Submitted by Filipe dos Santos (fsantos@pucsp.br) on 2018-09-26T10:04:28Z No. of bitstreams: 1 Ricardo Vieira de Souza.pdf: 1123440 bytes, checksum: e5ceefcb485691ee0e19257f666d7604 (MD5) / Made available in DSpace on 2018-09-26T10:04:28Z (GMT). No. of bitstreams: 1 Ricardo Vieira de Souza.pdf: 1123440 bytes, checksum: e5ceefcb485691ee0e19257f666d7604 (MD5) Previous issue date: 2018-08-24 / This work is based on the concern about the practice of illicit at the transnational level facilitated by the incessant and always renewed improvement of communication through the world wide web. If on the one hand, the internet, an indisputable product of this network, has favored the connection between people from different parts of the world, on the other hand, has brought cyber-crime to the forefront, which at the same time challenges the establishment of a criminal guardianship for cyberspace in impunity. This is due to the phenomenon of globalization, which has shortened distances in the face of technological and social advances, and the consequences of criminal law. The present research sought to justify how it is possible before the classical concepts of sovereignty that a state effectively combats transnational cyber crime. For that, points were developed as to how the classic concept of sovereignty is found; the characteristics of cyberspace; and the concepts of jurisdiction and criminal jurisdiction. Thus, a dogmatic criminal and procedural criminal analysis will be carried out if it is possible to establish a transnational criminal jurisdiction as a way of regulating cyberspace / Este trabalho parte da preocupação com a prática de ilícitos em nível transnacional facilitada pelo aprimoramento incessante e sempre renovado da comunicação através da rede mundial de computadores. Se de um lado, a internet, produto indiscutível dessa rede, favoreceu a conexão entre as pessoas de diversas partes do mundo, de outro, trouxe à baila a criminalidade cibernética, que contemporaneamente desafia o estabelecimento de uma tutela penal para o ciberespaço no que tange a impunidade. Isso decorre do fenômeno da globalização, a qual encurtou distâncias em face dos avanços tecnológicos e sociais, e as consequências causadas ao direito penal. A presente pesquisa buscou fundamentar como é possível ante os conceitos clássicos de soberania, que um Estado combata a criminalidade cibernética transnacional de maneira efetiva. Para tanto, foram desenvolvidos pontos de como encontra-se o conceito clássico de soberania; as características do ciberespaço; e os conceitos de jurisdição e competência penal. Torna-se assim efetuar uma análise dogmática penal e processual penal se é possível se instituir uma jurisdição penal transnacional como forma de regular o ciberespaço

Electronic commerce (e-commerce) markets provide benefits for both buyers and sellers; however, because of cyber security risks consumers are reluctant to transact online. Trust in e-commerce is paramount for adoption. Trust as a subject for research has been a term considered in depth by numerous researchers in various fields of study, including psychology and information technology. Various models have been developed in e-commerce to alleviate consumer fears, thus promoting trust in online environments. Third-party web seals and online scanning tools are some of the existing models used in e-commerce environments, but they have some deficiencies, e.g. failure to incorporate compliance, which need to be addressed. This research proposes an e-commerce assurance model for safe online shopping. The machine learning model is called the Page ranking analytical hierarchy process (PRAHP). PRAHP builds complementary strengths of the analytical hierarchy process (AHP) and Page ranking (PR) techniques to evaluate the trustworthiness of web attributes. The attributes that are assessed are Adaptive legislation, Adaptive International Organisation for Standardisation Standards, Availability, Policy and Advanced Security login. The attributes were selected based on the literature reviewed from accredited journals and some of the reputable e-commerce websites. PRAHP’s paradigms were evaluated extensively through detailed experiments on business-to-business, business-to-consumer, cloud-based and general e-commerce websites. The results of the assessments were validated by customer inputs regarding the website. The reliability and robustness of PRAHP was tested by varying the damping factor and the inbound links. In all the experiments, the results revealed that the model provides reliable results to guide customers in making informed purchasing decisions. The research also reveals hidden e-commerce topics that have not received attention, which generates knowledge and opens research questions for future researchers. These ultimately made significant contributions in e-commerce assurance, in areas such as security and compliance through the fusing of AHP and PR, integrated into a decision table for alleviating trustworthiness anxiety in various e-commerce transacting partners, e-commerce platforms and markets. / College of Engineering, Science and Technology / D. Phil. Information Systems

