دکتر بهروز ترک لادنی
-
Social networks have become a central part of our lives these days and have real effects on the world's events. However, social networks greatly boost spreading misinformation and rumors that are becoming more and more dangerous each day. As fighting rumors first requires detecting them, several researchers tried to propose novel approaches for automatic early detection of rumors. However, most of them rely on handcrafted content features which makes them prone to deception and threats the adaptability of the model. Furthermore, a great deal of work have concentrated on event-level rumor detection while it faces early detection with serious challenges. There are also deficiencies in proposed methods in terms of time and resource complexity. This study proposes a deep learning approach to automate the detection of rumors on Twitter. The proposed method relies on automatically extracted features through word and sentence embeddings along with profile and network-based features. It then uses Recurrent Neural Networks (RNN) leveraging Gated Recurrent Units (GRU) for detecting the veracity of a tweet. The proposed method also improves time efficiency. The achieved experimental evaluation results on RumorEval2019 dataset demonstrate that the proposed method outperforms other rival models on the same dataset in terms of both performance and time complexity. By the way, the proposed method is more resilient to deception by avoiding the use of handcrafted content features and leveraging features that are out of the control of the user.Keywords: Deception, deep Learning, Rumor detection, Social network, twitter
-
Sensitive methods are those that are commonly used by Android malware to perform malicious behavior. These methods may be either evasion or malicious payload methods. Although there are several approaches to handle these methods for performing effective dynamic malware analysis, but generally most of them are based on a manually created list. However, the performance shown by the selected approaches is dependent on completeness of the manually created list that is not almost a complete and up-to-date one. Missing some sensitive methods causes to degrade the overall performance and affects the effectiveness of analyzing Android malware.In this paper, we propose a machine learning approach to predict new sensitive methods that might be used in Android malware. We use a manually collected training dataset to train two classifiers: a classifier for detecting the sensitivity nature of the Android methods, and another classifier to categorize the detected sensitive methods into predefined categories. We applied the proposed approach to a large number of methods extracted from Android API 27. The proposed approach is able to predict hundreds of sensitive methods with accuracy of 90.5% for the first classifier and 87.4% for the second classifier. To evaluate the proposed approach, we built a new list of the detected sensitive methods and used it in a number of tools to perform dynamic malware analysis. The proposed model found various sensitive methods that were not considered before by any other tools. Hence, the effectiveness of these tools in performing dynamic analysis are increased.Keywords: Sensitive methods, Evasion methods, Payload methods, Dynamic analysis, Machine Learning
-
Todays, although social networks are used for extensive information sharing, spreading rumors has also been accelerated and become a serious problem. Rumor control can be accomplished through either hard or soft control strategies. The former uses depriving actions like blocking rumor spreaders, while the latter tries to persuade people personally avoiding rumor propagation by increasing their knowledge and awareness. Although there are some proposals for rumor control in social networks, suitable frameworks for modeling and analysis of rumor control strategies and methods with proper consideration of the effective factors is still a need. This study introduces a rumor propagation model based on evolutionary game theory along with a number of soft and hard rumor control methods. Using the proposed model, we simulate and analyze rumor control methods considering different environmental, personal, and content-related factors that may influence people's decisions about rumors. The simulation is conducted on a Twitter graph according to various society conditions. One of the findings is that the soft rumor control strategy is generally more effective than the hard rumor control strategy. The proposed model itself and the conducted analysis can be adopted for developing and deploying effective rumor control mechanisms in social network systems.Keywords: Evolutionary Game Theory, Rumor spreading, Rumor control, Social network
-
