Conference Title

The Third International Conference on

Information Security and Digital Forensics
(ISDF2017)

Conference Dates
December 8-10, 2017

Conference Venue
Metropolitan College, Thessaloniki, Greece

ISBN:
978-1-941968-46-8 ©2017 SDIWC

Published by
The Society of Digital Information and Wireless
Communications (SDIWC)
Wilmington, New Castle, DE 19801, USA
www.sdiwc.net
 Table of Contents

Cyber Security

Education Method for Simultaneous Achievement of Safety and Security in the IoT Era…………. 1

A Cumulative Sum Technique for Network Cyber Intrusion Detection………………………………….. 7

Digital Forensic

GPU Forensics: Recovering Artifacts From The Gpus Global Memory Using Opencl……........…….. 12

Formal Methods Application in Security

Common Attributes of Security Breach Types………………………………………………………………………..… 21

Information Security Risk Management

The Strategy of Brazilian Government to Improve the Information Security Risk Management
and the Cyber Security in Brazilian Public Sector……………………………………………………………………… 27

Miscellaneous
Project of building Security in Zoological garden …………………………………………………………………… 33

A Novel Semantic Framework for Cloud Service Ranking and Adoption………………………………… 44

Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

Education Method for Simultaneous Achievement of Safety and Security in

the IoT Era

Nyambayar Davaadorj, Yuitaka Ota, Akihiro Tsuchiya and Ichiro Koshijima

Department of Architecture, Civil Engineering and
Industrial Management Engineering
Nagoya Institute of Technology, Nagoya, Japan
Nyamaa0727@gmail.com

ABSTRACT However, workers in a manufacturing plant

The manufacturing industry is obligated to ensure
its employees' health and safety. However,
employees in a manufacturing plant are exposed
to constant safety hazards. Therefore, ensuring
worker safety in the plant is difficult. Moreover,
the manufacturing industry in recent times has
adopted control systems for plant management.
Therefore, it is imperative to respond to the threat
of cyber-attacks in a production environment.
Hence, simultaneously safeguarding the control
system against cyber-attacks and ensuring the
safety of employees is necessary. However, the
safety of employees and cyber-security are dealt
with independently by the production safety
division and the IT security division, respectively.
Such a scenario may lead to a delayed response in
case of an emergency and may increase the
seriousness of the damage caused. Therefore, in
this paper, a PDCA cycle that combines safety
and security in the IoT era is presented, and an
educational method is proposed that Safety-II and
Security-II implementation together.
KEYWORDS
are exposed continuously to health hazards.
With the recent introduction of control
systems by the manufacturing industry for
management, it has become necessary to
respond to the threat of cyber-attacks in a
production environment. Therefore, securing
the control systems against cyber-attacks
while ensuring the safety of employees at the
same time at a given site has become
necessary [2]. However, up until now, worker
safety and cyber security have been dealt with
separately by the production safety division
and the IT security division, respectively.
Safety and security divisions work
independently, and they may lead to more
severe damage caused by a delayed response
in case of an emergency [3].
Therefore, in this paper, a PDCA cycle that
combines safety and security in the IoT
(Internet of Thinking) era is presented, and an
educational method is proposed to implement
Safety-II and Security-II the organization,
simultaneously.

Safety, Security, Cyber-attack, IoT, ICS. 2 SAFETY AND SECURITY

1 INTRODUCTION In the IoT era, control systems are

With the diversification of production
processes, complications and international
standardization of on-site machine tools are
increasing. Moreover, with the introduction of
new mechanical equipment and chemical
substances, the causes of occupational
accidents are diversifying. Therefore, the
greatest obligation of the manufacturing
industry is to safeguard workers’ health and to
ensure the safety of its employees [1].
significantly involved in the planning, design,
operation, and marketing of the
manufacturing industry. In particular, IoT is
often used to achieve improvements in
productivity and to reduce the production
costs of plants and manufacturing industries.
Therefore, the manufacturing industry
needs to ensure employee safety and
industrial control system (ICS) safety
simultaneously. For that purpose, we define
the following two problems.

