Search

The Heuristic-Based Analysis method, which is otherwise known as Behavioural-Based Analysis technique applied by several Anti-Virus and Anti-Malware vendors of computer network systems has not been sufficient. There are gaps in the field of research to develop a novel approach to solving the inherent and existential threats and attacks in the interconnected computer network systems, especially in the fast growing IoT Ecosystems that has now become ubiquitous to everyday life. We proposed and presented the experimental implementation of an intelligent framework, including the realization of the Multilayer Perceptron (MLP) with multiple hidden layers by exploiting the capabilities of Hierarchical Extreme Learning Machine (H-ELM). This has the preeminent underexplored potentials for accelerated speed, rapid feature learning, training, improved classification performance, and accuracy of Detecting, Recognizing, and Predicting (DRP) anomalies in an Internet of Things (IoT) ecosystem. The experimental implementation demonstrated the effectiveness of the proposed Intelligent DRP-Framework also known as the iDRP-Framework using the generalized MLP technique for demonstrating how a non-traditional malware detection mechanism can be applied to dynamically and intelligently Detect, Recognize, and Predict malwares in the generated big dataset of an IoT ecosystem through converted image file, such as the Log files, and Binary dataset to create machine learning model. The result indicates that the proposed iDRP-Framework delivered significant performance and accuracy in the detection of anomalies in an interconnected computer network system.

The success of Machine Learning (ML) techniques in security applications, such as malware detection, is highly criticized for their vulnerability to Adversarial Examples (AE): perturbed input samples (e.g. malware) can mislead ML to produce an adversary’s desired output (e.g. benign class label). AEs against ML models are broadly studied in the computer vision domain where the adversary perturbs the pixel values of an image such that the change is not perceptible, but the resulting image is misclassified by the model. We investigate the effectiveness of attack techniques proposed in the image domain to attack ML classifiers in the context of mobile malware detection. Since the feature vector representation of samples is often used in ML, a simplified evaluation of ML classifiers’ robustness to AEs is to study feature-based attack models, where the adversary perturbs the input features. We compare the methods, trade-offs, and gaps for such attack models and show that generative models (e.g. GANs) outperform a selection of existing attacks in terms of attack success rate but apply large distortion to the original sample. We also describe how we use the generated samples for increasing a classifier’s robustness through adversarial training.

Purpose In this paper, a Quality of Service-sensitive customer behavior model graph (QoS-CBMG) is proposed for use in service quality adaptation in e-commerce systems. Success in achieving customer satisfaction and maximizing profit in e-commerce is highly dependent on the QoS provided. However, providing high-level QoS for all customers in all Web sessions is often deemed costly and inefficient. Therefore, a QoS-sensitive model for formulating QoS-aware offers to customers is required. The paper aims to respond to this necessity. Design/methodology/approach Process mining is adopted as the knowledge extraction technique for developing a QoS-CBMG. If it is assumed that user navigation on a website is a process, then clickstreams during one user’s navigations can be considered process steps. Findings The application of both QoS-CBMG (the new model) and CBMG (the classic version) to the same real data set demonstrated that the proposed method outperforms CBMG due to its reduction of average absolute error in the measurement scale. This finding also verifies the assumption that customer behavior is sensitive to the level of QoS. Research limitations/implications From a theoretical viewpoint, the obtained QoS-CBMG facilitates the adaption in e-commerce systems, which leads to conduct the user to the desired behavior by tuning QoS levels in different Web sessions in a dynamic manner. This implication is due to the fact that QoS-CBMG can predict the upcoming clickstream of the customer at different QoS levels. Practical implications Using the proposed model for the adaptation of service quality in e-commerce websites not only results in the efficient management of the provider’s resources but also encourages customer purchases from the website and increases profitability. It is noteworthy that with the advent of cloud computing, e-commerce websites are enabled to provide various levels of QoS for their customers by supplying their basic services (e.g. infrastructure, platform) through cloud platforms. Originality/value According to the best of our knowledge, no previous model has taken into account the QoS dimension for customer behavior modeling. The main contribution of this paper is to propose a CBMG that is sensitive to the QoS provided to customers during their navigation to formulate QoS-aware offers to them.

In recent years, machine learning approaches have been widely adopted for computer security tasks, including malware detection. Malware is a potent threat and an ongoing issue especially on smartphones which account for more than half of global web traffic. Although detection solutions are improving with the advances in machine learning techniques, they have been shown to be vulnerable to adversarial samples that carefully crafted perturbation enables them to evade detection. We propose a machine learning based model to attack malware classifiers leveraging the expressive capability of generative adversarial networks (GANs). We use GANs to generate effective adversarial samples by implying a threshold on the distortion amount on the generated samples. We show that the generated samples can bypass detection in 99% of attempts using a real Android application dataset.

Adaptive systems refer to autonomous interactive systems that adjust their behavior and functionality to environmental changes. In e-learning context, adaptive e-learning systems (AESs) adapt their services to users interests, knowledge and goals. In order to investigate the trend of researches in the field of adaptation in e-learning systems, a comprehensive survey of research papers in this context is presented. In this regard, 190 research papers, published between 2000 and 2012, from 45 journals are reviewed and analyzed. The basic contributions of the paper are manifold. First, it provides classifications of research papers from two different points of view: the adaptive technologies utilized in research papers in order to provide adaptation services for AESs and the application fields of research papers in AESs as research goals. Second, it presents statistical analyses on adaptive technologies and application fields. The analyses are carried out based on publication year of papers, the publication year versus adaptive technologies, the publication year versus application fields and adaptive technologies versus application fields. Third, the open problems, current state and prospective direction of researches in AESs are discussed. Finally, the paper suggests what adaptive technology might be the best choice for ongoing researches in each application field.