Android is a widely used operating system that employs a permission-based access control model. The Android Permissions System (APS) is responsible for mediating application resource requests. APS is a critical component of the Android security mechanism; hence, a failure in the design of APS can potentially lead to vulnerabilities that grant unauthorized access to resources by malicious applications. In this paper, we present a formal approach for modeling and verifying the security properties of APS. We demonstrate the usability of the proposed approach by showcasing the detection of a well-knownvulnerability found in Android’s custom permissions.Keywords: Android Security, Formal Methods, Verification
-
Smart grids using information technology (IT) and communication networks control smart home appliances to reduce costs and increase reliability and transparency. Preserving the privacy of the user data is one of the biggest challenges in smart grid research; by disclosing user-related data, an internal or external adversary can understand the habits and behavior of the users. A solution to address this challenge is, however, a data aggregation mechanism in which the aggregated data of all of the users in a residential area. The security and efficiency of the data aggregation approach are important. The drawback of the previous works is leaking fine-grained user data or the high computation and communication overhead. In this paper, we present an efficient privacy-preserving data-aggregation protocol, called PPDA, based on the Elliptic Curve Cryptography (ECC) and Anonymous Veto network protocol. The PPDA protocol aggregates metering data efficiently and securely so that it becomes applicable for resource-constraint metering devices. We also present an improved multi-cycle proposal of PPDA, called MC-PPDA. In the improved approach, the system initialization step runs only at the first cycle of the protocol which increases the efficiency of the protocol. Evaluation results show that the proposed approaches preserve the privacy of the fine-grained user data against an internal and external adversary; the improved multi-cycle approach is also secure against collusion. Compared to the previous approaches, the proposed approaches incur less computation and communication overhead.Keywords: smart grid, Smart Meter, data aggregation, Privacy-Preserving, Elliptic Curve Cryptography, AV-Net Mask
-
امروزه تشخیص حملات سطح مرورگر چالشی جدی برای حفاظت از اطلاعات کاربران محسوب می شود. حمله فردی در مرورگر (MitB ،(نوع مهمی از این حملات است که با استفاده از تروجان ها می تواند منجر به تغییر در محتویات صفحه وب، مداخله در ترافیک شبکه، سرقت نشست و سرقت اطلاعات کاربر شود. در این مقاله ابزاری کارآمد برای شناسایی بلادرنگ حملات MitB از طریق تحلیل پویای صفحات وب بر اساس توصیف الگوی حملات ارایه می شود. مزیت ابزار پیشنهادی نسبت به روش های مشابه این است که محدود به شناسایی یک یا چند حمله خاص نیست و کد روش شناسایی در ابزار تعبیه نشده است، بلکه الگوی حملات مختلف به صورت جداگانه توصیف می شود. جهت ارزیابی ابزار ارایه شده، دو سرویس وب آسیب پذیر ارایه شده توسط OWASP که دارای طیف وسیعی از آسیب پذیری های شناخته شده هستند، به همراه چارچوب آزمون نفوذپذیری BeEF مورد استفاده قرار گرفت و مجموعه ای از حملات MitB به صورت عملی پیاده سازی و توسط ابزار مورد ارزیابی قرار گرفت. همین آزمایش ها با استفاده از سه ابزار مشابه دیگر نیز عینا انجام و با ابزار ارایه شده مقایسه شد. علاوه بر برتری ابزار ارایه شده از جهت استقلال توصیف حملات از خود ابزار، نتایج حاصل نشان دهنده بهتر بودن معیارهای دقت و بازخوانی تشخیص آن نسبت به ابزارهای مشابه است.
کلید واژگان: حمله فردی در مرورگر, بدافزار, تشخیص بدافزار, تحلیل پویاDetection of browser attacks is considered a serious challenge in today’s web applications. Man in the Browser (MitB) attack is an important type of these attacks that can lead to changes in web page contents, interference in network traffic, session hijacking, and user information theft by using Trojans. In this paper, an efficient tool for real-time detection of MitB attacks through dynamic analysis of web pages based on the description of attack patterns is presented. The advantage of the proposed tool is that it is not limited to identifying one or more specific attacks and the identification method code is not embedded in the tool, but the patterns of different attacks are specified separately. In order to evaluate the presented tool, two vulnerable web services provided by OWASP, which have a wide range of known vulnerabilities, were used along with the BeEF penetration test framework, and a set of MitB attacks were practically implemented and evaluated by the tool. The same tests were performed using three other similar tools and compared with the developed tool. In addition to the superiority of the presented tool in terms of the independence of attack descriptions from the tool itself, the results show that the accuracy and readability of its diagnosis are better than similar tools.