ISBN: 978-1-941968-46-8 1
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
1. Discovering effective interactions
between safety and cybersecurity: It is
necessary to propose an analysis
method based on global standards.
Find out about effective PDCA cycle
to continuously implementing.
2. Maximizing organizational resilience
against uncertain and unexpected
cyber-attacks: It is necessary to access
PDCA cycles implementation based
on global standards.
2.1 Safety-based production
Deciding to standardize each of task for work
manuals and advancing work according to the
manual can reduce defects. First, it is
necessary to arrange work procedure manual
properly. Figure 1 shows indispensable
relationships between safety and production
tasks.
When tasks are designed using a procedure
manual, and when work is carried out
according to the guidelines in a procedure
manual, the following is achieved.
1. Machinery can be run without
incurring mechanical damage.
2. Machinery can be run without
incurring environmental damage.
3. Machinery can be run while ensuring
employee’s health and safety.
The above three operations ultimately result
in smooth operations in a manufacturing
business. Also, the work is devoid of
mechanical and environmental damage, and a
safe work environment for employees is
ensured, which leads to continuity in the
company's management.
Figure 1. Relationship between safety and production.
2.2 Security-based production
ISBN: 978-1-941968-46-8
A standardized operating procedure of the
control system allows the operation of the
control system to proceed normally. ICS is
involved in the planning, design, and
operation of the processing system. In
particular, an information network can be
used manufacturing industry utilizes IoT to
improve productivity, thereby contributing to
reduced costs and some human resource
requirements.
Therefore, designing a procedure manual for
the control system and utilizing the procedure
manual affects the following three aspects
(Figure 2).
1. Operation of the ICS network without
incurring safety damage.
2. Operation of the ICS network without
incurring production damage.
3. Operation of the ICS network without
information loss
The above three operations ultimately lead
to a smooth functioning of the manufacturing
business. Moreover, the work is devoid of
mechanical and environmental damage, and a
safe work environment for employees is
ensured, which leads to continuity in the
company's management.
Figure 2. Schematic of the safety and security
framework.
2.3 Safety and security-based production
Until now, safety has been implemented for
many years for the manufacturing industry in
the manufacturing industry. However,
realizing a perfectly safe plant is a
challenging task. Consequently, the
manufacturing industry has attempted to
secure the safety of the site using their
method for safety. Recently, the big
companies have adopted international
standards for safety and security. They expect
a reduction in risk due to the adoption of
global safety standards. In the IoT era, the use
2
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
of control systems in the production process
has become widespread. Figure 3 indicates
that the manufacturing industry uses the
control system for automation of the
production line, stable operations, and
reduction in the human resources required.
Also, manufacturing industries collect and
analyze data from the control system by
connecting to the Internet (for data analysis)
for improved marketing functions,
management, and line productivity. The
analyzed will help the industry adapt to a
flexible trading business market and enhance
its business efficiency. However, connecting
the control system to the Internet increases the
risk of cyber-attacks, consequently, increasing
risks in the future.
Figure 3. Maintain safe environment.
2.4 Analysis of Safety and Security
Integration Standard
In literature [1], [4] the authors discussed the
establishment of a cycle for bottom-up that
continues to improve, maintain and
implement after recognizing the international
standard for safety and security standards. For
safety, OHSAS18001 (Occupational Health
and Safety standard) is analyzed by using
IDEF0 and is mapped to a Resilience Matrix
(RM) that can be defined as a cycle to
develop new operational procedures to
maintain and increase organizational
resilience. In this matrix skill–rule–
knowledge (SRK) model and organizational
levels (i.e., individual, group, and
organization) are combined in the 3 × 3 chart.
To specify a security standard procedure,
IEC62443 (Industry network system standard)
ISBN: 978-1-941968-46-8
[5] is also analyzed by using the approach
mentioned above.
The analysis of global standard was
conducted by deconstructing and categorizing
clauses of the standard from the following
perspectives:
1. Chapter titles, subtitles, number, sentence
locations
2. Sentences (extracting only the sections on
recommendations for actions relating to
health and safety)
3. Subjects, objects, and verbs within
sentences
4. Verbs, objects, and verbs within
sentences
5. Knowledge, skill, rule based on
Rasmussen’s (Rasmussen, 1983) SRK
model [6].
Resilience matrix covers activities that
occur during establishment, implementation,
and maintenance. Accordingly, it seems to be
appropriate to place the IDEF0 model of the
global standard into the resilience matrix to
specify the structure of the organizational
activity cycle and identify basic activities. In
this previous study, we discussed a method
for evaluating a manner in which PDCA cycle
(Figure 4 shows) of OHSAS18001 and IEC
62443 systematically functions within
corporations. Based on the findings, this study
clarifies the potential structural objection for
corporations when implementing and
operating the OHSAS18001 and IEC 62443
standard.
According to the OHSAS18001 and IEC
62443 standard analysis, the installation of
the PDCA cycles is essential for achieving
continuous improvement. Safety and security
standard organization structure with section-
based PDCA cycle;
 Each section goes through the
implementation, maintenance, and
improvement processes.
 Subsequently, the improvement must be
checked and tested. If it passes the check,
one can proceed to the next stage.
 If the improvement fails the check, one
goes back to an improvement process,
provide safety instructions, and then
return to the cycle.
3
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
 PDCA is repeated in each responding
section of the organization.
Figure 4. Schematic of the safety and security standard
framework.
3 SAFETY AND SECURITY
SIMULTANEOUS ACHIEVEMENT
FRAMEWORK
In the event of a cyber-attack, it is necessary
to have a corresponding structure to add
security correspond for safety response. Also,
a response process is required to converge the
situation. If the control system survives the
cyber-attack as an operational abnormality,
measures for securing safety must be
immediately implemented. Safety response
and security correspondence must be realized
simultaneously. Figure 5 illustrates a cyber
incident correspondence structure that takes
into consideration the security
correspondence constraint condition. During a
cyber incident, the organization
(communication, resource, system) and there
are constraints on (resources, systems) in the
environment, and time constraints due to the
urgency in the cyber incident. We explain the
relationship between safety, cyber incident
response, and the corresponding constraints
using the IDEF0 modeling method. Given
that cyber-attacks cause unsafe operating
ISBN: 978-1-941968-46-8
conditions in the control system, safety
measures are first implemented.
An unsecured state is one of the outputs in
the process of looping safety correspondence
to safeguard the control system. The non-
secure state shown Figure 5 is the state of the
control system that is affected by the cyber