Orientador: Paulo Lício de Geus / Dissertação (mestrado) - Universidade Estadual de Campinas, Instituto de Computação / Made available in DSpace on 2018-10-08T19:16:40Z (GMT). No. of bitstreams: 1 Afonso_VitorMonte_M.pdf: 1149302 bytes, checksum: 7db349dd13a346a3b3e7175d2f7eeaae (MD5) Previous issue date: 2011 / Resumo: Páginas Web com conteúdo malicioso são uma das grandes ameaças à segurança de sistemas atualmente. Elas são a principal forma utilizada por atacantes para instalar programas maliciosos (malware) no sistema operacional dos usuários. Para desenvolver mecanismos de proteção contra essas páginas, elas precisam ser estudadas e entendidas profundamente. Existem diversos sistemas de análise que são capazes de analisar páginas Web, prover informações sobre elas e classificá-las como maliciosas ou benignas. Entretanto, estes sistemas possuem diversas limitações em relação ao tipo de código que pode ser analisado e aos tipos de ataque que podem ser detectados. Para suprir tal deficiência nos sistemas de análise de páginas Web maliciosas foi desenvolvido um sistema, chamado de BroAD (Browser Attacks Detection), que faz a análise destas páginas de forma dinâmica, monitorando tanto as chamadas de sistemas realizadas pelo navegador enquanto as processa, quanto as ações realizadas pelo código JavaScript contido na página. A detecção dos comportamentos maliciosos é feita em quatro etapas, utilizando técnicas de aprendizado de máquina e assinaturas. Estas etapas incluem a detecção de shellcodes, a detecção de anomalias no comportamento do JavaScript e a análise de chamadas de sistema e assinaturas de código JavaScript. Foram realizados testes que demonstram que o sistema desenvolvido possui taxas de detecção superiores aos sistemas do estado-da-arte de análise de páginas Web maliciosas e ainda provê mais informações a respeito delas, levando a um entendimento melhor das amostras. Além disso, são apresentados códigos que podem detectar e evadir facilmente a análise de parte desses sistemas usados na comparação, demonstrando a fragilidade deles / Abstract: Malicious Web applications are a significant threat to computer security today. They are the main way through which attackers manage to install malware on end-user systems. In order to develop protection mechanisms to these threats, the attacks themselves need to be deeply studied and understood. Several analysis systems exist to analyze Web pages, provide information about them and classify them as malicious or benign. However, these systems are limited regarding the type of attacks that can be detected and the programming languages that can be analyzed. In order to fill this gap, a system, called BroAD (Browser Attacks Detection), that is capable of analyzing malicious Web pages, was developed. It monitors both system calls and JavaScript actions and the detection of the malicious behavior is performed in four steps, by the use of machine learning techniques and signatures. These steps include the detection of shellcodes, the anomaly detection of the JavaScript behavior and the analysis of system calls and JavaScript signatures. The results of the performed tests show that the developed system has better detection rates than the state-of-the-art systems in malicious Web pages analysis and also provides more information about these pages, giving a better understanding about their behavior. Besides, codes that can be used to easily detect and evade the analysis of part of those systems are presented, showing their fragility / Mestrado / Ciência da Computação / Mestre em Ciência da Computação

