Information Systems Security: 17th International Conference, ICISS 2021, Patna, India, December 16–20, 2021, Proceedings (Security and Cryptology)

This book constitutes the proceedings of the 17th International Conference on Information Systems Security, ICISS 2021, held in Patna, India, during December 16-20, 2021. The 9 regular papers, 2 short papers and 4 work-in-progress papers included in this volume were carefully reviewed and selected from a total of 48 submissions. The papers were organized in topical sections named: attack detection, malware identification, data security in distributed systems, and applied cryptography. Preface Organization Abstract of Keynote Talks Multiagent Reasoning for Social Impact: Results from Deployments for Public Health and Conservation Data Privacy Re-visited During Covid19 Modeling and Leveraging Attrition in Cyber Operations Contents Attack Detection Identifying Tactics of Advanced Persistent Threats with Limited Attack Traces 1 Introduction 2 Background 2.1 MITRE ATT&CK Framework 2.2 Graph Embedding and GraphSAGE 3 Architecture and Approach 3.1 Data Collection 3.2 Graph Embedding Using GraphSAGE 4 Models 4.1 Online Metric Learning 4.2 SetConv: a New Approach for Learning from Imbalanced Data 5 Experiments 5.1 Experiment Setting 5.2 Result 6 Related Works 7 Conclusion and Future Work References WiP: Slow Rate HTTP Attack Detection with Behavioral Parameters 1 Introduction 2 Related Work 3 Proposed Slow Rate Attack Detection Method 3.1 Attack Indicators 3.2 How Different Parameters are Related? 3.3 Slow Rate Attack Detection 4 Experiments 4.1 Experiment in a Testbed (Experiment-1) 4.2 Experiment with Real Web Server (Experiment-2) 5 Conclusion References Multi Layer Detection Framework for Spear-Phishing Attacks 1 Introduction 2 Characteristics of Spear Phishing Email 2.1 Reflects Sense of Urgency 2.2 Impersonation 2.3 Malicious URLs and Attachments 2.4 Credential Harvesting and Lateral Movement 3 Related Work 4 Proposed Solution 5 Detection Engines 5.1 Impersonation Analysis Engine 5.2 Sentiment Analysis Engine 5.3 Content Analysis Engine 6 Aggregation Module 7 Dynamic Analysis Engine 8 Experiments and Results 8.1 Case I- Email ID 547 8.2 Case II-Security and Email ID 529 8.3 Case III - Email ID 347 8.4 Case IV - Email ID 448 9 Conclusion and Future Work References Vulnerability Analysis and Detection Using Graph Neural Networks for Android Operating System 1 Introduction 2 Literature Review 3 Proposed Methodology 3.1 Vulnerability Code Extraction 3.2 Intermediate Graph Representation 3.3 Feature Extraction 3.4 Graph Neural Network 3.5 Proposed GNN Architecture for Vulnerability Detection 4 Results and Discussion 4.1 Intermediate Graph Representation 4.2 Graph Data Extraction 4.3 Performance Evaluation of GNN 5 Conclusion and Future Work References Malware Identification Origin Information Assisted Hybrid Analysis to Detect APT Malware 1 Introduction 2 Related Work 3 Attack Flow of APT-Based Attacks 4 Proposed Methodology 4.1 How Does the PUI Get Installed on the System? 4.2 How to Get the PUI's Origin Information 4.3 Feature Engineering 4.4 Dataset Construction 5 Experiments and Performance Analysis 5.1 Experimental Setup 5.2 Data-Acquisition Process: Acquiring Features 5.3 Experimental Details 5.4 Model Training 5.5 Discussion 6 Conclusion and Future Work A Appendix A.1 List of Sources: Benign Executable Samples A.2 List of Sources: APT Malware Executable Samples References Raising MIPS Binaries to LLVM IR 1 Introduction 1.1 Brief About McSema and Remill 1.2 Benefits of Raising the Binaries to Intermediate Representation 2 Related Work 3 Methodology 3.1 Recovery 3.2 CFG Verification 3.3 