incident, viz., the human condition (judgment,
knowledge). Further, security correspondence
is implemented against the outputted insecure
state. Security correspondence loop is
executed until a secure state is outputted.
Even if a secure state is outputted, if the
control system is in an all-anxiety status, the
safety correspondence loop is executed again,
and if an insecure state is outputted in that
process, the security correspondence is
implemented. Safety response and security
correspondence are implemented in this
structure until the control system outputs it in
a safe and secure state. There exists an
extensive roof between the safety and security
tree. According to Figure 5 bottom arrow
which is control added to perform measures
implemented by the organization safely. Non-
safety state caused by cyber incidents is
implemented by the group and the division.
Mechanism added to safety perform measures
should be implemented individually.
Figure 5. Safe and secure state.
3.1 Approach to integration of safety and
cybersecurity
Resilience engineering is a concept proposed
by Erik Hollnagel [7]. Hollnagel presented
views on Safety-I and Safety-II, which are
summarized as follows.
 Safety-I: Avoiding that things go wrong.
The Safety-I means a state where things
4
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
do not go wrong. The safety I try only to
prevent these things from going wrong.
This approach assumes that it is possible
to attain safety by eliminating all of the
contributory factors of adverse outcomes.
 Safety-II: Safety management for
responding errors to happen. The safety-
II tries to ensure a state where the level of
required performance is maintained to be
as high as possible and to ensure that
things go right under varying conditions.
Attention is paid not too rare failure cases
but actual routine operational
performances.
By the above explanation, Security-I and
Security-II are assumed in the same way of
thinking.
 Security-I ： On the ICS, avoiding that
things go wrong Security-I refers to a
state where things do not go wrong in the
ICS. Security-I attempts to prevent these
accidents from happening. This approach
assumes that it is possible to attain safety
by eliminating all of the contributory
factors of adverse outcomes.
 Security-II: Security management for
responding errors that are yet to occur
Security-II attempts to ensure a state
where the level of required performance
is maintained as high as possible and to
ensure that things go right under varying
conditions.
In the system, attention is paid not to
infrequent failure cases but instead of actual
routine operational performances.
First, the global standard determines activities
based on risk assessment, which can be
considered as the countermeasures of Safety-I
and Security-I. Second, Safety-II and
Security-II define the maintenance and
improvement of a safe environment, which
can be considered as the countermeasures of
Safety-II and Security-II; these require a
continuous execution of the improvement
cycle.
Therefore, one company can
simultaneously achieve safety and security by
maintaining Safety-I, Safety-II, Security-I,
and Security-II continuously, as described in
Figure 6.
ISBN: 978-1-941968-46-8
Figure 6. Safety-I, security-I and safety-II, security-II
framework
3.2 Global Standard Approach for
Integration Respond
International standards correspond to Safety-I
and Security-I. Also, it is important to
identify and continuously maintain a cycle for
a bottom-up approach that can be
continuously improved, maintained, and
executed after recognizing the international
standards for safety and security. As shown in
Figure 7 one factory needs care about safety
(Safety-I, Safety-II) and security (Security-I,
Security-II), human approaches to Safety-II
and Security-II are indispensable. In the event
of accidents or cyber incident, it is human
beings who make the final making decision.
Therefore, it is necessary to continuously
develop a human resource development
training and PDCA of Safety-II and Security-
II in case of an emergency.
Figure 7. Safety and security integration framework.
3.3 ICS-BCP training Exercise to
Implement the Integrated Response
Safety-II and Security-II involve taking safety
measures at the early stages of an emergency.
However, cyber-attacks and cyber incidents
do not always happen, and cannot be
predicted. Therefore, it is necessary to
implement correspondence training when
Safety-II and Security-II occur. Training for
cyber incident handling is aimed at
5
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
understanding the framework for handling
cyber incidents. Therefore, depending on the
organizations that are trained, it is necessary
to consider the organizational (organizational
involved in the operation of the business) and
correspondence to cyber-attacks (response to
security).
In this exercise (calling ICS-BCP) training,
we will consider an organization’s response to
a cyber-attack. The purpose of the
correspondence changes with the passage of
the correspondence changes with the passage
of time. The following types of activities
should be considered according to the purpose
of correspondence. (Figure8) the typical
deliverables of the exercise are workflow
which becomes plants by considering “who”
performs an action and “when.”
1. Activities to regain plan safety when
attacks are disturbed.
2. Activities to maintain production
activities that are obstructed by attacks at
a specified service level.
3. Activities to deter further attacks.
4. Activities to preserve evidence of attacks.
Figure 8. Schematic of the safety and security
framework.
4 CONCLUSIONS
In this paper, the author proposed two
problems, viz., discovering effective
interactions between safety and cyber security
and Maximizing organizational resilience
against uncertain and unexpected cyber-
attacks. Discovering an effective interactive
ISBN: 978-1-941968-46-8
linkage between safety and cybersecurity is
necessary.
To that end, we need to maximize the
resilience of the organization to cyber-attacks
that cannot be predicted reliably. First, the
PDCA cycle necessary to combine Safety-I
and Security-I was extracted using the IDEF0
modeling method. To build a PDCA cycle
between Safety-II and Security-II, an exercise
framework to maximize organization
resilience was suggested.
ACKNOWLEDGEMENTS
This research is partially supported by the
Ministry of Education, Science, Sport and
Culture, Grant-in-Aid for Scientific Research
(A), No.16H01837 (2016); however, all
remaining errors are attributable to the
authors.
REFERENCES
[1] D. Nyambayar, H. Eguchi, and I. Koshijima, “A
Matric for Quantitative Estimation of Production
Unit Based On OSHMS,” IOP
Conf.Series:Materials Science and Engineering.
012009 doi:10.1088/1757-899X/206/1/012009.
[2] SANS: Industrial Control Systems Security Blog,
https://ics.sans.org/blog/2016/01/09/confirmation-
of-a-coordinated-attack-on-the-ukrainian-power-
grid. Accessed January 29, 2017.
[3] Y. Hashimoto, T. Toyoshima, S. Yogo, M. Koike,
T. Hamaguchi, S. Jing, and I. Koshijima, “Safety
Securing approach against cyber-attacks for
process control system,” Computers & Chemical
Engineering, vol.57, no.15, pp.181-186, October
2013.
[4] D. Nyambayar, and I. Koshijima, “Study of a
Safety and Security Framework Based on
Resilience Engineering,” REA symposium.
[5] IEC Central Office, Industrial Communication
Network, and System Security-Part2-1:
Establishing and industrial automation and control
system security manual, online, www.iec.ch.
Accessed on: online user accessed by Yoshihiro
Hashimoto.
[6] J. Rasmussen, “Skills, Rules, Knowledge.Signals,
Signs, and Symbols, and Other Distinctions in
Human Performance Models, ” IEEE Transactions
on Systems, Man, and Cybernetics, pp.257-266,
1983.
[7] E. Holnagel, “Safety-I and Safety-II,” Ashgate Pub
Co. The Past and Future of Safety Management.
6
 Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

