Thesis (B.A. Hons. 1970)--from the Dept. of History, University of Adelaide.

Botnets are networks of computers which have been compromised by malicious software which enables a remotely located adversary to control them and focus their collective power on specific tasks. Botnets pose a significant global threat, with tangible political, economic and military ramifications and have resultingly become a field of significant interest within the cyber-security research community. While a number of effective defence techniques have been devised for botnets utilizing centralized command and control infrastructures, few of these techniques are suitable for defending against larger-scale peer-to-peer (P2P) botnets. In contrast, the sybil attack, combined with index poisoning is an established defence technique for P2P botnets. During a sybil attack, fake bots (\ie sybils) are inserted into the botnet. These sybils distribute fake commands to bots, causing them not to carry out illicit activities. Bots also then unwittingly redistribute the fake commands to other bots in the botnet. This work uses packet-level simulation of a Kademlia-based P2P botnet to evaluate 1) the impact that the location of sybils within the underlying network topology can have on the effectiveness of sybil attacks and 2) several potential optimizations to the placement of sybils within the underlying network topology. / Graduate / 0537 / 0544 / 0984

Darknet markets are online services behind Tor where cybercriminals trade illegal goods and stolen datasets. In recent years, security analysts and law enforcement start to investigate the darknet markets to study the cybercriminal networks and predict future incidents. However, vendors in these markets often create multiple accounts (i.e., Sybils), making it challenging to infer the relationships between cybercriminals and identify coordinated crimes. In this thesis, we present a novel approach to link the multiple accounts of the same darknet vendors through photo analytics. The core idea is that darknet vendors often have to take their own product photos to prove the possession of the illegal goods, which can reveal their distinct photography styles. To fingerprint vendors, we construct a series deep neural networks to model the photography styles. We apply transfer learning to the model training, which allows us to accurately fingerprint vendors with a limited number of photos. We evaluate the system using real-world datasets from 3 large darknet markets (7,641 vendors and 197,682 product photos). A ground-truth evaluation shows that the system achieves an accuracy of 97.5%, outperforming existing stylometry-based methods in both accuracy and coverage. In addition, our system identifies previously unknown Sybil accounts within the same markets (23) and across different markets (715 pairs). Further case studies reveal new insights into the coordinated Sybil activities such as price manipulation, buyer scam, and product stocking and reselling. / Master of Science / Taking advantage of the high anonymity of darknet, cybercriminals have set up underground trading websites such as darknet markets for trading illegal goods. To understand the relationships between cybercriminals and identify coordinated activities, it is necessary to identify the multiple accounts hold by the same vendor. Apart from manual investigation, previous studies have proposed methods for linking multiple accounts through analyzing the writing styles hidden in the users' online posts, which face key challenges in similar tasks on darknet markets. In this thesis, we propose a novel approach to link multiple identities within the same darknet market or across different markets by analyzing the product photos. We develop a system where a series of deep neural networks (DNNs) are used with transfer learning to extract distinct features from a vendor's photos automatically. Using real-world datasets from darknet markets, we evaluate the proposed system which shows clear advantages over the writing style based system. Further analysis of the results reported by the proposed system reveal new insights into coordinated activities such as price manipulation, buyer scam and product stocking and reselling for those vendors who hold multiple accounts.

