Journal of information technology teaching cases, Feb 16, 2023
Over the past decade, the number and scale of ransomware attacks has grown. These attacks have st... more Over the past decade, the number and scale of ransomware attacks has grown. These attacks have stretched across multiple industries globally and caused billions of dollars of damages. Recent attacks have disrupted critical infrastructure and have served as prelude to war. Studies have shown that there is a lack of awareness among industry practitioners surrounding appropriate responses to ransomware. This failure during a career-defining moment is largely due to the gap between cyber security academic knowledge and industry practice. We therefore provide a learning resource for ransomware response education that is academically adequate, practically viable, and ultimately illustrates a process for proper employment of technology. This case, exposes students to technical requirements for a ransomware response and explores ransomware best practices. Discussion questions and a wargaming-style purple team exercise for individuals or groups extend the opportunity for delivering additional technical depth.
HAL is a multidisciplinary open access archive for the deposit and dissemination of scientific re... more HAL is a multidisciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.
International Journal of Critical Infrastructure Protection, 2015
A widespread emergency event in the United States triggers the activation of a regional emergency... more A widespread emergency event in the United States triggers the activation of a regional emergency operations center that manages a coordinated response to the disaster. Historically, the time-critical decisions made by emergency managers in the face of incomplete information and inadequate historical emergency event data have been guided primarily by their experience. The learning curve for emergency managers, especially novice managers, is steep, and is exacerbated by the complexity and scope of emergency events. This paper proposes a methodology designed to provide emergency managers with locality-specific information and resource allocation recommendations for large-scale event response, creating the foundation for a decision support system that draws on emergency event data. This work is the first to use locally-specific data for an emergency management decision support system. Two major allocation scenarios that influence the number of resources allocated to an event are considered and solutions are suggested to address them. Although the methodology is developed for a mid-sized region, it is generalizable to any region.
ICC 2021 - IEEE International Conference on Communications
Vehicle-to-vehicle (V2V) communication systems in the U.S. rely on IEEE 1609.2 security protocols... more Vehicle-to-vehicle (V2V) communication systems in the U.S. rely on IEEE 1609.2 security protocols for message authentication using digital signatures. A key requirement for trust management in such systems is the ability to detect misbehaving vehicles, e.g., when vehicles are repeatedly forging signatures. However, this creates a new attack surface where receivers cannot determine whether the causes of signature verification failures are indeed malicious attacks. In this paper, we present our novel, open-source, USRP-based testbed and utilize it to demonstrate how a stealthy reactive jammer can exploit this vulnerability. Our novel, targeted attack is highly efficient (even given the short validity period for vehicle pseudonyms) and difficult to detect. Our experimental results show that our attack can successfully discredit a victim in prominent misbehavior detection schemes with just two minutes of jamming. Finally, we discuss the capabilities and extensibility of our testbed as well as the challenges of potential attack mitigation techniques.
1 Abstract – Computer forensics is a continually evolving field, filled with challenges when exis... more 1 Abstract – Computer forensics is a continually evolving field, filled with challenges when existing hardware and software technologies progress and new devices and technologies are added to the mix. It is important for forensics investigators responsible for acquiring, preserving and analyzing digital evidence, to be aware of the challenges facing the forensics field and to apply latest technologies in forensics investigation. This paper discusses the challenges to the traditional forensics procedures and technologies due to evolving hardware and software. The authors present the latest forensics technologies and procedures as well as research ideas to address the challenges, especially in mobile device forensics, Solid State Drive (SSD) evidence recovery and analysis, and Windows memory forensics. Corresponding labs are designed and presented to assist computer forensic students and practitioners in getting acquainted with and practicing the new knowledge and tools.
2018 ASEE Annual Conference & Exposition Proceedings
Pan has been actively involved in the IT security area, especially in security audits and compute... more Pan has been actively involved in the IT security area, especially in security audits and computer forensics. Her current research interests include game-based digital forensics and memory-based malware detection using machine learning. She has published over 45 papers and presentations in research conferences and journals. She received grants from NSF, US Air Force Research Lab, and RIT. Dr. Pan teaches graduate courses in digital forensics and security audits.