A Cumulative Sum Technique for Network Cyber Intrusion Detection

Dimitris Sklavounos1, George Paraskevopoulos1, Aloysius Edoh2

1
AMC College, 74 Sorou St, Amarousio 11525
2
University of East London, 4-6 University Way, London E16 2RD
dsklavounos@mitropolitiko.edu.gr, gparsk@amc.edu.gr, edoh@uel.ac.uk

ABSTRACT which has created very useful datasets like the

The present work proposes a mechanism of
denial of service (DoS) intrusion detection, by
examining changes in mean of the UDP and
ICMP source bytes. The detection mechanism
utilized for this purpose is the tabular
cumulative sum (CUSUM) chart and the
experimental dataset is the NSL-KDD Dataset.
Two cases were evaluated. In the first case
intrusion occurred in the UDP packets while in
the second case the intrusion occurred in UDP
and ICMP packets. In both cases, a shift in the
source bytes mean value took place after the
intrusion, and it was clearly depicted in the
CUSUM chart. Thus, the intrusion detection in
both cases was made successfully.
KEYWORDS
DoS intrusion detection, CUSUM chart, NSL-
KDD Dataset
1 INTRODUCTION
Denial of service (DoS) and its distributed
type (DDoS) have been very serious threats of
security in systems and networks for several
years. Although many research works have
been carried out with satisfactory results, it
continues to retain research interest in new
detection methods. DoS attacks are very
dangerous for systems and networks because
they can cause serious delays in accessing
servers and other resources due to the packet
flooding. This means that in many cases
servers must be shut down that causes huge
problems in serviceability, especially in real-
time applications such as e-commerce or
banking[1].
Α valuable contribution to research for the
detection and confrontation of DoS and DDoS
intrusions was the recording of network data,
Defence Advanced Research Projects Agency
(DARPA) 1998 dataset and the later versions:
the Knowledge Discovery and Data mining
Competition (KDDCup) 1999 dataset and the
NSL-KDD. These datasets were created to be
utilized by the American Air Force and they
have been widely used to evaluate
performance of Intrusion Detection Systems
(IDS). Several research works have been
carried out focusing on the intrusion detection
in networks and systems. Indicative related
works are the following: The authors in [2]
proposed a scheme for detecting distributed
DoS attacks and their source, especially when
there are multiple attacks. Using a non-
parametric CUSUM algorithm, proposed by
Wang, they monitor the server traffic for high
increase of requests coming from new IP-
addresses. This situation indicates a fact of
attack. The authors in [3] evaluated two
anomaly detection algorithms (an adaptive
threshold algorithm and a CUSUM change
point detection algorithm), for detecting TCP
SYN flood attacks. The main goal of the
research focuses on how the parameters of the
algorithms and the characteristics of the
attacks affect the performance of detection
systems like the above. The work in [4]
focuses on the utilization of simple threshold
detection and CUSUM change point detection
algorithms for pin pointing anomalies in the
signal to noise ratio. The main task of the
work is to specify the balance between
performance and intelligence. In [5] the
authors proposed a simple and robust
mechanism, called Change-point Monitoring
(CPM), to detect DoS attacks. The work
utilizes the correlation between requests and
replies of the internet protocol behaviour,
which is being destroyed from the attacks.

ISBN: 978-1-941968-46-8 ©2017 SDIWC 7

 Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

The non- parametric CUSUM algorithm deviation is the square root of the variance
detects deviations from normal protocol which is equal to:
behaviours caused by DoS attacks.
The proposed method in the present work (1)
utilizes the NSL-KDD dataset, focusing on
the attribute of the source bytes of UDP and When the process is under control both
ICMP packets in order to achieve detection of moments of the distribution are
DoS intrusion. Considering that the network maintained constant. The mean may be
is under normal operation (no attacks taken as the target value of the quality
involved), in a certain training period the characteristic . During the operation of the
mean value of the source bytes may be tabular CUSUM chart, two statistics: the
estimated. This value is set as the target mean and are applied to accumulate the
in the cumulative sum (CUSUM) chart deviations from . accumulates the
mechanism that is utilized in order to achieve deviations above target while the
intrusion detection. Assuming that the UDP deviations below target and they are estimated
and ICMP source bytes are normally as:
distributed, with mean and standard
deviation σ. If after intrusion there is a shift (2)
in the mean value and or and
then the detection will be (3)
successfully achieved.
The rest of the paper is organized as follows: Initially = = 0.
Section 2 contains the methodology of the is the reference value and it is estimated by:
proposed method along with analytical
elements of the tabular CUSUM chart as well
as the NSL-KDD dataset. Section 3 contains (4)
the evaluation results for the intrusion
detection in the UDP packets as well as the where is the mean of the out of control
ICMP and UDP packets concurrently. Finally, values. is the decision interval
in section 4 there are the conclusions and which means that if either of the two statistics
further work. and exceeds the value of , then the
process is out of control. Two reasonable
2 METHODOLOGY values of may be or [7].

The proposed method is based on the idea of
detecting a change in the mean value of the
source bytes of the UDP and ICMP packets
respectively during operation. Thus, the
tabular cumulative sum control chart was
utilized for this purpose [6].
2.1 The Tabular CUSUM Control Chart
The utilized CUSUM control chart in the
present work is of the type of tabular, with
individual observations and it works as
follows:
Assuming a normal distribution of a random
variable with mean and a known or
estimable standard deviation of . Standard
2.2 The NSL-KDD Dataset
The data set used for this work is the NSL-
KDD that consists of 42 attributes. It does not
contain duplicate instances as they have been
removed from the previous version (KDD’99)
and so, it represents an improved type of data
sets. A number of NSL-KDD data set
versions are available: the 20% of the training
data identified as “KDDTrain+_20Percent”
with 25192 instances, as well as the
“KDDtest+” with 22544 instances. The
number of attributes in each version is 42
with the 42nd attribute labeled as ‘class’ to
indicate whether a given instance is normal
connection or an attack [8]. The dataset files

ISBN: 978-1-941968-46-8 ©2017 SDIWC 8

 Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

have been downloaded from [9]. The dataset
used for the evaluation was the
"KDDtrain20percent" with 42 attributes
where the 42nd attribute named “xattack”
contains a numbering which indicates the type
of the attack as follows: (1) is the DoS, (2) is
the User to Root (U2R), (3) is the Remote to
User (R2L), (4) is the Probe and (5) is the
normal operation packets. The files are also
formatted for the machine learning program
“WEKA”.
2.3 Proposed Method
A network that operates normally has been
considered as an initial situation, supported
with a data recording mechanism. The data
recording mechanism captures the required
information, which in this case are the source
bytes. Assuming that the UDP and ICMP
source bytes are normally distributed, with a
mean and standard deviation . In some
instance an intrusion occurs in either UDP or
ICMP packets. If after intrusion there is a
shift in the mean value and
, then the CUSUM control chart,
which is the utilized detection mechanism,
will successfully detect the intrusion.
According to the functionality of the CUSUM
chart, the calculation of the target mean
crucial. Thus, a training period is set in order
this value would be computed. Α hypothetical
training period may be the one in which the
UDP and ICMP packets of the NSL-KDD
dataset were recorded with the network in
normal operation (no attacks). Thus, the target
mean value was calculated from the entire
source bytes of the UDP packets while the
second evaluation (2nd case) concerned the
UDP and the ICMP source bytes
concurrently, since they gave the same target
mean For the above cases, the
CUSUM algorithm of the form (5):
(5)
was applied initially for the detection of the
mean shift and then the tabular CUSUM
control chart, as described in Sec. 2.1, for
more analytical process of the detection.
3 Evaluation of Results
3.1 Detection of DoS attack based on the
UDP packets.
The first stage of the method was the training
period for the calculation of the mean value of
the UDP source bytes. Thus, the entire set of
source bytes instances of the original NSL-
KDD dataset were used, considering that the
or network is in normal operation with no
attacks involved. The estimated mean value of
the entire UDP source bytes of the training
period was . The first evaluation was
the case where the first 100 instances
is contained source bytes of normal
operation, and in sequence with them there
were added instances of attack
packets. Applying the CUSUM algorithmic
test of (5) for 150 instances a change in mean
was observed as depicted in Figure 1.
400
200
0
17
25
33
41
49
57
65
73
81
89
97
1
9

