Lau Nga Sin. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2004. / Includes bibliographical references (leaves 101-110). / Abstracts in English and Chinese. / Abstract --- p.i / Acknowledgement --- p.iv / Chapter 1 --- Introduction --- p.1 / Chapter 1.1 --- Research Motivation --- p.2 / Chapter 1.2 --- Problem Statement --- p.3 / Chapter 1.3 --- Research Objectives --- p.4 / Chapter 1.4 --- Structure of the Thesis --- p.6 / Chapter 2 --- Background Study on DDoS Attacks --- p.8 / Chapter 2.1 --- Distributed Denial of Service Attacks --- p.8 / Chapter 2.1.1 --- DDoS Attack Architecture --- p.9 / Chapter 2.1.2 --- DDoS Attack Taxonomy --- p.11 / Chapter 2.1.3 --- DDoS Tools --- p.19 / Chapter 2.1.4 --- DDoS Detection --- p.21 / Chapter 2.2 --- DDoS Countermeasure: Attack Source Traceback --- p.23 / Chapter 2.2.1 --- Link Testing --- p.23 / Chapter 2.2.2 --- Logging --- p.24 / Chapter 2.2.3 --- ICMP-based traceback --- p.26 / Chapter 2.2.4 --- Packet marking --- p.28 / Chapter 2.2.5 --- Comparison of various IP Traceback Schemes --- p.31 / Chapter 2.3 --- DDoS Countermeasure: Packet Filtering --- p.33 / Chapter 2.3.1 --- Ingress Filtering --- p.33 / Chapter 2.3.2 --- Egress Filtering --- p.34 / Chapter 2.3.3 --- Route-based Packet Filtering --- p.35 / Chapter 2.3.4 --- IP Traceback-based Packet Filtering --- p.36 / Chapter 2.3.5 --- Router-based Pushback --- p.37 / Chapter 3 --- Domain-based IP Traceback Scheme --- p.40 / Chapter 3.1 --- Overview of our IP Traceback Scheme --- p.41 / Chapter 3.2 --- Assumptions --- p.44 / Chapter 3.3 --- Proposed Packet Marking Scheme --- p.45 / Chapter 3.3.1 --- IP Markings with Edge Sampling --- p.46 / Chapter 3.3.2 --- Domain-based Design Motivation --- p.48 / Chapter 3.3.3 --- Mathematical Principle --- p.49 / Chapter 3.3.4 --- Marking Mechanism --- p.51 / Chapter 3.3.5 --- Storage Space of the Marking Fields --- p.56 / Chapter 3.3.6 --- Packet Marking Integrity --- p.57 / Chapter 3.3.7 --- Path Reconstruction --- p.58 / Chapter 4 --- Route-based Packet Filtering Scheme --- p.62 / Chapter 4.1 --- Placement of Filters --- p.63 / Chapter 4.1.1 --- At Sources' Networks --- p.64 / Chapter 4.1.2 --- At Victim's Network --- p.64 / Chapter 4.2 --- Proposed Packet Filtering Scheme --- p.65 / Chapter 4.2.1 --- Classification of Packets --- p.66 / Chapter 4.2.2 --- Filtering Mechanism --- p.67 / Chapter 5 --- Performance Evaluation --- p.70 / Chapter 5.1 --- Simulation Setup --- p.70 / Chapter 5.2 --- Experiments on IP Traceback Scheme --- p.72 / Chapter 5.2.1 --- Performance Metrics --- p.72 / Chapter 5.2.2 --- Choice of Marking Probabilities --- p.73 / Chapter 5.2.3 --- Experimental Results --- p.75 / Chapter 5.3 --- Experiments on Packet Filtering Scheme --- p.82 / Chapter 5.3.1 --- Performance Metrics --- p.82 / Chapter 5.3.2 --- Choices of Filtering Probabilities --- p.84 / Chapter 5.3.3 --- Experimental Results --- p.85 / Chapter 5.4 --- Deployment Issues --- p.91 / Chapter 5.4.1 --- Backward Compatibility --- p.91 / Chapter 5.4.2 --- Processing Overheads to the Routers and Network --- p.93 / Chapter 5.5 --- Evaluations --- p.95 / Chapter 6 --- Conclusion --- p.96 / Chapter 6.1 --- Contributions --- p.96 / Chapter 6.2 --- Discussions and future work --- p.99 / Bibliography --- p.110