ICC 2021 - IEEE International Conference on Communications
Smart grid requires granular smart metering data collection at frequent time intervals. However, ... more Smart grid requires granular smart metering data collection at frequent time intervals. However, this introduces unique risks to consumer privacy. To address this challenge, several privacy-preserving data collection frameworks have been proposed. Data aggregation-based frameworks show promise in terms of privacy preservation. However, the related frameworks in the literature either have a high computational overhead on the smart meters or rely on architectures that may lead to single points of compromise. Also, most studies focus on solving the privacy problem and do not consider the integration of accurate billing in the framework. In this paper, we study a multiple aggregator based distributed privacy-preserving framework to address these challenges. The aggregators carry out the bulk of the computational load, thus making the framework lightweight for the smart meters. Our proposed framework and two other related schemes are deployed in an embedded environment for assessing the computational overhead on the smart meters due to temporal aggregation. The schemes are also studied via simulation to assess their end-to-end delay for spatial aggregation and scalability, and it is shown that our scheme outperforms the other two schemes. In addition, we analyze the resilience of our scheme against passive threats to privacy. A qualitative analysis of our scheme against other aggregation-based schemes in the literature is also presented in this paper.
2020 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm)
The desired features for the smart grid include dynamic billing capabilities along with consumer ... more The desired features for the smart grid include dynamic billing capabilities along with consumer privacy protection. Existing aggregation-based privacy frameworks have limitations such as centralized designs prone to single points of failure and/or a high computational overload on the smart meters due to in-network aggregation or complex algorithmic operations. Additionally, these existing schemes do not consider how dynamic billing can be implemented while consumer privacy is preserved. In this paper, a cyber-resilient framework that enables dynamic billing while focusing on consumer privacy preservation is proposed. The distributed design provides a framework for spatio-temporal aggregation and keeps the process lightweight for the smart meters. The comparative analysis of our proposed work with existing work shows a significant improvement in terms of the spatial aggregation overhead, overhead on smart meters and scalability. The paper also discusses the resilience of our framework against privacy attacks.
A technological issue in improving healthcare while lowering costs is the rapid and reliable shar... more A technological issue in improving healthcare while lowering costs is the rapid and reliable sharing of patient and other medical information across e-Health systems. Such sharing must be done securely and meet the privacy guarantees imposed by applicable laws and regulations; for instance, the Health Insurance Portability and Accountability Act (HIPAA) in the United States requires the use of appropriate access control mechanisms to protect healthcare information. Despite such legal requirements, currently implemented access control models in e-Health systems are often inadequate as demonstrated by the large and increasing numbers of successful attacks on healthcare systems. In particular, current access control models do not provide sufficient protection for healthcare systems from attacks by insiders, i.e., authorized personnel. This paper examines insider threats and presents an approach to protect healthcare information from unauthorized or improper use, disclosure, alteration,...
Proceedings of the 2017 ACM SIGCSE Technical Symposium on Computer Science Education, 2017
The growing shortage of skilled professionals in cybersecurity and forensics has increased global... more The growing shortage of skilled professionals in cybersecurity and forensics has increased global demand for information systems professionals. To identify and attract more students to cybersecurity and forensics programs, the authors developed a game engine along with a sequence of entertaining, engaging, and educational games, suitable for forensics and cybersecurity courses. This paper focuses on the design and development of a modular educational game framework composed of a game engine and a GUI-based game creator. Following narrative and storylines of the game via interactive dialogs and visualized abstract concepts, students are motivated and engaged to obtain the necessary knowledge. Students will also develop their problem solving skills by using real tools and technologies while playing the game. The GUI-based game creator allows educators to create and develop new educational games by only focusing on game content. CCS Concepts • Applied Computing➝Education➝Interactive learning environments • Professional topics➝Computing Education.
