From the Publisher:
A valuable reference for the novice as well as for the expert who needs a wider scope of coverage within the area of cryptography, this book provides easy and rapid access of information and includes more than 200 algorithms and protocols; more than 200 tables and figures; more than 1,000 numbered definitions, facts, examples, notes, and remarks; and over 1,250 significant references, including brief comments on each paper.

Handbook of Applied Cryptography

Anomaly detection is an important problem that has been researched within diverse research areas and application domains. Many anomaly detection techniques have been specifically developed for certain application domains, while others are more generic. This survey tries to provide a structured and comprehensive overview of the research on anomaly detection. We have grouped existing techniques into different categories based on the underlying approach adopted by each technique. For each category we have identified key assumptions, which are used by the techniques to differentiate between normal and anomalous behavior. When applying a given technique to a particular domain, these assumptions can be used as guidelines to assess the effectiveness of the technique in that domain. For each category, we provide a basic anomaly detection technique, and then show how the different existing techniques in that category are variants of the basic technique. This template provides an easier and more succinct understanding of the techniques belonging to each category. Further, for each category, we identify the advantages and disadvantages of the techniques in that category. We also provide a discussion on the computational complexity of the techniques since it is an important issue in real application domains. We hope that this survey will provide a better understanding of the different directions in which research has been done on this topic, and how techniques developed in one area can be applied in domains for which they were not intended to begin with.

/pdf/anomaly-detection-a-survey-1x33g9m0a3.pdf

Anomaly detection: A survey

Consider a data holder, such as a hospital or a bank, that has a privately held collection of person-specific, field structured data. Suppose the data holder wants to share a version of the data with researchers. How can a data holder release a version of its private data with scientific guarantees that the individuals who are the subjects of the data cannot be re-identified while the data remain practically useful? The solution provided in this paper includes a formal protection model named k-anonymity and a set of accompanying policies for deployment. A release provides k-anonymity protection if the information for each person contained in the release cannot be distinguished from at least k-1 individuals whose information also appears in the release. This paper also examines re-identification attacks that can be realized on releases that adhere to k- anonymity unless accompanying policies are respected. The k-anonymity protection model is important because it forms the basis on which the real-world systems known as Datafly, µ-Argus and k-Similar provide guarantees of privacy protection.

k -anonymity: a model for protecting privacy

PROBLEM TO BE SOLVED: To solve the problem, wherein it is impossible for an electronic content information provider to provide commercially secure and effective method, for a configurable general-purpose electronic commercial transaction/distribution control system. SOLUTION: In this system, having at least one protected processing environment for safely controlling at least one portion of decoding of digital information, a secure content distribution method comprises a process for encapsulating digital information in one or more digital containers; a process for encrypting at least a portion of digital information; a process for associating at least partially secure control information for managing interactions with encrypted digital information and/or digital container; a process for delivering one or more digital containers to a digital information user; and a process for using a protected processing environment, for safely controlling at least a portion of the decoding of the digital information. COPYRIGHT: (C)2006,JPO&NCIPI

https://apps.dtic.mil/dtic/tr/fulltext/u2/a423264.pdf

Systems and Methods for Secure Transaction Management and Electronic Rights Protection

We continue a line of research initiated in [10,11]on privacy-preserving statistical databases. Consider a trusted server that holds a database of sensitive information. Given a query function f mapping databases to reals, the so-called true answer is the result of applying f to the database. To protect privacy, the true answer is perturbed by the addition of random noise generated according to a carefully chosen distribution, and this response, the true answer plus noise, is returned to the user.

Previous work focused on the case of noisy sums, in which f = ∑ig(xi), where xi denotes the ith row of the database and g maps database rows to [0,1]. We extend the study to general functions f, proving that privacy can be preserved by calibrating the standard deviation of the noise according to the sensitivity of the function f. Roughly speaking, this is the amount that any single argument to f can change its output. The new analysis shows that for several particular applications substantially less noise is needed than was previously understood to be the case.

