International Journal of Information Security最新文献_第6页

Evaluating the merits and constraints of cryptography-steganography fusion: a systematic analysis 评估密码学与加密学融合的优点和制约因素：系统分析

IF 3.2 4区计算机科学

International Journal of Information Security Pub Date : 2024-05-05 DOI: 10.1007/s10207-024-00853-9

Indy Haverkamp, Dipti K. Sarmah

{"title":"Evaluating the merits and constraints of cryptography-steganography fusion: a systematic analysis","authors":"Indy Haverkamp, Dipti K. Sarmah","doi":"10.1007/s10207-024-00853-9","DOIUrl":"https://doi.org/10.1007/s10207-024-00853-9","url":null,"abstract":"In today's interconnected world, safeguarding digital data's confidentiality and security is crucial. Cryptography and steganography are two primary methods used for information security. While these methods have diverse applications, there is ongoing exploration into the potential benefits of merging them. This review focuses on journal articles from 2010 onwards and conference papers from 2018 onwards that integrate steganography and cryptography in practical applications. The results are gathered through different databases like Scopus, IEEE, and Web of Science. Our approach involves gaining insights into real-world applications explored in the existing literature and categorizing them based on domains and technological areas. Furthermore, we comprehensively analyze the advantages and limitations associated with these implementations, examining them from three evaluation perspectives: security, performance, and user experience. This categorization offers guidance for future research in unexplored areas, while the evaluation perspectives provide essential considerations for analyzing real-world implementations.","PeriodicalId":50316,"journal":{"name":"International Journal of Information Security","volume":"17 1","pages":""},"PeriodicalIF":3.2,"publicationDate":"2024-05-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140887843","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A cyber defense system against phishing attacks with deep learning game theory and LSTM-CNN with African vulture optimization algorithm (AVOA) 利用深度学习博弈论和带有非洲秃鹫优化算法（AVOA）的 LSTM-CNN 对抗网络钓鱼攻击的网络防御系统

IF 3.2 4区计算机科学

International Journal of Information Security Pub Date : 2024-05-05 DOI: 10.1007/s10207-024-00851-x

Mustafa Ahmed Elberri, Ümit Tokeşer, Javad Rahebi, Jose Manuel Lopez-Guede

引用次数: 0

Optimized common features selection and deep-autoencoder (OCFSDA) for lightweight intrusion detection in Internet of things 用于物联网轻量级入侵检测的优化通用特征选择和深度自动编码器（OCFSDA）

IF 3.2 4区计算机科学

International Journal of Information Security Pub Date : 2024-04-30 DOI: 10.1007/s10207-024-00855-7

Uneneibotejit Otokwala, Andrei Petrovski, Harsha Kalutarage

{"title":"Optimized common features selection and deep-autoencoder (OCFSDA) for lightweight intrusion detection in Internet of things","authors":"Uneneibotejit Otokwala, Andrei Petrovski, Harsha Kalutarage","doi":"10.1007/s10207-024-00855-7","DOIUrl":"https://doi.org/10.1007/s10207-024-00855-7","url":null,"abstract":"Embedded systems, including the Internet of things (IoT), play a crucial role in the functioning of critical infrastructure. However, these devices face significant challenges such as memory footprint, technical challenges, privacy concerns, performance trade-offs and vulnerability to cyber-attacks. One approach to address these concerns is minimising computational overhead and adopting lightweight intrusion detection techniques. In this study, we propose a highly efficient model called optimized common features selection and deep-autoencoder (OCFSDA) for lightweight intrusion detection in IoT environments. The proposed OCFSDA model incorporates feature selection, data compression, pruning, and deparameterization. We deployed the model on a Raspberry Pi4 using the TFLite interpreter by leveraging optimisation and inferencing with semi-supervised learning. Using the MQTT-IoT-IDS2020 and CIC-IDS2017 datasets, our experimental results demonstrate a remarkable reduction in the computation cost in terms of time and memory use. Notably, the model achieved an overall average accuracies of 99% and 97%, along with comparable performance on other important metrics such as precision, recall, and F1-score. Moreover, the model accomplished the classification tasks within 0.30 and 0.12 s using only 2KB of memory.","PeriodicalId":50316,"journal":{"name":"International Journal of Information Security","volume":"85 1","pages":""},"PeriodicalIF":3.2,"publicationDate":"2024-04-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140835179","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Unmasking the common traits: an ensemble approach for effective malware detection 揭示共同特征：有效检测恶意软件的集合方法

IF 3.2 4区计算机科学

International Journal of Information Security Pub Date : 2024-04-30 DOI: 10.1007/s10207-024-00854-8

Parthajit Borah, Upasana Sarmah, D. K. Bhattacharyya, J. K. Kalita

引用次数: 0

C2-Eye: framework for detecting command and control (C2) connection of supply chain attacks C2-Eye：检测供应链攻击的指挥与控制（C2）连接的框架