2017 ASEE Annual Conference & Exposition Proceedings
Pan has been actively involved in the IT security area, especially in security audits and compute... more Pan has been actively involved in the IT security area, especially in security audits and computer forensics. Her current research interests include game-based digital forensics and memory-based malware detection using machine learning. She has published over 45 papers and presentations in research conferences and journals. She received grants from NSF, US Air Force Research Lab, and RIT. Dr. Pan teaches graduate courses in digital forensics and security audits.
2016 IEEE Power & Energy Society Innovative Smart Grid Technologies Conference (ISGT), 2016
Emergence of the smart grid necessitates data collection from various entities connected to the p... more Emergence of the smart grid necessitates data collection from various entities connected to the power grid. By collecting fine-grained smart metering data from consumer household, smart grid is envisioned to offer innovative features, such as load-demand balance, dynamic pricing and demandresponse. However, the advent of sophisticated data analysis tools makes it possible to extract detailed electricity usage patterns, which can reveal personal information of consumer household. The privacy concern is one of the reasons jeopardizing general deployment of smart meters, despite their effectiveness in cost savings for both electricity suppliers and consumers. Anonymous transmission of smart metering data is a potential solution but it requires mechanisms to authenticate anonymous data. Moreover, enabling the service provider's access to consumer information for grid functionality while preserving consumer privacy, is a challenging task. The proposed anonymized authentication framework consists of an authentication scheme to protect data from unauthorized entities and an anonymization scheme to achieve privacy against authorized entities. The framework is designed to prevent service providers from correlating different types of data from a smart meter and avoid single point of failure.
2016 IEEE Frontiers in Education Conference (FIE), 2016
The United States Department of Homeland Security has identified 16 critical infrastructure secto... more The United States Department of Homeland Security has identified 16 critical infrastructure sectors that employ computing, technology and engineering students. However, most undergraduate curricula in these disciplines do not incorporate the fundamentals of critical infrastructure protection (CIP) into their curricula in a meaningful way. This paper describes the design, development, and usage of a modular curricular framework for integrating CIP into undergraduate programs via self-contained interdisciplinary course modules; a course module is a distinct curricular unit such as a lab or teaching component for use by an instructor in existing courses without requiring any course or program modifications. The framework is designed for use in multiple disciplines, and the modules are designed for presentation at different levels of the undergraduate experience, with subsequent modules built on those presented earlier. In addition, the paper discusses assessment results obtained from the validation of the framework and modules over the past three years that covered 345 students at the community college and university levels.
2016 IEEE Smart Energy Grid Engineering (SEGE), 2016
Privacy concerns about smart metering have proven to be a significant roadblock to adoption of th... more Privacy concerns about smart metering have proven to be a significant roadblock to adoption of the smart grid. In the smart grid, electricity usage data are collected in near real time, exposing users to attacks that reveal their habits, location, and preferences. Other research in this area has demonstrated the possibility of using pseudonyms to decouple low-frequency billing data from high-frequency grid maintenance data. Such schemes must provide a way to authenticate the pseudonym as belonging to a real customer, to defend against the submission of false data. However, this authentication process exposes the system to timing attacks that can correlate the authentication of a particular customer with the appearance of a new pseudonym on the network. These timing attacks have been addressed informally in the literature with techniques such as adding a random delay to transmission. The anonymity thus provided is not quantified or guaranteed, and can be subverted with active attacks via the service provider. This paper introduces a method for defeating timing attacks based on the theory of mix networks. The use of a mix formalizes a method of randomizing the order in which authentication attempts are serviced. The mix design is described in detail and it is shown that this method is more resistant to attack and allows for an explicit tradeoff between anonymity and delay.
2012 IEEE Global Communications Conference (GLOBECOM), 2012
Internet continues to grow in number and hence provisioning seamless Internet service to such use... more Internet continues to grow in number and hence provisioning seamless Internet service to such user is a topic of major interest. With new mobility architectures being investigated, it is important to have consistent comparative platforms and metrics. In this article, we introduce a novel and user-centric handoff cost framework to analyze handoff performance of different mobility schemes. The proposed framework helps examine the impacts of registration costs, signaling overhead, and data loss for Internet connected mobile users employing a unified ...