Keywords: MitB attacks, malware, malware detection, dynamic analysis -
در سال های اخیر، رواج شایعات در شبکه های اجتماعی که به ویژه با هدف فریب افکار عمومی ساخته می شوند، به یکی از نگرانی های جدی در جوامع مختلف تبدیل شده است. شایعات می تواند با قصد آسیب رسانی در حوزه های مختلف مدیریتی و انجام عملیات جنگ نرم تهیه و هدایت شود. بنابراین، با توجه به حجم بالای شایعات و لزوم کنترل سریع آن ها، توسعه مدل هایی برای تحلیل نحوه انتشار شایعات و ارزیابی کارایی و اثربخشی ساز و کارهای مختلف مقابله با شایعه از اهمیت ویژه ای برخوردار است. در این مقاله مدلی برای انتشار و کنترل شایعه به عنوان یک تهدید نرم در شبکه های اجتماعی ارایه شده است. این مدل با تکیه بر ساز و کارهای امنیت نرم مانند اعتماد، اعتبار منابع و منتشرکنندگان خبر و رتبه دهی به خبر، شایعه را با استفاده از خرد جمعی کنترل می کند. مدل پیشنهادی به صورت شبیه سازی عامل‐مبنا بر روی دو شبکه باراباسی‐آلبرت و شبکه ای از مجموعه داده های واقعی توییتر با استفاده از روش مونت کارلو ارزیابی شده است. نتایج ارزیابی نشان می دهند که ساز و کار پیشنهادی کنترل شایعه می تواند روشی کارا برای کنترل شایعه در شبکه های اجتماعی باشد و توسعه دهندگان این شبکه ها می توانند با استفاده از روش پیشنهادی و ارایه امکانات لازم بستری برای خودکنترلی شایعه توسط کاربران فراهم نمایند.
کلید واژگان: امنیت نرم, تهدید نرم, شایعه, شبکه اجتماعی, اعتماد, کنترل نرم -
سیستم عامل آندروید به دلیل وجود توسعه دهندگان فعال و فراگیر بودن، کاربران زیادی را به خود جذب کرده است. این در حالی است که بسیاری از برنامه های نوشته شده برای این محیط، دقت کافی در حفظ حریم خصوصی کاربران به خرج نمی دهند و به آسانی منجر به نشت اطلاعات حساس کاربران می شوند. بنابراین، یک چالش اصلی این است که چطور می توان به صورت موثری چنین آسیب پذیری هایی را شناسایی کرد. در این مقاله رویکردی مبتنی بر چارچوب وارسی مدل به منظور تشخیص امکان نشت اطلاعات حساس در برنامه های آندرویدی از طریق وارسی رفتار برنامه ها ارایه می کنیم. برای این کار ابزار JPF - Android را برای سازگار کردن با مسیله موردنظر توسعه داده و از آن برای مدل سازی و وارسی نشت اطلاعات در برنامه های آندرویدی استفاده می کنیم. برای ارزیابی رویکرد ارایه شده، توانایی آن در تشخیص نشت اطلاعات را به صورت عملی با ارزیابی و با رویکردهای مشابه مقایسه کرده ایم. نتایج آزمایش های انجام شده حاکی از آن است که رویکرد پیشنهادی به طور موفقیت آمیزی قادر به تشخیص نشت اطلاعات است. به علاوه ابزار تهیه شده گزارش مفصلی را به توسعه دهندگان ارایه می دهد تا اطلاعات دقیقی از نحوه انجام نشت اطلاعات به دست آورند.
