As traffic congestion becomes a huge problem for most developing and developed countries across the world, intelligent transportation systems (ITS) are becoming a hot topic that is attracting attention of researchers and the general public alike. In this paper, we demonstrate a specific implementation of an ITS system whereby traffic lights are actuated by DSRC radios installed in vehicles. More specifically, we report the design of prototype of a DSRC-Actuated Traffic Lights (DSRC-ATL) system. It is shown that this system can reduce the travel time and commute time significantly, especially during rush hours. Furthermore, the results reported in this paper do NOT assume or require all vehicles to be equipped with DSCR radios. Even with low penetration ratios, e.g., when only 20% of all vehicles in a city are equipped with DSRC radios, the overall performance of the designed system is superior to the current traffic control systems.

The widespread adoption of web vulnerability scanners and the differences in the functionality provided by these tool-based vulnerability detection approaches increase the demand for testing their detection effectiveness. Despite the advantages of dynamic testing approaches, the literature lacks studies that systematically evaluate the performance of open source web vulnerability scanners. The main objectives of this study are to assess the performance of open source scanners from multiple perspectives and to examine their detection capability. This paper presents the results of a comparative evaluation of the security features as well as the performance of four web vulnerability detection tools. We followed this comparative assessment with a case study in which we evaluate the level of agreement between the results reported by two open source web vulnerability scanners. Given that the results of our comparative evaluation did not show significant performance differences among the scanners while the results of the conducted case study revealed high level of disagreement between the reports generated by different scanners, we conclude that the inconsistencies between the reports generated by different scanners might not necessarily correlate with their performance properties. We also present some recommendations for helping developers of web vulnerabilities scanners to improve their tools’ capabilities.

Textual passwords remain the most commonly employed user authentication mechanism, and potentially will continue to be so for years to come. Despite the well-known security and usability issues concerning textual passwords, none of the numerous proposed authentication alternatives appear to have achieved a sufficient level of adoption to dominate in the foreseeable future. Password hints, consisting of a user generated text saved at the account setup stage, are employed in several authentication systems to help users to recall forgotten passwords. However, users are often unable to create hints that jog the memory without revealing too much information regarding the passwords themselves. We propose a rethink of password hints by introducing SỲNTHIMA, a novel cued recall-based textual password method that reveals no information regarding the password, requires no modifications to authentication servers, and requires no additional setup or registration steps. SỲNTHIMA makes use of users' contact lists, so that mapped password hints extracted from a user's contacts are automatically generated while the user is typing the password. We create formal models for relevant aspects of the password hint mechanism, define its threat model, and analyze the security and usability of SỲNTHIMA. We also present the results of an in-lab user study of SỲNTHIMA on 30 participants to evaluate its effectiveness and usability. The results demonstrate that SỲNTHIMA minimizes the number of incorrect login attempts and improves long-term password recall, with acceptable login times and positive user feedback. We summarize the lessons learned from the user study, with the hope of provoking further insights regarding the design of effective cued recall-based textual password schemes.

The feature of posting comments enables websites visitors (e.g., Youtube and Amazon) to interact and contribute to the posted content by adding comments. The fact that such comments are becoming part of the website content so that many visitors read them and that such comments are usually unvetted make them attractive to spammers for the purposes of advertising, spreading malware, phishing attacks, or spreading political or religious views. Due to large volume of comment spam, using manual filtration and vetting is unpractical and hence automatic spam detection techniques play a de-facto role in fighting spam content. In this paper, we propose and develop a comment spam detection mechanism that can be deployed as a browser plugin for inspecting the Document Object Model (DOM) of the web page in question and remove comments with spam content. We examine most detection features in the literature along with proposing new features to build a comment spam classifier. In order to test the accuracy of our classifier, we manually label a new corpus of blogs comments. We encourage other researchers to build upon our work and we hope that our corpus will benefit the research community in this area.

Tracking is a process that captures knowledge of the path of an object's movement and its current location. This paper proposes an ultra-wideband (UWB) indoor tracking system for blind people in a high interference environment such as facilities with communication equipment. To the best of our knowledge, our proposed system is the first that offers two features (1) server-based tracking, in which the administrator can get the current position and the path of the blind person in question; and (2) situation awareness, in which the blind person can get voice information about existing and surrounding places. The system has shown satisfactory results when it was used and evaluated by some blind participants.

Abstract The prevalence and severity of application‐layer vulnerabilities increase dramatically their corresponding attacks. In this paper, we present an extension to PHPIDS, an open source intrusion detection and prevention system for PHP‐based web applications, to visualize its security log. Our usage of security data visualization is motivated by the fact that most security defense systems are mainly based on text‐based logs for recording security‐related events, which are difficult to analyze and correlate. The proposed extension analyzes PHPIDS logs, correlates these logs with the corresponding web server logs, and plots the security‐related events. We use a set of tightly coupled visual representations of hypertext transfer protocol server requests containing known and suspicious malicious content, to provide system administrators and security analysts with fine‐grained visual‐based querying capabilities. We present multiple case studies to demonstrate the ability of our PHPIDS visualization extension to support security analysts with analytic reasoning and decision making in response to ongoing web server attacks. Experimenting the proposed PHPIDS visualization extension on real‐world datasets shows promise for providing complementary information for effectivesituational awareness. Copyright © 2014 John Wiley & Sons, Ltd.

