Science topic

Internet Security - Science topic

Explore the latest questions and answers in Internet Security, and find Internet Security experts.
Questions related to Internet Security
  • asked a question related to Internet Security
Question
4 answers
While Linux has its own bits of share in other things of daily life including software development, internet security, server and data analytics; why does it lags behind in academics and research especially in biological sciences despite of having financial advantage?
Relevant answer
Answer
Dear Subhradip Bhattacharjee,
The reasons are well outlined at the following sources:
Why do academics prefer Mac/Linux?
_____
_____
Linux vs MAC vs Windows
_____
_____
Linux & Windows Operating Systems
_____
_____
  • asked a question related to Internet Security
Question
20 answers
Does the development and implementation of new information technologies for banking affect the processes of improving the security of online banking systems?
Improvement of online banking security systems can currently be significantly determined, among others, by the implementation of new information technologies for banking.
Are the processes of improving internet banking security systems currently determined by the implementation of new information technologies, i.e. by implementing banking data processing technologies in Big Data database systems, Business Intelligence based analytics, implementation of Blockchain technology and artificial intelligence.
Do you think that the processes of improving internet banking security systems are currently determined by the implementation of new information technologies for banking?
Please reply
Best wishes
Relevant answer
Answer
Zhu, R. (2015). An Initial Study of Customer Internet Banking Security Awareness and Behaviour in China. In PACIS (p. 87).
  • asked a question related to Internet Security
Question
4 answers
I found AVISPA (Automated Validation of Internet Security Protocols and Applications) http://www.avispa-project.org/ for the analysis of Internet security-sensitive protocols. However, it is not recently updated (2007). Could please tell me the name of the free tools for testing security-sensitive protocols?
Relevant answer
Answer
SCYTHER its preferable
  • asked a question related to Internet Security
Question
5 answers
I want to apply a privacy-preserving algorithm in MQTT for IoT devices. Which tool do you suggest to simulate this algorithm? I want to measure the performance on the IoT battery device? Actually, I found many ways such as Matlab, Netsim, MIMIC MQTT, python, and Contiki cooja, but I'm not sure which simulation software is best suited for this? Could you give me a suggestion about the best environment?
Relevant answer
Answer
Netsim simulator is the best, it's gathering all these features of all other simulators
  • asked a question related to Internet Security
Question
3 answers
I am attempting to gather information regarding my project for my Internet Security class which is "How to take down a TOR website without the owners permission"? Most of the information that I have come across leads to DDOS. Can you please lend your assistance if possible?
Relevant answer
Answer
This is an interesting topic and several approaches can be used. As Branko Džakula mentioned, normally long-running, complex and well-coordinated missions are required, but sometimes easily exploitable attack vectors are available, too.
While DDoS can be used to deny access to a website quite easily, typically that only works for a limited time. Especially with respect to illicit content, DoS'ing does not bring down the source or owner of a website.
Therefore, to permanently bring down a website in the dark web, an identification of the server resp. the real IP address is required to initiate law enforcement.
To de-anonymize a user, three basic approaches can be used: technical exploitation, exploiting indirect shortcomings, and human error.
- Technical attacks are executed on Tor itself by exploiting design or implementation errors of the Tor protocol or software; the "relay early traffic confirmation attack" is an example.
- A subcategory of technical attacks on Tor are attacks exploiting vulnerabilities of components involved, but not of the Tor network itself, e.g., attacking the Firefox Browser or Add-Ons used by the Tor Browser. A well-known example is the shutdown of the "Playpen" dark web child pornography website by the FBI in February 2015. The FBI used a so-called "Network Investigative Technique" to de-anonymize the users. This was, in fact, the "exploitation" of an Adobe Flash Plug-In feature (class Decloak) which was enabled in older versions of the Tor Browser. Based on that, the FBI collected the real IP addresses of several thousand visitors and hacked into 8700 computers in 120 countries. After the prosecutions, 548 people were sentenced (as of May 2017), while the creator of Playpen was sentenced to 30 years.
