M.Comm. / Please refer to full text to view abstract

M.Com. (Informatics) / The-utilization of information technology is essential for an organization, not only to handle daily business activities but also to facilitate management decisions. The greater the dependence of the organization upon information technology, the greater the risk the organization is exposed to in case of an information systems interruption. Computer disasters, such as fires, floods, storms, sabotage and human error, constitute a security threat which could prejudice the survival of an organization. Disaster recovery planning is a realistic and imperative activity for each organization whether large or small. In the light of the potential economic and legal implications o fa disaster, it is no longer acceptable not to be prepared for such an occurrence today.A well designed and tested disaster recovery plan, as part of the total information security strategy of the organization, is therefore not only essential in the terms of the recovery of business functions, but for the SURVIVAL of the organization. In viewpoint above, it can be expected that disaster counterrevolutionary be standard practice for all organizations. However that is not the case. The literature study undertook, as well as exposure in practice, indicate clearly that disaster recovery planning enjoys low priority in most organizations. The majority existentialists are superficial, unstructured and insufficient and will not be successful when real disaster strikes.:The most important single cause for the failure of an organization ~ disaster recovery plan, will be that too much emphasis is being placed on the technical aspects rather than on the management or organizational aspects. The solutions an integrated approach of strategies and the multiple technologies which are available today. These strategies and technologies should be combined to meet the specific needs of the individual organization. The purpose of this dissertation was firstly to identify the most critical problems related to disaster recovery planning and secondly to provide a methodology for the development and implementation of a disaster recovery plan which addresses these problems. This methodology constitutes an enhancement on an existing information security methodology in order to establish a total information security strategy for a large organization with disaster recovery as an essential aspect of this strategy. The final disaster recovery planning methodology as proposed in this dissertation, was developed as a result of an extensive literature study undertook as well as involvement during the development of a disaster recovery system by the company which initiated this study.

No description available.