Lam, Kwok Tai. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2003. / Includes bibliographical references (leaves 64-66). / Abstracts in English and Chinese. / Chapter 1 --- Introduction to Network Security via Efficient IP Traceback --- p.10 / Chapter 1.1 --- Motivation --- p.10 / Chapter 1.2 --- DDoS Attacker Traceback Problem --- p.11 / Chapter 1.3 --- Document Roadmap --- p.13 / Chapter 2 --- Background --- p.14 / Chapter 2.1 --- Probabilistic Edge Marking Algorithm --- p.14 / Chapter 2.1.1 --- Probabilistic Edge Marking Procedure --- p.15 / Chapter 2.1.2 --- Attack Graph Construction Procedure --- p.17 / Chapter 2.1.3 --- Advantages and Disadvantages of Algorithm --- p.19 / Chapter 3 --- Attacker Traceback: Linear Topology --- p.22 / Chapter 3.1 --- Determination of Local Traffic Rates --- p.23 / Chapter 3.2 --- Determination of Minimum Stable Time tmin --- p.25 / Chapter 3.3 --- Elimination of Attackers --- p.26 / Chapter 4 --- Attacker Traceback: General Topology --- p.30 / Chapter 4.1 --- Determination of Local Traffic Rates --- p.30 / Chapter 4.2 --- Determination of Minimum Stable Time tmin --- p.33 / Chapter 5 --- Simulations --- p.36 / Chapter 5.1 --- Simulation 1 - Correctness and robustness of estimating the min- imum stable time tmin --- p.37 / Chapter 5.1.1 --- Simulation l.A - Influence on tmin by different packet arrival processes --- p.37 / Chapter 5.1.2 --- Simulation l.B - Influence on tmin by different packet arrival processes under MMPP --- p.38 / Chapter 5.1.3 --- Simulation l.C - Influence on tmin and variance of traffic rate estimation by different pthreshold --- p.39 / Chapter 5.2 --- Simulation 2 - Factors which influence the minimum stable time tmin --- p.40 / Chapter 5.2.1 --- Simulation 2.A - Influence on tmin by different length of the attack path --- p.41 / Chapter 5.2.2 --- Simulation 2.B - Influence on tmin by the relative posi- tions of the attackers --- p.42 / Chapter 5.2.3 --- Simulation 2.C - Influence on tmin by different ATR and different length of the attack path --- p.43 / Chapter 5.3 --- Simulation 3 - Extension to General Network Topology --- p.45 / Chapter 5.3.1 --- Simulation 3.A - Influence on tmin by different ATR and different diameter of the network topology --- p.45 / Chapter 5.3.2 --- Simulation 3.B - Influence on tmin by different number of attackers --- p.46 / Chapter 5.4 --- Simulation 4 - Extension to Internet Topology --- p.47 / Chapter 5.4.1 --- Simulation 4.A - Influence on tminby different diameter of the network topology --- p.49 / Chapter 5.4.2 --- Simulation 4.B - Influence on tmin by different number of attackers --- p.50 / Chapter 6 --- Experiments --- p.51 / Chapter 6.1 --- Experiment 1: Simple DoS Attack --- p.53 / Chapter 6.1.1 --- Experiment l.A - Influence on tmin by different types of DDoS attack --- p.54 / Chapter 6.1.2 --- Experiment l.B - Influence on tmin by different length of the attack path --- p.55 / Chapter 6.2 --- Experiment 2: Coordinated DoS Attack --- p.55 / Chapter 6.2.1 --- Experiment 2.A - Influence on tmin by the relative posi- tions of the attackers --- p.56 / Chapter 6.2.2 --- Experiment 2.B - Influence on tmin by different number of attackers --- p.58 / Chapter 7 --- Related Work --- p.59 / Chapter 8 --- Conclusion --- p.62 / Bibliography --- p.64

