M.Com. (Informatiks) / Please refer to full text to view abstract

by Chan Pui Chung. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2002. / Includes bibliographical references (leaves [56]-[61]). / Abstracts in English and Chinese. / Chapter 1 --- Introduction --- p.1 / Chapter 1.1 --- The Trends --- p.1 / Chapter 1.2 --- What this Thesis Contains --- p.3 / Chapter 2 --- Background --- p.5 / Chapter 2.1 --- Computer Security --- p.5 / Chapter 2.2 --- Anti-intrusion Techniques --- p.6 / Chapter 2.3 --- The Need for Intrusion Detection System --- p.7 / Chapter 2.4 --- Intrusion Detection System Categorization --- p.8 / Chapter 2.4.1 --- Network-based vs. Host-based --- p.8 / Chapter 2.4.2 --- Anomaly Detection vs. Misuse Detection --- p.10 / Chapter 2.4.3 --- Centralized vs. Distributed --- p.11 / Chapter 2.5 --- Agent-based IDS --- p.12 / Chapter 2.6 --- Mobile agent-based IDS --- p.12 / Chapter 3 --- Survey on Intrusion Step --- p.14 / Chapter 3.1 --- Introduction --- p.14 / Chapter 3.2 --- Getting information before break in --- p.14 / Chapter 3.2.1 --- Port scanning --- p.14 / Chapter 3.2.2 --- Sniffing --- p.16 / Chapter 3.2.3 --- Fingerprinting --- p.17 / Chapter 3.3 --- Intrusion method --- p.17 / Chapter 3.3.1 --- DOS and DDOS --- p.17 / Chapter 3.3.2 --- Password cracking --- p.18 / Chapter 3.3.3 --- Buffer overflows --- p.19 / Chapter 3.3.4 --- Race Condition --- p.20 / Chapter 3.3.5 --- Session Hijacking --- p.20 / Chapter 3.3.6 --- Computer Virus --- p.21 / Chapter 3.3.7 --- Worms --- p.21 / Chapter 3.3.8 --- Trojan Horse --- p.22 / Chapter 3.3.9 --- Social Engineering --- p.22 / Chapter 3.3.10 --- Physical Attack --- p.23 / Chapter 3.4 --- After intrusion --- p.23 / Chapter 3.4.1 --- Covering Tracks --- p.23 / Chapter 3.4.2 --- Back-doors --- p.23 / Chapter 3.4.3 --- Rootkits --- p.23 / Chapter 3.5 --- Conclusion --- p.24 / Chapter 4 --- A Survey on Intrusion Detection System --- p.25 / Chapter 4.1 --- Introduction --- p.25 / Chapter 4.2 --- Information Source --- p.25 / Chapter 4.2.1 --- Host-based Source --- p.25 / Chapter 4.2.2 --- Network-based Source --- p.26 / Chapter 4.2.3 --- Out-of-band Source --- p.27 / Chapter 4.2.4 --- Data Fusion from multiple sources --- p.27 / Chapter 4.3 --- Detection Technology --- p.28 / Chapter 4.3.1 --- Intrusion signature --- p.28 / Chapter 4.3.2 --- Threshold Detection --- p.31 / Chapter 4.3.3 --- Statistical Analysis --- p.31 / Chapter 4.3.4 --- Neural Network --- p.32 / Chapter 4.3.5 --- Artificial Immune System --- p.33 / Chapter 4.3.6 --- Data Mining --- p.33 / Chapter 4.3.7 --- Traffic Analysis --- p.34 / Chapter 4.4 --- False Alarm Rate --- p.35 / Chapter 4.5 --- Response --- p.35 / Chapter 4.6 --- Difficulties in IDS --- p.36 / Chapter 4.6.1 --- Base Rate Fallacy --- p.36 / Chapter 4.6.2 --- Denial of Service Attack against IDS --- p.37 / Chapter 4.6.3 --- Insertion and Evasion attack against the Network-Based IDS . --- p.37 / Chapter 4.7 --- Conclusion --- p.38 / Chapter 5 --- Preemptive