Au Man Ho Allen. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2005. / Includes bibliographical references (leaves 60-68). / Abstracts in English and Chinese. / Abstract --- p.i / Acknowledgement --- p.iii / Chapter 1 --- Introduction --- p.1 / Chapter 2 --- Preliminaries --- p.5 / Chapter 2.1 --- Complexity Theory --- p.5 / Chapter 2.2 --- Algebra and Number Theory --- p.7 / Chapter 2.2.1 --- Groups --- p.7 / Chapter 2.2.2 --- Additive Group Zn and Multiplicative Group Z*n --- p.8 / Chapter 2.2.3 --- The Integer Factorization Problem --- p.9 / Chapter 2.2.4 --- Quadratic Residuosity Problem --- p.11 / Chapter 2.2.5 --- Computing e-th Roots (The RSA Problem) --- p.13 / Chapter 2.2.6 --- Discrete Logarithm and Related Problems --- p.13 / Chapter 2.3 --- Public key Cryptography --- p.16 / Chapter 2.3.1 --- Encryption --- p.17 / Chapter 2.3.2 --- Digital Signature --- p.20 / Chapter 2.3.3 --- Identification Protocol --- p.22 / Chapter 2.3.4 --- Hash Function --- p.24 / Chapter 3 --- Paillier Cryptosystems --- p.26 / Chapter 3.1 --- Introduction --- p.26 / Chapter 3.2 --- The Paillier Cryptosystem --- p.27 / Chapter 4 --- Identity-based Cryptography --- p.30 / Chapter 4.1 --- Introduction --- p.31 / Chapter 4.2 --- Identity-based Encryption --- p.32 / Chapter 4.2.1 --- Notions of Security --- p.32 / Chapter 4.2.2 --- Related Results --- p.35 / Chapter 4.3 --- Identity-based Identification --- p.36 / Chapter 4.3.1 --- Security notions --- p.37 / Chapter 4.4 --- Identity-based Signature --- p.38 / Chapter 4.4.1 --- Security notions --- p.39 / Chapter 5 --- Identity-Based Cryptography from Paillier System --- p.41 / Chapter 5.1 --- Identity-based Identification schemes in Paillier setting --- p.42 / Chapter 5.1.1 --- Paillier-IBI --- p.42 / Chapter 5.1.2 --- CGGN-IBI --- p.43 / Chapter 5.1.3 --- GMMV-IBI --- p.44 / Chapter 5.1.4 --- KT-IBI --- p.45 / Chapter 5.1.5 --- Choice of g for Paillier-IBI --- p.46 / Chapter 5.2 --- Identity-based signatures from Paillier system . . --- p.47 / Chapter 5.3 --- Cocks ID-based Encryption in Paillier Setting . . --- p.48 / Chapter 6 --- Concluding Remarks --- p.51 / A Proof of Theorems --- p.53 / Chapter A.1 --- "Proof of Theorems 5.1, 5.2" --- p.53 / Chapter A.2 --- Proof Sketch of Remaining Theorems --- p.58 / Bibliography --- p.60

Ping Yan. / Thesis submitted in: December 2004. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2005. / Includes bibliographical references (leaves 93-100). / Abstracts in English and Chinese. / Abstract --- p.i / Acknowledgement --- p.iii / Chapter 1 --- INTRODUCTION --- p.1 / Chapter 1.1 --- The Problem --- p.1 / Chapter 1.2 --- Research Motivations and Objectives --- p.3 / Chapter 1.3 --- The Rationale --- p.8 / Chapter 1.4 --- Thesis Organization --- p.9 / Chapter 2 --- BACKGROUND STUDY --- p.10 / Chapter 2.1 --- Distributed Denial of Service Attacks --- p.10 / Chapter 2.1.1 --- Taxonomy of DoS and DDoS Attacks --- p.13 / Chapter 2.2 --- IP Traceback --- p.17 / Chapter 2.2.1 --- Assumptions --- p.18 / Chapter 2.2.2 --- Problem Model and Performance Metrics --- p.20 / Chapter 2.3 --- IP Traceback Proposals --- p.24 / Chapter 2.3.1 --- Probabilistic Packet Marking (PPM) --- p.24 / Chapter 2.3.2 --- ICMP Traceback Messaging --- p.26 / Chapter 2.3.3 --- Logging --- p.27 / Chapter 2.3.4 --- Tracing Hop-by-hop --- p.29 / Chapter 2.3.5 --- Controlled Flooding --- p.30 / Chapter 2.4 --- DDoS Attack Countermeasures --- p.30 / Chapter 2.4.1 --- Ingress/Egress Filtering --- p.33 / Chapter 2.4.2 --- Route-based Distributed