- The second category is indirect shortcomings which are not based on design or implementation vulnerabilities, e.g., default configurations of a webserver. An example is the popular Apache web server, which ships with the feature "mod_status" enabled, providing server details via the page "/server_status". For security reasons, the page is only accessible from localhost - but the Tor demon _is_ running on localhost, therefore, if enabled in standard configuration, the status page could be accessed via the dark web. In one example, all search queries of a dark web search engine were exposed as the could be looked up within the content of the status plugin. Clever utilization of uXDT (ultrasound cross-device tracking) is another example of indirect de-anonymization attacks.
- Last but not least, the often most prominent category when talking about security issues is also a common attack vector for de-anonymization in the dark web: human error and carelessness. For example, Ross Ulbricht (Dread Pirate Roberts, creator of the Silk Road) was caught because of a link of his dark web pseudonym to his Gmail address used in a public talk.
You can find more details about these attacks, additional examples, and other de-anonymization attacks in a paper of mine, which deals with the dark web, de-anonymization attacks and the often overrated role of the dark web: https://ccdcoe.org/uploads/2019/06/Art_15_Hidden-in-the-Shadow.pdf
  • asked a question related to Internet Security
Question
4 answers
What is the best solution at Gateway between the Internet (Public) and the Intranet (Vast LAN/VLAN (Private)) for the intruder detection, drop or deny, stopping spam emails and viruses/malwares, protect from exploiting vulnerabilities, flood a targets in application and communication protocol etc. and a best monitoring, evaluation and analysis tool for the better safeguard. Normally we intend to implement either a software or hardware firewall which enforces a set security policies that needs to be fine-tuned according to the recent advancement and race.
We can take all possible measures for the security of databases servers, web servers, systems servers with a set of inbuilt security mechanism and secure travel of transactions over the net based on encryption & VPN as choices are available.
Relevant answer
Answer
check the website https://www.zscaler.com/products/zscaler-internet-access A secure Internet gateway is a security solution that delivers protection to the internet network by preventing unauthorized traffic to enter the organization’s internal network. It is deployed by enterprises to provide security to their users from getting infected by malicious internet traffic, suspicious websites or malware. It also enables to follow compliance of the organization's policies and regulations. A gateway is a router which is a halting point for data that comes in and goes out of the computer network. Gateway has made communication easy to send and receive data across networks. Gateway is the prime component and without it, internet would not have been of any use.
Importance of Secure Internet Gateway - A Secure Internet Gateway is predominently deployed to monitor, track and protect the internet network by preventing suspicious traffic and data from coming in and going out of the corporate network. A secure web gateway is primarily used to monitor and prevent malicious traffic and data from entering, or even leaving, an organization’s network. It is deployed through gateway device/hardware/application implementing on the borders of the network obstruct current and future threats over all ports and protocols. It terminates access to malicious domains, IPs, URLs, and files even before establishing a connection or downloading a file. Secure Internet Gateway features URL filtering, application level control, data leakage prevention, malware code detection. Best Secure Internet Gateway Software -
Comodo Dome Secure Internet Gateway offers a security suite with functionalities to detect and obstruct any kind of malware activity from entering the network without creating any impact on the user experience and other normal operations of the computer. Comodo Dome implements the Default Deny approach through auto-containment technology, and ensures prevention mechanism by analysing the unknown or suspicious files even before they are delivered to the users. It is comprehensive, flexible, end-user friendly and easy to set up.
  • asked a question related to Internet Security
Question
12 answers
ACeS 2019 respectfully asks scholars and experts in Cybersecurity and related areas to consider being a member of the Technical Program Committee. If you are interested or if you have someone to recommend, please send CV to aces@usm.my with the Subject "TPC Member". We will have each CV reviewed and select most suitable ones for ACeS 2019.
TPC member’s name, affiliation and country will be shown on the conference site (aces.usm.my) and in the proceedings for ACeS 2019 as well.