ABSTRACT As people increasingly rely on computer systems and networks for services such as online... more ABSTRACT As people increasingly rely on computer systems and networks for services such as online banking, online shopping, and socialization, information security for identity protection and privacy has become more important today than ever. Businesses and organizations are also obligated to provide such security to comply with state and federal laws and regulations. Managing security risks and ensuring compliance with information security regulations and industry standards have become important for businesses and ...
IEEE International Conference on Mobile Adhoc and Sensor Systems Conference, 2005.
Abstract Wireless ad-hoc networks are vulnerable to various kinds of security threats and attacks... more Abstract Wireless ad-hoc networks are vulnerable to various kinds of security threats and attacks due to relative ease of access to wireless medium and lack of a centralized infrastructure. In this paper, we seek to detect and mitigate the denial of service (DoS) attacks that prevent authorized users from gaining access to the networks. These attacks affect the service availability and connectivity of the wireless networks and hence reduce the network performance. To this end, we propose a novel cross-layer based intrusion ...
Proceedings of the 13th annual conference on Information technology education - SIGITE '12, 2012
Identifying and attracting talented students to digital forensics programs is a crucial first ste... more Identifying and attracting talented students to digital forensics programs is a crucial first step to developing professionals in this relatively young field. To respond to these challenges, we propose to develop a fun, entertaining, and yet educational forensicscourse suitable for first year students in college, in an effort to identify and attract students to a forensics program. This paper focuses on the design and development of a gamebased forensics course using the game-based learning (GBL) approach building the game in a real computing environment that has direct access to actual forensics tools from a forensics machine and the evidence from a suspect machine. Interactive visualizations will be used to help students to understand the intangible and inaccessible abstract concepts such as deleted/hidden/encrypted/over-written digital evidence.
Journal of information technology teaching cases, Feb 16, 2023
Over the past decade, the number and scale of ransomware attacks has grown. These attacks have st... more Over the past decade, the number and scale of ransomware attacks has grown. These attacks have stretched across multiple industries globally and caused billions of dollars of damages. Recent attacks have disrupted critical infrastructure and have served as prelude to war. Studies have shown that there is a lack of awareness among industry practitioners surrounding appropriate responses to ransomware. This failure during a career-defining moment is largely due to the gap between cyber security academic knowledge and industry practice. We therefore provide a learning resource for ransomware response education that is academically adequate, practically viable, and ultimately illustrates a process for proper employment of technology. This case, exposes students to technical requirements for a ransomware response and explores ransomware best practices. Discussion questions and a wargaming-style purple team exercise for individuals or groups extend the opportunity for delivering additional technical depth.
HAL is a multidisciplinary open access archive for the deposit and dissemination of scientific re... more HAL is a multidisciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.
International Journal of Critical Infrastructure Protection, 2015
A widespread emergency event in the United States triggers the activation of a regional emergency... more A widespread emergency event in the United States triggers the activation of a regional emergency operations center that manages a coordinated response to the disaster. Historically, the time-critical decisions made by emergency managers in the face of incomplete information and inadequate historical emergency event data have been guided primarily by their experience. The learning curve for emergency managers, especially novice managers, is steep, and is exacerbated by the complexity and scope of emergency events. This paper proposes a methodology designed to provide emergency managers with locality-specific information and resource allocation recommendations for large-scale event response, creating the foundation for a decision support system that draws on emergency event data. This work is the first to use locally-specific data for an emergency management decision support system. Two major allocation scenarios that influence the number of resources allocated to an event are considered and solutions are suggested to address them. Although the methodology is developed for a mid-sized region, it is generalizable to any region.