Packet Filtering (DPF) --- p.34 / Chapter 2.4.3 --- IP Traceback Based Intelligent Packet Filtering --- p.35 / Chapter 2.4.4 --- Source-end DDoS Attack Recognition and Defense --- p.36 / Chapter 2.4.5 --- Classification of DDoS Defense Methods --- p.38 / Chapter 3 --- ADAPTIVE PACKET MARKING SCHEME --- p.41 / Chapter 3.1 --- Scheme Overview --- p.41 / Chapter 3.2 --- Adaptive Packet Marking Scheme --- p.44 / Chapter 3.2.1 --- Design Motivation --- p.44 / Chapter 3.2.2 --- Marking Algorithm Basics --- p.46 / Chapter 3.2.3 --- Domain id Marking --- p.49 / Chapter 3.2.4 --- Router id Marking --- p.51 / Chapter 3.2.5 --- Attack Graph Reconstruction --- p.53 / Chapter 3.2.6 --- IP Header Overloading --- p.56 / Chapter 3.3 --- Experiments on the Packet Marking Scheme --- p.59 / Chapter 3.3.1 --- Simulation Set-up --- p.59 / Chapter 3.3.2 --- Experimental Results and Analysis --- p.61 / Chapter 4 --- DDoS DEFENSE SCHEMES --- p.67 / Chapter 4.1 --- Scheme I: Packet Filtering at Victim-end --- p.68 / Chapter 4.1.1 --- Packet Marking Scheme Modification --- p.68 / Chapter 4.1.2 --- Packet Filtering Algorithm --- p.69 / Chapter 4.1.3 --- Determining the Filtering Probabilities --- p.70 / Chapter 4.1.4 --- Suppressing Packets Filtering with did Markings from Nearby Routers --- p.73 / Chapter 4.2 --- Scheme II: Rate Limiting at the Sources --- p.73 / Chapter 4.2.1 --- Algorithm of the Rate-limiting Scheme --- p.74 / Chapter 4.3 --- Performance Measurements for Scheme I & Scheme II . --- p.77 / Chapter 5 --- CONCLUSION --- p.87 / Chapter 5.1 --- Contributions --- p.87 / Chapter 5.2 --- Discussion and Future Work --- p.91 / Bibliography --- p.100

Leung Kwai Ki. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2006. / Includes bibliographical references (leaves 152-161). / Abstracts in English and Chinese. / Abstract --- p.i / 論文摘要 --- p.iii / Acknowledgements --- p.iv / Chapter 1 --- Introduction --- p.1 / Chapter 1.1 --- Contributions of this thesis --- p.3 / Chapter 1.2 --- Thesis structure --- p.3 / Chapter 2 --- Mobile Agent Paradigm --- p.6 / Chapter 3 --- Analysis on Fault-tolerant Mechanisms --- p.9 / Chapter 3.1 --- Design considerations --- p.9 / Chapter 3.1.1 --- Infrastructure failure --- p.10 / Chapter 3.1.2 --- Unfavorable outcomes --- p.10 / Chapter 3.1.3 --- Exactly-once property --- p.11 / Chapter 3.1.4 --- Blocking --- p.13 / Chapter 3.1.5 --- Network partitioning --- p.14 / Chapter 3.1.6 --- Domino effect --- p.15 / Chapter 3.1.7 --- Inter-agent communications and global consistency --- p.16 / Chapter 3.1.8 --- Platform dependent and platform independent approaches . . --- p.17 / Chapter 3.1.9 --- ACID in mobile agent systems --- p.17 / Chapter 3.2 --- Basic Mechanisms --- p.18 / Chapter 3.2.1 --- Replication mechanisms --- p.19 / Chapter 3.2.2 --- Checkpointing and logging --- p.22 / Chapter 3.2.3 --- Comparison between the replication and checkpointing mechanisms --- p.25 / Chapter 3.2.4 --- Rollback --- p.26 / Chapter 3.2.5 --- Diagnosis and planning --- p.26 / Chapter 3.3 --- Analysis of current approaches --- p.27 / Chapter 3.3.1 --- Infrastructure failure handling --- p.27 / Chapter 3.3.2 --- Unfavorable outcomes prevention --- p.38 / Chapter 3.3.3 --- Diagnosis and planning --- p.40 / Chapter 3.3.4 --- Summary --- p.42 / Chapter 3.4 --- Related work of analysing fault-tolerant mechanisms --- p.43 / Chapter 3.5 --- Summary --- p.43 / Chapter 4 --- Flexible Monitor Chain --- p.45 / Chapter 4.1 --- Overview --- p.45 / Chapter 4.2 --- Assumptions --- p.47 / Chapter 