IF 3.2 4区计算机科学

International Journal of Information Security Pub Date : 2024-04-29 DOI: 10.1007/s10207-024-00850-y

Raja Zeeshan Haider, Baber Aslam, Haider Abbas, Zafar Iqbal

{"title":"C2-Eye: framework for detecting command and control (C2) connection of supply chain attacks","authors":"Raja Zeeshan Haider, Baber Aslam, Haider Abbas, Zafar Iqbal","doi":"10.1007/s10207-024-00850-y","DOIUrl":"https://doi.org/10.1007/s10207-024-00850-y","url":null,"abstract":"Supply chain attacks are potent cyber attacks for widespread ramifications by compromising supply chains. Supply chain attacks are difficult to detect as the malware is installed through trustworthy supply chains, missing signs of infection and making deployed security controls ineffective. Recent increases in supply chain attacks warrant a Zero-trust model and innovative solutions for detecting supply chain attacks. Supply chain malware need to establish a Command and Control (C2) connection as a communication link with the attacker to proceed on the privileged pathway. Discovery of the C2 channel between the attacker and supply chain malware can lead to detection of the attack. The most promising technique for detecting supply chain attacks is monitoring host-based indicators and correlating these with associated network activity for early discovery of C2 connection. Proposed framework has introduced a novel approach of detecting C2 over DNS by incorporating host-based activity with corresponding network activity coupled with threat intelligence. C2-Eye integrates process-specific host-based features, correlated network activity, DNS metadata, DNS semantic analysis, and real time threat intelligence from publicly available resources for detecting C2 of supply chain attacks. Besides, C2-Eye monitors the exploitation of C2 channel for probable data exfiltration. C2-Eye has introduced a distinctive featureset with 22 novel features specific to supply chain attack, enabling detection of the attack with F1-score of 98.70%.","PeriodicalId":50316,"journal":{"name":"International Journal of Information Security","volume":"32 1","pages":""},"PeriodicalIF":3.2,"publicationDate":"2024-04-29","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140810703","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Perceptions of organizational responsibility for cybersecurity in Saudi Arabia: a moderated mediation analysis 沙特阿拉伯对组织网络安全责任的看法：调节性中介分析

IF 3.2 4区计算机科学

International Journal of Information Security Pub Date : 2024-04-26 DOI: 10.1007/s10207-024-00859-3

Ahmed M. Asfahani

{"title":"Perceptions of organizational responsibility for cybersecurity in Saudi Arabia: a moderated mediation analysis","authors":"Ahmed M. Asfahani","doi":"10.1007/s10207-024-00859-3","DOIUrl":"https://doi.org/10.1007/s10207-024-00859-3","url":null,"abstract":"The study aims to explore the crucial interaction between organizational responsibility and employee behavior in cybersecurity, particularly in the distinct setting of Saudi Arabia. It investigates how organizational responsibility perceptions impact employee attitudes and practices towards cybersecurity. The research utilizes a mixed theoretical framework, incorporating stewardship theory, protection motivation theory, and the theory of planned behavior. It examines the intricate link between organizational leadership, policies, and individual responses to cybersecurity threats through a comprehensive survey conducted among Saudi employees. The study discovers that employees’ perceptions of organizational responsibility greatly influence their cybersecurity behavior. It also finds that employee attitudes towards cybersecurity act as a mediator in this relationship. Contrary to expectations, personal experiences with cybersecurity incidents do not significantly moderate these relationships. This underlines the complex and culture-specific nature of cybersecurity compliance in organizational contexts. This research uniquely contributes to the understanding of cybersecurity behavior within organizations, particularly highlighting the need for policies that align with both organizational objectives and individual behaviors in culturally specific environments like Saudi Arabia. It offers novel insights into the less pronounced impact of personal cybersecurity experiences on organizational-employee dynamics in cybersecurity compliance.","PeriodicalId":50316,"journal":{"name":"International Journal of Information Security","volume":"12 1","pages":""},"PeriodicalIF":3.2,"publicationDate":"2024-04-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140799558","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

An online intrusion detection method for industrial control systems based on extended belief rule base 基于扩展信念规则库的工业控制系统在线入侵检测方法

IF 3.2 4区计算机科学

International Journal of Information Security Pub Date : 2024-04-26 DOI: 10.1007/s10207-024-00845-9