ICC 2021 - IEEE International Conference on Communications
Vehicle-to-vehicle (V2V) communication systems in the U.S. rely on IEEE 1609.2 security protocols... more Vehicle-to-vehicle (V2V) communication systems in the U.S. rely on IEEE 1609.2 security protocols for message authentication using digital signatures. A key requirement for trust management in such systems is the ability to detect misbehaving vehicles, e.g., when vehicles are repeatedly forging signatures. However, this creates a new attack surface where receivers cannot determine whether the causes of signature verification failures are indeed malicious attacks. In this paper, we present our novel, open-source, USRP-based testbed and utilize it to demonstrate how a stealthy reactive jammer can exploit this vulnerability. Our novel, targeted attack is highly efficient (even given the short validity period for vehicle pseudonyms) and difficult to detect. Our experimental results show that our attack can successfully discredit a victim in prominent misbehavior detection schemes with just two minutes of jamming. Finally, we discuss the capabilities and extensibility of our testbed as well as the challenges of potential attack mitigation techniques.
1 Abstract – Computer forensics is a continually evolving field, filled with challenges when exis... more 1 Abstract – Computer forensics is a continually evolving field, filled with challenges when existing hardware and software technologies progress and new devices and technologies are added to the mix. It is important for forensics investigators responsible for acquiring, preserving and analyzing digital evidence, to be aware of the challenges facing the forensics field and to apply latest technologies in forensics investigation. This paper discusses the challenges to the traditional forensics procedures and technologies due to evolving hardware and software. The authors present the latest forensics technologies and procedures as well as research ideas to address the challenges, especially in mobile device forensics, Solid State Drive (SSD) evidence recovery and analysis, and Windows memory forensics. Corresponding labs are designed and presented to assist computer forensic students and practitioners in getting acquainted with and practicing the new knowledge and tools.
2018 ASEE Annual Conference & Exposition Proceedings
Pan has been actively involved in the IT security area, especially in security audits and compute... more Pan has been actively involved in the IT security area, especially in security audits and computer forensics. Her current research interests include game-based digital forensics and memory-based malware detection using machine learning. She has published over 45 papers and presentations in research conferences and journals. She received grants from NSF, US Air Force Research Lab, and RIT. Dr. Pan teaches graduate courses in digital forensics and security audits.
ICC 2021 - IEEE International Conference on Communications
Smart grid requires granular smart metering data collection at frequent time intervals. However, ... more Smart grid requires granular smart metering data collection at frequent time intervals. However, this introduces unique risks to consumer privacy. To address this challenge, several privacy-preserving data collection frameworks have been proposed. Data aggregation-based frameworks show promise in terms of privacy preservation. However, the related frameworks in the literature either have a high computational overhead on the smart meters or rely on architectures that may lead to single points of compromise. Also, most studies focus on solving the privacy problem and do not consider the integration of accurate billing in the framework. In this paper, we study a multiple aggregator based distributed privacy-preserving framework to address these challenges. The aggregators carry out the bulk of the computational load, thus making the framework lightweight for the smart meters. Our proposed framework and two other related schemes are deployed in an embedded environment for assessing the computational overhead on the smart meters due to temporal aggregation. The schemes are also studied via simulation to assess their end-to-end delay for spatial aggregation and scalability, and it is shown that our scheme outperforms the other two schemes. In addition, we analyze the resilience of our scheme against passive threats to privacy. A qualitative analysis of our scheme against other aggregation-based schemes in the literature is also presented in this paper.
2020 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm)
The desired features for the smart grid include dynamic billing capabilities along with consumer ... more The desired features for the smart grid include dynamic billing capabilities along with consumer privacy protection. Existing aggregation-based privacy frameworks have limitations such as centralized designs prone to single points of failure and/or a high computational overload on the smart meters due to in-network aggregation or complex algorithmic operations. Additionally, these existing schemes do not consider how dynamic billing can be implemented while consumer privacy is preserved. In this paper, a cyber-resilient framework that enables dynamic billing while focusing on consumer privacy preservation is proposed. The distributed design provides a framework for spatio-temporal aggregation and keeps the process lightweight for the smart meters. The comparative analysis of our proposed work with existing work shows a significant improvement in terms of the spatial aggregation overhead, overhead on smart meters and scalability. The paper also discusses the resilience of our framework against privacy attacks.