Distributed Intrusion Detection using Mobile Agents --- p.39 / Chapter 5.1 --- Introduction --- p.39 / Chapter 5.2 --- Architecture Design --- p.40 / Chapter 5.2.1 --- Overview --- p.40 / Chapter 5.2.2 --- Agents involved --- p.40 / Chapter 5.2.3 --- Clustering --- p.42 / Chapter 5.3 --- How it works --- p.44 / Chapter 5.3.1 --- Pseudo codes of operations --- p.48 / Chapter 5.4 --- Advantages --- p.49 / Chapter 5.5 --- Drawbacks & Possible Solutions --- p.49 / Chapter 5.6 --- Other Possible Mode of Operation --- p.50 / Chapter 5.7 --- Conclusion --- p.51 / Chapter 6 --- Conclusion --- p.52 / A Paper Derived from this Thesis --- p.54 / Bibliography --- p.55

Yu Chiu-Man. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2002. / Includes bibliographical references (leaves 93-96). / Abstracts in English and Chinese. / Abstract --- p.i / Acknowledgements --- p.ii / Chapter 1 --- Introduction --- p.1 / Chapter 1.1 --- Advantages of mobile agents --- p.2 / Chapter 1.2 --- Security --- p.3 / Chapter 1.3 --- Contributions --- p.3 / Chapter 1.4 --- Structure --- p.4 / Chapter 2 --- The Problem of Execution Tampering Attack --- p.5 / Chapter 2.1 --- Mobile agent execution model --- p.5 / Chapter 2.2 --- Tampering attack from malicious hosts --- p.5 / Chapter 2.3 --- Open network environment --- p.6 / Chapter 2.4 --- Conclusion --- p.6 / Chapter 3 --- Existing Approaches to Solve the Execution Tampering Prob- lem --- p.8 / Chapter 3.1 --- Introduction --- p.8 / Chapter 3.2 --- Trusted execution environment --- p.9 / Chapter 3.2.1 --- Closed system --- p.9 / Chapter 3.2.2 --- Trusted hardware --- p.9 / Chapter 3.3 --- Tamper-detection --- p.11 / Chapter 3.3.1 --- Execution tracing --- p.11 / Chapter 3.4 --- Tamper-prevention --- p.12 / Chapter 3.4.1 --- Blackbox security --- p.12 / Chapter 3.4.2 --- Time limited blackbox --- p.13 / Chapter 3.4.3 --- Agent mess-up --- p.15 / Chapter 3.4.4 --- Addition of noisy code --- p.15 / Chapter 3.4.5 --- Co-operating agents --- p.16 / Chapter 3.5 --- Conclusion --- p.17 / Chapter 4 --- Tamper-Detection Mechanism of Our Protocol --- p.18 / Chapter 4.1 --- Introduction --- p.18 / Chapter 4.2 --- Execution tracing --- p.18 / Chapter 4.3 --- Code obfuscation --- p.21 / Chapter 4.3.1 --- Resilience of obfuscating transformation --- p.22 / Chapter 4.4 --- Execution tracing with obfuscated program --- p.23 / Chapter 4.5 --- Conclusion --- p.27 / Chapter 5 --- A Flexible Tamper-Detection Protocol by Using Cooperating Agents --- p.28 / Chapter 5.1 --- Introduction --- p.28 / Chapter 5.1.1 --- Agent model --- p.29 / Chapter 5.1.2 --- Execution model --- p.30 / Chapter 5.1.3 --- System model --- p.30 / Chapter 5.1.4 --- Failure model --- p.30 / Chapter 5.2 --- The tamper-detection protocol --- p.30 / Chapter 5.3 --- Fault-tolerance policy --- p.38 / Chapter 5.4 --- Costs of the protocol --- p.38 / Chapter 5.5 --- Discussion --- p.40 / Chapter 5.6 --- Conclusion --- p.42 / Chapter 6 --- Verification of the Protocol by BAN Logic --- p.43 / Chapter 6.1 --- Introduction --- p.43 / Chapter 6.2 --- Modifications to BAN logic --- p.44 / Chapter 6.3 --- Term definitions --- p.45 / Chapter 6.4 --- Modeling of our tamper-detection protocol --- p.46 / Chapter 6.5 --- Goals --- p.47 / Chapter 6.6 --- Sub-goals --- p.48 / Chapter 6.7 --- Assumptions --- p.48 / Chapter 6.8 --- Verification --- p.49 / Chapter 6.9 --- Conclusion --- p.53 / Chapter 7 --- Experimental Results Related to the Protocol --- p.54 / Chapter 7.1 --- Introduction --- p.54 / Chapter 7.2 --- Experiment environment --- p.54 / Chapter 7.3 --- Experiment procedures --- p.55 / Chapter 7.4 --- Experiment implementation --- p.56 / Chapter 7.5 --- Experimental results --- p.61 / Chapter 7.6 --- Conclusion --- p.65 / Chapter 8 --- Extension to Solve the ´حFake Honest Host´ح Problem --- p.68 / Chapter 8.1 --- Introduction --- p.68 / Chapter 8.2 --- "The method to solve the ""fake honest host"" problem" --- p.69 / Chapter 8.2.1 --- Basic idea --- p.69 / Chapter 8.2.2 --- Description of the method --- p.69 / Chapter 8.3 --- Conclusion --- p.71 / Chapter 9 --- Performance Improvement by Program Slicing --- p.73 / Chapter 9.1 --- Introduction --- p.73 / Chapter 9.2 --- Deployment of program slicing --- p.73 / Chapter 9.3 --- Conclusion --- p.75 / Chapter 10 --- Increase Scalability by Supporting Multiple Mobile Agents --- p.76 / Chapter 10.1 --- Introduction --- p.76 / Chapter 10.2 --- Supporting multiple mobile agents --- p.76 / Chapter 10.3 --- Conclusion --- p.78 / Chapter 11 --- Deployment of Trust Relationship in the Protocol --- p.79 / Chapter 11.1 --- Introduction --- p.79 / Chapter 11.2 --- Deployment of trust relationship --- p.79 / Chapter 11.3 --- Conclusion --- p.82 / Chapter 12 --- Conclusions and Future Work --- p.83 / A Data of Experimental Results --- p.86 / Publication --- p.92 / Bibliography --- p.93

Bi, Suzhi. / Thesis (Ph.D.)--Chinese University of Hong Kong, 2013. / Includes bibliographical references (leaves 113-119). / Electronic reproduction. Hong Kong : Chinese University of Hong Kong, [2012] System requirements: Adobe Acrobat Reader. Available via World Wide Web. / Abstract also in Chinese.

Thesis (M. Eng. and S.B.)--Massachusetts Institute of Technology, Dept. of Electrical Engineering and Computer Science, 2004. / Includes bibliographical references (p. 51-54). / The Regions network architecture is a new look at network organization that groups nodes into regions based on common purposes. This shift from strict network topology groupings of nodes requires a change in security systems. This thesis designs and implements the Regions Security Policy (RSP). RSP allows a unified security policy to be set across a region, fully controlling data as it enters into, exits from, and transits within a region. In doing so, it brings together several existing security solutions so as to provide security comparable to existing systems that is more likely to function correctly. / by Joshua W. Baratz. / M.Eng.and S.B.