105
113
121
129
137
145

-200
sequence of the UDP and ICMP source byte -400
Ci

values of the whole dataset. Thereafter, two -600

-800
cases were examined for both UDP and ICMP -1000
packets with the tabular CUSUM chart -1200
-1400
utilization. For both cases, the assumption
-1600
made was, that in an initial stage the network Instances
was in a normal operation (with no attacks) Figure 1. Drift of test statistic of the cumulative sum in
for instances. Afterwards, an attack took (5) with three attack instances after the 100th instance

place for a very small number of instances . In cases where n takes a lower value
The first evaluation (1st case) concerned the the detection will be also achieved, but

ISBN: 978-1-941968-46-8 ©2017 SDIWC 9

 Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

as the mean of the source byte values is closer

to the target mean value the detection is
clearer depicted. So, a conservative value of 114 278,1 13
115 301,7 14
was selected in order for the 116 290,3 15
detection to be clearly achieved and depicted. 117 313,9 16
As observed from the graph of Fig. 1, the drift 118 350,5 17
initially fluctuates around zero, and after 119 372,2 18
instance 97 takes a negative direction. This is 120 333,8 19
due to the downward shift of the mean 121 295,4 20
122 317,0 21
after the attack.
123 337,6 22
Furthermore, the statistic in (3) was applied 124 359,3 23
for 150 instances and it is depicted in Figure 125 382,9 24
2. 126 302,5 25
127 327,1 26
… … …
700,0
600,0
130 395 29
500,0 … … …
400,0 150 596,4 49
Ci

300,0
200,0
At instance 122 the value of , so
100,0
0,0 which means that at
1
9

105
113
121
129
137
145
17
25
33
41
49
57
65
73
81
89
97

instance 101 the shift in mean started to be

Instances
created (Fig. 1). If is
taken, then the first signal for out of control
Figure 2. Drift of test statistic of in (3) with three
process comes at instance 125, and then from
attack instances after the 100th instance
instance 130 until the end, the process is
As shown in the graph, the slope of from permanently out of control. This result shows
the 100th instance, where the attack occurred, that, the better choice of the decision interval
until the 150th, takes a permanently positive may be the case when .
direction. This change of the slope is due to
the change in mean of the values after 100 3.2 Detection of DoS attack based on the
and this means that the process is out of UDP and ICMP packets concurrently.
control. So, the detection is made.
More analytically, the out of control mean is The same method with the previous section
estimated as , (where (Sec. 3.1) was applied for the detection of
). From (4) the UDP and ICMP source bytes in a concurrent
parameter and the interval manner. Examining the ICMP source bytes
At instance 115 comes size in normal and attack classification, the
the first signal for out of control process and a size in attack showed a large diversion
second one comes at instance 117 to 120. upwards from the size in normal operation.
From instance 122 until the end of the process Thus, the CUSUM chart detection seems to
all values are greater than 300 and this means be quite obvious. Hence, more challenging
that from that point the process is out of situation is the detection of attack when
control (Table 1). examining both ICMP and UDP source bytes
concurrently. As mentioned above there is a
Table 1. Indicative values of the slope of Figure 2 large deviation upwards between normal and
Instances attack ICMP source bytes, while there is
1 0 0 deviation downwards in UDP packets. For
2 0 0 this detection the same scenario as in Sec 3.1
3 21,6 1 was applied, as far as the sequence of the
instances is concerned.

ISBN: 978-1-941968-46-8 ©2017 SDIWC 10

 Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

The CUSUM test of (5) for the same number out of control process comes at instance 92.
of instances (150) showed a change in mean Then again from instance 101 until the end,
as depicted in Figure 3. the process is permanently out of control.
This result leads to that, both values of
2500
(4 or 5) give a decision interval with the
2000 almost the same effectiveness.
1500
4 Conclusion and Future Work
Ci

1000

500 A new DoS intrusion detection has been

0 method proposed. The method was based on
1
9

105
113
121
129
137
145
17
25
33
41
49
57
65
73
81
89
97

-500
the source bytes of the UDP and ICMP
Instances protocols as they have been recorded in the
Figure 3. Drift of test statistic of the cumulative sum in NSL-KDD dataset. The mechanism utilized
(5) with four (2 ICMP & 2 UDP) attack instances after for the detection was the tabular CUSUM
the 100th instance chart, which gave satisfactory results since it
successfully detected the intrusion in both
Thereafter, the statistic in (2) was applied for UDP and ICMP packets.
150 instances as depicted in Figure 4. Further to this work the cases of moving
average as well as subgroup averages will be
2000,0 examined for the intrusion detection. Also,
1800,0
1600,0
detection evaluation will take place on the
1400,0 TCP packets for Remote to User (R2L) and
1200,0
User to Root (U2R) types of intrusion
Ci

1000,0
800,0
600,0
utilizing possible upcoming newer versions of
400,0 datasets.
200,0
0,0
17
25
33
41
49
57
65
73
81
89
97
1
9

105
113
121
129
137
145

4 REFERENCES
Instances
[1] Hovav, Anat, and John D’Arcy, “The impact of denial-of-
service attack announcements on the market value of firms”,
Figure 4. Drift of test statistic in (2) with four (2 Risk Management and Insurance Review 6.2 (2003):97-121.
ICMP & 2 UDP) attack instances after the 100th [2] Tao Peng, Christopher Leckie, Kotagiri Ramamohanarao,
[3]
instance “Detecting Distributed Denial of Service Attacks Using
Source IP Address Monitoring”, In Proceedings of the Third
International IFIP-TC6 Networking Conference Networking
Because there is a positive shift of the mean 2004.
the statistic (eq. 2) was applied. As [3] Vasilios A. Siris, Fotini Papagalou, “Application of anomaly
detection algorithms for detecting SYN flooding attacks”,
depicted in Figure 4, there is a sharp change Computer Communications 29 (2006) 1433–1442, Elsevier.
of the slope after the 100th instance and this [4] Alexandros G. Fragkiadakis, Vasilios A. Siris, and Nikolaos
Petroulakis, “Anomaly-Based Intrusion Detection Algorithms
indicates the change in the mean. for Wireless Networks”, E. Osipov et al. (Eds.): WWIC 2010,
In this case (the mean for both UDP LNCS 6074, pp. 192-203, 2010.
[5] Haining Wang, Danlu Zhang, Kang G. Shin, “Change-Point
and ICMP source bytes is 79), , Monitoring for Detection of DoS Attacks”, IEEE Transactions
on Dependable and Secure Computing ( Volume: 1, Issue: 4,
the parameter and the Oct.-Dec. 2004 )
interval The first signal [6] V. V. Koshti, “CUMULATIVE SUM CONTROL CHART”,
International Journal of Physics and Mathematical Sciences
for out of control process came at instance 91 ISSN: 2277-2111 (Online).
until 95 and then from instance 101 until 150 [7] D. R. Prajapati, “Effectiveness of Conventional CUSUM
Control Chart for Correlated Observations”, International
the process was out of control. From a list of Journal of Modeling and Optimization, Vol. 5, No. 2, April
values with the same logic as Table 1 (not 2015
[8] Preeti Aggarwala, Sudhir Kumar Sharma, “Analysis of KDD
quoted), at instance 101, . So, at Dataset Attributes- Class wise For Intrusion Detection” 3rd
instance the shift in mean started to be International Conference on Recent Trends in Computing
2015 (ICRTC-2015), Elsevier
created. For the decision interval [9] https://github.com/FransHBotes/NSLKDD-Dataset,
then the first signal for (10/7/2016)

