Generative Adversarial Networks (GANs) have revolutionized the generation of synthetic malware images, providing significant applications in cybersecurity. Traditional image-based metrics such as Inception Score (IS) and Fréchet Inception Distance (FID) evaluate the visual quality of these images but fail to capture their malicious nature fully. We propose a novel evaluation framework, cTIMS (Correlated Textual-Based and Image-Based Metric Suites), which integrates both image and text-based metrics to provide a comprehensive assessment. Utilizing the multimodal image captioning model BLIP, we extract textual descriptions of GAN-synthesized malware images and analyze the correlation between image metrics (IS, FID) and text metrics (BLEU, METEOR, ROUGE). Additionally, we introduce Kolmogrov-Arnold Network (KAN)-based CNN architectures (VGG16-KAN, VGG19-KAN), demonstrating significant performance improvements in malware classification. The effectiveness of the Train Real Test Synthetic (TRTS) approach in validating these correlations is also evaluated, confirming the method’s reliability in selecting high-quality GAN-generated images.

Order-preserving encryption (OPE) plays an important role in securing outsourced databases. OPE schemes can be either Stateless or Stateful. Stateful schemes can achieve the ideal security of order-preserving encryption, i.e., “reveal no information about the plaintexts besides order.” However, comparing to stateless schemes, stateful schemes require maintaining some state information locally besides encryption keys and the ciphertexts are mutable. On the other hand, stateless schemes only require remembering encryption keys and thus is more efficient. It is a common belief that stateless schemes cannot provide the same level of security as stateful ones because stateless schemes reveal the relative distance among their corresponding plaintext. In real world applications, such security defects may lead to the leakage of statistical and sensitive information, e.g., the data distribution, or even negates the whole encryption. In this paper, we propose a practical and secure stateless order-preserving encryption scheme. With prior knowledge of the data to be encrypted, our scheme can achieve IND-CCPA (INDistinguishability under Committed ordered Chosen Plaintext Attacks) security for static data set. Though the IND-CCPA security can't be met for dynamic data set, our new scheme can still significantly improve the security in real world applications. Along with the encryption scheme, in this paper we also provide methods to eliminate access pattern leakage in communications and thus prevents some common attacks to OPE schemes in practice.

In this Research to Practice paper, we present a sustainable model for teaching training in Computer Science. To address issues related to self-efficacy and teacher preparation, we started a formal program (IDoCode) that not only provides teacher training through the academic year, but also provides teachers the opportunity to obtain a Masters in STEM Education degree or a Graduate Certificate in Computer Science Teacher Endorsement.Through our program, we have shown that teachers feel more confident in their ability to teach computer science courses such as Exploring CS, AP CS Principles, and the Java-based AP CS A, as well as leading the students in a capstone project. In this paper, we present a sustainable approach to make a cultural change in the landscape of Computer Science education in the state of Idaho. We discuss various factors including working with the State Board of Education, local software companies, the university, and other invested partners to help CS courses in high school count towards graduation. We have also been active with respect to community engagement by organizing an annual meeting with counselors and principals to encourage women and minorities to take computer science courses and conducting summer professional development workshops for new teachers.

Over the years, email has evolved into one of the most widely used communication channels for both individuals and organizations. However, despite near ubiquitous use in much of the world, current information technology standards do not place emphasis on email security. Not until recently, webmail services such as Yahoo's mail and Google's gmail started to encrypt emails for privacy protection. However, the encrypted emails will be decrypted and stored in the service provider's servers. If the servers are malicious or compromised, all the stored emails can be read, copied and altered. Thus, there is a strong need for end-to-end (E2E) email encryption to protect email user's privacy. In this paper, we present a certificateless one-way group key agreement protocol with the following features, which are suitable to implement E2E email encryption: (1) certificateless and thus there is no key escrow problem and no public key certificate infrastructure is required; (2) one-way group key agreement and thus no back-and-forth message exchange is required; and (3) n-party group key agreement (not just 2- or 3-party). This paper also provides a security proof for the proposed protocol using "proof by simulation". Finally, efficiency analysis of the protocol is presented at the end of the paper.

