Many automation and power control systems are integrated into the 'Smart Grid' concept for efficiently managing and delivering electric power. This integrated approach created several challenges that need to be taken into consideration such as cyber security issues, information sharing, and regulatory compliance. There are several issues that need to be addressed in the area of cyber security. Currently, there are no metrics for evaluating cyber security and methodologies to detect cyber attacks are in their infancy. There is a perceived lack of security built into the smart grid systems, but there is no mechanism for information sharing on cyber security incidents. In this thesis, we discuss the vulnerabilities in power system devices, and present ideas and a proposal towards multiple-threat system intrusion detection. We propose to test the multiple-threat methods for cyber security monitoring on a multi-laboratory test bed, and aid the development of a SCADA test bed, to be constructed on the Georgia Tech Campus.

Botnets represent one of the most serious threats against Internet security since they serve as platforms that are responsible for the vast majority of large-scale and coordinated cyber attacks, such as distributed denial of service, spamming, and information stolen. Detecting botnets is therefore of great importance and a number of network-based botnet detection systems have been proposed. However, as botnets perform attacks in an increasingly stealthy way and the volume of network traffic is rapidly growing, existing botnet detection systems are faced with significant challenges in terms of effectiveness and scalability. The objective of this dissertation is to build novel network-based solutions that can boost both the effectiveness of existing botnet detection systems by detecting botnets whose attacks are very hard to be observed in network traffic, and their scalability by adaptively sampling network packets that are likely to be generated by botnets. To be specific, this dissertation describes three unique contributions. First, we built a new system to detect drive-by download attacks, which represent one of the most significant and popular methods for botnet infection. The goal of our system is to boost the effectiveness of existing drive-by download detection systems by detecting a large number of drive-by download attacks that are missed by these existing detection efforts. Second, we built a new system to detect botnets with peer-to-peer (P2P) command&control (C&C) structures (i.e., P2P botnets), where P2P C&Cs represent currently the most robust C&C structures against disruption efforts. Our system aims to boost the effectiveness of existing P2P botnet detection by detecting P2P botnets in two challenging scenarios: i) botnets perform stealthy attacks that are extremely hard to be observed in the network traffic; ii) bot-infected hosts are also running legitimate P2P applications (e.g., Bittorrent and Skype). Finally, we built a novel traffic analysis framework to boost the scalability of existing botnet detection systems. Our framework can effectively and efficiently identify a small percentage of hosts that are likely to be bots, and then forward network traffic associated with these hosts to existing detection systems for fine-grained analysis, thereby boosting the scalability of existing detection systems. Our traffic analysis framework includes a novel botnet-aware and adaptive packet sampling algorithm, and a scalable flow-correlation technique.

Online communities are growing at a phenomenal rate and with the large number of users these communities contain, attackers are drawn to exploit these users. Denial of information (DoI) attacks and information leakage attacks are two popular attacks that target users on online communities. These information based attacks are linked by their opposing views on low-quality information. On the one hand denial of information attacks which primarily use low-quality information (such as spam and phishing) are a nuisance for information consumers. On the other hand information leakage attacks, which use inadvertently leaked information, are less effective when low-quality information is used, and thus leakage of low-quality information is prefered by private information producers. In this dissertation, I introduce techniques for preventing abuse against these attacks in online communities using meta-model classification and information unification approaches, respectively. The meta-model classification approach involves classifying the ``connected payload" associated with the information and using the classification result for the determination. This approach allows for detection of DoI attacks in emerging domains where the amount of information may be constrained. My information unification approach allows for modeling and mitigating information leakage attacks. Unifying information across domains followed by a quantificiation of the information leaked, provides one of the first studies on users' susceptibality to information leakage attacks. Further, the modeling introduced allows me to quantify the reduced threat of information leakage attacks after applying information cloaking.

published_or_final_version / Computer Science / Doctoral / Doctor of Philosophy

published_or_final_version / Electrical and Electronic Engineering / Doctoral / Doctor of Philosophy

M. Tech. Information Networks / The increasing sophistication of information security threats and the ever-growing body of regulation has made information security a critical function in higher education institutions. Research was undertaken to investigate the implementation of information security strategies in higher education institutions in South Africa. This thesis investigates the following: How will the formulation of an information security strategy improve information security in higher education institutions; in what way should higher education institutions employ information security policies in order to improve information security; and how may the adoption of information security framework create information security awareness among employees in higher education institutions?

published_or_final_version / abstract / toc / Computer Science and Information Systems / Master / Master of Philosophy

No description available.