4.3 --- Protocol --- p.48 / Chapter 4.4 --- Different scenarios of failure --- p.51 / Chapter 4.5 --- Performance evaluation --- p.53 / Chapter 4.5.1 --- Simulation model --- p.53 / Chapter 4.5.2 --- Results and discussions --- p.55 / Chapter 4.6 --- Discussions --- p.58 / Chapter 4.6.1 --- Preservation of the exactly-once property --- p.58 / Chapter 4.6.2 --- High flexibility in the management of monitors --- p.59 / Chapter 4.6.3 --- High stability --- p.59 / Chapter 4.6.4 --- Feasibility to be applied in an open environment --- p.60 / Chapter 4.6.5 --- Overcoming the problem of network partitioning --- p.60 / Chapter 4.6.6 --- Lightweightedness --- p.60 / Chapter 4.6.7 --- Global consistency and domino effect --- p.61 / Chapter 4.7 --- Summary --- p.61 / Chapter 5 --- Transaction and Rollback Models --- p.62 / Chapter 5.1 --- Simple E-Marketplace --- p.64 / Chapter 5.2 --- Transaction and rollback models --- p.66 / Chapter 5.2.1 --- Distributed transaction without rollback (Ml) --- p.67 / Chapter 5.2.2 --- A chained-transaction (M2) --- p.67 / Chapter 5.2.3 --- A chained-transaction with flexible rollback scheme (M3) . --- p.69 / Chapter 5.3 --- Performance evaluation --- p.71 / Chapter 5.3.1 --- Experimental setup --- p.71 / Chapter 5.3.2 --- Results and discussions --- p.73 / Chapter 5.4 --- Summary --- p.77 / Chapter 6 --- Dependent Partial Rollback --- p.79 / Chapter 6.1 --- Overview --- p.80 / Chapter 6.2 --- Formal representation --- p.83 / Chapter 6.3 --- Assumptions --- p.85 / Chapter 6.4 --- Protocol --- p.86 / Chapter 6.5 --- Discussions --- p.89 / Chapter 6.5.1 --- Assumption: Weak migration and the effect of a stage --- p.90 / Chapter 6.5.2 --- Assumption: Failure free environment --- p.92 / Chapter 6.5.3 --- Assumption: guarantee of rollback --- p.92 / Chapter 6.5.4 --- Assumption: Domino effect --- p.93 / Chapter 6.5.5 --- Platform independence --- p.94 / Chapter 6.5.6 --- High efficiency --- p.94 / Chapter 6.5.7 --- Stage-based design --- p.94 / Chapter 6.5.8 --- Autonomy --- p.95 / Chapter 6.5.9 --- High flexibility --- p.95 / Chapter 6.6 --- Related Works --- p.96 / Chapter 6.7 --- Implementation of SEMP with dependent partial rollback --- p.97 / Chapter 6.8 --- Summary --- p.99 / Chapter 7 --- Analysis on Security Mechanisms --- p.100 / Chapter 7.1 --- Classifications of security issues --- p.100 / Chapter 7.2 --- Analysis of current approaches --- p.103 / Chapter 7.2.1 --- Encrypting functions and data --- p.103 / Chapter 7.2.2 --- Computing with encrypted functions --- p.106 / Chapter 7.2.3 --- Trusted environment --- p.107 / Chapter 7.2.4 --- Limitation of execution time --- p.109 / Chapter 7.2.5 --- Execution tracing --- p.110 / Chapter 7.3 --- Execution tracing --- p.111 / Chapter 7.4 --- Summary --- p.116 / Chapter 8 --- Execution Tracing with Randomly-Selected Hosts --- p.117 / Chapter 8.1 --- Overview --- p.117 / Chapter 8.2 --- Assumptions --- p.119 / Chapter 8.3 --- Protocol --- p.120 / Chapter 8.4 --- Performance evaluation --- p.121 / Chapter 8.4.1 --- Simple sgent system --- p.121 / Chapter 8.4.2 --- Experimental setup --- p.123 / Chapter 8.4.3 --- Results and discussions --- p.123 / Chapter 8.5 --- Discussions --- p.124 / Chapter 8.5.1 --- Detect the modifications of the code and data --- p.124 / Chapter 8.5.2 --- Against masquerade --- p.125 / Chapter 8.5.3 --- Against skip from re-execution --- p.125 / Chapter 8.5.4 --- Against collaboration --- p.125 / Chapter 8.5.5 --- Higher privacy --- p.126 / Chapter 8.5.6 --- Low workload on the trusted