近年來，網絡的犯罪數量一直在迅速增加。現在，惡意軟件作者編寫惡意程序竊取用戶的個人信息，或提供基於垃圾郵件的營銷服務為利潤的地方。為了更有效地傳播惡意軟件，黑客已經開始瞄準流行的在線社交網絡服務（SNS）的 SNS用戶和服務的互動性之間固有的信任關係。一種常見的攻擊方法是惡意軟件自動登錄使用偷來的 SNS用戶憑據，然後提供接觸/被盜的用戶帳戶的朋友名單，他們通過在一些短消息嵌入惡意 URL（鏈接）。受害人然後認為是他們的朋友提供的鏈接，按一下被感染。然而，這種方法是有效的，惡意軟件來模仿人類類似的行為，它可以超越任何一個/兩個班輪對話。在這篇論文中，我們首先介紹一個新類型的攻擊，提供惡意網址 SNS用戶之間的合法對話。為了證明其概念，我們設計和實施名為 Hitchbot惡意軟件[1]，其中包括多個攻擊源，為實現我們所提出的攻擊。特別是，當一個 SNS用戶發送一個鏈接/ URL到他/她的朋友，Hitchbot悄悄地取代類似，但惡意攔截在幾個可能的點之一，互動式輸入/輸出鏈接系統。由於惡意鏈接在一些適當的對話上下文之間的合法用戶交付，這使得它更難以對受害者（以及吊具）來實現攻擊，從而可以大幅增加轉換率。這方法也使 Hitchbot的繞過大多數現有的防禦計劃，主要是靠對用戶的行為或流量異常檢測。 Hitchbot是基於客戶端模塊的形式可以順利上常見的社交網絡服務，包括雅虎和微軟的郵件客戶端和其他基於 Web瀏覽器，如 Facebook和 MySpace的社交網絡服務的加息。為量化 Hitchbot的效力，我們已經研究，交換和處理對 URL操作時用戶的行為。最後，我們研究通過自動在線分類 /識別惡意網址的可行性。尤其是不同類型的屬性/惡意 URL分類功能的有效性進行量化，從不同的惡意網址數據庫中獲得數據的基礎上，我們也考慮實時的準確性，嚴格的延遲要求影響和權衡需求的惡意網址分類。 / The number of cyber crimes has continued to increase rapidly in the recent years. It is now commonplace for malware authors to write malicious programs for prot by stealing user personal information or providing spam-based marketing services. In order to spread malware more effectively, hackers have started to target popular online social networking services (SNS) due to the inherent trust-relationship between the SNS users and the interactive nature of the services. A common attacking approach is for a malware to automatically login using stolen SNS user cre¬dentials and then deliver malicious URLs (links) to the people on the contact/friend-list of the stolen user account by embedding them in some short messages. The victim then gets infected by clicking on the links thought to be delivered by their friends. However, for this approach to be effective, the malware has to mimic human-like behavior which can be quite challenging for anything beyond one/two-liner conversations. In this thesis, we first introduce a new type of attacks called the social hitch-hiking attacks which use a stealthier way to deliver malicious URLs by hitch-hiking on legitimate conversations among SNS users. As a proof-of-concept, we have designed and implemented a malware named Hitchbot [1] which incorporates multiple attack vectors for the realization of our proposed social hitch-hiking attacks. In particular, when a SNS user sends a link/URL to his/her friends, Hitchbot quietly replaces it with a similar-looking, but malicious one by intercepting the link at one of the several pos¬sible points along the interactive-input/output chain of the system. Since the malicious link is delivered within some proper conversation context between the legitimate users, this makes it much more difficult for the victim (which is also the spreader) to realize the attack and thus can increase the conversion rate substantially. The hitch-hiking approach also enables Hitchbot to bypass most existing defense schemes which mainly rely on user-behavior or traffic anomaly detection. Hitchbot is in form of a client-based module which can hitch-hike on common social networking services including the Yahoo and Microsoft Messaging clients and other web-browser-based social-networking services such as Facebook and Myspace. To quantify the effectiveness of Hitchbot, we have studied the behavior of users in exchanging, handling and operating on URLs. Lastly, we study the feasibility of defending hitching-hiking attacks via automated online classification/identification of malicious URLs. In particular, the effectiveness of different types of attributes/features used in malicious URL classification are quantified based on a data obtained from various malicious URL databases. We also consider the implications and trade-offis of stringent latency requirement on the accuracy of real-time, on-demand malicious URL classifications. / Detailed summary in vernacular field only. / Lam, Ka Chun. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2012. / Includes bibliographical references (leaves 43-48). / Electronic reproduction. Hong Kong : Chinese University of Hong Kong, [2012] System requirements: Adobe Acrobat Reader. Available via World Wide Web. / Abstracts also in Chinese. / Abstract --- p.i / Acknowledgement --- p.iv / Chapter 1 --- Introduction --- p.1 / Chapter 1.1 --- Background --- p.1 / Chapter 1.2 --- Organization --- p.4 / Chapter 2 --- Related Work --- p.6 / Chapter 2.1 --- Exploiting Social Networking Services --- p.6 / Chapter 2.1.1 --- Malware Spreading Channels in SNS --- p.7 / Chapter 2.1.2 --- Common Exploits on SNS platforms --- p.10 / Chapter 2.2 --- Recent defense mechanisms of Malware --- p.12 / Chapter 3 --- A New Class of Attacks via Social Hitch-hiking --- p.14 / Chapter 3.1 --- The Social Hitch-hiking Attack --- p.14 / Chapter 3.1.1 --- The Interactive User Input/Output Chain --- p.16 / Chapter 3.1.2 --- Four Attack Vectors --- p.17 / Chapter 4 --- Attack Evaluation and Measurement --- p.26 / Chapter 4.1 --- Comparison of Attack Vectors --- p.26 / Chapter 4.2 --- Attack Measurement --- p.27 / Chapter 4.3 --- Defense against Hitch-hiking Attacks --- p.29 / Chapter 5 --- Defense via Malicious URL Classification --- p.31 / Chapter 5.1 --- Methodology --- p.31 / Chapter 5.2 --- Attributes --- p.33 / Chapter 5.2.1 --- Lexical attributes --- p.34 / Chapter 5.2.2 --- Webpage content attributes --- p.34 / Chapter 5.2.3 --- Network attributes --- p.34 / Chapter 5.2.4 --- Host-based attributes --- p.35 / Chapter 5.2.5 --- Link popularity attributes --- p.36 / Chapter 5.3 --- Performance Evaluation and Discussions --- p.36 / Chapter 6 --- Conclusion and Future work --- p.41

