proceedings 39th Annual 2005 International Carnahan Conference on Security Technology","volume":"62 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121269186","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Security challenges for the next generation of highly available systems","authors":"S. Naqvi, M. Riguidel","doi":"10.1109/CCST.2005.1594840","DOIUrl":"https://doi.org/10.1109/CCST.2005.1594840","url":null,"abstract":"Nowadays, highly available (HA) systems are a must, for almost any business process. More recently, the need for HA systems have increased as electronic commerce and other internet-based applications have become widely used with the growing Web usage. Security is a major concern for these systems. Companies want to make sure that their security systems are working flawlessly and efficiently. Making sure that these systems are available to allow the right people access to the right areas of the company is imperative. Traditionally, HA systems consist of proprietary hardware and software components. However, the price/performance advantages of commercial-off-the-shelf (COTS) based clusters have had a compelling affect on HA vendors and their marketplace. The emergence of computational grids makes it feasible to develop cost-effective, large-scale geographically distributed HA systems. Making sure that critical applications on this new generation of HA systems are secured is a challenging proposition. In this article, we have identified a list of challenges for the next generation of grid-based HA systems. We have explored the visualization of security services with their pluggable implementation to address the security needs of these grid-based HA systems. The main advantages of this solution include independence with respect to the underlying security mechanisms; best trade-off between security guarantees and processing capabilities; configurability of security architecture; better portability across heterogeneous platforms; and a smaller application development cycle for the HA functionality in the system.","PeriodicalId":411051,"journal":{"name":"Proceedings 39th Annual 2005 International Carnahan Conference on Security Technology","volume":"100 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121468107","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Various viewpoints analysis of the actual and large-scale data by using the data mining technique","authors":"K. Tamura, K. Matsuura, H. Imai","doi":"10.1109/CCST.2005.1594821","DOIUrl":"https://doi.org/10.1109/CCST.2005.1594821","url":null,"abstract":"Many indiscriminate attacks represented by various computer worms happen on the Internet. These attacks, however, are not targeting at specific group of computers but all computers in the Internet. The administrator always has to grasp all activities on the Net, which is possible to take effective countermeasures against malicious activities by utilizing the logged data of IDS (intrusion detection system). So, we analyze the reliable data collected by the National Police Agency (NPA) of Japan with data mining approaches, and extract a flow of attacks with a measure of both appearance and confidence probability. Additionally, we dig deeper into the data by focusing on the difference of granularity of the Internet domains to which source hosts belong. We expect that the administrator can possess the preliminary knowledge required for defending against a possible attacks based on our results","PeriodicalId":411051,"journal":{"name":"Proceedings 39th Annual 2005 International Carnahan Conference on Security Technology","volume":"96 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127129381","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"An evaluation of fingerprint image quality across an elderly population vis-a-vis an 18-25 year old population","authors":"N. Sickler, S. Elliott","doi":"10.1109/CCST.2005.1594817","DOIUrl":"https://doi.org/10.1109/CCST.2005.1594817","url":null,"abstract":"This study evaluated fingerprint quality across two populations, elderly and young, in order to assess age and moisture as potential factors affecting utility image quality. Specifically, the examination of these variables was conducted on a population over the age of 62, and a population between the ages of 18 and 25, using two fingerprint recognition devices (capacitance and optical). Collected individual variables included: age, gender, ethnic background, handedness, moisture content of each index finger, occupation(s), subject's use of hand moisturizer, and prior usage of fingerprint devices. Computed performance measures included failure to enroll, and quality scores. The results indicated there was statistically significant evidence that both age and moisture affected effectiveness image quality of each index finger at /spl alpha/=0.01 on the optical device, and there was statistically significant evidence that age affected effectiveness image quality of each index finger on the capacitance device, but moisture was only significant for the right index finger at /spl alpha/=0.01.","PeriodicalId":411051,"journal":{"name":"Proceedings 39th Annual 2005 International Carnahan Conference on Security Technology","volume":"117 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127588094","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"The application of bioinformatics to network intrusion detection","authors":"K. Takeda","doi":"10.1109/CCST.2005.1594860","DOIUrl":"https://doi.org/10.1109/CCST.2005.1594860","url":null,"abstract":"In this paper, a novel approach that applies bioinformatics algorithms to network intrusion detection is proposed. Network intrusion detection is the problem to detect security violations on or through a network. Misuse detection approach of network intrusion detection which is widely deployed on today's network environment requires precise signature data and occasionally fails to detect variants of known attacks or new types of attack.","PeriodicalId":411051,"journal":{"name":"Proceedings 39th Annual 2005 International Carnahan Conference on Security Technology","volume":"32 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117353220","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Subjective image quality evaluation in security imaging