Guangyu Qian, Jinyuan Li, Wei He, Wei Zhang, You Cao

{"title":"An online intrusion detection method for industrial control systems based on extended belief rule base","authors":"Guangyu Qian, Jinyuan Li, Wei He, Wei Zhang, You Cao","doi":"10.1007/s10207-024-00845-9","DOIUrl":"https://doi.org/10.1007/s10207-024-00845-9","url":null,"abstract":"Intrusion detection in industrial control systems (ICS) is crucial for maintaining the security of physical information systems. However, the existing models predominantly rely on black-box approaches, which exhibit limitations in result credibility and the ability to adapt to complex and dynamic environments. Consequently, this paper proposes an online updatable extended belief rule base model (O-EBRB) for intrusion detection in ICS. Firstly, an industrial intrusion detection model rooted in the extended belief rule base (EBRB) is established. This model excels in concurrently processing both quantitative and qualitative data, ensuring the reliability of its outcomes. Subsequently, a novel domain-based rule update methodology for integrating new observation data is proposed. By incorporating or merging fresh data into the original model, it enhances the model’s adaptability in dynamic settings. Finally, employing the domain-based rule weight calculation approach, the model continues to effectively compute model parameters even with the continuous expansion of rules. Through extensive experimentation on two real-world industrial intrusion detection datasets, the results demonstrate the effectiveness of the proposed model in handling information and its robust performance in dynamic environments.","PeriodicalId":50316,"journal":{"name":"International Journal of Information Security","volume":"14 1","pages":""},"PeriodicalIF":3.2,"publicationDate":"2024-04-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140799707","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Validation and extension of two domain-specific information privacy competency models 验证和扩展两个特定领域的信息隐私能力模型

IF 3.2 4区计算机科学

International Journal of Information Security Pub Date : 2024-04-22 DOI: 10.1007/s10207-024-00843-x

Aikaterini Soumelidou, Aggeliki Tsohou

{"title":"Validation and extension of two domain-specific information privacy competency models","authors":"Aikaterini Soumelidou, Aggeliki Tsohou","doi":"10.1007/s10207-024-00843-x","DOIUrl":"https://doi.org/10.1007/s10207-024-00843-x","url":null,"abstract":"The purpose of this paper is to validate two domain-specific information privacy competency models (IPCMs); the first for online consumers and the second for users of mobile applications (apps). For the validation of the competency models, we conducted qualitative research, using interviews to collect feedback by a group of nine information privacy experts. Regarding the evaluation, the experts commented largely positively for the structure and content of the IPCMs, as well as for the extent to which they achieve the intended goals. They also provided several points for improvements, which resulted in enhancing the quality of both IPCMs. The validation of the domain-specific demonstrated that this is the first study to empirically examine the privacy competencies that users of specific technological contexts should hold. The IPCMs can be used not only by educators and privacy policy makers for the design of privacy interventions, but also by e-commerce and mobile-apps providers, who could gain important insights into the way that they can be more reliable for their users. Both consumers and users of mobile-apps could benefit from IPCMs by acquiring the necessary privacy competencies through training programs for the protection of their information privacy.","PeriodicalId":50316,"journal":{"name":"International Journal of Information Security","volume":"137 1","pages":""},"PeriodicalIF":3.2,"publicationDate":"2024-04-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140635618","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A generic framework for blockchain-assisted on-chain auditing for off-chain storage 区块链辅助链上审计离链存储的通用框架

IF 3.2 4区计算机科学

International Journal of Information Security Pub Date : 2024-04-18 DOI: 10.1007/s10207-024-00846-8

Saeed Banaeian Far, Maryam Rajabzadeh Asaar, Afrooz Haghbin

{"title":"A generic framework for blockchain-assisted on-chain auditing for off-chain storage","authors":"Saeed Banaeian Far, Maryam Rajabzadeh Asaar, Afrooz Haghbin","doi":"10.1007/s10207-024-00846-8","DOIUrl":"https://doi.org/10.1007/s10207-024-00846-8","url":null,"abstract":"In recent times, blockchain-based data auditing protocols have emerged as a cutting-edge area of study. Nevertheless, a conspicuous dearth of a generic framework upon which to ground such protocols is evident. This study introduces a pioneering and all-encompassing framework, designated as “Blockchain-assisted On-chain Auditing for Off-chain Storage” (BA2OC). The BA2OC framework operates without the reliance on a predefined auditor for the auditing process or a centralized verifier for the verification of on-chain auditing. It is conceivable that BA2OC forms the cornerstone of public data auditing protocols underpinned by blockchain technology. This framework bestows evidence of data ownership, ensures data integrity, facilitates public verification, supports batch verification, and bolsters the security against cyber threats through the utilization of cryptographic tools. The analysis underscores the comprehensive nature of the BA2OC framework, which positions it as the linchpin of blockchain-based public auditing protocols. Following a parametric evaluation of the BA2OC framework, this study takes into account real-world considerations, such as the utilization of the RSA cryptosystem and Android-based smartphones, to proffer a concrete protocol. The investigation further demonstrates that the BA2OC framework minimizes communication overhead while maintaining operational efficiency.","PeriodicalId":50316,"journal":{"name":"International Journal of Information Security","volume":"5 1","pages":""},"PeriodicalIF":3.2,"publicationDate":"2024-04-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140624966","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Enhancing security in QCA-based circuits using optimal key gate placement 利用最佳键门布局增强基于 QCA 电路的安全性

IF 3.2 4区计算机科学

International Journal of Information Security Pub Date : 2024-04-17 DOI: 10.1007/s10207-024-00842-y

M. Amutha, K. R. Kavitha

引用次数: 0