کلید واژگان: برنامه های آندرویدی, نشت حریم خصوصی, تحلیل ردیابی اجرا, وارسی مدل -
بسیاری از برنامه های اندرویدی دارای اطلاعات یا وظایف حساس و مهمی هستند. این برنامه ها اغلب از چندین مولفه تشکیل می شوند که می توانند از طریق ساز و کار اینتنت در دو سطح درون برنامه ای و یا بین برنامه ای با یکدیگر در تعامل باشند. اندروید به منظور برقراری امنیت در این تعاملات، ساز و کارهای امنیتی مختلفی را از جمله ساز و کار مجوزدهی ارایه داده است. با این حال، یک برنامه با کسب مجوزهایی که خود از داشتن آن ها محروم است، می تواند اعمالی را فراتر از امتیازات خود انجام دهد که به آن حمله افزایش امتیاز گفته می شود. در این مقاله ابزار VAnDroid که قبلا بر اساس رویکرد مهندسی نرم افزار نرم افزار مدل رانده توسط مولفین مقاله ارایه شده، تکمیل می شود تا مجموعه مهمی از حملات افزایش امتیاز تحت عنوان «وکیل سرگردان» را نیز در هر دو سطح درون برنامه ای و بین برنامه ای شناسایی کند. برای ارزیابی ابزار جدید که در قالب یک افزونه جدید اکلیپس به نام +VAnDroid پیاده سازی شده است، ده برنامه اندرویدی با بالاترین رواج در بین کاربران ایرانی تحت ابزار ارایه شده در شرایط مختلف تحلیل شدند. نتایج حاصل، نشان می دهد که +VAnDroid می تواند به صورت صحیحی آسیب پذیری از نوع وکیل سرگردان را در برنامه های اندرویدی کشف کند.
کلید واژگان: برنامه های اندروید, ساز و کار مجوزدهی, مهندسی معکوس مدل رانده, حملات افزایش امتیاز, وکیل سرگردان -
روزانه شایعات مختلف به عنوان نوعی از اطلاعات تایید نشده در شبکه های اجتماعی منتشر می شوند و به عنوان یک تهدید نرم در فضای سایبری خسارات جبران ناپذیری وارد می کنند. از این رو مطالعه ی روش های کنترل شایعه به عنوان بخشی از سازوکارهای امنیت نرم نقش مهمی در کاهش خسارات ناشی از شایعه ایفا می کند. یکی از روش های کنترل شایعه در شبکه های اجتماعی، استفاده از کنترل نرم شایعه است، به این معنی که با افزایش آ گاهی و دانش مردم در مورد شایعه، آنها در برخورد با شایعه آن را باور نکنند و در نتیجه خود افراد از انتشار شایعه خودداری کنند. در این تحقیق یک مدل اعتماد ارایه می شود که به کمک آن کاربران شبکه اجتماعی در مواجهه با شایعه، دوستان معتمد خود در زمینه شایعه را یافته و از آنها در مورد صحت شایعه مشورت می گیرند تا از انتشار شایعه اجتناب کنند. مدل ارایه شده شامل روشی برای انتخاب دوستان معتمد برای مشورت در مورد شایعه با استفاده از امکانات شبکه های اجتماعی است. به منظور ارزیابی مدل از داده های واقعی مجموعه داده ی فم استفاده شده است. نتایج نشان می دهد دوستان معتمد که توسط مدل پیشنهادی برای مشورت پیشنهاد می شوند با دقت بالایی همان کسانی هستند که ضدشایعه منتشر می کنند.