ISBN: 978-1-941968-46-8 ©2017 SDIWC 11

Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
GPU FORENSICS: RECOVERING ARTIFACTS FROM THE GPUS
GLOBAL MEMORY USING OPENCL
Yazeed Albabtain
Department of Computer and Information Technology, Purdue University
401 N.Grant Street, West Lafayette, IN 47907
{yalbabta, byang} @purdue.edu
ABSTRACT
The purpose of this research is to perform a graph-
ics recovery process on the GPU in line with the
principles of computer forensics. The research
tested the possibility of recovering artifacts of last
visited web pages and last opened images from the
GPUs global memory. The experiment deployed
the OpenCL framework and tested JPEG, TIFF, and
BMP graphic file formats of 64x64 pixels, 100x100
pixels, and 200x200 pixels in size. Other variables,
such as the choice of OS, GPU, and GPU driver,
were also tested to measure the effectiveness on the
proposed method. The research indicates that re-
covering artifacts from the GPUs global memory is
possible using a set of unique pixel patterns. The
research highlights three challenges of implement-
ing forensic techniques on GPUs: 1) elusive global
memory allocation scheme of GPUs; 2) varying
levels of support for different GPU drivers; and 3)
the prerequisite of using certain types of OS and
applications.
KEYWORDS
GPU forensics, OpenCL, RAM, volatile memory,
GPU Architecture, Artifacts, Webpage, Images.
1 INTRODUCTION
With the rise of the global internet over the
past decades, the use of digital technology be-
came an essential part of human life, which,
inevitably, also gave rise to cybercrime. This
shift toward digital has led to the rise of a
new area of forensic science, digital forensics,
which is concerned with collecting and exam-
ining potential digital evidence from comput-
ers, networks, and mobile phones. As a result,
a new area of forensic science, data recovery,
has been gaining a momentum in the investiga-
ISBN: 978-1-941968-46-8
Baijian Yang
tion of digital devices. Potentially critical data
is being processed and saved for a limited time
in the global memory of graphics processing
units (GPUs) that can benefit digital forensic
investigations. Due to the volatility of data,
few researchers have implemented forensics
methods to recover artifacts from the GPU. To
the best of the authors knowledge, [7] was the
only major work that has attempted to recover
graphic images from a GPUs global memory
dump using CUDA. However, the work was
limited to 200x200 pixel TIFF files, and not
all of the tested images were successfully re-
stored. This paper introduces a data recov-
ery process for graphic and webpage artifacts
from the global memory of GPUs. Building
on prior work attempting to recover graph-
ics from the global memory dump of GPUs
using CUDA (Zhang, 2015), we consider an
enhanced data recovery method for retrieving
inaccessible, lost, or deleted data using the
Open Computing Language (OpenCl) frame-
work. To evaluate the data recovery capabili-
ties of OpenCl, we test several image formats,
in different pixel sizes, and on different oper-
ating systems. Since the OpenCL framework
is widely supported by GPU vendors, our pro-
posed approach is applicable to a good vari-
ety of GPUs. We also consider how the choice
of GPU driver affects the data recovery pro-
cess. Due to the large variety and possible
combinations of available hardware and soft-
ware, implementing the OpenCl data recovery
method to GPUs faces three major challenges:
1) elusive global memory allocation scheme of
GPUs; 2) varying levels of support for different
GPU drivers; and 3) the prerequisite of using
the types of OS and applications on which the
recovery process is applicable. The rest of the
paper is organized as follows. Related work
12
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
is reviewed in Section 2, followed by the de-
scription and illustration of the proposed GPU
graphics recovery process in Section 3. Results
from the experiments are examined and dis-
cussed in Section 4. The paper concludes our
work and gives an outlook on future research
directions in Section 5.
2 LITERATURE REVIEW
Offloading graphics processing tasks to the
GPU has led to substantial improvements in
the performance of graphical computations.
The deployment of GPUs has further increased
with the emergence of general-purpose graph-
ics processing units (GPGPUs). While study-
ing how GPU-assisted malware affect mem-
ory forensics, the authors of [1], found that
GPUs can assist applications to achieve a sub-
stantial speed-up and enhance the performance
of various applications, including financial and
scientific computations. The authors further
posit that GPUs have enabled the realization
of video transcoding, bitcoin mining, recover-
ing passwords, and regular expression match-
ing. However, they note that despite the GPUs
ability to perform generic computations, GPU
misuse, i.e., the use of GPUs to engage in mali-
cious activity, has not been studied sufficiently.
To perform a forensic analysis on the GPU, the
authors gathered and analyzed numerous data
structures by developing several custom tools
specifically for this purpose. The data struc-
tures that were examined in the study include
graphic page tables, hangcheck flags, a list of
buffer objects, a list of contexts, and the regis-
ter files. The study also revealed that the use
of various GPU ecosystems posed substantial
challenges in the forensic process. This, there-
fore, makes it necessary to develop individual
tools for the probable combinations of GPU
simulations and operating systems. GPUs may
also be implemented to solve both general
tasks and tasks that require intensive compu-
tations. For instance, GPUs may be used to
increase the performance of AES and RSA en-
cryption algorithms. Similarly, GPUs can be
implemented to accelerate routers to support IP
networks [4]. GPUs may also aid in the estab-
ISBN: 978-1-941968-46-8
lishment of high-speed intrusion detection sys-
tems (IDSs). Researchers in [4], aimed at eval-
uating the potential risks associated with GPUs
and, more specifically, how attackers are ca-
pable of disclosing sensitive data stored in the
GPUs memory. While performing an in-depth
analysis on GPUs to detect security
3 susceptibilities, the authors discovered that
extensively used GPUs, namely NVIDIA’s and
AMD’s, fail to initialize recently allotted GPU
memory pages that are likely to contain deli-
cate user data. This vulnerability may then be
exploited through attack strategies so that the
program data belonging to the victim can be
revealed, particularly information stored in the
GPUs memory. Such exploitations may hap-
pen both during the execution of a program
and after its termination. The greatest num-
ber of these attacks targeted the Chrome and