In this work, we consider the possibility and the effectiveness of implementing secure network coding and error-correcting network coding at the same time. Upon achieving this goal, information can be multicast securely to the sink nodes through a noisy network. Toward this end, we propose constructions of such codes and prove their optimality. After that, we extend the idea of generalized Hamming Weight [54] for the classical point-to-point communication channel to linear network coding. We also extend the idea of generalized Singleton bound to linear network coding. We further show that the generalized Hamming weight can completely characterize the security performance of linear code at the source node on a given linear network code. We then introduce the idea of Network Maximum Distance Separable code (NMDS code), which can be shown to play an important role in minimizing the information that an eavesdropper can obtain from the network. The problem of obtaining the optimal security performance is in fact equivalent to the problem of obtaining a Network Maximum Distance Separable code. / Network coding is one of the most important breakthroughs in information theory in recent years. The theory gives rise to a new concept regarding the role of nodes in a communication network. Unlike in existing networks where the nodes act as switches, in the paradigm of network coding, every node in the network can act as an encoder for the incoming information. With this new infrastructure, it is possible to utilize the full capacity of the network where it is impossible to do so without network coding. In the seminar paper by Ahlswede et al. [1] where network coding was introduced, the achievability of the maxflow bound for every single source multicast network by using network coding was also proved. By further exploring the possibility of linear network coding, Cai and Yeung introduced the idea of error-correcting network coding and secure network coding in [7] and [8] respectively. These papers launched another two important research areas in the field of network coding. / Ngai, Chi Kin. / Adviser: Yqung Wai Ho. / Source: Dissertation Abstracts International, Volume: 70-06, Section: B, page: 3696. / Thesis (Ph.D.)--Chinese University of Hong Kong, 2008. / Includes bibliographical references (leaves 122-128). / Electronic reproduction. Hong Kong : Chinese University of Hong Kong, [2012] System requirements: Adobe Acrobat Reader. Available via World Wide Web. / Electronic reproduction. [Ann Arbor, MI] : ProQuest Information and Learning, [200-] System requirements: Adobe Acrobat Reader. Available via World Wide Web. / Abstracts in English and Chinese. / School code: 1307.

We live today in the information age with users being able to access and share information freely by using both personal computers and their handheld devices. This, in turn, has been made possible by the Internet. However, this poses security risks as attempts are made to use this same environment in order to compromise the confidentiality, integrity and availability of information. Accordingly, there is an urgent need for users and organisations to protect their information resources from agents posing a security threat. Organisations typically spend large amounts of money as well as dedicating resources to improve their technological defences against general security threats. However, the agents posing these threats are adopting social engineering techniques in order to bypass the technical measures which organisations are putting in place. These social engineering techniques are often effective because they target human behaviour, something which the majority of researchers believe is a far easier alternative than hacking information systems. As such, phishing effectively makes use of a combination of social engineering techniques which involve crafty technical emails and website designs which gain the trust of their victims. Within an organisational context, there are a number of areas which phishers exploit. These areas include human factors, organisational aspects and technological controls. Ironically, these same areas serve simultaneously as security measures against phishing attacks. However, each of these three areas mentioned above are characterised by gaps which arise as a result of human involvement. As a result, the current approach to mitigating phishing threats comprises a single-layer defence model only. However, this study proposes a holistic model which integrates each of these three areas by strengthening the human element in each of these areas by means of a security awareness, training and education programme.

M.Comm. / The principal aim of the present dissertation is to determine the nature of an electronicbanking environment, to determine the threats within such an environment and the security functionality needed to ward off these threats. Security solutions for each area at risk will be provided in short. The main focus of the dissertation will fall on the security protocols that can be used as solutions to protect a banking system. In the dissertation, indication will also be given of what the security protocols, in their turn, depend on to provide protection to a banking system. There are several security protocols that can be used to secure a banking system. The problem, however, is to determine which protocol will provide the best security for a bank in a specific application. This dissertation is also aimed at providing a general security framework that banks could use to evaluate various security protocols which could be implemented to secure a banking system. Such framework should indicate which security protocols will provide a bank in a certain banking environment with the best protection against security threats. It should also indicate which protocols could be used in combination with others to provide the best security.

published_or_final_version / abstract / Electrical and Electronic Engineering / Master / Master of Philosophy