Relevant answer
Answer
Email is aces@usm.my
  • asked a question related to Internet Security
Question
15 answers
In connection with the development of cybercrime on the Internet, the security systems for transfer and processing of data, financial transactions, electronic banking, etc. carried out on the Internet are improved. In addition to electronic banking, the key information security in the internal IT systems of central state institutions is protected. Cybercriminal attacks on cyber-banking systems and hacker attacks aimed at companies to extort ransom for decrypting data encrypted by computer viruses on disks (cybercriminal ransomware attacks) and hack attacks from abroad on key central institutions, ministries and other institutions of the public administration sector and enterprises of strategic branches of the national economy.
In connection with the above, I am asking you:
Do you think, for security reasons, everything that happens on the Internet should be analyzed by the public security services?
Please answer
Best wishes
Relevant answer
Answer
Following
  • asked a question related to Internet Security
Question
2 answers
I want to compare age wise cyber crime between USA and Japan. However, I could not find similar data for both countries. I got data from US related to number and loss due to cyber crime age wise. For Japan, I got the data (survey) about internet security (such as financial loss, virus infection etc).
Is there any method or software that can analyse these two data?
Relevant answer
Answer
Thanks a lot.
  • asked a question related to Internet Security
Question
2 answers
Botnets are some of the most serious threats to Internet security?
Relevant answer
Answer
I am following answer
  • asked a question related to Internet Security
Question
5 answers
Can anyone suggest some link, which provides all the details regarding AVISPA( Automated Validation of Internet Security Protocols and Applications) tool and its generated outputs?
Relevant answer
Answer
Thanks, this link is not working
  • asked a question related to Internet Security
Question
7 answers
There are various algorithm to generate the keys in Public Cryptosystem, e.g., Diffie-Hellman Key Exchange is very popular algorithm to generate and distribute the shared secret keys between two parties. However, I am interested to generate the shared key with the involvement session ID or number by Diffie-Hellman Key Exchange. What are different mechanism to perform these things.
Any alternative are also most welcome.
Relevant answer
Answer
A brief introduction to cryptography from the IBM website may also help you to understand: https://www.ibm.com/support/knowledgecenter/en/SSB23S_1.1.0.14/gtps7/seccon.html
This website will generate keys online:
  • asked a question related to Internet Security
Question
3 answers
PKI guarantees that a machine is who it says it is through 3 party system?  What about processes on the same machine.  I want to validate that a signed or encrypted message came from a specific process.
Relevant answer
Answer
I think that a simple read lock should fulfill your requirement of giving merely one process access to a certificate repository. I caught a glimpse of the existing literature and found a patent about a read and write lock management at https://www.google.com/patents/US6029190. I hope it helps you.
  • asked a question related to Internet Security
Question
6 answers
Have you any idea or suggestions ?
Relevant answer
Answer
I can give u some advises if still not achieved the work...
  • asked a question related to Internet Security
Question
6 answers
Cloud users, corporations have their own security policy but it is very difficult to have an effective security policy, so what are the challenges cloud users faces in defining an effective security policy model? And what are the existing solutions to handle the challenges?
Relevant answer
Answer
You might also be interested in our paper talking about key cloud security considerations that we made at Intel when deploying and using applications tin the cloud.
  • asked a question related to Internet Security
Question
8 answers
is there any idea of internet of things security to work with it as a paper?
Relevant answer
Answer
Security of Internet of things is complex:
-First, some things may be small (so sensor network security and RFID security may come to mind as a model. So achieving secrecy may be a challenge.
-Second: some things need authentication since they represent sensitive control function. How to do it?
-Some things may be in the wild, so how can one assures they are not contaminated by the adversary.
-Some things have identity and some need privacy perhaps as to not reveal too much info for tracking.
-A big new issue is that "things" may have real-world function so safety of their operation under malicious possible attack is to be considered.
I would start with possibly the literature/ software on what works in sensor networks as a possible reference point for physical security, confidentiality, and authentication issues, and with digital control networks for safety.
  • asked a question related to Internet Security
Question
11 answers
After reading some papers, I found many papers skip the detail of making IDS, instead, directly go to evaluation part. 
