Siraj A. Shaikh

Who's your best friend?: targeted privacy attacks In location-sharing social networks

This paper presents a study that aims to answer two important questions related to targeted location-sharing privacy attacks: (1) given a group of users and their social graph, is it possible to predict which among them is likely to reveal most about their whereabouts, and (2) given a user, is it possible to predict which among her friends knows most about her whereabouts. To answer these questions we analyse the privacy policies of users of a real-time location sharing application, in which users actively shared their location with their contacts. The results show that users who are central to their network are more likely to reveal most about their whereabouts. Furthermore, we show that the friend most likely to know the whereabouts of a specific individual is the one with most common contacts and/or greatest number of contacts.

Knowing who to watch: Identifying attackers whose actions are hidden within false alarms and background noise

Insider attacks are often subtle and slow, or preceded by behavioral indicators such as organizational rule-breaking which provide the potential for early warning of malicious intent; both these cases pose the problem of identifying attacks from limited evidence contained within a large volume of event data collected from multiple sources over a long period. This paper proposes a scalable solution to this problem by maintaining long-term estimates that individuals or nodes are attackers, rather than retaining event data for post-facto analysis. These estimates are then used as triggers for more detailed investigation. We identify essential attributes of event data, allowing the use of a wide range of indicators, and show how to apply Bayesian statistics to maintain incremental estimates without global updating. The paper provides a theoretical account of the process, a worked example, and a discussion of its practical implications. The work includes examples that identify subtle attack behaviour in subverted network nodes, but the process is not network-specific and is capable of integrating evidence from other sources, such as behavioral indicators, document access logs and financial records, in addition to events identified by network monitoring.

Characteristic trade-offs in designing large-scale biometric-based identity management systems

Biometric-based identity management systems are deemed to be the new solution to address the challenges of global security and citizenship. While such systems do prove effective, the nature of biometric technology, the costs involved, and increasing threats to theft and loss of data bring with it a variety of other considerations that cannot be ignored. We approach such systems from the perspective of large-scale high-volume public deployments. We find that various characteristics of such deployments present a trade-off, where emphasis on one undermines the other. Such characteristic trade-off spaces are described and explored in this paper. The ultimate contribution lies in the understanding of such trade-off spaces for the purposes of optimal design of such systems. We use our approach to analyse the recently launched Identity Card scheme in the United Kingdom.

Towards a metric for Open Source Software Quality

Software quality is more than just conformance to a set of requirements and represents many attributes related to each other that make up a piece of software. An important part of this measure depends on the underlying processes and methodologies used in the engineering of software. We present an early exposition towards a quality model for open source software (OSS). We describe some basic notions of quality for OSS and present a basic model, where quality notions consist of various factors that influence such quality. The purpose of this effort is ultimately to develop a quantitative metric for software quality.

A Deployment Value Model for Intrusion Detection Sensors

The value of an intrusion detection sensor is often associated with its data collection and analysis features. Experience tells us such sensors fall under a range of different types and are diverse in their operational characteristics. There is a need to examine some of these characteristics to appreciate the value they add to intrusion detection deployments. This paper presents a model to determine the value derived from deploying sensors, which serves to be useful to analyse and compare intrusion detection deployments.

Networking Recon: Network reconnaissance

Along with its wider reach in society, in the form of both mobility and relatively affordable access, the internet has transformed the world we live in, serving as bedrock for electronic commerce and other digital and communication services. It has become an integral part of the personal, professional, and economic spheres of our daily life. Global organisations, whether official, commercial, or social, are relying on it ever more to function, bringing an increasing need for a secure electronic infrastructure. The pervasive nature of the internet, one major factor behind its success, is also proving to be its main threat. Once connected to this global network, no one is more than a few clicks away from servers hosting websites that transact commerce worth millions or critical state-run networks that run sensitive operations.

Optimising IDS Sensor Placement

In large network environments multiple intrusion detection sensors are needed to adequately monitor network traffic. However, deploying and managing additional sensors on a large network can be a demanding task, and organizations have to balance their desire for detecting intrusions throughout their network with financial and staffing limitations. This paper investigates how intrusion detection system (IDS) sensors should best be placed on a network when there are several competing evaluation criteria. This is a computationally difficult problem and we show how Multi-Objective Genetic Algorithms provide an excellent means of searching for optimal placements.

A Biometric Authentication Protocol for 3G Mobile Systems: Modelled and Validated Using CSP and Rank Functions

This paper describes a protocol, called BIO3G, for establishing secure and privacy friendly biometric authentication in 3G mobile environments. BIO3G provides real end-to-end strong user authentication to the mobile operator, requiring no storing or transferring of biometric data and eliminating the need for biometric enrolment and administration procedures, which are time-consuming for the user and expensive for the mobile operator. BIO3G was modelled and evaluated using the formal process algebra CSP.

Information security education in the UK: a proposed course in secure e-commerce systems

The paper discusses briefly the available academic programs in the subject area of Information Security in the United Kingdom (UK). We then present our experience of designing a module the purpose of which is to train students in the concepts of Information Security. We discuss the rationale behind our choice of teaching methods and the structure of the module in detail.

Detecting stealthy attacks

Display Omitted A scalable monitoring scheme for stealthy attacks on computer networks is presented.Bayesian fusion along with traffic sampling is used as a data reduction method.Stealthy activities can be detected using 10-20% size sampling rates.A tracing algorithm for anonymous stealthy activities to their sources is presented.The effect of network parameters on detection is investigated. Stealthy attackers move patiently through computer networks - taking days, weeks or months to accomplish their objectives in order to avoid detection. As networks scale up in size and speed, monitoring for such attack attempts is increasingly a challenge. This paper presents an efficient monitoring technique for stealthy attacks. It investigates the feasibility of proposed method under number of different test cases and examines how design of the network affects the detection. A methodological way for tracing anonymous stealthy activities to their approximate sources is also presented. The Bayesian fusion along with traffic sampling is employed as a data reduction method. The proposed method has the ability to monitor stealthy activities using 10-20% size sampling rates without degrading the quality of detection.