M.Com. (Informatiks) / Please refer to full text to view abstract

by Chan Pui Chung. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2002. / Includes bibliographical references (leaves [56]-[61]). / Abstracts in English and Chinese. / Chapter 1 --- Introduction --- p.1 / Chapter 1.1 --- The Trends --- p.1 / Chapter 1.2 --- What this Thesis Contains --- p.3 / Chapter 2 --- Background --- p.5 / Chapter 2.1 --- Computer Security --- p.5 / Chapter 2.2 --- Anti-intrusion Techniques --- p.6 / Chapter 2.3 --- The Need for Intrusion Detection System --- p.7 / Chapter 2.4 --- Intrusion Detection System Categorization --- p.8 / Chapter 2.4.1 --- Network-based vs. Host-based --- p.8 / Chapter 2.4.2 --- Anomaly Detection vs. Misuse Detection --- p.10 / Chapter 2.4.3 --- Centralized vs. Distributed --- p.11 / Chapter 2.5 --- Agent-based IDS --- p.12 / Chapter 2.6 --- Mobile agent-based IDS --- p.12 / Chapter 3 --- Survey on Intrusion Step --- p.14 / Chapter 3.1 --- Introduction --- p.14 / Chapter 3.2 --- Getting information before break in --- p.14 / Chapter 3.2.1 --- Port scanning --- p.14 / Chapter 3.2.2 --- Sniffing --- p.16 / Chapter 3.2.3 --- Fingerprinting --- p.17 / Chapter 3.3 --- Intrusion method --- p.17 / Chapter 3.3.1 --- DOS and DDOS --- p.17 / Chapter 3.3.2 --- Password cracking --- p.18 / Chapter 3.3.3 --- Buffer overflows --- p.19 / Chapter 3.3.4 --- Race Condition --- p.20 / Chapter 3.3.5 --- Session Hijacking --- p.20 / Chapter 3.3.6 --- Computer Virus --- p.21 / Chapter 3.3.7 --- Worms --- p.21 / Chapter 3.3.8 --- Trojan Horse --- p.22 / Chapter 3.3.9 --- Social Engineering --- p.22 / Chapter 3.3.10 --- Physical Attack --- p.23 / Chapter 3.4 --- After intrusion --- p.23 / Chapter 3.4.1 --- Covering Tracks --- p.23 / Chapter 3.4.2 --- Back-doors --- p.23 / Chapter 3.4.3 --- Rootkits --- p.23 / Chapter 3.5 --- Conclusion --- p.24 / Chapter 4 --- A Survey on Intrusion Detection System --- p.25 / Chapter 4.1 --- Introduction --- p.25 / Chapter 4.2 --- Information Source --- p.25 / Chapter 4.2.1 --- Host-based Source --- p.25 / Chapter 4.2.2 --- Network-based Source --- p.26 / Chapter 4.2.3 --- Out-of-band Source --- p.27 / Chapter 4.2.4 --- Data Fusion from multiple sources --- p.27 / Chapter 4.3 --- Detection Technology --- p.28 / Chapter 4.3.1 --- Intrusion signature --- p.28 / Chapter 4.3.2 --- Threshold Detection --- p.31 / Chapter 4.3.3 --- Statistical Analysis --- p.31 / Chapter 4.3.4 --- Neural Network --- p.32 / Chapter 4.3.5 --- Artificial Immune System --- p.33 / Chapter 4.3.6 --- Data Mining --- p.33 / Chapter 4.3.7 --- Traffic Analysis --- p.34 / Chapter 4.4 --- False Alarm Rate --- p.35 / Chapter 4.5 --- Response --- p.35 / Chapter 4.6 --- Difficulties in IDS --- p.36 / Chapter 4.6.1 --- Base Rate Fallacy --- p.36 / Chapter 4.6.2 --- Denial of Service Attack against IDS --- p.37 / Chapter 4.6.3 --- Insertion and Evasion attack against the Network-Based IDS . --- p.37 / Chapter 4.7 --- Conclusion --- p.38 / Chapter 5 --- Preemptive Distributed Intrusion Detection using Mobile Agents --- p.39 / Chapter 5.1 --- Introduction --- p.39 / Chapter 5.2 --- Architecture Design --- p.40 / Chapter 5.2.1 --- Overview --- p.40 / Chapter 5.2.2 --- Agents involved --- p.40 / Chapter 5.2.3 --- Clustering --- p.42 / Chapter 5.3 --- How it works --- p.44 / Chapter 5.3.1 --- Pseudo codes of operations --- p.48 / Chapter 5.4 --- Advantages --- p.49 / Chapter 5.5 --- Drawbacks & Possible Solutions --- p.49 / Chapter 5.6 --- Other Possible Mode of Operation --- p.50 / Chapter 5.7 --- Conclusion --- p.51 / Chapter 6 --- Conclusion --- p.52 / A Paper Derived from this Thesis --- p.54 / Bibliography --- p.55