host --- p.126 / Chapter 8.5.7 --- Feasible to be used in the open environment --- p.126 / Chapter 8.5.8 --- Secure data collection --- p.126 / Chapter 8.5.9 --- Comparison with the existing approaches --- p.127 / Chapter 8.5.10 --- Weaknesses --- p.128 / Chapter 8.6 --- Optimizations --- p.128 / Chapter 8.6.1 --- Sampling --- p.128 / Chapter 8.6.2 --- Inserting sub-state and request on demand --- p.129 / Chapter 8.7 --- Summary --- p.129 / Chapter 9 --- FTS Framework --- p.131 / Chapter 9.1 --- Assumptions --- p.132 / Chapter 9.2 --- Abstract framework --- p.132 / Chapter 9.2.1 --- Different agents and their duties --- p.132 / Chapter 9.2.2 --- Messaging --- p.135 / Chapter 9.3 --- Implementation in Jade --- p.135 / Chapter 9.3.1 --- Characteristics of Jade --- p.137 / Chapter 9.3.2 --- Core implementation details --- p.138 / Chapter 9.4 --- Performance Evaluation --- p.144 / Chapter 9.4.1 --- Experimental Setup --- p.144 / Chapter 9.4.2 --- Experimental Results --- p.145 / Chapter 9.5 --- Discussions --- p.147 / Chapter 9.5.1 --- High worker survivability --- p.148 / Chapter 9.5.2 --- Low blocking chance --- p.148 / Chapter 9.5.3 --- Trusted Third Party Hosts --- p.149 / Chapter 9.6 --- Summary --- p.149 / Chapter 10 --- Conclusions and Future Works --- p.150 / Bibliography --- p.152 / Publications --- p.161

The Internet and computer networks have become an important part of our organizations and everyday life. With the increase in our dependence on computers and communication networks, malicious activities have become increasingly prevalent. Network attacks are an important problem in today’s communication environments. The network traffic must be monitored and analyzed to detect malicious activities and attacks to ensure reliable functionality of the networks and security of users’ information. Recently, machine learning techniques have been applied toward the detection of network attacks. Machine learning models are able to extract similarities and patterns in the network traffic. Unlike signature based methods, there is no need for manual analyses to extract attack patterns. Applying machine learning algorithms can automatically build predictive models for the detection of network attacks. This dissertation reports an empirical analysis of the usage of machine learning methods for the detection of network attacks. For this purpose, we study the detection of three common attacks in computer networks: SSH brute force, Man In The Middle (MITM) and application layer Distributed Denial of Service (DDoS) attacks. Using outdated and non-representative benchmark data, such as the DARPA dataset, in the intrusion detection domain, has caused a practical gap between building detection models and their actual deployment in a real computer network. To alleviate this limitation, we collect representative network data from a real production network for each attack type. Our analysis of each attack includes a detailed study of the usage of machine learning methods for its detection. This includes the motivation behind the proposed machine learning based detection approach, the data collection process, feature engineering, building predictive models and evaluating their performance. We also investigate the application of feature selection in building detection models for network attacks. Overall, this dissertation presents a thorough analysis on how machine learning techniques can be used to detect network attacks. We not only study a broad range of network attacks, but also study the application of different machine learning methods including classification, anomaly detection and feature selection for their detection at the host level and the network level. / Includes bibliography. / Dissertation (Ph.D.)--Florida Atlantic University, 2017. / FAU Electronic Theses and Dissertations Collection

