-
DocCert: Nostrification, Document Verification and Authenticity Blockchain Solution
Authors:
Monther Aldwairi,
Mohamad Badra,
Rouba Borghol
Abstract:
Many institutions and organizations require nostrification and verification of qualification as a prerequisite for hiring. The idea is to recognize the authenticity of a copy or digital document issued by an institution in a foreign country and detect forgeries. Certificates, financial records, health records, official papers and others are often required to be attested from multiple entities in d…
▽ More
Many institutions and organizations require nostrification and verification of qualification as a prerequisite for hiring. The idea is to recognize the authenticity of a copy or digital document issued by an institution in a foreign country and detect forgeries. Certificates, financial records, health records, official papers and others are often required to be attested from multiple entities in distinct locations. However, in this digital era where most applications happen online, and document copies are uploaded, the traditional signature and seal methods are obsolete. In a matter of minutes and with a simple photo editor, a certificate or document copy may be plagiarized or forged. Blockchain technology offers a decentralized approach to record and verify transactions without the need for huge infrastructure investment. In this paper, we propose a blockchain based nostrification system, where awarding institutions generate a digital certificate, store in a public but permissioned blockchain, where students and other stakeholders may verify. We present a thorough discussion and formal evaluation of the proposed system.
△ Less
Submitted 13 October, 2023;
originally announced October 2023.
-
Evaluating Web Search Engines Results for Personalization and User Tracking
Authors:
Shamma Rashed,
Tasnim Said,
Amal Abdulrahman,
Arsiema Yohannes,
Monther Aldwairi
Abstract:
Recently, light has been shed on the trend of personalization, which comes into play whenever different search results are being tailored for a group of users who have issued the same search query. The unpalatable fact that myriads of search results are being manipulated has perturbed a horde of people. With regards to that, personalization can be instrumental in spurring the Filter Bubble effects…
▽ More
Recently, light has been shed on the trend of personalization, which comes into play whenever different search results are being tailored for a group of users who have issued the same search query. The unpalatable fact that myriads of search results are being manipulated has perturbed a horde of people. With regards to that, personalization can be instrumental in spurring the Filter Bubble effects, which revolves around the inability of certain users to gain access to the typified contents that are allegedly irrelevant per the search engine's algorithm.
In harmony with that, there is a wealth of research on this area. Each of these has relied on using techniques revolving around creating Google accounts that differ in one feature and issuing identical search queries from each account. The search results are often compared to determine whether those results are going to vary per account. Thereupon, we have conducted six experiments that aim to closely inspect and spot the patterns of personalization in search results. In a like manner, we are going to examine how the search results are going to vary accordingly. In all of the tasks, three different metrics are going to be measured, namely, the number of total hits, the first hit, and the correlation between hits. Those experiments are centered around fulfilling the following tasks. Firstly, setting up four VPNs that are located at different geographic locations and comparing the search results with those obtained in the UAE. Secondly, performing the search while logging in and out of a Google account. Thirdly, searching while connecting to different networks: home, phone, and university networks. Fourthly, using different search engines to issue the search queries. Fifthly, using different web browsers to carry out the search process. Finally, creating and training six Google accounts.
△ Less
Submitted 15 November, 2022;
originally announced November 2022.
-
Detecting Malicious Domains Using Statistical Internationalized Domain Name Features in Top Level Domains
Authors:
Alshaima Almarzooqi,
Jawahir Mahmoud,
Bayena Alzaabi,
Arsiema Ghebremichael,
Monther Aldwairi
Abstract:
The Domain Name System (DNS) is a core Internet service that translates domain names into IP addresses. It is a distributed database and protocol with many known weaknesses that subject to countless attacks including spoofing attacks, botnets, and domain name registrations. Still, the debate between security and privacy is continuing, that is DNS over TLS or HTTP, and the lack of adoption of DNS s…
▽ More
The Domain Name System (DNS) is a core Internet service that translates domain names into IP addresses. It is a distributed database and protocol with many known weaknesses that subject to countless attacks including spoofing attacks, botnets, and domain name registrations. Still, the debate between security and privacy is continuing, that is DNS over TLS or HTTP, and the lack of adoption of DNS security extensions, put users at risk. Consequently, the security of domain names and characterizing malicious websites is becoming a priority. This paper analyzes the difference between the malicious and the normal domain names and uses Python to extract various malicious DNS identifying characteristics. In addition, the paper contributes two categories of features that suppers Internationalized Domain Names and scans domain system using five tools to give it a rating. The overall accuracy of the Random Forest Classifier was 95.6%.