Complex enterprise environments consist of globally distributed infrastructure with a variety of applications and a large number of activities occurring on a daily basis. This increases the attack surface and narrows the view of ongoing intrinsic dynamics. Thus, many malicious activities can persist under the radar of conventional detection mechanisms long enough to achieve critical mass for full-fledged cyber attacks. Many of the typical detection approaches are signature-based and thus are expected to fail in the face of zero-day attacks. In this paper, we present the building-blocks for developing a Malicious Activity Detection System (MADS). MADS employs predictive modeling techniques for the detection of malicious activities. Unlike traditional detection mechanisms, MADS includes the detection of both network-based intrusions and malicious user behaviors. The system utilizes a simulator to produce holistic replication of activities, including both benign and malicious, flowing within a given complex IT environment. We validate the performance and accuracy of the simulator through a case study of a Fortune 500 company where we compare the results of the simulated infrastructure against the physical one in terms of resource consumption (i.e., CPU utilization), the number of concurrent users, and response times. In addition to an evaluation of the detection algorithms with varying hyper-parameters and comparing the results.

The user location information represents a core dimension as understanding user context is a prerequisite for providing human-centered services that generally improve quality of life. In comparison with outdoor environments, sensing location information in indoor environments requires a higher precision and is a more challenging task due in part to the expected various objects (such as walls and people) that reflect and disperse signals. In this paper, we survey the related work in the field of indoor positioning by providing a comparative analysis of the state-of-the-art technologies, techniques, and algorithms. Unlike previous studies and surveys, our survey present new taxonomies, review some major recent advances, and argue on the area open problems and future potential. We believe this paper would spur further exploration by the research community of this challenging problem space.

Fake identities and user accounts (also called "Sybils") in online communities represent today a treasure for adversaries to spread fake product reviews, malware and spam on social networks, and Astroturf political campaigns. State-of-the-art in the defense mechanisms includes Automated Turing Tests (ATTs such as CAPTCHAs) and graph-based Sybil detectors. Sybil detectors in social networks leverage the assumption that Sybils will find it hard to befriend real users which leads to Sybils being connected to each other forming strongly connected sub graphs that can be detected using graph theory. However, the large majority of Sybils are in fact successful in integrating themselves into real user communities (such as the case in Twitter and Facebook). In this paper, we first study and compare the current detection mechanisms of Sybil accounts. We also explore various types of Twitter Sybil accounts detection features with the objective of building an effective and practical classifier. In order to build and evaluate our classifier, we collect and manually label a dataset of twitter accounts, including human users, bots, and hybrid (i.e., Tweets are posted by both human and bots). We believe this Twitter Sybils corpus will help researchers in conducting sound measurement studies. We also develop a browser plug-in (that we call Twitter Sybils Detector or TSD for short) that utilizes our classifier and warns the user about possible Sybil accounts before accessing them, upon clicking on a Twitter account.

Web spam techniques aim to mislead search engines so that web spam pages get ranked higher than they deserve. This leads to misleading search results as spam pages might appear in search results although the content of these spam pages might not be related to the search terms. Despite the effort of search engines to deploy various techniques to detect and filter out web spam pages from being listed in their search results, spammers continue to develop new tactics to evade search engines detection mechanisms. In this paper, we study the effectiveness and accuracy of newly developed anti-spamming techniques in Google search engine. Focusing on Arabic spam pages, our study results show that Google anti-spamming techniques are ineffective against spam pages with Arabic content. We explore various types of web spam detection features to obtain an appropriate set of detection features that yield a reasonable detection accuracy. In order to build and evaluate our classifier, we collect and manually label a dataset of Arabic web pages, including both benign and spam pages. We believe this Arabic web spam corpus helps researchers in conducting sound measurement studies. We also develop a browser plug-in that utilizes our classifier and warns the user about web spam pages before accessing them, upon clicking on a search term. The plug-in has also the ability to filter out search engine results.

The objective of security data visualizations is to help cyber analysts to perceive trends and patterns, and gain insights into security data. Sound and systematic evaluations of security data visualizations are rarely performed, in part due to the lack of proper quantitative and qualitative measures. In this paper, we present a novel evaluation approach for security visualization based on Christopher Alexander's fifteen properties of living structures. Alexander's fifteen properties are derived from various visual patterns that appear in nature. Each property represents the guidelines for good design. We believe that using these fundamental properties have the potential for building a more robust evaluation. Each property offers essential qualities that enable better analytical reasoning. We demonstrate how to use Alexander's properties to evaluate security related visualizations. We derive a set of visualization-specific properties for evaluation, developed based on Alexander's original properties.

The prevalence and severity of application-layer vulnerabilities increase dramatically their corresponding attacks. In this paper, we present an extension to PHPIDS, an open source intrusion detection and prevention system for PHP-based web applications, to visualize its security log. The proposed extension analyzes PHPIDS logs, correlates these logs with the corresponding web server logs, and plots the security-related events. We use a set of tightly coupled visual representations of HTTP server requests containing known and suspicious malicious content, to provide system administrators and security analysts with fine-grained visual-based querying capabilities. We present multiple case studies to demonstrate the ability of our PHPIDS visualization extension to support security analysts with analytic reasoning and decision making in response to ongoing web server attacks. Experimenting the proposed PHPIDS visualization extension on real-world datasets shows promise for providing complementary information for effective situational awareness.

Although search engines have deployed various techniques to detect and filter out Web spam, Web stammers continue to develop new tactics to influence the result of search engines ranking algorithms, for the purpose of obtaining an undeservedly high ranks. In this paper, we study the effect of the page language on the spam detection features. We examine how the distribution of a set of selected detection features changes according to the page language. Also, we study the effect of the page language on the detection rate of a given classifier using a selected set of detection features. The analysis results show that selecting suitable features for a classifier that segregates spam pages depends heavily on the language of the examined Web page, due in part to the different set of Web spam mechanisms used by each type of stammers.