Authentication based on passwords is used largely in applications for computer security and privacy. However, human actions such as choosing bad passwords and inputting passwords in an insecure way are regarded as “the weakest link” in the authentication chain. Rather than arbitrary alphanumeric strings, users tend to choose passwords either short or meaningful for easy memorization. With web applications and mobile apps piling up, people can access these applications anytime and anywhere with various devices. This evolution brings great convenience but also increases the probability of exposing passwords to shoulder surfing attacks. Attackers can observe directly or use external recording devices to collect users' credentials. To overcome this problem, we proposed a novel authentication system PassMatrix, based on graphical passwords to resist shoulder surfing attacks. With a one-time valid login indicator and circulative horizontal and vertical bars covering the entire scope of pass-images, PassMatrix offers no hint for attackers to figure out or narrow down the password even they conduct multiple camera-based attacks. We also implemented a PassMatrix prototype on Android and carried out real user experiments to evaluate its memorability and usability. From the experimental result, the proposed system achieves better resistance to shoulder surfing attacks while maintaining usability.

The equipment lock has been an important tool for the power company to protect the electricity metering equipment. However, the conventional equipment lock has two potential problems: vandalism and counterfeiting. To fulfill the control and track the potential illegal behavior, the human labor and paper are required to proceed with related operations, resulting in the consumption of a large amount of human resources and maintenance costs. This study focused on the design of RFID technology applied to the traditional equipment lock, which, through the mobile and electronic technology, strengthens the management/operating convenience of the lock and provides the solutions for anti-counterfeiting and spoilage detection so that the national energy can be properly protected and fairly distributed.

Cybersecurity has become one of the largest growing fields in computer science and the technology industry. Faulty security has cost the global economy immense losses. Oftentimes, the pitfall in such financial loss is due to the security of passwords. Companies and regular people alike do not do enough to enforce strict password guidelines like the NIST (National Institute of Standard Technology) recommends. When big security breaches happen, thousands to millions of passwords can be exposed and stored into files, meaning people are susceptible to dictionary and rainbow table attacks. Those are only two examples of attacks that are used to crack passwords. In this paper, we will be going over three open-source password managers, each chosen for their own uniqueness. Our results will conclude on the overall security of each password manager using a list of established attacks and development of new potential attacks on such software. Additionally, we will compare our research with the limited research already conducted on password managers. Finally, we will provide some general guidelines of how to develop a better and more secure password manager.

As a result of high-tech companies such as Google, Yahoo, and Microsoft offering free email services, email has become a primary channel of communication. However, email service providers have traditionally offered little in the way of message privacy protection. This has made emails, of which billions are sent around the world on any day, an attractive data source for personal identity information thieves. Google was one of the first companies to provide substantial email privacy protection when they began using the HTTPS always-on option to encrypt messages sent through their email service, Gmail. Unfortunately, Gmail's encryption option does not offer true point-to-point encryption since the encrypted emails are decrypted and stored in plaintext form on Google's servers. This type of approach poses a security vulnerability which is unacceptable to security-minded users such as highly sensitive government agencies and private companies. For these users, true point-to-point encryption is needed. This paper introduces an identity-based one-way group key agreement protocol and describes a point-to-point email encryption scheme based on the protocol. Both the security proofs and the efficiency analysis, with experimental results, of the new scheme are provided.

The time-bound hierarchical key assignment problem is to assign time sensitive keys to security classes in a partially ordered hierarchy so that legal data accesses among classes can be enforced. Two time-bound hierarchical key assignment schemes have been proposed in the literature, but both of them were proved insecure against collusive attacks. In this paper, we will propose an RSA-based time-bound hierarchical key assignment scheme and describe its possible application. The security analysis shows that the new scheme is safe against the collusive attacks.