کلید واژگان: انتشار شایعه, کنترل نرم شایعه, مشورت, اعتماد, شبکه های اجتماعی -
Most of the current research on static analysis of Android applications for security vetting either work on Java source code or the Dalvik bytecode. Nevertheless, Android allows developers to use C or C++ code in their programs that is compiled into various binary architectures. Moreover, Java and the native code components (C or C++) can collaborate with each other using Java Native Interface. Recent research shows that native codes are frequently used in both benign and malicious Android applications. Most of the present Android static analysis tools avert considering native codes in their analysis and applied trivial models for their data-flow analysis. As we know only the open source JN-SAF tool has tried to solve this issue statically. However, there are still challenges like libC functions and multi-threading in native codes that we want to address in this work. We presented SANT as an extension of JN-SAF for supporting Static Analysis of Native Threads. We considered modeling libC functions in our data-flow analysis to have a more precise analysis when dealing with security vetting of native codes. We also used control flow and data dependence graphs in SANT to handle multiple concurrent threads and find implicit data-flow between them. Our experiments show that the conducted improvements outperforms JN-SAF in real-world benchmark applications.Keywords: Android Security, information leakage, Mobile Security, Static analysis
-
Dynamic analysis is a prominent approach in analyzing the behavior of Android apps. To perform dynamic analysis, we need an event generator to provide proper environment for executing the app in an emulator. Monkey is the most popular event generator for Android apps in general, and is used in dynamic analysis of Android malware as well. Monkey provides high code coverage and yet high speed in generating events. However, in the case of malware analysis, Monkey suffers from several limitations. It only considers UI events but no system events, and because of random behavior in generating UI events, it may lose dropping the connectivity of the test environment during the analysis process. Moreover, it provides no defense against malware evasion techniques. In this paper, we try to enhance Monkey by reducing its limitations while preserving its advantages. The proposed approach has been implemented as an extended version of Monkey, named Curious-Monkey. Curious-Monkey provides facilities for handling system events, handling evasion techniques, and keeping the test environment's connectivity up during the analysis process. We conducted many experiments to evaluate the effectiveness of the proposed tool regarding two important criteria in dynamic malware analysis: the ability to trigger malicious payloads and the code coverage. In the evaluation process, we used the Evadroid benchmark and the AMD malware dataset. Moreover, we compared Curious-Monkey with Monkey and Ares tools. The results show that the Curious-Monkey provides better results in case of triggering malicious payloads, as well as better code coverage.Keywords: Curious-Monkey, Monkey, Android, Event Generator, Android Malware, Dynamic analysis
-
فراتحلیل تاثیر کاربرد فناوری اطلاعات و ارتباطات بر عملکرد آموزشی و پژوهشی اعضای هیات علمی دانشگاه ها
پیشینه و اهداف:
ماهیت آموزش عالی به علت پیشرفت فاوا در حال تحول بوده و این فناوری ها بر روی رسالت دانشگاه ها در ابعاد آموزش و پژوهش تاثیر به سزایی گذاشته است. فاوا واسطه ای ست که امکان بیان طیف گسترده ای از اطلاعات، اندیشه ها، مفاهیم و پیام ها را فراهم می کند. این پدیده با تمام ویژگی ها و کاربردهایی که دارد، عبارت است از گردآوری، سازمان دهی، ذخیره و نشر اطلاعات اعم از صوت، تصویر، متن یا عدد که با استفاده از ابزارهای رایانه ای و مخابراتی صورت پذیرد. فاوا به عنوان رویکردی نوین، مکمل آموزش است نه جایگزین آن، هدف از توسعه آن، بهبود و کارآمدتر ساختن منابع آموزش و پرورش، به ویژه منابع انسانی است. مطالعات متعددی در گذشته اثرات مثبت فاوا را در تدریس نشان داده اند. گسترش فناوری اطلاعات و استفاده از ابزارها و مفاهیم نوین، زمینه بسط اطلاعات و دسترسی آسان و کم هزینه را برای فراگیران اعم از دانش آموزان، دانشجویان و معلمان به روش برخط فراهم کرده و تبادل سریع اطلاعات و تعاملات فرهنگی را میسر می سازد. موسسات آموزش عالی نیز به طور فزاینده ای نسبت به استفاده از فاوابه عنوان ابزاری برای یاددهی یادگیری، همکاری های علمی، ارتباطات علمی، توسعه و توانمندی اعضای هییت علمی برنامه ریزی کرده و در عمل، سعی بر آن دارند که فاوا را برای تحقق اهداف به کار ببرند. در مواجه با نیاز جهانی کاربرد فاوا به استادان در جایگزین نمودن روش های آموزش سنتی با ابزار و امکانات آموزش و یادگیری مبتنی بر فناوری کمک خواهند کرد. اما امروزه این امر برای آموزش خیلی مهم تر از گذشته است، زیرا ابزارهای جدید و استفاده از فاوا در روش های آموزشی موثرند. به نظر می رسد فاوا تاثیر شگرفی بر فرایند یادگیری در آموزش عالی از طریق ارایه فرصت های جدید و جالبی برای اساتید و دانشجویان داشته باشد. هدف پژوهش حاضر فراتحلیل پژوهش های انجام شده در زمینه تاثیر استفاده از فناوری اطلاعات و ارتباطات بر عملکرد آموزشی و پژوهشی استادان، جهت برآورد اندازه اثر واقعی فاوا بر عملکرد آموزشی و پژوهشی استادان بود.
