Zero-knowledge proof schemes are one of the main building blocks of modern cryptography. Using the Helios voting protocol as a practical example, we show mistakes in the previous understanding of these proof schemes and the resulting security problems. We proceed to define a hierarchy of security notions that solidifies our understanding of proof schemes: weak proof schemes, strong proof schemes and multi-proofs. We argue that the problems in Helios result from its use of weak proofs and show how these proofs can be made strong. We provide the first proof of ballot privacy for full Helios ballots with strong proofs. In Helios, a proof scheme commonly known as Fiat-Shamir-Schnorr is used to strengthen encryption, a construction also known as Signed E1Gamal or more generally, Encrypt+PoK. We show that in the Encrypt+PoK construction, our hierarchy of proof scheme notions corresponds naturally to a well-known hierarchy of security notions for public-key encryption: weal< proofs yield chosen-plain text secure encryption, strong proofs yield non-malleable encryption and multi-proofs yield chosen-ciphertext secure encryption. Next, we ask whether Signed E1Gamal is chosen-ciphertext secure, a question closely related but not identical to whether Fiat-Shamir-Schnorr proofs are multi-proofs. We answer both these questions negatively: under a reasonable assumption, the failure of which would cast doubt on the security of Schnorr-like proofs, we prove that Signed E1Gamal cannot be shown to be chosen-ciphertext secure by a reduction to the security of plain E1Gamal. This answers an open question, to our knowledge first asked by Shoup and Gennaro in a paper published in 1998.

This thesis consists of the research contributions made by Dr. Bhavani Thuraisingham to secure dependable data management between 1985 and 2010. It provides a sample set of papers and my summary and analysis of these papers in the areas of (i) multilevel secure data management, (ii) dependable data management (iii) semantic web, web services and security and (iv) data mining for malware detection. The four areas will be described in four parts. Each part will have an introduction. There are three appendices. My vitae are given in Appendix E. The copyright permissions of all the papers are given in Appendix C. My contributions to each of the papers presented in this thesis are given in Appendix F.

The landscape of cyber security has changed over the past decade from one of disruption and destruction of data to one of espionage and stealth attacks. The current approach is for malware to disguise itself as a non-threatening piece of code in order to bypass detection. The predominant obfuscation technique is that of Packing. Using this approach, malicious files encrypt and compress the malevolent code and store it within the contents of another executable whose sole purpose is to decrypt and execute the code. Utilising this approach removes any mal ware signatures or signs of nefarious intent, as the code is now scrambled. A large number of packers are available online for use or customisation which helps to explain why the vast majority of malware found in the wild is discovered in packed form The research in this thesis addresses the issue of uncovering those executable files which are packed. Being able to detect a packed executable file is a strong indicator that it is potentially a piece of mal ware. The approaches examined in this thesis utilise static analysis techniques to inspect the contents of a suspicious file so it can be classified as packed or non-packed. Utilising this approach does not require the file to be' executed at any stage and therefore minimises the computational overheads associated with doing so as well as reducing the risk of an infection caused by a running instance of mal ware. The use on entropy scoring as a metric for classification is examined and extended upon to produce new detection methodologies. This work also utilises steganalysis techniques to aid in the detection of packed executables with an impressive outcome. The research has contributed new effective methods for malware detection while significantly reducing the complexity and cost for detection.

Computer network systems are constantly under attack or have to deal with attack attempts. The first step in any network's ability to fight against intrusive attacks is to be able to detect intrusions when they are occurring. Intrusion Detection Systems (IDS) are therefore vital in any kind of network, just as antivirus is a vital part of a computer system. With the increasing computer network intrusion sophistication and complexity, most of the victim systems are compromised by sophisticated multi-step attacks. In order to provide advanced intrusion detection capability against the multi-step attacks, it makes sense to adopt a rigorous and generalising view to tackling intrusion attacks. One direction towards achieving this goal is via modelling and consequently, modelling based detection. An IDS is required that has good quality of detection capability, not only to be able to detect higher-level attacks and describe the state of ongoing multi-step attacks, but also to be able to determine the achievement of high-level attack detection even if any of the modelled low-level attacks are missed by the detector, because no alert being generated may represent that the corresponding low-level attack is either not being conducted by the adversary or being conducted by the adversary but evades the detection. This thesis presents an attack tree based intrusion detection to detect multistep attacks. An advanced attack tree modelling technique, Attack Detection Tree, is proposed to model the multi-step attacks and facilitate intrusion detection. In addition, the notion of Quality of Detectability is proposed to describe the ongoing states of both intrusion and intrusion detection. Moreover, a detection uncertainty assessment mechanism is proposed to apply the measured evidence to deal with the uncertainty issues during the assessment process to determine the achievement of high-level attacks even if any modelled low-level incidents may be missing.

A cyber war exists between anti-malware researchers and malware writers. At the heart of this war rages a weapons race that has existed for decades, originating the 19805, with the arrival of the first computer virus. Obfuscation is one of the latest strategies employed by malware writers to camouflage the tell-tale signs of malware and thereby undermine anti-malware software making malware analysis difficult for anti-malware researchers.The the motivation for this research is, therefore, to find a malware detection strategy that is immune to the obfuscation methods used by the malware writers. One approach is to use program run-time traces (dynamic analysis) to perform N~gram analysis. N-gram analysis is the investigation of a program structure using bytes, charactersor text strings. The research presented in this thesis uses dynamic analysis to investigate malwaredetection using a Support Vector Machine (SVM) approach based on N-gram analysis. The key challenges addressed in this research are: Configuration of a host environment that can trace both benign and malicious software programs; SVM configuration using cross~validation to provide a robust classifier; the challenge of feature selection and feature reduction is addressed by first applying a feature filter and then presenting the reduced feature set to the SVM for feature selection. Several filtering methods are investigated and the findings have identified a suitable filter based on Eigenvectors. The final challenge associated with dynamic analysis is the length of time a program has to be run to ensure a correct classification. This is addressed in this research by investigating 14 different program run-lengths The findings show that obfuscated (packed and polymorphic) malware can be detected using a Support Vector Machine classifier with features extracted from program run-length traces.

No description available.

No description available.

No description available.

No description available.

No description available.