Elisa Bertino

Elisa Bertino
Purdue University | Purdue

About

1,274
Publications
201,581
Reads
How we measure 'reads'
A 'read' is counted each time someone views a publication summary (such as the title, abstract, and list of authors), clicks on a figure, or views or downloads the full-text. Learn more
35,455
Citations

Publications

Publications (1,274)
Article
Because encryption is a fundamental security building blocks, existing encryption techniques like AES, Twofish, Blowfish, Triple DES are constantly under the threat of being compromised. We introduce a simple graph-theoretic encryption method named CryptoCliqIn using clique injection and prove that the decryption of this encryption without the appr...
Preprint
Cellular networks represent a critical infrastructure and their security is thus crucial. 5G - the latest generation of cellular networks - combines different technologies to increase capacity, reduce latency, and save energy. Due to its complexity and scale, however, ensuring its security is extremely challenging. In this white paper, we outline r...
Conference Paper
Full-text available
This paper focuses on checking the correctness and robustness of the AT command interface exposed by the cellular baseband processor through Bluetooth and USB. A device's application processor uses this interface for issuing high-level commands (or, AT commands) to the baseband processor for performing cellular network operations (e.g., placing a p...
Conference Paper
A great quantity of user passwords nowadays has been leaked through security breaches of user accounts. To enhance the security of the Password Authentication Protocol (PAP) in such circumstance, Android app developers often implement a complementary One-Time Password (OTP) authentication by utilizing the short message service (SMS). Unfortunately,...
Conference Paper
Full-text available
The paper proposes 5GReasoner, a framework for property-guided formal verification of control-plane protocols spanning across multiple layers of the 5G protocol stack. The underlying analysis carried out by 5GReasoner can be viewed as an instance of the model checking problem with respect to an adversarial environment. Due to an effective use of be...
Conference Paper
In location based services, predicting users' temporal-spatial behavior is critical for accurate recommendation. In this paper, we adopt a joint embedding (JointE) model to learn the representations of user, location, and users' action in the same latent space. The functionality of a location is the critical factor influencing different elements of...
Chapter
In this paper, we give a location privacy-preserving solution for the mobile crowd sensing (MCS) system. The solution makes use of the blind signature technique for anonymous authentication and allows a mobile user to participate in the MCS for certain times set in the registration. Furthermore, we introduce a concept of anonymous reputation for mo...
Chapter
Password authentication is widely used to validate users’ identities because it is convenient to use, easy for users to remember, and simple to implement. The password authentication protocol transmits passwords in plaintext, which makes the authentication vulnerable to eavesdropping and replay attacks, and several protocols have been proposed to p...
Article
Cellular networks are and will increasingly be one of the most critical infrastructures, and their security is obviously crucial. However, securing cellular networks is a challenging task. These networks consist of multiple layers: physical, radio resource control, nonaccess stratum, and so on. Each layer, in turn, has its own protocols, such as th...
Article
In this paper we introduce an extension of context-free grammars called answer set grammars (ASGs). These grammars allow annotations on production rules, written in the language of Answer Set Programming (ASP), which can express context-sensitive constraints. We investigate the complexity of various classes of ASG with respect to two decision probl...
Conference Paper
As the Internet of Things (IoT) grows at a rapid pace, there is a need for an effective and efficient form of security tailored for IoT devices. In this paper, we introduce E-Spion, an anomaly-based system level Intrusion Detection System (IDS) for IoT devices. E-Spion profiles IoT devices according to their 'behavior' using system level informatio...
Article
In an edge-enabled data management and computing environment, it is critical to ensure the privacy of the information acquired, processed, and exchanged among the different parties. The problem is complex because of the large scale, mobility, device, and protocol heterogeneity. Also, unlike in conventional environments, communication may be fragmen...
Article
Health monitoring of civil infrastructures is a key application of Internet of things (IoT), while edge computing is an important component of IoT. In this context, swarms of autonomous inspection robots, which can replace current manual inspections, are examples of edge devices. Incorporation of pretrained deep learning algorithms into these robot...
Conference Paper
In the cellular ecosystem, base stations act as trusted intermediaries between cellular devices and the core network. During connection bootstrapping, devices currently, however, do not possess any mechanisms to authenticate a base station before connecting to it. This lack of authentication has been shown to be exploitable by adversaries to instal...
Article
Private record linkage protocols allow multiple parties to exchange matching records, which refer to the same entities or have similar values, while keeping the non-matching ones secret. Conventional protocols are based on computationally expensive cryptographic primitives and therefore do not scale. To address these scalability issues, hybrid prot...
Chapter
Generative policies have been proposed as a mechanism to learn the constraints and preferences of a system—especially complex systems such as the ones found in coalitions—in a given context so that the system can adapt to unexpected changes seamlessly, thus achieving the system goals with minimal human intervention. Generative policies can help a c...
Chapter
