Mitigating Colluding Attacks in Online Social Networks and Crowdsourcing Platforms

Online Social Networks (OSNs) have created new ways for people to communicate, and for companies to engage their customers -- with these new avenues for communication come new vulnerabilities that can be exploited by attackers. This dissertation aims to investigate two attack models: Identity Clone Attacks (ICA) and Reconnaissance Attacks (RA). During an ICA, attackers impersonate users in a network and attempt to infiltrate social circles and extract confidential information. In an RA, attackers gather information on a target\u27s resources, employees, and relationships with other entities over public venues such as OSNs and company websites. This was made easier for the RA to be efficient because well-known social networks, such as Facebook, have a policy to force people to use their real identities for their accounts. The goal of our research is to provide mechanisms to defend against colluding attackers in the presence of ICA and RA collusion attacks. In this work, we consider a scenario not addressed by previous works, wherein multiple attackers collude against the network, and propose defense mechanisms for such an attack. We take into account the asymmetric nature of social networks and include the case where colluders could add or modify some attributes of their clones. We also consider the case where attackers send few friend requests to uncover their targets. To detect fake reviews and uncovering colluders in crowdsourcing, we propose a semantic similarity measurement between reviews and a community detection algorithm to overcome the non-adversarial attack. ICA in a colluding attack may become stronger and more sophisticated than in a single attack. We introduce a token-based comparison and a friend list structure-matching approach, resulting in stronger identifiers even in the presence of attackers who could add or modify some attributes on the clone. We also propose a stronger RA collusion mechanism in which colluders build their own legitimacy by considering asymmetric relationships among users and, while having partial information of the networks, avoid recreating social circles around their targets. Finally, we propose a defense mechanism against colluding RA which uses the weakest person (e.g., the potential victim willing to accept friend requests) to reach their target

Defending against Sybil Devices in Crowdsourced Mapping Services

Real-time crowdsourced maps such as Waze provide timely updates on traffic, congestion, accidents and points of interest. In this paper, we demonstrate how lack of strong location authentication allows creation of software-based {\em Sybil devices} that expose crowdsourced map systems to a variety of security and privacy attacks. Our experiments show that a single Sybil device with limited resources can cause havoc on Waze, reporting false congestion and accidents and automatically rerouting user traffic. More importantly, we describe techniques to generate Sybil devices at scale, creating armies of virtual vehicles capable of remotely tracking precise movements for large user populations while avoiding detection. We propose a new approach to defend against Sybil devices based on {\em co-location edges}, authenticated records that attest to the one-time physical co-location of a pair of devices. Over time, co-location edges combine to form large {\em proximity graphs} that attest to physical interactions between devices, allowing scalable detection of virtual vehicles. We demonstrate the efficacy of this approach using large-scale simulations, and discuss how they can be used to dramatically reduce the impact of attacks against crowdsourced mapping services.Comment: Measure and integratio

Quality of Information in Mobile Crowdsensing: Survey and Research Challenges

Smartphones have become the most pervasive devices in people's lives, and are clearly transforming the way we live and perceive technology. Today's smartphones benefit from almost ubiquitous Internet connectivity and come equipped with a plethora of inexpensive yet powerful embedded sensors, such as accelerometer, gyroscope, microphone, and camera. This unique combination has enabled revolutionary applications based on the mobile crowdsensing paradigm, such as real-time road traffic monitoring, air and noise pollution, crime control, and wildlife monitoring, just to name a few. Differently from prior sensing paradigms, humans are now the primary actors of the sensing process, since they become fundamental in retrieving reliable and up-to-date information about the event being monitored. As humans may behave unreliably or maliciously, assessing and guaranteeing Quality of Information (QoI) becomes more important than ever. In this paper, we provide a new framework for defining and enforcing the QoI in mobile crowdsensing, and analyze in depth the current state-of-the-art on the topic. We also outline novel research challenges, along with possible directions of future work.Comment: To appear in ACM Transactions on Sensor Networks (TOSN

A trust framework for peer-to-peer interaction in ad hoc networks

PhDAs a wider public is increasingly adopting mobile devices with diverse applications, the idea of who to trust while on the move becomes a crucial one. The need to find dependable partners to interact is further exacerbated in situations where one finds oneself out of the range of backbone structures such as wireless base stations or cellular networks. One solution is to generate self-started networks, a variant of which is the ad hoc network that promotes peer-to-peer networking. The work in this thesis is aimed at defining a framework for such an ad hoc network that provides ways for participants to distinguish and collaborate with their most trustworthy neighbours. In this framework, entities create the ability to generate trust information by directly observing the behaviour of their peers. Such trust information is also shared in order to assist those entities in situations where prior interactions with their target peers may not have existed. The key novelty points of the framework focus on aggregating the trust evaluation process around the most trustworthy nodes thereby creating a hierarchy of nodes that are distinguished by the class, defined by cluster heads, to which they belong. Furthermore, the impact of such a framework in generating additional overheads for the network is minimised through the use of clusters. By design, the framework also houses a rule-based mechanism to thwart misbehaving behaviour or non-cooperation. Key performance indicators are also defined within this work that allow a framework to be quickly analysed through snapshot data, a concept analogous to those used within financial circles when assessing companies. This is also a novel point that may provide the basis for directly comparing models with different underlying technologies. The end result is a trust framework that fully meets the basic requirements for a sustainable model of trust that can be developed onto an ad hoc network and that provides enhancements in efficiency (using clustering) and trust performance