روش هاکلیه پژوهش های انجام شده، تا پایان سال 1396 در زمینه رابطه ی میزان استفاده از فناوری اطلاعات با عملکرد آموزشی و پژوهشی اعضای هیات علمی در ایران جامعه پژوهشی می باشد. با بررسی همه پژوهش های انجام شده تعداد 6 پژوهش درباره اثر فناوری اطلاعات و ارتباطات با عملکرد آموزشی استادان و همچنین تعداد 5 پژوهش درباره اثر فناوری اطلاعات و ارتباطات با عملکرد پژوهشی استادان که دارای ویژگی های مناسب برای ورود به فراتحلیل بودند، انتخاب شدند. ابزار پژوهش، چک لیست گزینش پژوهش ها از نظر فنی و روش شناختی بود . مدل فراتحلیل ترجیحی در این پژوهش رویکرد ترکیب نتایج هانتر و اشمیت بود. برای تفسیر نتایج نیز از رویکرد کوهن استفاده شد.
یافته هااندازه اثر فناوری اطلاعات و ارتباطات بر عملکرد آموزشی استادان نیز 413/0 می باشد که برمبنای شاخص های تفسیری، بالاتر از متوسط است. همچنین اندازه اثر فناوری اطلاعات و ارتباطات بر عملکرد پژوهشی استادان نیز 315/0 می باشد که برمبنای شاخص های تفسیری، متوسط است.
نتیجه گیریکاربرد فناوری اطلاعات و ارتباطات بر عملکرد آموزشی و پژوهشی استادان به طور معناداری تاثیر دارد. با توجه به نتایج به دست آمده و کمیت و کیفیت پژوهش های موجود، پیشنهاد می شود تحقیقات این دو حوزه در سطح بالاتری از لحاظ کیفی و رعایت قواعد تدوین مقاله و اجرای پژوهش انجام شود. همچنین برای رسیدن به یک نتیجه قابل اعتماد در مرحله اول از آمار پارامتریک درطرح خود استفاده کنند و روش های آماری قوی همراه با نمونه متناسب و روش های نمونه گیری مناسب با جامعه استفاده گردد.
کلید واژگان: فراتحلیل, فناوری اطلاعات و ارتباطات, عملکرد آموزشی و پژوهشی, استادان دانشگاهBackground and ObjectivesThe nature of higher education is evolving due to the advancement of ICT while these technologies have had a significant impact on the mission of universities in education and research directions. ICT is a mdeiator that enables the expression of a wide range of information, ideas, concepts and messages. This phenomenon, with all its features and applications, is the collection, organization, storage and dissemination of information, including audio, video, text or number, using computer and telecommunications tools. ICT as a new approach is complementary to education, not its alternative, and its the purpose of development is to improve and make education resources more efficient in general and human resources in particular. Numerous studies in the past have shown the positive effects of ICT in teaching. The development of information technology and the use of new tools and concepts provide the basis for the expansion of information and easy and low-cost access for learners, including school and unviersity students and teachers in the online way and enable the rapid exchange of information and cultural interactions. Higher education institutions are increasingly planning to use ICT as a tool for teaching-learning, scientific collaboration, scientific communication, development, and faculty empowerment, and in practice, are trying to use ICT to achieve goals. In facing the global need, ICT use help educators replace traditional teaching methods with technology-based teaching and learning tools and facilities. But today this is much more important for education than in the past, because new tools and the use of ICT are effective in instructional methods. ICT seems to have a tremendous impact on the learning process in higher education by providing new and exciting opportunities for faculty and students. The present study aims to Meta-analyze the previous studies on the effect of ICT on the faculty members' educational and research performance to show the real value 0f ICT.