Paskirstytos maišos lentelės modeliai ir jų saugumo problemos yra aktyviai nagrinėjama sritis akademinėje bendruomenėje. Šiame darbe keliama hipotezė, kad praktinės DHT tinklų realizacijos neužtikrina teoriniuose modeliuose priimtos sąlygos, kad mazgų prisijungiančių prie tinklo identifikatoriai bus generuojami atsitiktinai. Randamas atakų sudėtingumo įvertis, kai atsitiktinių identifikatorių generavimas yra privalomas ir kai identifikatorius galima pasirinkti laisvai. Hipotezės patvirtinimui atliekamas eksperimentas. Surenkami ir analizuojami vieno didžiausių DHT tinklų (BitTorrent DHT) duomenys. Aprašomas literatūroje siūlomas problemos sprendimo būdas ir praktinės problemos kylančios jį realizuojant. Pasiūlomas naujas praktiškai pritaikomas ir našus identifikatorių generavimo patikrinimo metodas bei metodas naujų identifikatorių generavimo greičiui DHT tinkle valdyti. / Distributed Hash Table models and its security implications, has long been a subject of interest. This thesis is based on the assumption that practical implementations do not enforce random node id generation regardless of the fact that theoretical models require node ids to be chosen by random and distributed in the address space uniformly. To measure the impact on the DHT network security if the assumption holds an analysis of attack complexity in both cases is performed. Results indicate that the complexity grows from O(1) to O(M) if the node id cannot be selected arbitrarily (M is the number of nodes in DHT network). Stated assumption is confirmed by analysing classic node id protection methods and performing analysis of BitTorrent DHT network. The reason for the lack of node id protection in practice is considered to be the complexity and performance penalty of the classic methods. To facilitate the implementations of DHT networks a new method to ensure random node id generation and copy protection is provided. Proposed method utilizes MACs based on shared keys to provide a proof of the ownership of the node id while still providing means to protect it from being copied. Efficiency of the proposed method is evaluated by conducting an experiment. In order to protect small DHT networks against a Sybil attack a method to control the speed of node id generation is also proposed.

abstract: Peer-to-peer systems are known to be vulnerable to the Sybil attack. The lack of a central authority allows a malicious user to create many fake identities (called Sybil nodes) pretending to be independent honest nodes. The goal of the malicious user is to influence the system on his/her behalf. In order to detect the Sybil nodes and prevent the attack, a reputation system is used for the nodes, built through observing its interactions with its peers. The construction makes every node a part of a distributed authority that keeps records on the reputation and behavior of the nodes. Records of interactions between nodes are broadcast by the interacting nodes and honest reporting proves to be a Nash Equilibrium for correct (non-Sybil) nodes. In this research is argued that in realistic communication schedule scenarios, simple graph-theoretic queries such as the computation of Strongly Connected Components and Densest Subgraphs, help in exposing those nodes most likely to be Sybil, which are then proved to be Sybil or not through a direct test executed by some peers. / Dissertation/Thesis / Ph.D. Computer Science 2010

