Security and Privacy Assessment for Medical Technical Devices: A Playbook for Evaluating Cybersecurity and Privacy

This thesis presents a detailed assessment methodology for medical devices that use Bluetooth connectivity, incorporating both technical and privacy considerations. The framework, referred to as the playbook, provides a practical guide for Sykehuspartner to better evaluate and mitigate cybersecurity risks before procuring new medical technical equipment connected to applications with Bluetooth. The evaluation of privacy and Application Programming Interface (API) security in the procurement process of medical technical equipment is addressed in the research. The study introduces a playbook divided into four sections: network traffic, Bluetooth security, terms/conditions of use, and token security. The playbook consists of questions for each section and incorporates a scoring system. The playbook also provides guidance for answering the questions. Through the use of a Man-in-the-Middle proxy and relevant documentation, suppliers can be effectively compared. The research aims to enhance privacy and security evaluations, ensuring the protection of sensitive data and promoting secure interactions within healthcare information systems. The playbook should be improved before being used by Sykehuspartner. The playbook is not completely tested and should be improved before it can be an effective asset to Sykehuspartner in the procurement process

Generate optimal number of features in mobile malware classification using Venn diagram intersection

Smartphones are growing more susceptible as technology develops because they contain sensitive data that offers a severe security risk if it falls into the wrong hands. The Android OS includes permissions as a crucial component for safeguarding user privacy and confidentiality. On the other hand, mobile malware continues to struggle with permission misuse. Although permission-based detection is frequently utilized, the significant false alarm rates brought on by the permission-based issue are thought to make it inadequate. The present detection method has a high incidence of false alarms, which reduces its ability to identify permission-based attacks. By using permission features with intent, this research attempted to improve permission-based detection. However, it creates an excessive number of features and increases the likelihood of false alarms. In order to generate the optimal number of features created and boost the quality of features chosen, this research developed an intersection feature approach. Performance was assessed using metrics including accuracy, TPR, TNR, and FPR. The most important characteristics were chosen using the Correlation Feature Selection, and the malicious program was categorized using SVM and naive Bayes. The Intersection Feature Technique, according to the findings, reduces characteristics from 486 to 17, has a 97 percent accuracy rate, and produces 0.1 percent false alarms

Integrated Framework for Data Quality and Security Evaluation on Mobile Devices

Data quality (DQ) is an important concept that is used in the design and employment of information, data management, decision making, and engineering systems with multiple applications already available for solving specific problems. Unfortunately, conventional approaches to DQ evaluation commonly do not pay enough attention or even ignore the security and privacy of the evaluated data. In this research, we develop a framework for the DQ evaluation of the sensor originated data acquired from smartphones, that incorporates security and privacy aspects into the DQ evaluation pipeline. The framework provides support for selecting the DQ metrics and implementing their calculus by integrating diverse sensor data quality and security metrics. The framework employs a knowledge graph to facilitate its adaptation in new applications development and enables knowledge accumulation. Privacy aspects evaluation is demonstrated by the detection of novel and sophisticated attacks on data privacy on the example of colluded applications attack recognition. We develop multiple calculi for DQ and security evaluation, such as a hierarchical fuzzy rules expert system, neural networks, and an algebraic function. Case studies that demonstrate the framework\u27s performance in solving real-life tasks are presented, and the achieved results are analyzed. These case studies confirm the framework\u27s capability of performing comprehensive DQ evaluations. The framework development resulted in producing multiple products, and tools such as datasets and Android OS applications. The datasets include the knowledge base of sensors embedded in modern mobile devices and their quality analysis, technological signals recordings of smartphones during the normal usage, and attacks on users\u27 privacy. These datasets are made available for public use and can be used for future research in the field of data quality and security. We also released under an open-source license a set of Android OS tools that can be used for data quality and security evaluation