Lifting 4 Challenges 4.1 Handling Branch Delay Slots 4.2 Handling Instruction Cross References 4.3 Handling Synchronisation Interface 4.4 Handling Instruction Decoding 5 Evaluation 5.1 Evaluation of Recompilation Lift Mode 5.2 Evaluation of Analysis Lift Mode 6 Conclusion and Future Plan References Data Security in Distributed Systems Automated Identification of Social Media Bots Using Deepfake Text Detection 1 Introduction 2 NLP for Bot Detection 2.1 Challenges of NLP for Bot Detection 2.2 Dataset 3 Related Work 4 Methodology 4.1 BERT 4.2 BiLSTM 4.3 VLAD 4.4 Classifier 5 Experiments and Results 6 Conclusion and Future Directions References Landcoin: A Practical Protocol for Transfer-of-Asset 1 Introduction 2 Background and Motivation 3 Architecture of Landcoin Protocol 3.1 From a Transfer-of-Value to a Transfer-of-Asset System 3.2 From Permissionless to Permissioned Setup 3.3 Steps and Requirements of Workflow for Land Management 3.4 Mainchain: Parameters and Construction 3.5 Sidechain: Placeholder for Private Information 3.6 Protocol Stakeholders, Their Roles, and Transaction Types 4 Summary of Guarantees 5 Implementation Details 6 Conclusion References WiP: A Distributed Approach for Statistical Disclosure Control Technologies 1 Introduction 2 On SDC Deployment 2.1 Roles 2.2 Fulfilling the Data Anonymizer Role 3 Distributed SDC Tool 3.1 Functionalities 3.2 Proof-of-Concept Prototype 3.3 Research Directions 4 Conclusion References Applied Cryptography A Verifiable Lossless Multiple Secret Images Sharing Scheme 1 Introduction 1.1 Motivation Towards Multiple Secret Images Sharing (MSIS) 1.2 Related Works 1.3 Limitations 1.4 Our Contributions 2 Preliminaries 3 Proposed Scheme 3.1 Shares Generation 3.2 Secret Images Reconstruction 4 Theoretical Analysis 5 Comparison and Experimental Results 5.1 Comparison 5.2 Experimental Results 6 Conclusion References Experimental Verification of Estimated Block Size of BKZ Algorithm Against LWE 1 Introduction 2 Preliminaries 2.1 Learning with Errors Problem 2.2 Lattices 2.3 Lattice Problem and Lattices Basis Reduction 3 Related Work 3.1 2016 Estimate ch11DBLP:confspsussspsAlkimDPS16 3.2 Experimental Analysis Against the 2016 Estimate 4 Proposed Method 5 Results and Discussion 5.1 Reliability of the 2016 Estimate 5.2 Observation in Smaller Block Sizes 5.3 Effect of the Second Intersection 6 Conclusion References WiP: Privacy Enabled Biometric Authentication Based on Proof of Decryption Techniques 1 Introduction 2 Related Work 3 Proposed Solution 3.1 Homomorphic HMAC 3.2 Biometric Authentication Using Verifiable Computing 3.3 Blinding Techniques 4 Experiments and Results 5 Conclusion and Future Work References WiP: QoS Based Recommendation System for Efficient Private Inference of CNN Using FHE 1 Introduction 2 Related Work 3 Proposed Method 3.1 Optimization Formulation for Pruning CNN 3.2 Pruning 3.3 Efficient Packing 3.4 Recommendation System for Private Inference 4 Results and Evaluation 4.1 Model Training and Pruning 4.2 Private Inference 5 Conclusion and Future Work References Improvement over Montgomery Modular Multiplication 1 Introduction 2 Overview of the Montgomery Modular Multiplicaton of ch14Mont85 3 Proposed Improvement 4 Conclusion References Faster Private Rating Update via Integer-Based Homomorphic Encryption 1 Introduction 2 Related Works 2.1 Arjan's Protocol 2.2 Lipmaa and Zhang's Protocol 3 Preliminaries 3.1 HE1N Encryption Scheme 3.2 Secure Bit Decomposition (SBD) 4 Proposed Protocol 4.1 Privacy Analysis 5 Performance Evaluation 5.1 Communication Cost 5.2 Computation Cost 5.3 Storage Cost 5.4 Experimental Results 6 Conclusion A Secure Bit Decomposition (SBD) References Author Index