Cette thèse en Informatique s'inscrit dans le cadre de gestion de la confiance et plus précisément des systèmes de recommandation. Ces systèmes sont généralement basés sur les retours d'expériences des utilisateurs (i.e., qualitatifs/quantitatifs) lors de l'utilisation des ressources sur le Web (ex. films, vidéos et service Web). Les systèmes de recommandation doivent faire face à trois types d'incertitude liés aux évaluations des utilisateurs, à leur identité et à la variation des performances des ressources au fil du temps. Nous proposons une approche robuste pour évaluer la confiance en tenant compte de ces incertitudes. Le premier type d'incertitude réfère aux évaluations. Cette incertitude provient de la vulnérabilité du système en présence d'utilisateurs malveillants fournissant des évaluations biaisées. Pour pallier cette incertitude, nous proposons un modèle flou de la crédibilité des évaluateurs. Ce modèle, basé sur la technique de clustering flou, permet de distinguer les utilisateurs malveillants des utilisateurs stricts habituellement exclus dans les approches existantes. Le deuxième type d'incertitude réfère à l'identité de l'utilisateur. En effet, un utilisateur malveillant a la possibilité de créer des identités virtuelles pour fournir plusieurs fausses évaluations. Pour contrecarrer ce type d'attaque dit Sybil, nous proposons un modèle de filtrage des évaluations, basé sur la crédibilité des utilisateurs et le graphe de confiance auquel ils appartiennent. Nous proposons deux mécanismes, l'un pour distribuer des capacités aux utilisateurs et l'autre pour sélectionner les utilisateurs à retenir lors de l'évaluation de la confiance. Le premier mécanisme permet de réduire le risque de faire intervenir des utilisateurs multi-identités. Le second mécanisme choisit des chemins dans le graphe de confiance contenant des utilisateurs avec des capacités maximales. Ces deux mécanismes utilisent la crédibilité des utilisateurs comme heuristique. Afin de lever l'incertitude sur l'aptitude d'une ressource à satisfaire les demandes des utilisateurs, nous proposons deux approches d'évaluation de la confiance d'une ressource sur leWeb, une déterministe et une probabiliste. La première consolide les différentes évaluations collectées en prenant en compte la crédibilité des évaluateurs. La deuxième s'appuie sur la théorie des bases de données probabilistes et la sémantique des mondes possibles. Les bases de données probabilistes offrent alors une meilleure représentation de l'incertitude sous-jacente à la crédibilité des utilisateurs et permettent aussi à travers des requêtes un calcul incertain de la confiance d'une ressource. Finalement, nous développons le système WRTrust (Web Resource Trust) implémentant notre approche d'évaluation de la confiance. Nous avons réalisé plusieurs expérimentations afin d'évaluer la performance et la robustesse de notre système. Les expérimentations ont montré une amélioration de la qualité de la confiance et de la robustesse du système aux attaques des utilisateurs malveillants / This thesis in Computer Science is part of the trust management field and more specifically recommendation systems. These systems are usually based on users’ experiences (i.e., qualitative / quantitative) interacting with Web resources (eg. Movies, videos and Web services). Recommender systems are undermined by three types of uncertainty that raise due to users’ ratings and identities that can be questioned and also due to variations in Web resources performance at run-time. We propose a robust approach for trust assessment under these uncertainties. The first type of uncertainty refers to users’ ratings. This uncertainty stems from the vulnerability of the system in the presence of malicious users providing false ratings. To tackle this uncertainty, we propose a fuzzy model for users’ credibility. This model uses a fuzzy clustering technique to distinguish between malicious users and strict users usually excluded in existing approaches. The second type of uncertainty refers to user’s identity. Indeed, a malicious user purposely creates virtual identities to provide false ratings. To tackle this type of attack known as Sybil, we propose a ratings filtering model based on the users’ credibility and the trust graph to which they belong. We propose two mechanisms, one for assigning capacities to users and the second one is for selecting users whose ratings will be retained when evaluating trust. The first mechanism reduces the attack capacity of Sybil users. The second mechanism chose paths in the trust graph including trusted users with maximum capacities. Both mechanisms use users’ credibility as heuristic. To deal with the uncertainty over the capacity of a Web resource in satisfying users’ requests, we propose two approaches for Web resources trust assessment, one deterministic and one probabilistic. The first consolidates users’ ratings taking into account users credibility values. The second relies on probability theory coupled with possible worlds semantics. Probabilistic databases offer a better representation of the uncertainty underlying users’ credibility and also permit an uncertain assessment of resources trust. Finally, we develop the system WRTrust (Web Resource Trust) implementing our trust assessment approach. We carried out several experiments to evaluate the performance and robustness of our system. The results show that trust quality has been significantly improved, as well as the system’s robustness in presence of false ratings attacks and Sybil attacks