Mo, Mingzhen. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2011. / Includes bibliographical references (p. 111-123). / Abstracts in English and Chinese. / Abstract --- p.i / Acknowledgement --- p.v / Chapter 1 --- Introduction --- p.1 / Chapter 1.1 --- Overview --- p.1 / Chapter 1.2 --- Thesis Contributions --- p.5 / Chapter 1.3 --- Problem Description --- p.6 / Chapter 1.4 --- Thesis Organization --- p.8 / Chapter 2 --- Background Study --- p.11 / Chapter 2.1 --- Overview --- p.11 / Chapter 2.2 --- Problem Definitions --- p.12 / Chapter 2.3 --- Privacy in Online Social Networks --- p.14 / Chapter 2.4 --- Attack --- p.17 / Chapter 2.4.1 --- Statistical Learning --- p.18 / Chapter 2.4.2 --- Graph Theory --- p.22 / Chapter 2.5 --- Protection --- p.23 / Chapter 2.5.1 --- Clustering-Based Approach --- p.24 / Chapter 2.5.2 --- Modification-Based Approach --- p.27 / Chapter 3 --- Exploit Social Networks with SSL --- p.30 / Chapter 3.1 --- Overview --- p.31 / Chapter 3.2 --- Semi-Supervised Learning Framework --- p.35 / Chapter 3.2.1 --- Co-Training SSL --- p.36 / Chapter 3.2.2 --- Graph-Based SSL --- p.38 / Chapter 3.2.3 --- Local and Global Consistency Graph-Based SSL --- p.39 / Chapter 3.3 --- Experiment --- p.40 / Chapter 3.3.1 --- Dataset Description --- p.41 / Chapter 3.3.2 --- Data Preprocessing --- p.43 / Chapter 3.3.3 --- Experiment Process --- p.45 / Chapter 3.3.4 --- Experiment Results --- p.47 / Chapter 3.4 --- Conclusion --- p.49 / Chapter 4 --- Exploiting Social Networks with CG SSL --- p.50 / Chapter 4.1 --- Overview --- p.51 / Chapter 4.2 --- Exploit Learning Model and Algorithms --- p.56 / Chapter 4.2.1 --- Exploit Learning Model --- p.57 / Chapter 4.2.2 --- Algorithms --- p.60 / Chapter 4.2.3 --- Community Generation --- p.65 / Chapter 4.3 --- Experiment --- p.66 / Chapter 4.3.1 --- Dataset Description --- p.67 / Chapter 4.3.2 --- Data Preprocessing --- p.70 / Chapter 4.3.3 --- Experiment Process --- p.72 / Chapter 4.3.4 --- Experiment Results --- p.77 / Chapter 4.4 --- Conclusion --- p.82 / Chapter 5 --- APA Comparison Scheme --- p.83 / Chapter 5.1 --- Overview --- p.84 / Chapter 5.2 --- Attack-Protect-Attack (APA) Comparisons Scheme --- p.87 / Chapter 5.2.1 --- Algorithm --- p.87 / Chapter 5.2.2 --- Attack & Protection Approaches --- p.88 / Chapter 5.3 --- Experiment --- p.91 / Chapter 5.3.1 --- Dataset Description --- p.92 / Chapter 5.3.2 --- Data Preprocessing --- p.92 / Chapter 5.3.3 --- Experiment Process --- p.94 / Chapter 5.3.4 --- Experiment Result --- p.95 / Chapter 5.4 --- Conclusion --- p.103 / Chapter 6 --- Conclusion and Future Work --- p.105 / Chapter 6.1 --- Conclusion --- p.105 / Chapter 6.2 --- Future Work --- p.107 / Bibliography --- p.111

Thesis (M.S.)--Computing, Georgia Institute of Technology, 2008. / Committee Chair: Wenke Lee; Committee Member: Jonathon Giffin; Committee Member: Mustaque Ahamad.

Thesis (Ph.D.)--Electrical and Computer Engineering, Georgia Institute of Technology, 2008. / Committee Chair: McLaughlin, Steven; Committee Member: Barros, Joao; Committee Member: Bellissard, Jean; Committee Member: Fekri, Faramarz; Committee Member: Lanterman, Aaron

Thesis (M.S. in Computer Science)--Naval Postgraduate School, June 2005. / Thesis Advisor(s): Neil Rowe, J.D. Fulp. Includes bibliographical references (p. 53-54). Also available online.

This thesis supports the hypothesis that the measurement of the potency of threat agents to information systems is a crucial element in the accurate calculation of the risks to which systems are subject and the subsequent management of those risks. It describes a series of papers that were published as the result of research that has been carried out into a range of information security issues. The research evolved over the period from 1995 from the underlying drive to identify means of proving improved protection for government and military information systems. Once the initial research was completed, further work was undertaken to resolve issues identified in completed research and also to address newly identified security issues. This document describes the relationship between the papers that were produced from the individual areas of research and address a range of related topics. This document examines the sources of threats to information systems and methods that can be employed to improve the process of managing and treating the risk that they create. It also addresses issues relating to areas of information security that have not been clearly understood and a provides a number of countermeasures that can be implemented to protect information systems in government, the commercial sector and in private use and a framework for the forensic investigation of incidents. As a result of this research, a clearer understanding has been gained of methods that can be implemented to improve the security of information systems at all levels and a threat methodology has been developed that is now taught in a number of countries and which has now been adopted by the UK Government for further development to meet their specific needs. The contribution to knowledge has been the development of advice on the security of information systems, a taxonomy for the investigation of incidents and a method for the measurement of threat.