Ping Yan. / Thesis submitted in: December 2004. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2005. / Includes bibliographical references (leaves 93-100). / Abstracts in English and Chinese. / Abstract --- p.i / Acknowledgement --- p.iii / Chapter 1 --- INTRODUCTION --- p.1 / Chapter 1.1 --- The Problem --- p.1 / Chapter 1.2 --- Research Motivations and Objectives --- p.3 / Chapter 1.3 --- The Rationale --- p.8 / Chapter 1.4 --- Thesis Organization --- p.9 / Chapter 2 --- BACKGROUND STUDY --- p.10 / Chapter 2.1 --- Distributed Denial of Service Attacks --- p.10 / Chapter 2.1.1 --- Taxonomy of DoS and DDoS Attacks --- p.13 / Chapter 2.2 --- IP Traceback --- p.17 / Chapter 2.2.1 --- Assumptions --- p.18 / Chapter 2.2.2 --- Problem Model and Performance Metrics --- p.20 / Chapter 2.3 --- IP Traceback Proposals --- p.24 / Chapter 2.3.1 --- Probabilistic Packet Marking (PPM) --- p.24 / Chapter 2.3.2 --- ICMP Traceback Messaging --- p.26 / Chapter 2.3.3 --- Logging --- p.27 / Chapter 2.3.4 --- Tracing Hop-by-hop --- p.29 / Chapter 2.3.5 --- Controlled Flooding --- p.30 / Chapter 2.4 --- DDoS Attack Countermeasures --- p.30 / Chapter 2.4.1 --- Ingress/Egress Filtering --- p.33 / Chapter 2.4.2 --- Route-based Distributed Packet Filtering (DPF) --- p.34 / Chapter 2.4.3 --- IP Traceback Based Intelligent Packet Filtering --- p.35 / Chapter 2.4.4 --- Source-end DDoS Attack Recognition and Defense --- p.36 / Chapter 2.4.5 --- Classification of DDoS Defense Methods --- p.38 / Chapter 3 --- ADAPTIVE PACKET MARKING SCHEME --- p.41 / Chapter 3.1 --- Scheme Overview --- p.41 / Chapter 3.2 --- Adaptive Packet Marking Scheme --- p.44 / Chapter 3.2.1 --- Design Motivation --- p.44 / Chapter 3.2.2 --- Marking Algorithm Basics --- p.46 / Chapter 3.2.3 --- Domain id Marking --- p.49 / Chapter 3.2.4 --- Router id Marking --- p.51 / Chapter 3.2.5 --- Attack Graph Reconstruction --- p.53 / Chapter 3.2.6 --- IP Header Overloading --- p.56 / Chapter 3.3 --- Experiments on the Packet Marking Scheme --- p.59 / Chapter 3.3.1 --- Simulation Set-up --- p.59 / Chapter 3.3.2 --- Experimental Results and Analysis --- p.61 / Chapter 4 --- DDoS DEFENSE SCHEMES --- p.67 / Chapter 4.1 --- Scheme I: Packet Filtering at Victim-end --- p.68 / Chapter 4.1.1 --- Packet Marking Scheme Modification --- p.68 / Chapter 4.1.2 --- Packet Filtering Algorithm --- p.69 / Chapter 4.1.3 --- Determining the Filtering Probabilities --- p.70 / Chapter 4.1.4 --- Suppressing Packets Filtering with did Markings from Nearby Routers --- p.73 / Chapter 4.2 --- Scheme II: Rate Limiting at the Sources --- p.73 / Chapter 4.2.1 --- Algorithm of the Rate-limiting Scheme --- p.74 / Chapter 4.3 --- Performance Measurements for Scheme I & Scheme II . --- p.77 / Chapter 5 --- CONCLUSION --- p.87 / Chapter 5.1 --- Contributions --- p.87 / Chapter 5.2 --- Discussion and Future Work --- p.91 / Bibliography --- p.100

The Internet and computer networks have become an important part of our organizations and everyday life. With the increase in our dependence on computers and communication networks, malicious activities have become increasingly prevalent. Network attacks are an important problem in today’s communication environments. The network traffic must be monitored and analyzed to detect malicious activities and attacks to ensure reliable functionality of the networks and security of users’ information. Recently, machine learning techniques have been applied toward the detection of network attacks. Machine learning models are able to extract similarities and patterns in the network traffic. Unlike signature based methods, there is no need for manual analyses to extract attack patterns. Applying machine learning algorithms can automatically build predictive models for the detection of network attacks. This dissertation reports an empirical analysis of the usage of machine learning methods for the detection of network attacks. For this purpose, we study the detection of three common attacks in computer networks: SSH brute force, Man In The