Trust Management for P2P application in Delay Tolerant Mobile Ad-hoc Networks. An Investigation into the development of a Trust Management Framework for Peer to Peer File Sharing Applications in Delay Tolerant Disconnected Mobile Ad-hoc Networks.

Security is essential to communication between entities in the internet. Delay tolerant and disconnected Mobile Ad Hoc Networks (MANET) are a class of networks characterized by high end-to-end path latency and frequent end-to-end disconnections and are often termed as challenged networks. In these networks nodes are sparsely populated and without the existence of a central server, acquiring global information is difficult and impractical if not impossible and therefore traditional security schemes proposed for MANETs cannot be applied. This thesis reports trust management schemes for peer to peer (P2P) application in delay tolerant disconnected MANETs. Properties of a profile based file sharing application are analyzed and a framework for structured P2P overlay over delay tolerant disconnected MANETs is proposed. The framework is implemented and tested on J2ME based smart phones using Bluetooth communication protocol. A light weight Content Driven Data Propagation Protocol (CDDPP) for content based data delivery in MANETs is presented. The CDDPP implements a user profile based content driven P2P file sharing application in disconnected MANETs. The CDDPP protocol is further enhanced by proposing an adaptive opportunistic multihop content based routing protocol (ORP). ORP protocol considers the store-carry-forward paradigm for multi-hop packet delivery in delay tolerant MANETs and allows multi-casting to selected number of nodes. Performance of ORP is compared with a similar autonomous gossiping (A/G) protocol using simulations. This work also presents a framework for trust management based on dynamicity aware graph re-labelling system (DA-GRS) for trust management in mobile P2P applications. The DA-GRS uses a distributed algorithm to identify trustworthy nodes and generate trustable groups while isolating misleading or untrustworthy nodes. Several simulations in various environment settings show the effectiveness of the proposed framework in creating trust based communities. This work also extends the FIRE distributed trust model for MANET applications by incorporating witness based interactions for acquiring trust ratings. A witness graph building mechanism in FIRE+ is provided with several trust building policies to identify malicious nodes and detect collusive behaviour in nodes. This technique not only allows trust computation based on witness trust ratings but also provides protection against a collusion attack. Finally, M-trust, a light weight trust management scheme based on FIRE+ trust model is presented

A conceptual model for proactive detection of potential fraud enterprise systems: exploiting SAP audit trails to detect asset misappropriation

Fraud costs the Australian economy approximately $3 billion annually, and its frequency and financial impact continues to grow. Many organisations are poorly prepared to prevent and detect fraud. Fraud prevention is not perfect therefore fraud detection is crucial. Fraud detection strategies are intended to quickly and efficiently identify frauds that circumvent preventative measures so that an organisation can take appropriate corrective action. Enhancing the ability of organisations to detect potential fraud may have a positive impact on the economy. An effective model that facilitates proactive detection of potential fraud may potentially save costs and reduce the propensity of future fraud by early detection of suspicious user activities. Enterprise systems generate millions of transactions annually. While most of these are legal and routine transactions, a small number may be fraudulent. The enormous number of transactions makes it difficult to find these few instances among legitimate transactions. Without the availability of proactive fraud detection tools, investigating suspicious activities becomes overwhelming. This study explores and develops innovative methods for proactive detection of potential fraud in enterprise systems. The intention is to build a model for detection of potential fraud based on analysis of patterns or signatures building on theories and concepts of continuous fraud detection. This objective is addressed by answering the main question; can a generalised model for proactive detection of potential fraud in enterprise systems be developed? The study proposes a methodology for proactive detection of potential fraud that exploits audit trails in enterprise systems. The concept of proactive detection of otential fraud is demonstrated by developing a prototype. The prototype is a near real-time web based application that uses SAS for its analytics processes. The aim of the prototype is to confirm the feasibility of implementing proactive detection of potential fraud in practice. Verification of the prototype is achieved by performing a series of tests involving simulated activity, followed by a full scale case study with a large international manufacturing company. Validation is achieved by obtaining independent reviews from the case study senior staff, auditing practitioners and a panel of experts. Timing experiments confirm that the prototype is able to handle real data volumes from a real organisation without difficulty thereby providing evidence in support of enhancement of auditor productivity. This study makes a number of contributions to both the literature and auditing practice