Mobile Crowd Sensing (MCS) or Participatory Sensing (PS) are two emerging systems as smart mobile devices become ubiquitous. One of the advantages of such a sensing system is that almost anyone with a mobile device can become a moving "sensor". However, despite the convenience, the openness of such systems is a double-edged sword: participants can misbehave and pose a threat. Usually, current MCS or PS systems are relatively weak and lack effective data sources selection mechanisms. As a result, fake or forged data can be collected, representing wrongly the sensed conditions on the surroundings, i.e. noise, moisture, etc. Therefore, a Hardened Registration Process (HRP) is proposed to provide a pre-examination on participants that are chosen to collect sensing data. There is one previous work on such a topic. It targets device examination (root, emulator, bot-net detection, etc.) for Android devices, preventing attackers from managing to register not actual but emulated devices and thus manage to effectively manipulate the collected data. The focus of this project is on enhancing the previous work and extending it with complementary mechanisms. We proposed a two-step HRP process, comprising a client detection for identifying malicious devices and server-side detection for revealing Sybil devices. We improve the previous HRP by implementing detection mechanisms in C (native) code and such an enhanced device examination process is the first step: client detection. In addition, to detect adversaries that can bypass the client detection method, we proposed an additional server-side detection to eliminate emulators and Sybil devices, adopting peer-to-peer interaction with Bluetooth Low Energy to corroborate the physical presence of the registered devices. With this enhancement, we achieve higher detection performance. Adversaries cannot easily bypass the client-side detection with rooted or emulated devices. Moreover, even if some adversaries can bypass the client-side detection, the server-side detection can prevent adversaries from registering Sybil devices more than the number of devices they own. / Mobile Crowd Sensing (MCS) eller Participatory Sensing (PS) är två framväxande system när smarta mobila enheter blir allestädes närvarande. En av fördelarna med ett sådant avkänningssystem är att nästan alla med en mobil enhet kan bli en rörlig sensor". Men trots bekvämligheten är öppenheten i sådana system ett tveeggat svärd: deltagare kan missköta sig och utgöra ett hot. Vanligtvis är nuvarande MCS- eller PS-system relativt svaga och saknar effektiva valmekanismer för datakällor. Som ett resultat kan falska eller förfalskade data samlas in, som felaktigt representerar de avkända förhållandena i omgivningen, d.v.s. buller, fukt, etc. Därför föreslås en förstärkt registreringsprocess för att ge en förundersökning av deltagare som väljs för att samla in avkänningsdata. Det finns ett tidigare arbete om ett sådant ämne. Det är inriktat på enhetsundersökning (root, emulator, bot-net-detektion, etc.) för Android-enheter, vilket förhindrar angripare från att lyckas registrera inte faktiska utan emulerade enheter och på så sätt lyckas effektivt manipulera den insamlade informationen. Fokus för detta projekt ligger på att förbättra det tidigare arbetet och utöka det med kompletterande mekanismer. Vi föreslog en tvåstegs HRP-process, som omfattar en klientdetektering för att identifiera skadliga enheter och detektering på serversidan för att avslöja Sybil-enheter. Vi förbättrar den tidigare HRP genom att implementera detekteringsmekanismer i C (native) kod och en sådan förbättrad enhetsundersökningsprocess är det första steget: klientdetektering. Dessutom, för att upptäcka motståndare som kan kringgå klientdetekteringsmetoden, föreslog vi en extra detektering på serversidan för att eliminera emulatorer och Sybil-enheter, genom att använda peer-to-peer-interaktion med Bluetooth Low Energy för att bekräfta den fysiska närvaron av de registrerade enheterna. Med denna förbättring uppnår vi högre detektionsprestanda. Motståndare kan inte lätt kringgå upptäckten på klientsidan med rotade eller emulerade enheter. Dessutom, även om vissa motståndare kan kringgå upptäckten på klientsidan, kan detekteringen på serversidan förhindra att motståndarna registrerar Sybil-enheter mer än antalet enheter de äger.

This study encompasses the development of the Sibyl Chant in Spain from its early beginnings within the liturgy as a musical piece, through its growth into a dramatic ceremony associated with the Play of the Prophets, its move from Latin into the vernacular and details of its performance, to its formal abolition in the sixteenth century. The Latin Sibylline poem, Judicii siqnum, which first appears in St. Augustine's City of God and the sermon Contra Judaeos, Paganos; et Arianos, prophesies the events on Judgement Day. Its entry into the liturgy in Spain is examined in the first chapter which, drawing on hitherto undiscovered examples of the chant from the ninth century to the fifteenth, concludes that, although the text of the chant my have been known within the Hispanic rite, its music is a product of French ecclesiastical influence. With its establishment within the liturgy and subsequent dissemination across the Peninsula by the house of Cluny, it was sung in almost every cathedral city until the sixteenth century as part of the sixth or ninth lesson of Christmas Matins. The second chapter traces its development into a dramatic ceremony in the fifteenth century. A study of known texts from Catalonia, and hitherto unknown examples of the sermon with rubrics indicating dramatic activity from an early date in Castile, concludes that the Sibyl ceremony was a product of the Ordo Prophetarum. From the thirteenth century, the Latin of the chant was often superceded by the vernacular. A comparison, in the third chapter, of Catalan and Castilian versions reveals that they owe little to the Judicii siqnum, and Provengal examples which have been considered their Source, and a Catalan troubadour influence is argued. The final chapter explores the practice of the Sibyl ceremony, with details of its performance: its liturgical position, costume, staging, attendant practices and final prohibition.