Techniques for detection of anomalies in accesses to database systems have been widely investigated. Existing techniques operate in two main phases. The first phase is a training phase during which profiles of the database subjects are created based on historical data representing past users’ actions. New actions are then checked with these profile...
Chapter
In any machine learning problem, obtaining and acquiring good training data is the main challenge that needs to be overcome to build a good model. When applying machine learning approaches in the context of coalition operations, one may only be able to get data for training machine learning models from coalition partners. However, all coalition par...
Chapter
Full-text available
The promise of AIs that can target, shoot at, and eliminate enemies in the blink of an eye, brings about the possibility that such AIs can turn rogue and create an adversarial “Skynet.” The main danger is not that AIs might turn against us because they hate us, but because they think they want to be like us: individuals. The solution might be to tr...
Conference Paper
Full-text available
Survey on the challenges of using vehicular networks as a vehicular cloud for the Internet in terms of dependability and security.
Article
Insider threats are a serious problem that could be more damaging than outsiders’ attacks. The reason is that insiders are users who have legitimate access to the data. A database management system (DBMS) access control mechanism is unable to prevent misuse of the data to which the user is authorized to access. Many mechanisms were proposed to dete...
Article
Policy-based access control systems are crucial for secure information sharing in collaborative applications. However, policy management needs to be flexible in order to adapt to different environments and be able to support policy evolution. However, when dealing with large sets of evolving policies, it is critical that policies meet certain polic...
Article
Policy-based management of computer systems, computer networks and devices is a critical technology especially for present and future systems characterized by large-scale systems with autonomous devices, such as robots and drones. Maintaining reliable policy systems requires efficient and effective analysis approaches to ensure that the policies ve...
Conference Paper
Full-text available
PAST is a self-adaptive security tool for discovering the features of the protocols adopted by the devices in an IoT ecosystem. Based on such discovery, specific security defenses are deployed on the basis of (i) the attacks targeting such protocols, and (ii) the security features provided by the protocols themselves. We outline the reasons for the...
Article
The use of big data combined with powerful machine-learning algorithms raises major concerns over potential adverse effects. Consequently, data transparency is critical for many data-intensive applications. We provide a comprehensive definition, elaborate on various concerns, and articulate an initial road map for critical research challenges.
Article
Most users on social media have intrinsic characteristics, such as interests and political views, that can be exploited to identify and track them, thus raising privacy and identity concerns in online communities. In this article, we investigate the problem of user identity linkage on two behavior datasets collected from different experiments. Spec...
Chapter
Full-text available
Ransomware has recently (re)emerged as a popular malware that targets a wide range of victims - from individual users to corporate ones for monetary gain. Our key observation on the existing ransomware detection mechanisms is that they fail to provide an early warning in real-time which results in irreversible encryption of a significant number of...
Article
We design and implement a query language for a secure, interoperable, and multi-granular provenance framework, referred to as QL-SimP. Our language supports two provenance representations (relational and graph-based) due to its independence from the underlying provenance representation. It also supports various queries that can be utilized for diff...
Article
Access Control policies allow one to control data sharing among multiple subjects. For high assurance data security, it is critical that such policies be fit for their purpose. In this paper we introduce the notion of “policy quality” and elaborate on its many dimensions, such as consistency, completeness, and minimality. We introduce a framework s...
Preprint
Full-text available
Anytime, Anywhere' data access model has become a widespread IT policy in organizations making insider attacks even more complicated to model, predict and deter. Here, we propose Gargoyle, a network-based insider attack resilient framework against the most complex insider threats within a pervasive computing context. Compared to existing solutions,...
Conference Paper
Full-text available
Over the past years, crowdsourcing has increasingly been used for the discovery of vulnerabilities in software. While some organizations have extensively used crowdsourced vulnerability discovery, other organizations have been very hesitant in embracing this method. In this paper, we report the results of a qualitative study that reveals organizati...
Conference Paper
Full-text available
Despite decades of research on the Internet security, we constantly hear about mega data breaches and malware infections affecting hundreds of millions of hosts. The key reason is that the current threat model of the Internet relies on two assumptions that no longer hold true: (1) Web servers, hosting the content, are secure, (2) each Internet conn...
Conference Paper
In context-aware applications, user's access privileges rely on both user's identity and context. Access control rules are usually statically defined while contexts and the system state can change dynamically. Changes in contexts can result in service disruptions. To address this issue, this poster proposes a reactive access control system that ass...
Conference Paper
Access control for information has primarily focused on access statically granted to subjects by administrators usually in the context of a specific system. Even if mechanisms are available for access revocation, revocations must still be executed manually by an administrator. However, as physical devices become increasingly embedded and interconne...