△ Less
Submitted 15 November, 2022;
originally announced November 2022.
-
Evaluating virtual laboratory platforms for supporting on-line information security courses
Authors:
Monther Aldwairi
Abstract:
Distance education had existed for a long time, then it has undergone a renaissance with the advent of computers and the Internet. Distance education relied on physically delivered material and assessments to students, who work offline at home. More recently, online learning or e-learning introduced virtual classrooms, assessments, online tests and transformed the classroom an into interactive onl…
▽ More
Distance education had existed for a long time, then it has undergone a renaissance with the advent of computers and the Internet. Distance education relied on physically delivered material and assessments to students, who work offline at home. More recently, online learning or e-learning introduced virtual classrooms, assessments, online tests and transformed the classroom an into interactive online classroom. Despite the large number of online degrees offered, face-to-face remained the dominant mode and e-learning was just used to complement the classroom. The Covid-19 pandemic continues to impact higher education, and online learning is a forgone conclusion. However, the digital divide hindered the disadvantaged schools and students efforts to transition to online learning. As the pandemic continues to change the education landscape, many challenges arise and prevent student from realising the full potential of e-learning. One of those is the access to physical labs in science, engineering, and computer science programs. This study evaluates practical solutions for virtual labs to be used in teaching information security and ethical hacking. The course ran over five semesters, and 164 students were surveyed. The survey measured perceptions, enjoyment, experiences and attitudes towards virtual labs, and the results were supporting adoption and acceptance of virtual labs.
△ Less
Submitted 17 August, 2022;
originally announced August 2022.
-
FALSE: Fake News Automatic and Lightweight Solution
Authors:
Fatema Al Mukhaini,
Shaikhah Al Abdoulie,
Aisha Al Kharuosi,
Amal El Ahmad,
Monther Aldwairi
Abstract:
Fake news existed ever since there was news, from rumors to printed media then radio and television. Recently, the information age, with its communications and Internet breakthroughs, exacerbated the spread of fake news. Additionally, aside from e-Commerce, the current Internet economy is dependent on advertisements, views and clicks, which prompted many developers to bait the end users to click l…
▽ More
Fake news existed ever since there was news, from rumors to printed media then radio and television. Recently, the information age, with its communications and Internet breakthroughs, exacerbated the spread of fake news. Additionally, aside from e-Commerce, the current Internet economy is dependent on advertisements, views and clicks, which prompted many developers to bait the end users to click links or ads. Consequently, the wild spread of fake news through social media networks has impacted real world issues from elections to 5G adoption and the handling of the Covid- 19 pandemic. Efforts to detect and thwart fake news has been there since the advent of fake news, from fact checkers to artificial intelligence-based detectors. Solutions are still evolving as more sophisticated techniques are employed by fake news propagators. In this paper, R code have been used to study and visualize a modern fake news dataset. We use clustering, classification, correlation and various plots to analyze and present the data. The experiments show high efficiency of classifiers in telling apart real from fake news.
△ Less
Submitted 16 August, 2022;
originally announced August 2022.
-
PhishOut: Effective Phishing Detection Using Selected Features
Authors:
Suhail Paliath,
Mohammad Abu Qbeitah,
Monther Aldwairi
Abstract:
Phishing emails are the first step for many of today's attacks. They come with a simple hyperlink, request for action or a full replica of an existing service or website. The goal is generally to trick the user to voluntarily give away his sensitive information such as login credentials. Many approaches and applications have been proposed and developed to catch and filter phishing emails. However,…
▽ More
Phishing emails are the first step for many of today's attacks. They come with a simple hyperlink, request for action or a full replica of an existing service or website. The goal is generally to trick the user to voluntarily give away his sensitive information such as login credentials. Many approaches and applications have been proposed and developed to catch and filter phishing emails. However, the problem still lacks a complete and comprehensive solution. In this paper, we apply knowledge discovery principles from data cleansing, integration, selection, aggregation, data mining to knowledge extraction. We study the feature effectiveness based on Information Gain and contribute two new features to the literature. We compare six machine-learning approaches to detect phishing based on a small number of carefully chosen features. We calculate false positives, false negatives, mean absolute error, recall, precision and F-measure and achieve very low false positive and negative rates. Na{\"ı}ve Bayes has the least true positives rate and overall Neural Networks holds the most promise for accurate phishing detection with accuracy of 99.4\%.