Tsang, Hing Chung. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2011. / Includes bibliographical references (leaves 79-92). / Abstracts in English and Chinese. / Abstract --- p.i / Acknowledgement --- p.iv / Chapter 1 --- Introduction --- p.1 / Chapter 1.1 --- Motivation --- p.1 / Chapter 1.2 --- Software Cracking --- p.2 / Chapter 1.3 --- Objectives --- p.4 / Chapter 1.4 --- Contributions --- p.5 / Chapter 1.5 --- Thesis Outline --- p.6 / Chapter 2 --- Related Work --- p.8 / Chapter 2.1 --- Hardware-based Protection --- p.8 / Chapter 2.2 --- Network-based Protection --- p.9 / Chapter 2.3 --- Software-based Protection --- p.11 / Chapter 2.3.1 --- Obfuscation --- p.11 / Chapter 2.3.2 --- Code Encryption --- p.13 / Chapter 2.3.3 --- Virtual Machine --- p.15 / Chapter 2.3.4 --- Self-checksumming --- p.16 / Chapter 2.3.5 --- Watermarking --- p.20 / Chapter 2.3.6 --- Self-modifying Code --- p.22 / Chapter 2.3.7 --- Software Aging --- p.23 / Chapter 3 --- Proposed Protection Scheme --- p.24 / Chapter 3.1 --- Introduction --- p.24 / Chapter 3.2 --- Protector --- p.27 / Chapter 3.2.1 --- A Traditional Protector Structure --- p.28 / Chapter 3.2.2 --- Protector Construction --- p.31 / Chapter "3,2.3" --- Protector Implementation - Version 1 --- p.32 / Chapter 3.2.4 --- Protector Implementation - Version 2 --- p.35 / Chapter 3.2.5 --- Tamper Responses --- p.37 / Chapter 3.3 --- Protection Tree --- p.39 / Chapter 3.4 --- Non-deterministic Execution of Functions --- p.43 / Chapter 3.4.1 --- Introduction to n-version Functions --- p.44 / Chapter 3.4.2 --- Probability Distributions --- p.45 / Chapter 3.4.3 --- Implementation Issues --- p.47 / Chapter 3.5 --- Desired Properties --- p.49 / Chapter 4 --- Cracking Complexity and Security Analysis --- p.52 / Chapter 4.1 --- Cracking Complexity --- p.52 / Chapter 4.2 --- Security Analysis --- p.55 / Chapter 4.2.1 --- Automation Attacks --- p.55 / Chapter 4.2.2 --- Control Flow Graph Analysis --- p.55 / Chapter 4.2.3 --- Cloning Attack --- p.56 / Chapter 4.2.4 --- Dynamic Tracing --- p.56 / Chapter 5 --- Experiments --- p.58 / Chapter 5.1 --- Execution Time Overhead --- p.59 / Chapter 5.2 --- Tamper Responses --- p.67 / Chapter 6 --- Conclusion and Future Work --- p.73 / Chapter 6.1 --- Conclusion --- p.73 / Chapter 6.2 --- Comparison --- p.75 / Chapter 6.3 --- Future Work --- p.77 / Bibliography --- p.79

Enhancing power grids' performance and resilience has been one of the greatest challenges in engineering and science over the past decade. A recent report by the National Academies of Sciences, Engineering, and Medicine along with other studies emphasizes the necessity of deploying new ideas and mathematical tools to address the challenges facing the power grids now and in the future. To full this necessity, numerous grid modernization programs have been initiated in recent years. This thesis focuses on one of the most critical challenges facing power grids which is their vulnerability against failures and attacks. Our approach bridges concepts in power engineering and computer science to improve power grids resilience and security. We analyze the vulnerability of power grids to cyber and physical attacks and failures, design efficient