A technological issue in improving healthcare while lowering costs is the rapid and reliable shar... more A technological issue in improving healthcare while lowering costs is the rapid and reliable sharing of patient and other medical information across e-Health systems. Such sharing must be done securely and meet the privacy guarantees imposed by applicable laws and regulations; for instance, the Health Insurance Portability and Accountability Act (HIPAA) in the United States requires the use of appropriate access control mechanisms to protect healthcare information. Despite such legal requirements, currently implemented access control models in e-Health systems are often inadequate as demonstrated by the large and increasing numbers of successful attacks on healthcare systems. In particular, current access control models do not provide sufficient protection for healthcare systems from attacks by insiders, i.e., authorized personnel. This paper examines insider threats and presents an approach to protect healthcare information from unauthorized or improper use, disclosure, alteration,...
Proceedings of the 2017 ACM SIGCSE Technical Symposium on Computer Science Education, 2017
The growing shortage of skilled professionals in cybersecurity and forensics has increased global... more The growing shortage of skilled professionals in cybersecurity and forensics has increased global demand for information systems professionals. To identify and attract more students to cybersecurity and forensics programs, the authors developed a game engine along with a sequence of entertaining, engaging, and educational games, suitable for forensics and cybersecurity courses. This paper focuses on the design and development of a modular educational game framework composed of a game engine and a GUI-based game creator. Following narrative and storylines of the game via interactive dialogs and visualized abstract concepts, students are motivated and engaged to obtain the necessary knowledge. Students will also develop their problem solving skills by using real tools and technologies while playing the game. The GUI-based game creator allows educators to create and develop new educational games by only focusing on game content. CCS Concepts • Applied Computing➝Education➝Interactive learning environments • Professional topics➝Computing Education.
2017 ASEE Annual Conference & Exposition Proceedings
Pan has been actively involved in the IT security area, especially in security audits and compute... more Pan has been actively involved in the IT security area, especially in security audits and computer forensics. Her current research interests include game-based digital forensics and memory-based malware detection using machine learning. She has published over 45 papers and presentations in research conferences and journals. She received grants from NSF, US Air Force Research Lab, and RIT. Dr. Pan teaches graduate courses in digital forensics and security audits.
2016 IEEE Power & Energy Society Innovative Smart Grid Technologies Conference (ISGT), 2016
Emergence of the smart grid necessitates data collection from various entities connected to the p... more Emergence of the smart grid necessitates data collection from various entities connected to the power grid. By collecting fine-grained smart metering data from consumer household, smart grid is envisioned to offer innovative features, such as load-demand balance, dynamic pricing and demandresponse. However, the advent of sophisticated data analysis tools makes it possible to extract detailed electricity usage patterns, which can reveal personal information of consumer household. The privacy concern is one of the reasons jeopardizing general deployment of smart meters, despite their effectiveness in cost savings for both electricity suppliers and consumers. Anonymous transmission of smart metering data is a potential solution but it requires mechanisms to authenticate anonymous data. Moreover, enabling the service provider's access to consumer information for grid functionality while preserving consumer privacy, is a challenging task. The proposed anonymized authentication framework consists of an authentication scheme to protect data from unauthorized entities and an anonymization scheme to achieve privacy against authorized entities. The framework is designed to prevent service providers from correlating different types of data from a smart meter and avoid single point of failure.