Middle (MITM) and application layer Distributed Denial of Service (DDoS) attacks. Using outdated and non-representative benchmark data, such as the DARPA dataset, in the intrusion detection domain, has caused a practical gap between building detection models and their actual deployment in a real computer network. To alleviate this limitation, we collect representative network data from a real production network for each attack type. Our analysis of each attack includes a detailed study of the usage of machine learning methods for its detection. This includes the motivation behind the proposed machine learning based detection approach, the data collection process, feature engineering, building predictive models and evaluating their performance. We also investigate the application of feature selection in building detection models for network attacks. Overall, this dissertation presents a thorough analysis on how machine learning techniques can be used to detect network attacks. We not only study a broad range of network attacks, but also study the application of different machine learning methods including classification, anomaly detection and feature selection for their detection at the host level and the network level. / Includes bibliography. / Dissertation (Ph.D.)--Florida Atlantic University, 2017. / FAU Electronic Theses and Dissertations Collection

近年雲存儲發展迅速，它具彈性的收費模式還有使用上的便利性吸引了不少用家把它當作一個備份的平台，如何保障雲端上資料的完整性也就成了一項重要的課題。我們試著探討如何能有效地在客戶端檢查雲端上資料的完整性，並且在探測到雲存儲節點故障以後如何有效地進行修復。抹除碼(Erasure codes)透過產生冗餘，令編碼過後的資料能允許一定程度的缺片。雲端使用者可以利用抹除碼把檔案分散到不同的雲節點，即使其中一些節點壞了用戶還是能透過解碼餘下的資料來得出原檔。我們的研究是基於一種叫再造編碼(Regenerating code)的新興抹除碼。再造編碼借用了網絡編碼(Network coding)的概念，使得在修復錯誤節點的時候並不需要把完整的原檔先重構一遍，相比起一些傳統的抹除碼（如里德所羅門碼Reed-Solomoncode）能減少修復節點時需要下載的資料量。其中我們在FMSR這門再造編碼上實現了一個能有效檢測錯誤的系統FMSR-DIP。FMSR-DIP的好處是在檢測的時候只需要下載一小部份的資料，而且不要求節點有任何的編碼能力，可以直接對應現今的雲存儲。為了驗證我們系統的實用性，我們在雲存儲的測試平台上運行了一系列的測試。 / To protect outsourced data in cloud storage against corruptions, enabling integrity protection, fault tolerance, and efficient recovery for cloud storage becomes critical. To enable fault tolerance from a client-side perspective, users can encode their data with an erasure code and stripe the encoded data across different cloud storage nodes. We base our work on regenerating codes, a recently proposed type of erasure code that borrows the concept of network coding and requires less repair traffic than traditional erasure codes during failure recovery. We study the problem of remotely checking the integrity of regenerating-coded data against corruptions under a real-life cloud storage setting. Specifically, we design a practical data integrity protection (DIP) scheme for a specific regenerating code, while preserving the intrinsic properties of fault tolerance and repair traffic saving. Our DIP scheme is designed under the Byzantine adversarial model, and enables a client to feasibly verify the integrity of random subsets of outsourced data against general or malicious corruptions. It works under the simple assumption of thin-cloud storage and allows different parameters to be fine-tuned for the performance-security trade-off. We implement and evaluate the overhead of our DIP scheme in a cloud storage testbed under different parameter choices. We demonstrate that remote integrity checking can be feasibly integrated into regenerating codes in practical deployment. / Detailed summary in vernacular field only. / Chen, Chuk Hin Henry. