Obligated by a utility pricing model, Internet-facing web resources hosted in the public cloud are vulnerable to Fraudulent Resource Consumption (FRC) attacks. Unlike an application-layer DDoS attack that consumes resources with the goal of disrupting short-term availability, an FRC attack is a considerably more subtle attack that instead seeks to disrupt the long-term financial viability of operating in the cloud by exploiting the utility pricing model over an extended time period. By fraudulently consuming web resources in sufficient volume (i.e. data transferred out of the cloud), an attacker (e.g. botnet) is able to incur significant fraudulent charges to the victim. This paper proposes an attribution methodology to identify malicious clients participating in an FRC attack. Experimental results demonstrate that the presented methodology achieves qualified success against challenging attack scenarios.

Society's dependency on information technology has drastically outpaced educational curricula and the opportunities that universities and higher education institutes provide to students from both technical (e.g., computer engineering, computer science) and non-technical majors. To increase the opportunities for all students to learn how protect themselves as individuals and others as professionals from numerous cyber threats the focus of this work is to identify gaps in engineering curricula and present novel approaches to fulfill the growing and diverse needs of cyber security education. The overall objective of this paper is to make security education accessible, relevant, and tangible across educational curricula, as well as to provide the framework to extend these efforts beyond university classrooms and into community colleges and high schools. While the predominant focus, research, and innovative practices in the area of cyber security have focused on technical students at the university level, this work instead concentrates on the demographic of students that desire to learn about cyber security without having to major in computer engineering, for example. In this paper we present a three-tiered framework that provides breadth and depth to security education across multiple education levels. This all-encompassing framework for security education includes providing (1) formal literacy-based training for students of all backgrounds, (2) inquiry-based learning through security- and technically-focused student groups and activities, and (3) classical technical·based initiatives. For each of these respective areas, previous research and efforts are discussed as well as the innovative practices that we have developed to address identified educational gaps.

We are losing the battle in cyber security. We heavily rely on technology as the main defense, instead of recognizing that the easiest attack vectors are the people who operate the computers. The general public does not understand the decisions they make each and every day have security implications for themselves, their projects and their companies. Since people are a primary target, education is one of the “secret weapons” in the cyber security battlefield. Further, if everyday users are the targets, then all audiences, not just technical staff, need training and education in cyber security basics. We argue that computer security literacy is not only the next step in computer security defense; it may be one of the most important steps we can take. Through this workshop we want to encourage the profession to reach out to the populous and help make them security literate. The goal of the workshop is to provide an alternative approach to teaching Computer Security Literacy. This approach, developed at Iowa State University, demonstrates how Computer Security Literacy courses for non-technical students benefit them in their daily lives, now as students and in the future as working professionals.

This paper discusses an attack on the cloud computing model by which an attacker subtly exploits a fundamental vulnerability of current utility compute models over a sustained period of time. Internet-accessible cloud services expose resources that are metered for billing purposes. These resources are subject to fraudulent resource consumption that is intended to run up the operating expenses for public cloud service customers. The details and significance of this attack are discussed as well as two detection methodologies and there respective experimental results. This work investigates a potentially significant vulnerability of the cloud computing model that could be exploited from any Internet connected host. Well-crafted transactions that only differ in intent but not in content are challenging to differentiate and thus this attack may be difficult to detect and prevent.