Doctor of Philosophy

dissertationIn computer science, functional software testing is a method of ensuring that software gives expected output on specific inputs. Software testing is conducted to ensure desired levels of quality in light of uncertainty resulting from the complexity of software. Most of today's software is written by people and software development is a creative activity. However, due to the complexity of computer systems and software development processes, this activity leads to a mismatch between the expected software functionality and the implemented one. If not addressed in a timely and proper manner, this mismatch can cause serious consequences to users of the software, such as security and privacy breaches, financial loss, and adversarial human health issues. Because of manual effort, software testing is costly. Software testing that is performed without human intervention is automatic software testing and it is one way of addressing the issue. In this work, we build upon and extend several techniques for automatic software testing. The techniques do not require any guidance from the user. Goals that are achieved with the techniques are checking for yet unknown errors, automatically testing object-oriented software, and detecting malicious software. To meet these goals, we explored several techniques and related challenges: automatic test case generation, runtime verification, dynamic symbolic execution, and the type and size of test inputs for efficient detection of malicious software via machine learning. Our work targets software written in the Java programming language, though the techniques are general and applicable to other languages. We performed an extensive evaluation on freely available Java software projects, a flight collision avoidance system, and thousands of applications for the Android operating system. Evaluation results show to what extent dynamic symbolic execution is applicable in testing object-oriented software, they show correctness of the flight system on millions of automatically customized and generated test cases, and they show that simple and relatively small inputs in random testing can lead to effective malicious software detection

App-Privacy As An Abstract Value – Approaching Contingent Valuation For Investigating The Willingness To Pay For App Privacy

Apps can be seen as the embodiment of ubiquitous computing, i.e. the creation of environments saturated with computing and communication capability, integrated with human users. App markets are typical examples of so-called free or freemium markets, i.e. most apps include (at least) a free basic version. However, this does not mean that consumers do not have to pay for the benefits they derive. More precisely, private information of consumers is generated as the majority of apps receives, stores, or processes personal data, although sometimes other revenue mechanisms are used simultaneously. Given the fact that consumers’ information privacy as personal data privacy is a major part of the economic exchange when downloading and using apps, app privacy is determined as an attribute of the value proposition of apps. The current paper approaches the contingent valuation for measuring the willingness to pay for app privacy as an abstract value

Providing Secure Web Services for Mobile Applications

Changing consumer behavior drives the demand for convenient and easy-to-use mobile applications across industries. This also impacts the financial sector. Banks are eager to offer their services as mobile applications to match the modern consumer needs. The mobile applications are not independently able to provide the required functionality; they interact with the existing core business functions by consuming secure Web Services over the Internet. The thesis analyses the problem of how a bank can enable a new secure distribution and communication channel via the mobile applications. This new channel must be able to interact with existing core systems. The problem is investigated from different axis related to Web Services protocols suitable for mobile use, security solutions for the communication protocols and the required support available in the selected mobile operating systems. The result of the analysis is an architectural description to fulfil the presented requirements. In addition to constructing the architecture, the thesis also describes some of the more advanced threats targeted against mobile apps and Web Services and provides mitigation schemes for the threats. The selected architecture contains a modular security solution that can be utilized outside of the financial context as well. ACM Computing Classification System (CCS 2012): - Information systems → Web Services - Security and privacy → Software and application security - Software and its engineering → Software architecture

Mobile Learning: location, collaboration and scaffolding inquiry

Critiques of mobile learning pedagogy are concerned with whether such approaches are technology led. This chapter discusses how the particular features of mobile learning can be harnessed to provide new learning opportunities in relation to collaboration, inquiry and location-based learning. Technology supported inquiry learning is a situation rich with possibilities for collaboration. In particular, mobile learning offers new possibilities for scaffolding collaboration together with its other better-known features such as scaffolding the transfer between settings and making learning relevant by making use of the possibilities of location-based learning. These features are considered as part of mobile learning models, in particular mobile collaborative learning models

Android on x86

Computer scienc

Smart Sensor Technologies for IoT

The recent development in wireless networks and devices has led to novel services that will utilize wireless communication on a new level. Much effort and resources have been dedicated to establishing new communication networks that will support machine-to-machine communication and the Internet of Things (IoT). In these systems, various smart and sensory devices are deployed and connected, enabling large amounts of data to be streamed. Smart services represent new trends in mobile services, i.e., a completely new spectrum of context-aware, personalized, and intelligent services and applications. A variety of existing services utilize information about the position of the user or mobile device. The position of mobile devices is often achieved using the Global Navigation Satellite System (GNSS) chips that are integrated into all modern mobile devices (smartphones). However, GNSS is not always a reliable source of position estimates due to multipath propagation and signal blockage. Moreover, integrating GNSS chips into all devices might have a negative impact on the battery life of future IoT applications. Therefore, alternative solutions to position estimation should be investigated and implemented in IoT applications. This Special Issue, “Smart Sensor Technologies for IoT” aims to report on some of the recent research efforts on this increasingly important topic. The twelve accepted papers in this issue cover various aspects of Smart Sensor Technologies for IoT