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2012. / Includes bibliographical references (leaves 38-41). / Abstracts also in Chinese. / Chapter 1 --- Introduction --- p.1 / Chapter 2 --- Preliminaries --- p.4 / Chapter 2.1 --- FMSR Implementation --- p.4 / Chapter 2.2 --- Threat Model --- p.6 / Chapter 2.3 --- Cryptographic Primitives --- p.7 / Chapter 3 --- Design --- p.8 / Chapter 3.1 --- Design Goals --- p.8 / Chapter 3.2 --- Notation --- p.9 / Chapter 3.3 --- Overview of FMSR-DIP --- p.11 / Chapter 3.4 --- Basic Operations --- p.11 / Chapter 3.4.1 --- Upload operation --- p.11 / Chapter 3.4.2 --- Check operation --- p.13 / Chapter 3.4.3 --- Download operation --- p.15 / Chapter 3.4.4 --- Repair operation --- p.16 / Chapter 4 --- Implementation --- p.17 / Chapter 4.1 --- Integration of DIP into NCCloud --- p.17 / Chapter 4.2 --- Instantiating Cryptographic Primitives --- p.18 / Chapter 4.3 --- Trade-off Parameters --- p.19 / Chapter 5 --- Security Analysis --- p.22 / Chapter 5.1 --- Uses of Security Primitives --- p.22 / Chapter 5.2 --- Security Guarantees --- p.23 / Chapter 5.2.1 --- Corrupting an AECC Stripe --- p.23 / Chapter 5.2.2 --- Picking Corrupted Bytes for Checking --- p.25 / Chapter 5.2.3 --- Putting It All Together --- p.26 / Chapter 6 --- Evaluations --- p.27 / Chapter 6.1 --- Running Time Analysis --- p.27 / Chapter 6.2 --- Monetary Cost Analysis --- p.30 / Chapter 6.3 --- Summary --- p.33 / Chapter 7 --- Related Work --- p.34 / Chapter 8 --- Conclusions --- p.37 / Bibliography --- p.38

Computer entertainment is a big business today. Due to the availability of broadband network connections, the Internet is already a platform for many high quality multimedia applications. For example, online theaters and multi-player online games (MOG) are two of the most popular multimedia applications on the Internet. Although the Internet provides us a very convenient channel for data dissemination, its open architecture leads to many security issues. The security problems are especially complicated for computer entertainment applications since we must address both efficiency and security at the same time. In this thesis, we tackle four security issues in different aspects of computer entertainment applications. Specifically, the issues are (1) "to provide secure multimedia streaming while allowing proxy caching by untrusted third parties", (2) "to detect cheating in MOGs other than using conventional labor-intensive methods", (3) "to synchronize game clients in highly-interactive MOGs while resisting cheating in both the application and protocol level", and (4) "to exchange messages in peer-to-peer (P2P) MOGs so that distributed simulation is allowed but information exposure is mitigated". For each of the above issues, we present an effective solution that preserves the architecture of that particular multimedia application and also is feasible and efficient to deploy on the Internet. / Yeung, Siu Fung. / Adviser: John C. S. Lui. / Source: Dissertation Abstracts International, Volume: 70-09, Section: B, page: . / Thesis (Ph.D.)--Chinese University of Hong Kong, 2009. / Includes bibliographical references (leaves 137-142). / Electronic reproduction. Hong Kong : Chinese University of Hong Kong, [2012] System requirements: Adobe Acrobat Reader. Available via World Wide Web. / Electronic reproduction. [Ann Arbor, MI] : ProQuest Information and Learning, [200-] System requirements: Adobe Acrobat Reader. Available via World Wide Web. / Abstracts in English and Chinese. / School code: 1307.

Security protocols provide a communication architecture upon which security-sensitive distributed applications are built. Flaws in security protocols can expose applications to exploitation and manipulation. A number of formal analysis techniques have been applied to security protocols, with the ultimate goal of verifying whether or not a protocol fulfils its stated security requirements. These tools are limited in a number of ways. They are not fully automated and require considerable effort and expertise to operate. The specification languages often lack expressiveness. Furthermore the model checkers often cannot handle large industrial scale protocols due to the enormous number of states generated.Current research is addressing many of the limitations of the older tools by using state-of-the-art search optimisation and modelling techniques. This dissertation examines new ways in which industrial protocols can be analysed and presents abstract communication channels; a method for explicitly specifying assumptions made about the medium over which participants communicate.