MethodsThe research sample consists of all previous studies done on the effect of ICT till 2018 in Iran. The purposeful sampling was done for selection of 6 studies on the effect of ICT on the faculty members' educational performance and 5 appropriate studies regarding the impact of ICT on their research performance to enter the meta-analysis. The isntrument for data gathering includes a checklist of choosing studies technically and methodologically. The meta-analysis method consists of the mixed approach of Hunter and Smith and Cohen for interpretation of results.
FindingsThe findings confirmed that ICT has a significant effect on faculty members' educational and research performance. The effect size was of ICT on the faculty members' educational performance was 0.413. Also, the effect size of ICT on the faculty members' research performance was 0.315.
ConclusionVsing ICT has significant effect on educationl and research per formance of faculty members. Considering the obtained results and the quantity and quality of existing research studies, it is suggested that the researches of these two fields be carried out at a higher level in terms of quality and observance of the rules of academic paper writing and conducting research. Also, to achieve a reliable result in the first stage, use parametric statistics in their design and use strong statistical methods with appropriate sample and appropriate sampling methods in accordance with the population.
Keywords: Meta-analysis, information, communication technology, Educational, Research Performance, University Professors -
In today's highly interconnected networks, security of the entities are often interdependent. This means security decisions of the agents are not only influenced by their own costs and constraints, but also are affected by their neighbors’ decisions. Game theory provides a rich set of tools to analyze such influence networks. In the game model, players try to maximize their utilities through security investments considering the network structure, costs and constraints, which have been set by the network owner. However, decisions of selfish entities to maximize their utilities do not always lead to a socially optimum solution. Therefore, motivating players to reach the social optimum is of high value from the network owner’s point of view. The network owner wants to maximize the overall network security by designing the game's parameters. As far as we know, there is no notable work in the context of linear influence networks to introduce appropriate game design for this purpose. This paper presents design methods that make use of the adjustments of players’ costs, interdependencies, and constraints to align players' incentives with a network-wide global objective. We present a comprehensive investigation of existence and uniqueness conditions of Nash Equilibrium in such environments. Furthermore, numerical results of applying the proposed mechanisms in a sample real-world example are illustrated.
Keywords: Interdependent Security, Nash equilibrium, Social Optimum, Game Design -
One of the main requirements for providing software security is the enforcement of access control policies, which is sometimes referred to as the heart of security. The main purpose of access control policies is to protect resources of the system against unauthorized accesses. Any error in the implementation of access control policies may lead to undesirable outcomes. Hence, we should ensure that these policies are properly implemented. For testing the implementation of access control policies, it is desired to use automated methods. In fact, these methods are faster and more reliable solutions for assessment of the software systems. Although several researches are conducted for automated testing of the specification of access control policies at the design phase, there is not enough research on testing their implementation. In addition, since access control is amongst non-functional requirements of the system, it is not easy to test them along with other requirements of the system by usual methods. To address this challenge, in this paper, we propose an automated method for testing the implementation of access control in a system. This method, as a model based technique, is able to extract test cases for evaluating the access control policies of the system under test. To generate test cases automatically, a combination of behavior model of the system and the specification of access control policies that is written in XACML, are used. The experimental results show that the proposed approach is able to kill the mutants and cover most of the code that is related to access control policies.Keywords: Access control policies, Automated testing, Model based technique, Implementation of access control, XACML
-