monitoring schemes for robust state estimation, develop algorithms to control the grid under tension, and introduce methods to generate realistic power grid test cases. Our contributions can be divided into four major parts: Power Grid State Prediction: Large scale power outages in Australia (2016), Ukraine (2015), Turkey (2015), India (2013), and the U.S. (2011, 2003) have demonstrated the vulnerability of power grids to cyber and physical attacks and failures. Power grid outages have devastating effects on almost every aspect of modern life as well as on interdependent systems. Despite their inevitability, the effects of failures on power grids' performance can be limited if the system operator can predict and understand the consequences of an initial failure and can immediately detect the problematic failures. To enable these capabilities, we study failures in power grids using computational and analytical tools based on the DC power flow model. We introduce new metrics to efficiently evaluate the severity of an initial failure and develop efficient algorithms to predict its consequences. We further identify power grids' vulnerabilities using these metrics and algorithms. Power Grid State Estimation: In order to obtain an accurate prediction of the subsequent effects of an initial failure on the performance of the grid, the system operator needs to exactly know when and where the initial failure has happened. However, due to lack of enough measurement devices or a cyber attack on the grid, such information may not be available directly to the grid operator via measurements. To address this problem, we develop efficient methods to estimate the state of the grid and detect failures (if any) from partial available information. Power Grid Control: Once an initial failure is detected, prediction methods can be used to predict the subsequent effects of that failure. If the initial failure is causing a cascade of failures in the grid, a control mechanism needs to be applied in order to mitigate its further effects. Power Grid Islanding is an effective method to mitigate cascading failures. The challenge is to partition the network into smaller connected components, called islands, so that each island can operate independently for a short period of time. This is to prevent the system to be separated into unbalanced parts due to cascading failures. To address this problem, we introduce and study the Doubly Balanced Connected graph Partitioning (DBCP) problem and provide an efficient algorithm to partition the power grid into two operating islands. Power Grid Test Cases for Evaluation: In order to evaluate algorithms that are developed for enhancing power grids resilience, one needs to study their performance on the real grid data. However, due to security reasons, such data sets are not publicly available and are very hard to obtain. Therefore, we study the structural properties of the U.S. Western Interconnection grid (WI), and based on the results we present the Network Imitating Method Based on LEarning (NIMBLE) for generating synthetic spatially embedded networks with similar properties to a given grid. We apply NIMBLE to the WI and show that the generated network has similar structural and spatial properties as well as the same level of robustness to cascading failures. Overall, the results provided in this thesis advance power grids' resilience and security by providing a better understanding of the system and by developing efficient algorithms to protect it at the time of failure.