In our technology- and information-infused world, cyberspace is an integral part of modern-day society. As the number of active cyberspace users increases, so too does the chances of a cyber threat finding a vulnerable target increase. All cyber users who are exposed to cyber risks need to be educated about cyber security. Human beings play a key role in the implementation and governing of an entire cybersecurity and cybersafety solution. The effectiveness of any cybersecurity and cybersafety solutions in a societal or individual context is dependent on the human beings involved in the process. If these human beings are either unaware or not knowledgeable about their roles in the security solution they become the weak link in these cybersecurity solutions. It is essential that all users be educated to combat any threats. Children are a particularly vulnerable subgroup within society. They are digital natives and make use of ICT, and online services with increasing frequency, but this does not mean they are knowledgeable about or behaving securely in their cyber activities. Children will be exposed to cyberspace throughout their lifetimes. Therefore, cybersecurity and cybersafety should be taught to children as a life-skill. There is a lack of well-known, comprehensive cybersecurity and cybersafety educational campaigns which target school children. Most existing information security and cybersecurity education campaigns limit their scope. Literature reports mainly on education campaigns focused on primary businesses, government agencies and tertiary education institutions. Additionally, most guidance for the design and implementation of security and safety campaigns: are for an organisational context, only target organisational users, and mostly provide high-level design recommendations. This thesis addressed the lack of guidance for designing and implementing cybersecurity and cybersafety educational campaigns suited to school learners as a target audience. The thesis aimed to offer guidance for designing and implementing education campaigns that educate school learners about cybersecurity and cybersafety. This was done through the implementation of an action research process over a five-year period. The action research process involved cybersecurity and cybersafety educational interventions at multiple schools. A total of 18 actionable guidelines were derived from this research to guide the design and implementation of cybersecurity and cybersafety education campaigns which aim to educate school children.

Today, one is expected to remember multiple user names and passwords for different domains when one wants to access on the Internet. Identity management seeks to solve this problem through creating a digital identity that is exchangeable across organisational boundaries. Through the setup of collaboration agreements between multiple domains, users can easily switch across domains without being required to sign in again. However, use of this technology comes with risks of user identity and personal information being compromised. Criminals make use of spoofed websites and social engineering techniques to gain illegal access to user information. Due to this, the need for users to be protected from online threats has increased. Two processes are required to protect the user login information at the time of sign-on. Firstly, user’s information must be protected at the time of sign-on, and secondly, a simple method for the identification of the website is required by the user. This treatise looks at the process for identifying and verifying user information, and how the user can verify the system at sign-in. Three models for identity management are analysed, namely the Microsoft .NET Passport, Liberty Alliance Federated Identity for Single Sign-on and the Mozilla TrustBar for system authentication.

Learning to write software requires much practice and frequent assessment. Consequently, the use of computers to assist in the assessment of computer programs has been important in supporting large classes at universities. The main approaches to the problem are dynamic analysis (testing student programs for expected output) and static analysis (direct analysis of the program code). The former is very sensitive to all kinds of errors in student programs, while the latter has traditionally only been used to assess quality, and not correctness. This research focusses on the application of static analysis, particularly structural similarity, to marking student programs. Existing traditional measures of similarity are limiting in that they are usually only effective on tree structures. In this regard they do not easily support dependencies in program code. Contemporary measures of structural similarity, such as similarity flooding, usually rely on an internal normalisation of scores. The effect is that the scores only have relative meaning, and cannot be interpreted in isolation, ie. they are not meaningful for assessment. The SimRank measure is shown to have the same problem, but not because of normalisation. The problem with the SimRank measure arises from the fact that its scores depend on all possible mappings between the children of vertices being compared. The main contribution of this research is a novel graph similarity measure, the Weighted Assignment Similarity measure. It is related to SimRank, but derives propagation scores from only the locally optimal mapping between child vertices. The resulting similarity scores may be regarded as the percentage of mutual coverage between graphs. The measure is proven to converge for all directed acyclic graphs, and an efficient implementation is outlined for this case. Attributes on graph vertices and edges are often used to capture domain specific information which is not structural in nature. It has been suggested that these should influence the similarity propagation, but no clear method for doing this has been reported. The second important contribution of this research is a general method for incorporating these local attribute similarities into the larger similarity propagation method. An example of attributes in program graphs are identifier names. The choice of identifiers in programs is arbitrary as they are purely symbolic. A problem facing any comparison between programs is that they are unlikely to use the same set of identifiers. This problem indicates that a mapping between the identifier sets is required. The third contribution of this research is a method for applying the structural similarity measure in a two step process to find an optimal identifier mapping. This approach is both novel and valuable as it cleverly reuses the similarity measure as an existing resource. In general, programming assignments allow a large variety of solutions. Assessing student programs through structural similarity is only feasible if the diversity in the solution space can be addressed. This study narrows program diversity through a set of semantic preserving program transformations that convert programs into a normal form. The application of the Weighted Assignment Similarity measure to marking student programs is investigated, and strong correlations are found with the human marker. It is shown that the most accurate assessment requires that programs not only be compared with a set of good solutions, but rather a mixed set of programs of varying levels of correctness. This research represents the first documented successful application of structural similarity to the marking of student programs.