Design of secure authentication solutions for low-cost RFID tags is still an open and quite challenging problem, though many protocols have been published in the last decade. In 2013, Wei and Zhang proposed a new lightweight RFID authentication protocol that conforms to the EPC-C1G2 standard and claimed that the protocol would be immune against all known attacks on RFID systems. In this paper, we consider the security of this protocol and show that it cannot provide secure authentication for RFID users. An attacker, by following our suggested approach, will be able to impersonate server/reader, and destroy synchronization between the back-end server and the tag. Finally, we enhance this protocol, and by using formal and informal security analysis we show that the enhanced protocol strongly inhibits the security flaws of its predecessor.Keywords: RFID, EPC-C1G2 Standard, Mutual Authentication, Impersonation, De-Synchronization
-
An important issue in P2P networks is the existence of malicious nodes that decreases the performance of such networks. Reputation system in which nodes are ranked based on their behaviour, is one of the proposed solutions to detect and isolate malicious (low ranked) nodes. GossipTrust is an interesting previously proposed algorithm for reputation aggregation in P2P networks based on the concept of gossip. Despite its important contribution, this algorithm has deficiencies especially with high number of nodes that leads to high execution time and low accuracy in the results. In this paper, a grouped Gossip based Reputation Aggregation (GGRA) algorithm is proposed. In GGRA, GossipTrust is executed in each group between group members and between groups instead of executing in the whole network. Due to the reduction in the number of nodes and using strongly connected graph instead of a weakly one, gossip algorithm in GGRA is executed quickly. With grouping, not only reputation aggregation is expected to be more scalable, but also because of the decrement in the number of errors of the gossiped communication, the results get more accurate. The evaluation of the proposed algorithm and its comparison with GossipTrust confirms the expected results.
-
Nowadays, the growth of virtual environments such as virtual organizations, social networks, and ubiquitous computing, have led to the adoption of trust concept. One of the methods of making trust in such environments is to use long-term relationship with a trusted partner. The main problem of this kind of trust, which is based on personal experiences, is its limited domain. Moreover, both parties of such trust relationship will face big problems of collecting data and forming reasonable and reliable beliefs. Considering the concept of “group” in modeling trust is a way to overcome the above mentioned problems. Since,group-based trust is more suited with the nature of trust in new virtual environments. In this paper a new trust model called “GTrust” is proposed in which trust is considered as a collective and shared feature of all group members. Therefore, group membership is used as the judgment criteria regarding a person’s expected behavior and how he can be a trustee. GTrust is based on Metagraphs which is a graphical data structure for representing a collection of directed set-to-set mappings. We show that by using GTrust, large trust spaces between unknown individuals can be shaped effectively. The proposed model not only offers a better description of human sense of trust when considering communities, but also provides the setting for evaluating the trust of individuals whom we do not know, and therefore provides an extended evaluation domain.
-
Despite significant advances in the access control domain, requirements of new computational environments like web services still raise new challenges. Lack of appropriate method for specification of access control policies (ACPs), composition, verification and analysis of them have all made the access control in the composition of web services a complicated problem. In this paper, a new independent formal model called Constrained Policy Graph (CPG) for specification of ACPs and their composition as well as verification of conflict or incompatibility among the ACPs is represented. It is shown how CPG can be used in modeling and verification of web service composition ACPs. Also the application of CPG for modeling policies in BPEL processes -as the most common composition method for web services- is illustrated.Keywords: Access Control Policy (ACP), Verification, Web Service Composition, BPEL, Constrained Policy Graph (CPG)
- این فهرست شامل مطالبی از ایشان است که در سایت مگیران نمایه شده و توسط نویسنده تایید شده‌است.
- مگیران تنها مقالات مجلات ایرانی عضو خود را نمایه می‌کند. بدیهی است مقالات منتشر شده نگارنده/پژوهشگر در مجلات خارجی، همایش‌ها و مجلاتی که با مگیران همکاری ندارند در این فهرست نیامده‌است.
- اسامی نویسندگان همکار در صورت عضویت در مگیران و تایید مقالات نمایش داده می شود.
©2000-2025 magiran.com All Rights Reserved.