University of Macau / Faculty of Law

University of Macau / Faculty of Law

A decision tree is a graph or model for representing all the alternatives in a decision making process. Most of the methods that generate decision trees for a specific problem use examples of data instances in the decision tree generation process. We propose a new method called "RBDT-1"- rule based decision tree -for learning a decision tree from a set of decision rules that cover the data instances. RBDT-l method uses a set of declarative rules as an input for generating a decision tree. The method's goal is to create on-demand a short and accurate decision tree from a stable or dynamically changing set of rules. The rules used by RBDT-1 could be generated either by an expert or induced directly from a rule induction method or indirectly by extracting them from a decision tree. We conduct a comparative study of RBDT-1 with four existing decision tree methods based on different problems. The outcome of the study shows that in terms of tree complexity (number of nodes and leaves in the decision tree) RBDT-1 compares favorably to AQDT-1 and AQDT-2 which are methods that create decision trees from rules. RBDT-1 compares favorably also to ID3 while is as effective as C4.5 where both (ID3 and C4.5) are famous methods that generate decision trees from data examples. Experiments show that the classification accuracies of the different decision trees produced by the different methods under comparison are equal. To illustrate how RBDT-1 can successfully be applied to an existing real life problem that could benefit from the method, we choose identity application fraud detection. We designed a new unsupervised framework to detect fraudulent applications for identity certificates by extracting identity patterns from the web, and crossing these patterns with information contained in the application forms in order to detect inconsistencies or anomalies. The outcome of this process is submitted to a decision tree classifier generated using RBDT-1 on the fly from a rule base which is derived from heuristics and expert knowledge, and updated as more information are obtained on fraudulent behavior. We evaluate the proposed framework by collecting real identity information online and generating synthetic fraud cases, achieving encouraging performance results.

Most of the attacks and fraudulent activities on the Internet are carried out by malware. In particular, botnets, as state-of-the-art malware, are now considered as the largest threat to Internet security. In this thesis, we focus on addressing the botnet detection problem in an enterprise-like network environment. We present a comprehensive correlation-based framework for multi-perspective botnet detection consisting of detection technologies demonstrated in four complementary systems: BotHunter, BotSniffer, BotMiner, and BotProbe. The common thread of these systems is correlation analysis, i.e., vertical correlation (dialog correlation), horizontal correlation, and cause-effect correlation. All these Bot* systems have been evaluated in live networks and/or real-world network traces. The evaluation results show that they can accurately detect real-world botnets for their desired detection purposes with a very low false positive rate. We find that correlation analysis techniques are of particular value for detecting advanced malware such as botnets. Dialog correlation can be effective as long as malware infections need multiple stages. Horizontal correlation can be effective as long as malware tends to be distributed and coordinated. In addition, active techniques can greatly complement passive approaches, if carefully used. We believe our experience and lessons are of great benefit to future malware detection.

The study focus on child pornography on the Internet as a manifestation of sexual abuse and sexual exploitation of children. The debate centres around the exacerbated effect of child pornography on victims and subsequent effects on the society. Ultimately, the study aims to highlight the various legal and non-legal responses specific to child pornography on the Internet with a view to proffer solutions to African states on how to deal with the problem. The study also lend an African voice to the ongoing debate on how to deal with the problem of child pornography on the Internet