Li, Jiexing. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2008. / Includes bibliographical references (leaves [105]-110). / Abstracts in English and Chinese. / Abstract --- p.i / Acknowledgement --- p.iv / Chapter 1 --- Introduction --- p.1 / Chapter 1.1 --- Problem Statement --- p.1 / Chapter 1.2 --- Contributions --- p.3 / Chapter 1.3 --- Thesis Organization --- p.5 / Chapter 2 --- Background Study --- p.7 / Chapter 2.1 --- Generalization Algorithms --- p.7 / Chapter 2.2 --- Privacy Principles --- p.10 / Chapter 2.3 --- Other Related Research --- p.11 / Chapter 3 --- Anti-Corruption Privacy Preserving Publication --- p.13 / Chapter 3.1 --- Motivation --- p.13 / Chapter 3.2 --- Problem Settings --- p.14 / Chapter 3.3 --- Defects of Generalization --- p.18 / Chapter 3.4 --- Perturbed Generalization --- p.23 / Chapter 3.5 --- Modeling Privacy Attacks --- p.26 / Chapter 3.5.1 --- Corruption-Aided Linking Attacks --- p.26 / Chapter 3.5.2 --- Posterior Confidence Derivation --- p.28 / Chapter 3.6 --- Formal Results --- p.30 / Chapter 3.7 --- Experiments --- p.34 / Chapter 3.8 --- Summary --- p.37 / Chapter 4 --- Preservation of Proximity Privacy --- p.39 / Chapter 4.1 --- Motivation --- p.39 / Chapter 4.2 --- Formalization --- p.40 / Chapter 4.2.1 --- Privacy Attacks --- p.41 / Chapter 4.2.2 --- "(ε, m)-Anonymity" --- p.42 / Chapter 4.3 --- Inadequacy of the Existing Methods --- p.44 / Chapter 4.3.1 --- Inadequacy of Generalization Principles --- p.45 / Chapter 4.3.2 --- Inadequacy of Perturbation --- p.49 / Chapter 4.4 --- "Characteristics of (Epsilon, m) Anonymity" --- p.51 / Chapter 4.4.1 --- A Reduction --- p.51 / Chapter 4.4.2 --- Achievable Range of m Given e1and e2 --- p.53 / Chapter 4.4.3 --- Achievable e1 and e2 Given m --- p.57 / Chapter 4.4.4 --- Selecting the Parameters --- p.60 / Chapter 4.5 --- Generalization Algorithm --- p.61 / Chapter 4.5.1 --- Non-Monotonicity and Predictability --- p.61 / Chapter 4.5.2 --- The Algorithm --- p.63 / Chapter 4.6 --- Experiments --- p.65 / Chapter 4.7 --- Summary --- p.70 / Chapter 5 --- Privacy Preserving Publication for Multiple Users --- p.71 / Chapter 5.1 --- Motivation --- p.71 / Chapter 5.2 --- Problem Definition --- p.74 / Chapter 5.2.1 --- K-Anonymity --- p.75 / Chapter 5.2.2 --- An Observation --- p.76 / Chapter 5.3 --- The Butterfly Method --- p.78 / Chapter 5.3.1 --- The Butterfly Structure --- p.78 / Chapter 5.3.2 --- Anonymization Algorithm --- p.83 / Chapter 5.4 --- Extensions --- p.89 / Chapter 5.4.1 --- Handling More Than Two QIDs --- p.89 / Chapter 5.4.2 --- Handling Collusion --- p.91 / Chapter 5.5 --- Experiments --- p.93 / Chapter 5.6 --- Summary --- p.101 / Chapter 6 --- Conclusions and Future Work --- p.102 / Chapter A --- List of Publications --- p.104 / Bibliography --- p.105

Suen, Ho Yan. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2009. / Includes bibliographical references (leaves 99-104). / Abstract also in Chinese. / Abstract --- p.i / Acknowledgement --- p.iv / Chapter 1 --- Introduction --- p.1 / Chapter 1.1 --- Motivation --- p.1 / Chapter 1.2 --- Organization --- p.4 / Chapter 2 --- Literature Review --- p.6 / Chapter 2.1 --- Related Works --- p.6 / Chapter 2.2 --- Background Study --- p.7 / Chapter 2.2.1 --- World Wide Web --- p.7 / Chapter 2.2.2 --- Distributed Denial of Service Attack --- p.11 / Chapter 2.2.3 --- Tools for Dimension Reduction --- p.13 / Chapter 2.2.4 --- Tools for Anomaly Detection --- p.20 / Chapter 2.2.5 --- Receiver operating characteristics (ROC) Analysis --- p.22 / Chapter 3 --- System Design --- p.25 / Chapter 3.1 --- Methodology --- p.25 / Chapter 3.2 --- System Overview --- p.27 / Chapter 3.3 --- Reference Profile