The first step is a very clean characterization of privacy in terms of indistinguishability of transcripts. Additionally, we obtain separation results showing the increased value of interactive sanitization mechanisms over non-interactive.

/pdf/calibrating-noise-to-sensitivity-in-private-data-analysis-4vnm2uv9ap.pdf

Calibrating noise to sensitivity in private data analysis

The distribution of keys in a computer network using single key or public key encryption is discussed. We consider the possibility that communication keys may be compromised, and show that key distribution protocols with timestamps prevent replays of compromised keys. The timestamps have the additional benefit of replacing a two-step handshake.

/pdf/timestamps-in-key-distribution-protocols-3m5avk0h6i.pdf

Timestamps in key distribution protocols

I. INTRODUCTION. 1. Gulf War-Infowar. The Gulf War. Information Warfare. From Chicks to Chips. 2. A Theory of Information Warfare. Information Resources. The Value of Resources. Players. The Offense. The Defense. A Dual Role. Offensive Information Warfare. Increased Availability to Offensive Player. Decreased Availability to Defensive Player. Decreased Integrity. Other Classification Schemes. Defensive Information Warfare. Types of Defense. Information Security and Information Assurance. The CIA Model and Authorization. 3. Playgrounds to Battlegrounds. Play. Motivation. Culture. More than Child's Play. Crime. Intellectual Property Crimes. Fraud. Computer Fraud and Abuse. Fighting Crime. Individual Rights. National Security. Foreign Intelligence. War and Military Conflict. Terrorism. Netwars. Protecting National Infrastructures. II. OFFENSIVE INFORMATION WARFARE. 4. Open Sources. Open Source and Competitive Intelligence. Privacy. Snooping on People Through Open Sources. Web Browsing. Privacy Regulations. Piracy. Copyright Infringement. Trademark Infringement. Dark Sides. 5. Psyops and Perception Management. Lies and Distortions. Distortion. Fabrication. Hoaxes. Social Engineering. Denouncement. Conspiracy Theories. Defamation. Harassment. Advertising. Scams. Spam Wars. Censorship. United States Restrictions. 6. Inside the Fence. Traitors and Moles. State and Military Espionage. Economic Espionage. Corporate Espionage. Privacy Compromises. Business Relationships. Visits and Requests. Fraud and Embezzlement. Bogus Transactions. Data Diddling. Inside Sabotage. Physical Attacks. Software Attacks. Penetrating the Perimeter. Physical Break-ins and Burglaries. Search and Seizure. Dumpster Diving. Bombs. 7. Seizing the Signals. Eavesdropping on Conversations. Cellular Intercepts. Pager Intercepts. Law Enforcement Wiretaps. Foreign Intelligence Intercepts. Deciphering the Messages. Traffic Analysis. Pen Registers and Trap and Trace. Location Tracking. Telecommunications Fraud. Blue Boxes. PBX and Related Fraud. Voice Mail Fraud. Calling Card Fraud. Cloned Phones and Cellular Fraud. Computer Network Monitoring. Packet Sniffers. Keystroke Monitoring. Environment Surveillance. Cameras and Video. Satellites and Imagery. Van Eck Receptors. Miscellaneous Sensors. Shoulder Surfing. Privacy and Accountability. Sabotage. Tampering with Phone Service. Jamming. Radio Frequency Weapons. Physical Attacks. 8. Computer Break-Ins and Hacking. Accounts. Getting Access. Tools and Techniques. A Demonstration. Network Scanners. Packet Sniffers. Password Crackers. Buffer Overpows and Other Exploits. Social Engineering. Covering up Tracks. Information Theft. Gathering Trophies. More than Trophies. Tampering. Web Hacks. Domain Name Service Hacks. Takedown. Remote Shutdown. Extent. 9. Masquerade. Identity Theft. Forged Documents and Messages. E-Mail Forgeries. Forgeries in Spam. E-Mail Floods. IP Spoofing. Counterfeiting. Trojan Horses. Software Trojans. Riding the Web. E-Mail Relays. Chipping. Undercover Operations and Stings. 10. Cyberplagues. Viruses. Program Viruses. Boot Viruses. Macro Viruses. Concealment Techniques. Who Writes Viruses. Prevalence. Virus Hoaxes. Worms. III. DEFENSIVE INFORMATION WARFARE. 11. Secret Codes and Hideaways. Locks and Keys. Cryptography. Digital Ciphers. Code Breaking. Generation and Distribution of Keys. Public-Key Distribution and Diffie-Hellman. Public-Key Cryptography and RSA. Key Storage and Recovery. Applications of Encryption. The Limits of Encryption. Steganography. Anonymity. Sanitization. Trash Disposal. Shielding. 12. How to Tell a Fake. Biometrics. Passwords and Other Secrets. Integrity Checksums. Digital Signatures. Public-Key Management and Certificates. Watermarks. Call Back and Call Home. Location-based Authentication. Badges and Cards. 13. Monitors and Gatekeepers. Access Controls. Authorization Policies. Access Control Monitors. Limitations. Filters. Firewalls. Junk E-Mail Filters. Web Filters. Intrusion and Misuse Detection. Workplace Monitoring. Automated Detection. Computer Intrusion and Misuse Detection. Analogy with the Human Immune System. Detecting and Eradicating Viruses and Malicious Mobile Code. 14. In a Risky World. Vulnerability Monitoring. Finding Computer and Network Security Flaws. Monitoring Security Publications. Building It Secure. The Orange Book. The ITSEC and Common Criteria. Evaluation. Commercial Criteria. ICSA Certification. Accreditation. The Capability Maturity Model. Security Awareness and Training. Avoiding Single Points of Failure. Backups. Risk Management. Risk Assessment and Asset Valuation. Insurance. Benchmarking. Due Care and Liability. Incident Handling. Investigation and Assessment. Containment and Recovery. Improving Security. Notification. In-Kind Response. Legal and Civil Remedies. Economic and Military Response. Emergency Preparedness. Obstacles. 15. Defending the Nation. Generally Accepted System Security Principles. Protecting Critical Infrastructures. President's Commission on Critical Infrastructure Protection. Presidential Decision Directive. Encryption Policy. Code Making. Code Breaking. International Policies. U.S. Policy. Legal Challenges. Legislation. Encryption Policy in Perspective. Bibliography of Books. Endnotes. Index. 0201433036T04062001