Purpose – This paper aims to propose a comprehensive model to find out the most preventive subset of security controls against potential security attacks inside the limited budget. Deploying the appropriate collection of information security controls, especially in information system-dependent organizations, ensures their businesses' continuity alongside with their effectiveness and efficiency. Design/methodology/approach – Impacts of security attacks are measured based on interdependent asset structure. Regarding this objective, the asset operational dependency graph is mapped to the security attack graph to assess the risks of attacks. This mapping enables us to measure the effectiveness of security controls against attacks. The most effective subset is found by mapping its features (cost and effectiveness) to items’ features in a binary knapsack problem, and then solving the problem by a modified version of the classic dynamic programming algorithm. Findings – Exact solutions are achieved using the dynamic programming algorithm approach in the proposed model. Optimal security control subset is selected based on its implementation cost, its effectiveness and the limited budget. Research limitations/implications – Estimation of control effectiveness is the most significant limitation of the proposed model utilization. This is caused by lack of experience in risk management in organizations, which forces them to rely on reports and simulation results. Originality/value – So far, cost-benefit approaches in security investments are followed only based on vulnerability assessment results. Moreover, dependency weights and types in interdependent structure of assets have been taken into account by a limited number of models. In the proposed model, a three-dimensional graph is used to capture the dependencies in risk assessment and optimal control subset selection, through a holistic approach.

The tremendous growth of internet-of-things integrated with VoIP applications gives a serious challenge to digital forensic researchers. This integration gives more challenges in investigation process because there are various types of VoIP application with different design and implementation features. There are diverse VoIP applications used by criminals that caused difficulties in the identification, acquisition and preservation of evidential data. This paper used Skype to determine the data remnants on Windows 7 and Windows 8.1 when users run Skype functions including installing and uninstalling, instant messaging, voice and video call, video messaging, sending and receiving files, screen sharing and taking pictures. The link where the victim and suspect may have been in contact on Skype is provable by the proposed methods. It is found that potential evidences can be found in capturing memory, capturing network traffic, user application data and the data remnants available in user's device.

The cloud computing adoption process is constantly advancing whereas the security of clouds is still one of the major concerns of clients to adopt and use the new computing paradigm. To ensure a high level of security of cloud services and applications, testing is an appropriate approach to detect possible vulnerabilities before real case scenarios occur. Thus, many academic papers have been published to identify and address challenges in cloud security. However, most of the researchers focused on TaaS rather than on testing the cloud, which led to a current gap in academics. This paper presents a systematic literature review of testing cloud security. The authors elucidate a general and consistent topic overview, beginning with defining and introducing key terms. Furthermore, gaps in recent related publications are revealed, hence prospective research implications are pointed out to foster the understanding and relations of current research fields.

In the recent decade, using of Personal Digital Assistants (PDAs) and smart phones had incredible growth and they can be used as a small computer in business, communication and education. Most of current civil engineering software are created for desktop computers in specific operating system and platforms without any portability and flexibility feature. This paper proposed a web-based architecture for an interactive Finite Element (FE) program. The architecture supports linear and nonlinear analysis of reinforce concrete buildings subjected to static and dynamic loading. Structure modeling is performed on the client-side via any internet browser. Data is send to the server and analyzed by FE program which has been installed on the server. Then, the result of analysis which is response of structure under imposed load is send back to the client-side to show and plot output of analysis. The developed software which is named Analysis of Reinforced Concrete Structure (ARCS) implemented in secure and user friendly interface. Running software in offline mode is possible for modeling but internet connection is needed to transfer input data to the server and transfer output of analysis from server to the client-side. The most important advantage of proposed model is operating system and platform independency. Backup capability of all data and authority access control are other features of ARCS. Therefore the developed software is able to use extensively by engineers to carry out modeling and analysis of structures by any PDAs or smart phones through any operating systems and platforms.

Deploying an appropriate collection of information security countermeasures in an organization should result in high-level blocking power against existing threats. In this chapter, a new knapsack-based approach is proposed for finding out which subset of countermeasures is the best at preventing probable security attacks. In this regard, an effectiveness score is defined for each countermeasure based on its mitigation level against all threats. Organizations are always looking for more effective low-cost solutions, so another consideration is that the implementation cost of the selected countermeasure portfolio should not exceed the allocated budget. Following the knapsack idea, the implementation cost of each countermeasure and its effectiveness, defined as inputs and the best subset, are chosen with respect to budget limits. Our results are compared with similar research and recommend the same countermeasure portfolio.

This Electronic voting has about twenty years history and lots of partially secure electronic voting schemes has been proposed in this period of time. There are some security requirements that these entire schemes have been supposed to comply. Another important issue about voting schemes is efficiency, in which, in most cases have been eclipsed because of complying those security requirements. Security techniques such as using public key infrastructure are very common in electronic voting schemes which cause a heavy load on process and increase the number of transmissions between parties In this paper, we introduce a secure and efficient electronic voting scheme based on blind signatures in which voters do not need a set of public/private keys. The proposed scheme fulfills all the security requirements mentioned in the literature.

Online social networks provide user relationships and increase information and resource sharing between a large amount of users. Communications by social networks overtake the emails, and it poses enormous security challenges in this platform. Numerous privacy leakages arise while unauthorized users can access information at anywhere and anytime. This paper presents Usage Decision Online Social Network (UDOSN) model to protect private data from illegal access before and during the usage in online social networks. The authentication function controls the access requests before the usage, and right requests are done by the authorization function during the usage. Presented scenarios show the process of both functions. Moreover, Usage Decision Online Social Network model is reusable and environment-independent, and it is defined for social network with formal descriptions.