△ Less
Submitted 21 April, 2020;
originally announced April 2020.
-
Efficient and Secure Flash-based Gaming CAPTCH
Authors:
Monther Aldwairi,
Suaad Mohammed,
Megana Lakshmi Padmanabhan
Abstract:
With the growth of connectivity to smart grids, new applications, and the changing interaction between customer and energy clouds, clouds are more vulnerable to denial-of-service attacks. Efficient detection methods are required to authenticate, detect and control attackers. Completely Automated Public Turing test to tell Computers and Humans Apart, CAPTCHA, is one efficient tool to thwart denial…
▽ More
With the growth of connectivity to smart grids, new applications, and the changing interaction between customer and energy clouds, clouds are more vulnerable to denial-of-service attacks. Efficient detection methods are required to authenticate, detect and control attackers. Completely Automated Public Turing test to tell Computers and Humans Apart, CAPTCHA, is one efficient tool to thwart denial of service attacks. The server presents the user with a client puzzle to solve in order to gain access to the service or website. The puzzle should be hard enough for computers, but easy for humans to solve. Several methods have been suggested including the popular image-based, as well as video-based, and text-based CAPTCHAs. In this paper, we present a new Flash-based gaming CAPTCHA to differentiate bots from humans. We propose a drag and drop client puzzle where the user will play a simple game to answer a visual question. Our method turns out to be convenient, easy for users and challenging for bots. Additionally, it has gaming aspect, which makes it interesting to users of all age groups.
△ Less
Submitted 9 April, 2020;
originally announced April 2020.
-
Efficient Wu-Manber Pattern Matching Hardware for Intrusion and Malware Detection
Authors:
Monther Aldwairi,
Yahya Flaifel,
Khaldoon Mhaidat
Abstract:
Network intrusion detection systems and antivirus software are essential in detecting malicious network traffic and attacks such as denial-of-service and malwares. Each attack, worm or virus has its own distinctive signature. Signature-based intrusion detection and antivirus systems depend on pattern matching to look for possible attack signatures. Pattern matching is a very complex task, which re…
▽ More
Network intrusion detection systems and antivirus software are essential in detecting malicious network traffic and attacks such as denial-of-service and malwares. Each attack, worm or virus has its own distinctive signature. Signature-based intrusion detection and antivirus systems depend on pattern matching to look for possible attack signatures. Pattern matching is a very complex task, which requires a lot of time, memory and computing resources. Software-based intrusion detection is not fast enough to match high network speeds and the increasing number of attacks. In this paper, we propose special purpose hardware for Wu-Manber pattern matching algorithm. FPGAs form an excellent choice because of their massively parallel structure, reprogrammable logic and memory resources. The hardware is designed in Verilog and implemented using Xilinx ISE. For evaluation, we dope network traffic traces collected using Wireshark with 2500 signatures from the ClamAV virus definitions database. Experimental results show high speed that reaches up to 216 Mbps. In addition, we evaluate time, device usage, and power consumption.
△ Less
Submitted 1 March, 2020;
originally announced March 2020.
-
Detection and Analysis of Drive-by Downloads and Malicious Websites
Authors:
Saeed Ibrahim,
Nawwaf Al Herami,
Ebrahim Al Naqbi,
Monther Aldwairi
Abstract:
A drive by download is a download that occurs without users action or knowledge. It usually triggers an exploit of vulnerability in a browser to downloads an unknown file. The malicious program in the downloaded file installs itself on the victims machine. Moreover, the downloaded file can be camouflaged as an installer that would further install malicious software. Drive by downloads is a very go…
▽ More
A drive by download is a download that occurs without users action or knowledge. It usually triggers an exploit of vulnerability in a browser to downloads an unknown file. The malicious program in the downloaded file installs itself on the victims machine. Moreover, the downloaded file can be camouflaged as an installer that would further install malicious software. Drive by downloads is a very good example of the exponential increase in malicious activity over the Internet and how it affects the daily use of the web. In this paper, we try to address the problem caused by drive by downloads from different standpoints. We provide in depth understanding of the difficulties in dealing with drive by downloads and suggest appropriate solutions. We propose machine learning and feature selection solutions to remedy the the drive-by download problem. Experimental results reported 98.2% precision, 98.2% F-Measure and 97.2% ROC area.
△ Less
Submitted 9 April, 2020; v1 submitted 19 February, 2020;
originally announced February 2020.