Information warfare and security

A method and apparatus for authenticating the identity of a remote user entity where the identity of such user entity is authenticated by use of information specific to geodetic location of the user entity but that changes constantly, making "spoofing" the host device extremely difficult. The invention is preferably implemented utilizing satellite positioning technology to produce the identifying information.

Method and apparatus for authenticating the location of remote users of networked computing systems

Location-based authentication: Grounding cyberspace for better security

Editors’ abstract. Netwar is not mainly about technology—but good information technology sure makes a difference. In this chapter, Denning (Georgetown University) examines how activists, hacktivists, and cyberterrorists use the Internet, and what influence they have been able to exert on policymakers. Social activists seem the most effective of these netwar actors. Hacktivists and cyberterrorists have not posed much of a real threat to date—but this could change if they acquire better tools , techniques, and methods of organization, and i f cyberdefenses do not keep pace. In this swiftly evolving area, today’s tools and techniques are often soon outdated; yet Denning’s analytic approach should prove conceptually sound for years to come. The original version of this paper was sponsored by the Nautilus Institute and presented at a conference on “The Internet and International Systems: Information Technology and American Foreign Policy Decision Making,” The World Affairs Council, San Francisco, December 10, 1999 (www.nautilus.org/info-policy/workshop/papers/denning.html). Reprinted by permission.

/pdf/activism-hacktivism-and-cyberterrorism-the-internet-as-a-4t1vblwa9g.pdf

Dorothy E. Denning

Papers

Timestamps in key distribution protocols

Information warfare and security

Method and apparatus for authenticating the location of remote users of networked computing systems

Location-based authentication: Grounding cyberspace for better security

Activism, Hacktivism, and Cyberterrorism: the Internet As a Tool for Influencing Foreign Policy