Firefox web browsers that render web pages
through the GPU. The research also indicated
that, regardless of their wide application in the
computing industry, the security issues associ-
ated with GPUs have not been given the neces-
sary consideration [4]. Random Access Mem-
ory (RAM) analysis is similar to the foren-
sic analysis of GPUs, however, it is concerned
with analyzing volatile information from the
RAM relating to executable applications, net-
work links, as well as the command history
[2]. Like GPU forensics, memory forensics
is affected by the fact that RAM, being a
volatile memory, loses data immediately when
the power is interrupted. However, under cer-
tain favorable conditions such as uninterrupted
power and the computer not being locked, a
forensic investigation of the RAM can still be
conducted within a particular time frame and
using specialized tools. The forensic analy-
sis of RAM may require copying the RAM’s
contents to perform a comprehensive analysis
of the memory dump, while in other cases it
requires the retrieval of Unicode string con-
tent or ASCII [6]. The authors of [7], con-
ducted three experiments, the Color Test, the
Line Test, and the Color Map Pattern Test,
respectively, to explore the formatting pattern
of images. The Color Test, in which differ-
13
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
ent data were introduced onto the screen, was
aimed at exploring the data structures of col-
ors within the GPUs memory. The evidence
was then collected from the GPUs memory
with the help of an enhanced model. The re-
searcher then created eight different color rep-
resentation squares using Photoshop to prepare
the evidence. The squares were given individ-
ual values such as 000000, 00FF00, FFFF00,
among others. After the analysis of the data
structures and the deletion of empty memory
spaces, the researcher successfully recovered
the photo [7]. The limitations of this paper
are that the author only tested one image size,
which is 200x200 pixels, and used CUDA,
which is limited to NVIDIA GPUs. To im-
prove upon these results, our paper will test
different image formats in different sizes using
OpenCL, which is supported by multiple GPUs
such as AMD, Intel, and NVIDIA.
2.1 Open Computing Language (OpenCL)
OpenCL is a framework used to write pro-
grams through its execution across diverse
platforms containing CPUs, GPUs, and other
processors [3]. OpenCL offers several distinct
advantages as compared to CUDA. For ex-
ample, the mathematical precision in OpenCL
is well-defined, whereas in CUDA it is un-
defined. Furthermore, while OpenCL is sup-
ported by many GPU vendors such as AMD,
Intel, and NVIDIA, CUDA is only supported
by NVIDIA. And lastly, OpenCL provides
CPU support, while CUDA doesnt. OpenCl
contains certain specific functions that sup-
port the execution of commands. These ser-
vices are necessary for the data transfer be-
tween the buffer objects and the host mem-
ory. The clEnqueueReadBuffer enqueues com-
mands to read from, or write to, a buffer object
to the host memory, while the clCreateBuffer
is used to create the buffer object also from
the host memory [3]. Both functions, there-
fore, puts the reading’ and writing’ command
queue and therefore, they are commanded prin-
cipal objects. The clEnqueueReadBuffer helps
in the data transfer from the buffer object to
host memory whereas the writing occurs from
ISBN: 978-1-941968-46-8
the host memory to the buffer. The reading of
data by the clEnqueueReadBuffer requires an
allocated area of the memory for the data stor-
age, because the function cannot perform the
memory allocation by itself.
3 METHODOLOGY
The methodology used for this experiment was
built on the workflow defined by [7]. The de-
sign process consists of three stages. Stage 1
is to acquire potential unique pixel patterns by
first cleaning the GPUs global memory, fol-
lowed by computing conversion matrices be-
tween the image and the data retrieved from
the GPUs global memory. Stage 2 simulates
the live capture process with the assumption of
no noise. The images to be tested were loaded
onto the GPU and then captured as a mem-
ory dump, which are then restored to possible
graphics by applying the unique patterns gen-
erated in Stage 1. In Stage 3, if the method
is efficient, one of the recovered images will
be found visually identical to the image previ-
ously loaded onto the GPU in Stage 2.
Figure 1. Design process.
The experiment tests three image formats in
three different sizes. The image formats that
will be tested are JPEG, TIFF, and BMP. The
image sizes that will be tested are 64x64 pix-
els, 100x100 pixels, and 200x200 pixels. Since
memory allocation is difficult to predict, we
first clean the memory in Stage 1 and Stage 2
in an attempt to ease the process of locating the
dump data of the processed image.
3.1 Generating Patterns
The first step in this experiment is to generate
patterns which later will be used to recover any
image of the same size as the generated pattern.
14
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

Table 1. Total number of an identified patterns per im-

age.

Image size Generated patterns Unique patterns found

64x64 20 2
100x100 35 4
200x200 45 9

Figure 2. Color map image for sizes 64x64, 100x100,

and 200x200. 3.2 Data collection

To validate whether the generated pixel pat-

We generate a color map image for each im- terns can recover images of the same size, it
age size as shown in Figure 2. The color map was necessary to first perform a test with a ran-
images were created using Adobe Photoshop dom image. For this study, a random image
and each pixel of the image has a unique color. was opened and then closed in Windows Photo
The purpose of generating these color map im- Viewer. We chose this program because it uses
ages is to create a set of pixel patterns that we the GPU, supports many image file formats,
can later use to recover the test image. To ease and is one of the most commonly used image
the process of recovering the dump data of the viewer applications. After loading the image
image, we cleaned the global memory of the into the GPUs memory, we used the OpenCL
GPU using OpenCL. The color map image was functions clEnqueueReadBuffer and clCreate-
processed through the GPU by simply open- Buffer, to recover the dump data of the random
ing and closing the image in Windows Photo image.
Viewer. Then, the dump data of the processed
color map image was recovered from the GPU
using OpenCL. Once the color map image is
processed and the dump data of the color map
image is collected multiple times, a set of pixel
patterns will be ready to recover any image of
the same size. For this experiment, the image
sizes were 64x64, 100x100, and 200x200 pix-
els.

