1. Csilla Farkas Department of Computer Science and Engineering University of South Carolina farkas@cec.sc.edu

2. Who is Impacted by Cyber Attacks? Source: http://www.cagle.com/2010/05/internet-privacy /http://www.cagle.com/2010/05/internet-privacy /

3. What is Cyber Security? Highly Technical People, processes, and technology Legislation and Regulation Risk management

4. Web Evolution Past: Human usage – HTTP – Static Web pages (HTML) Current: Human and some automated usage – Interactive Web pages – Web Services (WSDL, SOAP, SAML) – Semantic Web (RDF, OWL, RuleML, Web databases) – XML technology (data exchange, data representation) Future: Semantic Web Services

5. ARE THE EXISTING SECURITY MECHANISMS SUFFICIENT TO PROVIDE DATA AND APPLICATION SECURITY OF THE NEXT GENERATION WEB?

6. Limitation of Research Syntax-based No association protection Limited handling of updates No data or application semantics No inference control

7. Secure XML Views - Example UC S John Smith UC 111-2222 S Jim Dale UC TS S Harry Green UC 333-4444 S Joe White UC MT78 TS medicalFiles countyRec patient name John Smith milBaseRec physician Jim Dale physician Joe White name Harry Green milTag MT78 patient phone 111-2222 phone 333-4444 View over UC data

8. Secure XML Views - Example cont. John Smith Jim Dale Harry Green Joe White medicalFiles countyRec patient name John Smith milBaseRec physician Jim Dale physician Joe White name Harry Green patient View over UC data

9. Secure XML Views - Example cont. medicalFiles countyRec patient name John Smith milBaseRec physician Jim Dale physician Joe White name Harry Green patient View over UC data John Smith Jim Dale Harry Green Joe White

10. Secure XML Views - Example cont. UC S John Smith UC Jim Dale UC TS S Harry Green UC Joe White UC medicalFiles countyRec patient name John Smith milBaseRec physician Jim Dale physician Joe White name Harry Green patient View over UC data

11. Secure XML Views - Example cont. medicalFiles name John Smith physician Jim Dale physician Joe White name Harry Green View over UC data John Smith Jim Dale Harry Green Joe White

12. Secure XML Views - Solution Multi-Plane DTD Graph (MPG) Minimal Semantic Conflict Graph (association preservation) Cover story Transformation rules

13. TopSecret Secret Unclassified Multi-Plane DTD Graph D,medicalFiles D, countyRecD, milBaseRec D, patientD, milTag D, nameD, phone UC S S S TS D, physician MPG = DTD graph over multiple security planes

14. Transformation - Example namephone physician MSCG MPG TS UC S Security Space Secret

15. Transformation - Example MPG TS S UC SP name physician MSCG

16. Transformation - Example MPG TS S UC  SP MSCG

17. Transformation - Example MPG TS S UC SP medicalFiles emergencyRec name physician Data Structure

18. The Inference Problem General Purpose Database: Non-confidential data + Metadata  Undesired Inferences Semantic Web: Non-confidential data + Metadata (data and application semantics) + Computational Power + Connectivity  Undesired Inferences

19. Association Graph Association similarity measure – Distance of each node from the association root – Difference of the distance of the nodes from the association root – Complexity of the sub-trees originating at nodes Example: Air show address fort XML document: Association Graph: address fort Public Public, AC

20. Correlated Inference Object[]. waterSource :: Object basin :: waterSource place :: Object district :: place address :: place base :: Object fort :: base address fort Public Water source base Confidential district basin Public ? Concept Generalization: weighted concepts, concept abstraction level, range of allowed abstractions

21. 21 Correlated Inference (cont.) address fort Public district basin Public Object[]. waterSource :: Object basin :: waterSource place :: Object district :: place address :: place base :: Object fort :: base place base Water Source Water source Base Place Water source base Confidential

22. Inference Removal Relational databases: limit access to data Web inferences – Cannot redesign public data outside of protection domain – Cannot modify/refuse answer to already published web page Protection Options – Release misleading information – Remove information – Control access to metadata

23. Big Data Analytics: Are there new questions? Technologies Big Data characteristics Big Data characteristics – Volume – Variety – Velocity – live database, fast growth

24. Past: The Inference Problem Organizational Data Confidential Attacker Public Access Control X Ontology Data Integration and Inferences Web Data

25. Present: Big Data Inferences Private ? Ontology Data Integration and Inferences Web Data Secure ?

26. Future: Research Challenges Security for raw data Security for raw data – Flexible access control – Data removal Security for metadata Security for metadata – Protection need of novel, new concept – Metadata guided attacks Cross-context attacks Cross-context attacks – Correlate data across multiple contexts SemanticWebTechnologies

27. Need for Visualization Context 1 Context 3 Context 2

28. Questions?

29. National Center of Academic Excellence in Information Assurance Education National Training Standards, Knowledge Units

30. OUTREACH EDUCATION RESEARCH CIAE Mission

31. OUTREACH EDUCATION IA courses IA specialization Applied Computing Graduate IA Certificate RESEARCH K-12 Cyber Security Education Higher Educational Institutes Industry Partnership

32. OUTREACH EDUCATION RESEARCH External funding Peer-reviewed publications Ph.D. graduates CIAE Mission