Mobile ad hoc networks (MANETs) are generating much interest both in academia and the telecommunication industries. The principal attractions of MANETs are related to the ease with which they can be deployed due to their infrastructure-less and decentralized nature. For example, unlike other wireless networks, MANETs do not require centralized infrastructures such as base stations, and they are arguably more robust due to their avoidance of single point of failures. Interestingly, the attributes that make MANETs attractive as a network paradigm are the same phenomena that compound the challenge of designing adequate security schemes for these innovative networks. / One of the challenging security problems is the issue of certificate revocation in MANETs where there are no on-line access to trusted authorities. In wired network environments, when certificates are to be revoked, certificate authorities (CAs) add the information regarding the certificates in question to certificate revocation lists (CRLs) and post the CRLs on accessible repositories or distribute them to relevant entities. In purely ad hoc networks, there are typically no access to centralized repositories or trusted authorities; therefore the conventional method of certificate revocation is not applicable. / Another challenging MANET security problem is the issue of secure routing in the presence of selfish or adversarial entities which selectively drop packets they agreed to forward; and in so doing these selfish or adversarial entities can disrupt the network traffic and cause various communication problems. / In this thesis, we present two security protocols we developed for addressing the above-mentioned MANET security needs. The first protocol is a decentralized certificate revocation scheme which allows the nodes within a MANET to have full control over the process of certificate revocation. The scheme is fully contained and it does not rely on any input from centralized or external entities such as trusted CAs. The second protocol is a secure MANET routing scheme we named Robust Source Routing (RSR). In addition to providing data origin authentication services and integrity checks, RSR is able to mitigate against intelligent, colluding malicious agents which selectively drop or modify packets they are required to forward.

Ecommerce refers to the buying and selling of products and services electronically via the Internet and other computer networks (Electronic Commerce 2011). The critical components of ecommerce are a well designed website and a merchant account for payment by the customer (Ecommerce critical components 2008). Merchants that sell their products and services via the Internet have a competitive edge over those that do not. It is therefore becoming common practice for both small and large business to transact electronically. With the vast opportunities, new risks and vulnerabilities are introduced. Consumers are reluctant to transact electronically because of the fear of unauthorized access and interception of confidential information (Online Banking Concerns 2011). Other fears include the changing of data with malicious intent, denial of use, hacking, deliberate disclosure of confidential information and e-mail associated risks (Safeena, Abdulla & Date 2010). The use of technology such as encryption and decryption has not adequately addressed these problems because fraudsters have found new and sophisticated methods of attaining consumer information illegally. Phishing is one such method. Phishing results in identity theft and financial fraud when the fraudster tricks the online users into giving their confidential information like passwords, identity numbers, credit card number and personal information such as birthdates and maiden names. The fraudster will then use the information to impersonate the victim to transfer funds from the victim‟s account or use the victim‟s information to make purchases (Srivastava 2007). Since 2002, many laws passed in South Africa have attempted to allay fears so that consumers can conduct business electronically with confidence. The following legislation aims to protect consumers: - The Electronic Communications and Transactions Act (Republic of South Africa 2002). - The Consumer Protection Act (Republic of South Africa 2008). - The Protection of Personal Information Bill which is expected to be passed in 2011 (Republic of South Africa 2009). This research aims to examine the extent to which these legislation can address the security concerns of consumers. The researcher is also interested in ascertaining how knowledgeable consumers are on these legislation and what their attitudes are towards their personal information security. / Thesis (M.Com.)-University of KwaZulu-Natal, Westville, 2011.