Can anyone give me some hints about how to build a host based light weight IDS for detecting VM escape? Good references?
Thank you very much!
Relevant answer
Answer
Hi Bo Sun, 
Are you referring to Virtual machine interfaces or Virtual machine introspection ( the host IDS that exploits virtual machine introspection to check the integrity of a kernel running inside a virtual machine)? I am assuming the later, in case here are a list of articles:
A Virtual Machine Introspection Based Architecture for Intrusion Detection
Virtual machine introspection: Observation or interference?
Virtual Machine Introspection:
A formal model for virtual machine introspection:
Virtuoso: Narrowing the Semantic Gap in Virtual Machine Introspection:
For VMI, as defined above, then yes this sounds like a useful approach - in fact a combination of VMI and Network monitoring is likely to provide a more "semantic" observation of VM escaping. Contextually speaking that is, for example where you capture a correlation between VMI and network activities to build a picture of anomalous resource access and network activity.
An interesting subject!
  • asked a question related to Internet Security
Question
5 answers
How can organization monitor their CSP and provide assurance to relevant stake holders that privacy requirement are met when their PII( personally identifiable information) in the cloud?
Relevant answer
Answer
  • asked a question related to Internet Security
Question
13 answers
How privacy issues can be addressed in the context of cloud computing policy?
Relevant answer
Answer
Take a look at Legal requirements as mentioned above, and privacy policy statements from organizations to derive privacy requirements which then you can transform for applications. 
  • asked a question related to Internet Security
Question
20 answers
Suppose I have made a IDS (Intrusion Detection System), For example using KDD CUP99 I have made a system and I have done the test and evaluation and the result is acceptable. Now, I want to evaluate my proposed system on real online traffic . I can capture the packet using PCAP, I can extract the features and detect is it normal and anomaly. BTW, my problem is how can evaluate the output, because there is no ground file for that traffic. How can evaluate my system on real traffic? may be during the testing all the traffic in normal how can evaluate the performance of system on abnormal traffic? I think I have to make some abnormal traffic and test the system using my own abnormal traffic, Does this idea is correct and how should I make abnormal traffic?
Relevant answer
Answer
Your IDS is supposed to check the intrusions of a real-world data set, just recently released or just launch it by yourself. When we are doing real-time detection then we are supposed to launch the attacks or whatever you are interested in. After that run your algorithm and if it results well than you can surely use it for real time evaluation. KDD is no more. You can use Snort or other alternatives of Snort for doing so. 
  • asked a question related to Internet Security
Question
2 answers
Relevant answer
Answer
I assume you are referring to web app security assessment.
  • asked a question related to Internet Security
Question
5 answers
user can request for any website and phishing page then direclty move on orignal page
Relevant answer
Answer
Beside all technical countermeasures to detect and antagonize phishing, it can also be prevented by improving the online users' phishing awareness. Just catch a glimpse at https://www.researchgate.net/profile/Curtis_Carver/publication/222730836_Phishing_for_user_security_awareness/links/0deec5161aaaf78130000000.pdf for example!
  • asked a question related to Internet Security
Question
9 answers
latest cloud computing security issues to do my resaerch
Relevant answer
Answer
Hello, 
A review of the cloud computing is mentioned in the following paper and a solution is mentioned for secure instance migration in the cloud. "Towards secure instance migration in the cloud". You can find this on my profile.
  • asked a question related to Internet Security
Question
2 answers
Relevant answer
Answer
The terms “dependability”‎ and “security”‎ have been used interchangeably to describe the properties of secure and trusted software.
However, the extant literature shows that dependability attributes are considered as the cure for security threats, abnormal behavior and untrustworthy issues in a software system.
A system is considered dependable when it can be depended on to produce the consequences for which it was designed, with no adverse effect in its intended environment. Dependability comprises several attributes that imply availability, confidentiality, integrity, reliability, safety, and maintainability.
Methods and tools to attain the dependability attributes have been discussed in details in my previous publications.
I hope this can help you. Good luck.