Construction --- p.31 / Chapter 3.4 --- Real-time Anomaly Detection and Response --- p.32 / Chapter 3.5 --- Chapter Summary --- p.34 / Chapter 4 --- Reference Profile Construction --- p.35 / Chapter 4.1 --- Web Access Logs Collection --- p.35 / Chapter 4.2 --- Data Preparation --- p.37 / Chapter 4.3 --- Feature Extraction and Embedding Engine (FEE Engine) --- p.40 / Chapter 4.3.1 --- Sub-Sequence Extraction --- p.42 / Chapter 4.3.2 --- Hash Function on Sub-sequences (optional) --- p.45 / Chapter 4.3.3 --- Feature Vector Construction --- p.46 / Chapter 4.3.4 --- Diffusion Wavelets Embedding --- p.47 / Chapter 4.3.5 --- Numerical Example of Feature Set Reduction --- p.49 / Chapter 4.3.6 --- Reference Profile and Further Use of FEE Engine --- p.50 / Chapter 4.4 --- Chapter Summary --- p.50 / Chapter 5 --- Real-time Anomaly Detection and Response --- p.52 / Chapter 5.1 --- Session Filtering and Data Preparation --- p.54 / Chapter 5.2 --- Feature Extraction and Embedding --- p.54 / Chapter 5.3 --- Distance-based Outlier Scores Calculation --- p.55 / Chapter 5.4 --- Anomaly Detection and Response --- p.56 / Chapter 5.4.1 --- Length-Based Anomaly Detection Modules --- p.56 / Chapter 5.4.2 --- Characteristics of Anomaly Detection Modules --- p.59 / Chapter 5.4.3 --- Dynamic Threshold Adaptation --- p.60 / Chapter 5.5 --- Chapter Summary --- p.63 / Chapter 6 --- Experimental Results --- p.65 / Chapter 6.1 --- Experiment Datasets --- p.65 / Chapter 6.1.1 --- Normal Web Access Logs --- p.66 / Chapter 6.1.2 --- Attack Data Generation --- p.68 / Chapter 6.2 --- ROC Curve Construction --- p.70 / Chapter 6.3 --- System Parameters Selection --- p.71 / Chapter 6.4 --- Performance of Anomaly Detection --- p.82 / Chapter 6.4.1 --- Performance Analysis --- p.85 / Chapter 6.4.2 --- Performance in defending DDoS attacks --- p.87 / Chapter 6.5 --- Computation Requirement --- p.91 / Chapter 6.6 --- Chapter Summary --- p.95 / Chapter 7 --- Conclusion and Future Work --- p.96 / Bibliography --- p.99

Abstract not available

Collaborative environments allow users to share and access data across networks spanning multiple administrative domains and beyond organisational boundaries. This poses several security concerns such as data confidentiality, data privacy and threats to improper data usage. Traditional access control mechanisms focus on centralised systems and implicitly assume that all resources reside in the one domain. This serves as a critical limitation for inter-organisational collaborative environments, which are characteristically decentralised, distributed and heterogeneous. A consequence of the lack of suitable access control mechanisms for inter-organisational collaborative environments is that data owners relinquish all control over data they release. In these environments, we can reasonably consider more complex cases where documents may have multiple contributors, all with differing access control requirements. Facilitating such cases, as well as maintaining control over the document’s content, its structure and its flow path as it circulates through multiple administrative domains, is a non-trival issue. This thesis proposes an architecture model for specifying and enforcing access control restrictions on sensitive data that follows a pre-defined inter-organisational workflow. Our approach is to embed access control enforcement within the workflow object (e.g. the circulating document containing sensitive data) as opposed to relying on each administrative domain to enforce the access control policies. The architecture model achieves this using cryptographic access control – a concept that relies on cryptography to enforce access control policies.