systems","authors":"M. Klima, P. Páta, K. Fliegel, P. Hanzlik","doi":"10.1109/CCST.2005.1594824","DOIUrl":"https://doi.org/10.1109/CCST.2005.1594824","url":null,"abstract":"The subjective image quality of image or video information is a crucial item in security imaging systems. During last five years our lab has tested and verified various approaches to the image compression for security purposes and the evaluation of subjective image quality. In the paper, we have discussed selected important facts related to the subjective image quality evaluation and we have presented some anomalous experimental behavior of image compression techniques. An object-defined approach is investigated and advantageous characteristics of chosen methods are deployed to achieve the optimal performance of the surveillance video coder. Among others, we propose to use the artificial neural network (ANN) to predict resulting image quality rating scores. The proposed quality assessment model has been trained and tested using a set of grayscale images distorted by selected image compression algorithms.","PeriodicalId":411051,"journal":{"name":"Proceedings 39th Annual 2005 International Carnahan Conference on Security Technology","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131228750","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Growth of high quality bulk cadmium telluride crystals for use in X-ray and gamma-ray sensors","authors":"B. Cantwell, A. Basu, A. Brinkman, M. Robinson","doi":"10.1109/CCST.2005.1594885","DOIUrl":"https://doi.org/10.1109/CCST.2005.1594885","url":null,"abstract":"Despite its intrinsic advantages as a sensor material for the detection of gamma and X radiation, CdTe has proved a difficult material to produce consistently and in sufficient quantities. We report further developments of a vapour phase technique, which has provided significant advantages over current melt growth technologies. Crystals of up to 50 mm in diameter have been produced with increased growth rates up to 12 mm/day.","PeriodicalId":411051,"journal":{"name":"Proceedings 39th Annual 2005 International Carnahan Conference on Security Technology","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114061515","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A hierarchical access control scheme in ad-hoc wireless networks","authors":"C. Hernández-Goya, P. Caballero-Gil","doi":"10.1109/CCST.2005.1594870","DOIUrl":"https://doi.org/10.1109/CCST.2005.1594870","url":null,"abstract":"The restrictions of resources present in the environment of mobile ad hoc networks (MANETs) have forced the adaptation of the existing tools for guaranteeing security basic services in this new framework. The set of restrictions associated to computational, communication and power supply resources is the main barrier when providing them with security mechanisms. The solutions outlined so far for authentication based on classical tools have result non satisfactory for this setting. That is why examining the possibility of using advanced protocols should be explored. Following this trend, a new authentication protocol specifically designed for this setting is proposed in this work. A hard on average problem and an NP-complete one, belonging both to graph theory, are combined in order to design simultaneously an admission control protocol (ACP) and a node authentication protocol (NAP) using identification schemes belonging to the set of zero-knowledge interactive proofs (ZKIP). Using this technique is a way to avoid the nuisances derived from the utilization of PKT.","PeriodicalId":411051,"journal":{"name":"Proceedings 39th Annual 2005 International Carnahan Conference on Security Technology","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122088542","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Enhancing interoperability of security operation center to heterogeneous intrusion detection systems","authors":"A. C. Lin, Hsing-Kuo Wong, Tzong-Chen Wu","doi":"10.1109/CCST.2005.1594841","DOIUrl":"https://doi.org/10.1109/CCST.2005.1594841","url":null,"abstract":"This study aimed at enhancing the interoperability of a SOC (security operation center) to heterogeneous IDSes (intrusion detection systems) by designing a few EDMEF (intrusion detection message exchange format) templates. The adopted approach based on the specification of IDMEF and the need of incident detection. The resulted templates have two types that are for use of most usual alerts and aggregation of similar alerts respectively. The objectives of these templates are to simplify the usage of IDMEF and to improve the disadvantages originating from un-customized IDMEF. The results support the objectives of this study.","PeriodicalId":411051,"journal":{"name":"Proceedings 39th Annual 2005 International Carnahan Conference on Security Technology","volume":"43 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121293415","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Authentication services and biometrics: network security issues","authors":"O.S. Benavente, R. Piccio-Marchetti","doi":"10.1109/CCST.2005.1594871","DOIUrl":"https://doi.org/10.1109/CCST.2005.1594871","url":null,"abstract":"The Internet is increasingly becoming a public vehicle for remote operations. Integrating biometric information in the authentication chain exposes new problems. Remote virtual identity is starting to play in the way towards an eEurope, and applications for e-government integrate biometrics. Remote identity of subjects should be unambiguously stated. Several features drive the spread of biometric authentication in network applications, in order to provide end-to-end security across the authentication chain aliveness detection and fake-resistive methods, network protocols, security infrastructure, integration of biometrics and public key infrastructure (PKI), etc. This paper proposes a mid-layer interoperable architecture furnished with a set of generic interfaces and protocol definitions. This scheme enables a future introduction of new modules and applications with a minimal development effort.","PeriodicalId":411051,"journal":{"name":"Proceedings 39th Annual 2005 International Carnahan Conference on Security Technology","volume":"163 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124538577","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}