2016 IEEE Frontiers in Education Conference (FIE), 2016
The United States Department of Homeland Security has identified 16 critical infrastructure secto... more The United States Department of Homeland Security has identified 16 critical infrastructure sectors that employ computing, technology and engineering students. However, most undergraduate curricula in these disciplines do not incorporate the fundamentals of critical infrastructure protection (CIP) into their curricula in a meaningful way. This paper describes the design, development, and usage of a modular curricular framework for integrating CIP into undergraduate programs via self-contained interdisciplinary course modules; a course module is a distinct curricular unit such as a lab or teaching component for use by an instructor in existing courses without requiring any course or program modifications. The framework is designed for use in multiple disciplines, and the modules are designed for presentation at different levels of the undergraduate experience, with subsequent modules built on those presented earlier. In addition, the paper discusses assessment results obtained from the validation of the framework and modules over the past three years that covered 345 students at the community college and university levels.
2016 IEEE Smart Energy Grid Engineering (SEGE), 2016
Privacy concerns about smart metering have proven to be a significant roadblock to adoption of th... more Privacy concerns about smart metering have proven to be a significant roadblock to adoption of the smart grid. In the smart grid, electricity usage data are collected in near real time, exposing users to attacks that reveal their habits, location, and preferences. Other research in this area has demonstrated the possibility of using pseudonyms to decouple low-frequency billing data from high-frequency grid maintenance data. Such schemes must provide a way to authenticate the pseudonym as belonging to a real customer, to defend against the submission of false data. However, this authentication process exposes the system to timing attacks that can correlate the authentication of a particular customer with the appearance of a new pseudonym on the network. These timing attacks have been addressed informally in the literature with techniques such as adding a random delay to transmission. The anonymity thus provided is not quantified or guaranteed, and can be subverted with active attacks via the service provider. This paper introduces a method for defeating timing attacks based on the theory of mix networks. The use of a mix formalizes a method of randomizing the order in which authentication attempts are serviced. The mix design is described in detail and it is shown that this method is more resistant to attack and allows for an explicit tradeoff between anonymity and delay.
2012 IEEE Global Communications Conference (GLOBECOM), 2012
Internet continues to grow in number and hence provisioning seamless Internet service to such use... more Internet continues to grow in number and hence provisioning seamless Internet service to such user is a topic of major interest. With new mobility architectures being investigated, it is important to have consistent comparative platforms and metrics. In this article, we introduce a novel and user-centric handoff cost framework to analyze handoff performance of different mobility schemes. The proposed framework helps examine the impacts of registration costs, signaling overhead, and data loss for Internet connected mobile users employing a unified ...
ABSTRACT As people increasingly rely on computer systems and networks for services such as online... more ABSTRACT As people increasingly rely on computer systems and networks for services such as online banking, online shopping, and socialization, information security for identity protection and privacy has become more important today than ever. Businesses and organizations are also obligated to provide such security to comply with state and federal laws and regulations. Managing security risks and ensuring compliance with information security regulations and industry standards have become important for businesses and ...
IEEE International Conference on Mobile Adhoc and Sensor Systems Conference, 2005.
Abstract Wireless ad-hoc networks are vulnerable to various kinds of security threats and attacks... more Abstract Wireless ad-hoc networks are vulnerable to various kinds of security threats and attacks due to relative ease of access to wireless medium and lack of a centralized infrastructure. In this paper, we seek to detect and mitigate the denial of service (DoS) attacks that prevent authorized users from gaining access to the networks. These attacks affect the service availability and connectivity of the wireless networks and hence reduce the network performance. To this end, we propose a novel cross-layer based intrusion ...
Proceedings of the 13th annual conference on Information technology education - SIGITE '12, 2012
Identifying and attracting talented students to digital forensics programs is a crucial first ste... more Identifying and attracting talented students to digital forensics programs is a crucial first step to developing professionals in this relatively young field. To respond to these challenges, we propose to develop a fun, entertaining, and yet educational forensicscourse suitable for first year students in college, in an effort to identify and attract students to a forensics program. This paper focuses on the design and development of a gamebased forensics course using the game-based learning (GBL) approach building the game in a real computing environment that has direct access to actual forensics tools from a forensics machine and the evidence from a suspect machine. Interactive visualizations will be used to help students to understand the intangible and inaccessible abstract concepts such as deleted/hidden/encrypted/over-written digital evidence.
Uploads
Papers by Sumita Mishra