Conference Paper
We propose a tool to capture applications requirements with respect to the enforcement of network security policies in an object-oriented design language. Once a design captures clear, concise, easily understood network requirements new technologies become possible, including network transactions and user-driven policies to remove rarely used netwo...
Conference Paper
Massive amounts of data are being collected, stored, and analyzed for various business and marketing purposes. While such data analysis is critical for many applications, it could also violate the privacy of individuals. This paper describes the issues involved in designing a privacy aware data management framework for collecting, storing, and anal...
Article
Full-text available
Online knowledge production sites, such as Wikipedia and Stack Overflow, are dominated by small groups of contributors. How does this affect knowledge quality and production? Does the persistent presence of some key contributors among the most productive members improve the quality of the knowledge, considered in the aggregate? The paper addresses...
Chapter
Recent technologies, such as IoT, social networks, cloud computing, and data analytics, make today possible to collect huge amounts of data. However, for data to be used to their full power, data security and privacy are critical. Data security and privacy have been widely investigated over the past thirty years. However, today we face new issues i...
Article
The sensors of a context-aware system extract contextual information from the environment and relay that information to higher-level processes of the system so to influence the system’s control decisions. However, an adversary can maliciously influence such controls indirectly by manipulating the environment in which the sensors are monitoring, the...
Conference Paper
In this paper, we present our position-based, Multi-EnterpRise Containerization (MERC) architecture for BYOD security. The MERC architecture leverages positional data to grant context-aware capabilities to container-based systems. We grant enterprises the ability of defining location- and proximity-based conditions that must be met in order for use...
Article
Considering the huge number of vehicles on the roads, Vehicular Ad-hoc Networks (VANETs) are envisioned to foster a variety of new applications ranging from road safety enhancement to mobile entertainment. These new VANET applications all face a critical challenge which is to ensure the identity and location privacy of vehicles’ owners who particip...
Conference Paper
Most users on social media have intrinsic characteristics, such as interests and political views, that can be exploited to identify and track them. It raises privacy and identity issues in online communities. In this paper we investigate the problem of user identity linkage on two behavior datasets collected from different experiments. Specifically...
Article
Full-text available
Graphs are used for representing and understanding objects and their relationships for numerous applications such as social networks, semantic webs, and biological networks. Integrity assurance of data and query results for graph databases is an essential security requirement. In this paper, we propose two efficient integrity verification schemes-H...
Conference Paper
The Internet of Things (IoT) paradigm refers to the network of physical objects or 'things' embedded with electronics, software, sensors, and connectivity to enable objects to exchange data with servers, centralized systems, and/or other connected devices based on a variety of communication infrastructures. IoT makes it possible to sense and contro...
Article
In current Android architecture, users have to decide whether an app is safe to use or not. Expert users can make savvy decisions to avoid unnecessary privacy breach. However, the majority of normal users are not technically capable or do not care to consider privacy implications to make safe decisions. To assist the technically incapable crowd, we...
Article
High-profile and often destructive distributed denial of service (DDoS) attacks continue to be one of the top security concerns as the DDoS attacks volumes are increasing constantly. Among them, the SYN Flood attack is the most common type. Conventional DDoS defense solutions may not be preferable, since they demand highly capable hardware resource...
Conference Paper
Full-text available
With the rapid development of location based social networks (LBSN) and location based services (LBS), the location recommendation to users has gained much attentions. A traditional location recommendation scheme may use any of the following information to generate a location recommendation: users’ check-in frequencies on different locations, their...
Article
At present, Bluetooth Low Energy (BLE) is dominantly used in commercially available Internet of Things (IoT) devices - such as smart watches, fitness trackers, and smart appliances. Compared to classic Bluetooth, BLE has been simplified in many ways that include its connection establishment, data exchange, and encryption processes. Unfortunately, t...
Conference Paper
Full-text available
We present a method for computing the best provisioning of security resources for Internet of Things (IoT) scenarios characterized by a high degree of mobility. The security infrastructure is specified by a security resource allocation plan computed as the solution of an optimization problem that minimizes the risk of having IoT devices not monitor...
Conference Paper
Full-text available
Online knowledge production sites, such as Wikipedia or Stack Overflow, are dominated by small groups of contributors. How does this affect knowledge production and its quality? Does the persistent presence of some key contributors among the most productive members improve or not the quality of the knowledge, considered in the aggregate? The presen...
Article
Despite their enormous growth, current social networks lack a systematic approach to delegate rights – when an entity authorizes another to access the resources on its behalf. This paper proposes a delegation model based on socio-technical design and theory of cooperation and collaboration that best suits the requirements of social networks. The mo...