Millions of users world-wide are sharing content using Peer-to-Peer (P2P) networks, such as Skype and Bit Torrent. While such new innovations undoubtedly bring benefits, there are nevertheless some associated threats. One of the main hazards is that P2P worms can penetrate the network, even from a single node and then spread rapidly. Understanding the propagation process of such worms has always been a challenge for researchers. Different techniques, such as simulations and analytical models, have been adopted in the literature. While simulations provide results for specific input parameter values, analytical models are rather more general and potentially cover the whole spectrum of given parameter values. Many attempts have been made to model the worm propagation process in P2P networks. However, the reported analytical models to-date have failed to cover the whole spectrum of all relevant parameters and have therefore resulted in high false-positives. This consequently affects the immunization and mitigation strategies that are adopted to cope with an outbreak of worms. The first key contribution of this thesis is the development of a susceptible, exposed, infectious, and Recovered (SEIR) analytical model for the worm propagation process in a P2P network, taking into account different factors such as the configuration diversity of nodes, user behaviour and the infection time-lag. These factors have not been considered in an integrated form previously and have been either ignored or partially addressed in state-of-the-art analytical models. Our proposed SEIR analytical model holistically integrates, for the first time, these key factors in order to capture a more realistic representation of the whole worm propagation process. The second key contribution is the extension of the proposed SEIR model to the mobile M-SEIR model by investigating and incorporating the role of node mobility, the size of the worm and the bandwidth of wireless links in the worm propagation process in mobile P2P networks. The model was designed to be flexible and applicable to both wired and wireless nodes. The third contribution is the exploitation of a promising modelling paradigm, Agent-based Modelling (ABM), in the P2P worm modelling context. Specifically, to exploit the synergies between ABM and P2P, an integrated ABM-Based worm propagation model has been built and trialled in this research for the first time. The introduced model combines the implementation of common, complex P2P protocols, such as Gnutella and GIA, along with the aforementioned analytical models. Moreover, a comparative evaluation between ABM and conventional modelling tools has been carried out, to demonstrate the key benefits of ease of real-time analysis and visualisation. As a fourth contribution, the research was further extended by utilizing the proposed SEIR model to examine and evaluate a real-world data set on one of the most recent worms, namely, the Conficker worm. Verification of the model was achieved using ABM and conventional tools and by then comparing the results on the same data set with those derived from developed benchmark models. Finally, the research concludes that the worm propagation process is to a great extent affected by different factors such as configuration diversity, user-behaviour, the infection time lag and the mobility of nodes. It was found that the infection propagation values derived from state-of-the-art mathematical models are hypothetical and do not actually reflect real-world values. In summary, our comparative research study has shown that infection propagation can be reduced due to the natural immunity against worms that can be provided by a holistic exploitation of the range of factors proposed in this work.

Text in Afrikaans / Parralel met die snelle groei van rekenaartegnologie en die groteiwordende rol wat rekenaars in ans alledaagse lewe speel, is daar ongelukkig 'n toename in die misbruik van rekenaars. Benewens die wyses om rekenaarmisbruik by wyse van remedies in die siviele reg aan te spreek, is dit hoofsaaklik die taak van die strafreg om sodanige misbruik te kriminaliseer en deur middel van straf sulke misbruik te voorkom en oortreders af te skrik. Uit 'n ontleding van die Suid-Afrikaanse strafreg het dit geblyk dat bestaande misdrywe, beide gemeenregtelik en statuter, nie voldoende rekenaarmisbruik kan kriminaliseer en aanspreek nie. Wetgewing blyk die mees gepaste optossing te wees. Uit 'n regsvergelykende studie van die hantering van rekenaarmisbruik in jurisdiksies waar die wetgewer verskillende benaderings toegepas het, het dit geblyk dat die mees gepaste wyse om rekenaarmisbruik te kriminaliseer sal wees om ongemagtigde rekenaarbetreding as moedermisdaad te bestraf aangesien dit die fondament is waarop enige verdere misbruik van 'n rekenaar gebaseer word. Daarbenewens moet verdere meer spesifieke misbruikshandelinge wyd omskryfword as misdrywe, ten opsigte van meer emstige misbruik na betreding van 'n rekenaar / Parallel with the growth in computer technology and increasing use of computers, there has been an increase in computer misuse. In addition to addressing different methods of computer misuse in terms of civil law remedies, it is mainly the task of the criminal law to criminalise such misuse, prevent computer misuse and deter offenders by means of punishment. It was clear from a study of South African criminal law that existing offences, both statutory and in terms of the common law, do not criminalise and address computer misuse effectively. It therefore seems that legislation would be the most appropriate solution. It appeared from a comparative study of jurisdictions where legislators approach computer misuse differently, that the most effective way of criminalising computer misuse would be to criminalise una1,1thorised computer accessing as basic offence. In addition thereto more specific further acts of serious computer misuse, defined broadly, should be criminalised / Criminal and Procedural Law / LL.M. (Criminal & Procedural Law)