<p>Trust has played a central role in the design of open distributed systems that span distinct administrative domains. When components of a distributed system can assess the trustworthiness of their peers, they are in a better position to interact with them. There are numerous examples of distributed systems that employ trust inference techniques to regulate the interactions of their components including peer-to-peer file sharing systems, web site and email server reputation services and web search engines.</p> <p>The recent rise in popularity of Online Social Networking (OSN) services has made an additional dimension of trust readily available to system designers: social trust. By social trust, we refer to the trust information embedded in social links as annotated by users of an OSN. This thesis' overarching contribution is methods for employing social trust embedded in OSNs to solve two distinct and significant problems in distributed information systems. </p> <p>The first system proposed in this thesis assesses the ability of OSN users to correctly classify online identity assertions. The second system assesses the ability of OSN users to correctly configure devices that classify spamming hosts. In both systems, an OSN user explicitly ascribes to his friends a value that reflects how trustworthy he considers their classifications. In addition, both solutions compare the classification input of friends to obtain a more accurate measure of their pairwise trust. Our solutions also exploit trust transitivity over the social network to assign trust values to the OSN users. These values are used to weigh the classification input by each user in order to derive an aggregate trust score for the identity assertions or the hosts.</p> <p>In particular, the first problem involves the assessment of the veracity of assertions on identity attributes made by online users. Anonymity is one of the main virtues of the Internet. It protects privacy and freedom of speech, but makes it hard to assess the veracity of assertions made by online users concerning their identity attributes (e.g, age or profession.) We propose FaceTrust, the first system that uses OSN services to provide lightweight identity credentials while preserving a user's anonymity. FaceTrust employs a ``game with a purpose'' design to elicit the</p> <p>opinions of the friends of a user about the user's self-claimed identity attributes, and uses attack-resistant trust inference to compute veracity scores for the attributes. FaceTrust then provides credentials, which a user can use to corroborate his online identity assertions. </p> <p>We evaluated FaceTrust using a crawled social network graph as well as a real-world deployment. The results show that our veracity scores strongly correlate with the ground truth, even when a large fraction of the social network users are dishonest. For example, in our simulation over the sample social graph, when 50% of users were dishonest and each user employed 1000 Sybils, the false assertions obtained approximately only 10% of the veracity score of the true assertions. We have derived the following lessons from the design and deployment of FaceTrust: a) it is plausible to obtain a relatively reliable measure of the veracity of identity assertions by relying on the friends of the user that made the assertion to classify them, and by employing social trust to determine the trustworthiness of the classifications; b) it is plausible to employ trust inference over the social graph to effectively mitigate Sybil attacks; c) users tend to mostly correctly classify their friends' identity assertions.</p> <p>The second problem in which we apply social trust involves assessing the trustworthiness of reporters (detectors) of spamming hosts in a collaborative spam mitigation system. Spam mitigation can be broadly classified into two main approaches: a) centralized security infrastructures that rely on a limited number of trusted monitors (reporters) to detect and report malicious traffic; and b) highly distributed systems that leverage the experiences of multiple nodes within distinct trust domains. The first approach offers limited threat coverage and slow response times, and it is often proprietary. The second approach is not widely adopted, partly due to the </p> <p>lack of assurances regarding the trustworthiness of the reporters. </p> <p>Our proposal, SocialFilter, aims to achieve the trustworthiness of centralized security services and the wide coverage, responsiveness, and inexpensiveness of large-scale collaborative spam mitigation. It enables nodes with no email classification functionality to query the network on whether a host is a spammer. SocialFilter employs trust inference to weigh the reports concerning spamming hosts that collaborating reporters submit to the system. To the best of our knowledge, </p> <p>it is the first collaborative threat mitigation system that assesses the trustworthiness of the reporters by both auditing their reports and by leveraging the social network of the reporters' human administrators. Subsequently, SocialFilter weighs the spam reports according to the trustworthiness of their reporters to derive a measure of the system's belief that a host is a spammer. </p> <p>We performed a simulation-based evaluation of SocialFilter, which indicates its potential: </p> <p>during a simulated spam campaign, SocialFilter classified correctly 99% of spam, while yielding no false positives. The design and evaluation of SocialFilter offered us the following lessons: a) it is plausible to introduce Sybil-resilient OSN-based trust inference mechanisms to improve the reliability and the attack-resilience of collaborative spam mitigation; b) using social links to obtain the trustworthiness of reports concerning spammers (spammer reports) can result in comparable spam-blocking effectiveness with approaches that use social links to rate-limit spam (e.g., Ostra); c) unlike Ostra, SocialFilter yields no false positives. We believe that the design lessons from SocialFilter are applicable to other collaborative entity classification systems.</p> / Dissertation

No description available.