  • asked a question related to Internet Security
Question
5 answers
I  am  developing  a  security  features  for a  system, there  i  have  to   prevent  port  knocking  from  other  machine  and allow  only  the authenticated  users  in my  machine...?.  Is  it  possible....
Relevant answer
Answer
 One of my undergraduate students did a project that consisted of the following:
A multi threaded port knocker which used the following measures:
1) each message was sent with an RSA key for validation
2) the user used the key to encrypt the AES key
3) the AES key was used to encode the next port knocking sequence. this would protect the protocol from replay attacks.
One feature that was otu of scope but could serve as future work is cycling the AES key and RSA keys.
Hope this helps
  • asked a question related to Internet Security
Question
2 answers
Dear researchers,
Can I use the version academic for simulate my new IDS?
Relevant answer
Answer
Thank you khoula for your reply
  • asked a question related to Internet Security
Question
5 answers
For an almost finished book I'm always looking for computer crime cases in the Netherlands and Flanders. Since I have to do with poor statistics from government and software vendors I prefer real cases and people telling about they were stonewalled or helped by the authorities.
Relevant answer
Answer
thanks
  • asked a question related to Internet Security
Question
15 answers
What are the importance of image steganography as data security on the internet?
Relevant answer
Answer
Ultimately it  depends on the scenario you wish to apply either. With cryptography there are obvious visual clues, obfuscated data or merely a password entry screen. However, with Steganography the user can send the image to multiple recipients without them even realising that the image contains hidden data, and only the intended recipient can be made aware of this contents and the means of how to extract said data.
  • asked a question related to Internet Security
Question
1 answer
I am seeking help from anyone to suggest me any experts in internet security and intrusion detection in internet traffic for reference.
Relevant answer
Answer
Could you be more specific on the type of advise you are searching for? So that we can better address your inquiry
  • asked a question related to Internet Security
Question
9 answers
If it is on internet it is not private!!!
Relevant answer
Answer
That really depends with whom you wish to communicate. As a general-purpose, long-standing, trusted solution I'd recommend the PGP web of trust. You can still use Gmail with it, for example by using Thunderbird with the Enigmail plugin, because you don't have to share your key with Google. The problem is of course key management - if it's lost, it has to be revoked.
For more tailored uses I'd go with starting a Tor hidden service, to run a hidden portal. For general-purpose web traffic one could use the HTTPS Anywhere plugin along with adblockers and tracker-disablers that are available for all major browsers. Since we're on the topic of browser plugins I should also mention Crypto.Cat, which starts up an encrypted chatroom (which anyone can join if they know the chatroom name).
These things so far deal with use-cases and not with theory. The biggest threat (since you mention wireless networks) is a man-in-the-middle attack, and that's why the WoT recommends only trusting keys you've received in person. I hope I've answered the "meat" of the question; please add a comment if I've left something out.
  • asked a question related to Internet Security
Question
4 answers
I am using KDD cup 99 dataset in classifying network intrusions and normal data. So, I am just wondering is my system considered anomaly-based IDS or signature-based IDS?
Relevant answer
Answer
My opinion is that KDD CUP 99 data are obsolete and i believe the academic community should give researchers the opportunity to try new datasets and not asking them all the time to compare there results with this obsolete dataset. If you check the internet for example in Wireshark website you will find many pcap files from newer attacks. You can combine them and try make them as one dataset and test them with your IDS. If you manage to create a good dataset is good to publish it in the internet so that other researchers can test them also.
Now about your question is how you are going to use this data. I mean what IDS you are going to use. Most IDS like Snort are signature based. Anomaly based it need sensor across the network training etc. Check this article is very good http://www.scmagazine.com/signature-based-or-anomaly-based-intrusion-detection-the-practice-and-pitfalls/article/30471/
I hope i helped you.
  • asked a question related to Internet Security
Question
1 answer
If possible, suggest me the web site names which have daily updates about cloud security.
Relevant answer
Answer
you can refer to a newly published paper in IEEE Communications Surveys & Tutorials entitled "Security and Privacy in Cloud Computing".