Figure 3. Pixel patterns for 100x100 image. Figure 4. Recovered dump data.

Figure 3 shows the unique patterns that were

recovered by processing the color map im-
age multiple times. The same experiment is
repeated with a 200x200 pixel image and a
64x64 pixel image. Table 1 shows and the
number of unique patterns found for each size.
The above image shows an example of dump
data that represents a 100x100 pixel image
which can be used later to recover the image in
its original shape. The offset 8A40000 marks
the start of the image.

ISBN: 978-1-941968-46-8 15
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
Figure 5. Noise removal.
Noise removal is a critical step in the process
of recovering images from the GPU. The high-
lighted part above shows noise that needs to
be removed to successfully recover the image.
Other noise that needs to be removed is the fol-
lowing:
1. rows with all 00
2. rows with all FF
3. FA F3 EE FF FA F3 EE FF FA F3 EE FF
FA F3 EE FF
4. FA F3 EE FF FA F3 EE FF 00 00 00 00
00 00 00 00
3.3 Image and webpage recovery process
After recovering the pixel patterns shown in
Section 3.1 and setting the stage to recover the
image, the patterns that store the image data
were used to map the recovered image to its
original state.
Figure 6. Image recovery process.
The patterns generated in Section 3.1 show the
structure of the image in the GPU. Processing
the color map image multiple times will yield
different pixel combinations. To successfully
recover a random image, we use the generated
ISBN: 978-1-941968-46-8
patterns to find the correct combination of pix-
els that matches the random image that was
processed by the GPU. It should be noted that
[7] invented the technique of Pattern mapping,
and this paper enhanced it to support different
types of images and sizes as well as webpages.
Figure 7. Webpage recovery process.
Since there is no way to know the resolu-
tion of the image we want to recover, we as-
sumed that its size is 1024x1024 pixels. The
GPU used for this experiment was a GTS450
from the NVIDIA Fermi family. It has high-
performance capabilities, with a 2x ability and
DirectX 11 geometry processing power, and a
maximum memory size of 1,024 MB [5].
3.4 GPUs and drivers test
A test for multiple drivers will be conducted to
test the effects of different GPU drivers on the
Graphics recovery process. According to [9],
the driver of the GPU plays an essential role
in accessing the GPU. Therefore, several GPU
types will be tested to understand which GPUs
support the proposed method and which do not.
3.5 Operating System test
The OS is one of the major factors that influ-
ence the process of recovering graphics from
GPUs. The aim of the OS test is to measure
the influence of the different operating systems
on the recovery process. For this study, the
16
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

NVIDIA GPU GTS450 was tested on three op- based on the results in Figure 8, there is not one
erating systems: Windows 7, Windows 8, and specific pattern for each image size, but rather
Windows 10. a set of unique patterns. As shown in Figure
8, the recovered images shift between the four
4 RESULTS unique patterns generated in Section 3.1. All
ten images tested were recovered successfully
The results of the experiments conducted in
using just four patterns for the 100x100 pixel
Section 3 will be evaluated and discussed in the
image. For the 64x64 pixel image, two unique
following subsections.
patterns were discovered, and all the ten dif-
4.1 Image recovery results ferent images tested match those two unique
patterns as shown in Figure 9.
Several images with different sizes and formats
were tested in this paper. In order to ensure
the accuracy of the results, we tested ten dif-
ferent images for each size to determine if the
generated unique pixel patterns are enough to
recover the image of the same size or not.
Table 2. The successful results of the image recovery
process .
Figure 9. Unique patterns for 64x64 pixel image.
Image size JPEG BMP TIFF
64x64 4 3 3
When testing larger images, the number of pat-
100x100 4 3 3
200x200 4 3 3 terns increased as shown in table 1.

Table 2 shows the number and the type of the

successfully recovered images. It can be ob-
served from the experiment that the patterns
generated in Section 3.1 were enough to re-
cover the images of the same size.

Figure 10. 200x200 image results.

The successful pixel pattern for figure 10 im-

Figure 8. 100x100 image results.
[7] indicated that his experiment was looking
for a single correct pixel pattern. However,
age was pattern 2. It is important to note that
using different GPUs could result in differ-
ent pixel pattern combinations and could yield
both more or less number of unique patterns
for each image size. The Color Map images
that were used to generate the pixel patterns
in Section 3.1 are in the TIFF format. Using
these patterns, we were able to recover JPEG
and BMP images from a pattern that was orig-
inally generated from a TIFF image. Thus, we

ISBN: 978-1-941968-46-8 17
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
conclude that the image format does not influ-
ence the recovery process.
4.2 Webpage recovery
The webpage recovery process followed the
same approach as recovering the images from
the GPU, except this time our aim was to test
the possibility of recovering artifacts of the
last visited webpages. The browser used for
this experiment is Google Chrome, and we
edited the NVIDIA control panel to enable the
GPU to operate whenever the user uses Google
Chrome. This was necessary because, by de-
fault, when visiting websites, the GPU will not
work unless a web extension requires GPU in-
volvement.
Figure 11. Tested Facebook webpage on the left, and
the recovered artifacts on the right.
We opened a Facebook account page to test
the possibility of recovering any artifacts from
the GPU after visiting the webpage. About 40
percent of the webpage content was recovered
successfully and with high legibility, although
other parts of the recovered webpage, about 60
percent, cannot be read or recognized. In a case
where a suspect is under investigation, recover-
ing 40percent of the last visited page has good
potential for solving the case, e.g. in the case
of recovering illicit content from the suspects
machine.
4.3 GPU and driver results
Several GPUs and drivers were tested to gain
a proper understanding of which GPUs and
drivers support the graphics recovery process
and which do not.
Table 3 shows the GPUs and the drivers that
did not support the graphics recovery process.
ISBN: 978-1-941968-46-8
Table 3. Unsuccessful recovery attempts.
GPU GPU Drivers
AMD Radeon HD 6770 15.7, 14.12, 14.4, 12.1, 13.1, 13.4 amd catalyst
GTX560M 378.49, 353.9
GTX960M All drivers from 341.81 notebook win10 64bit international To 359.06
In these cases, every time OpenCL tried to
collect the dump data, the dump file returned
blocks of only zeros, indicating that those sec-
tions did not contain any data. To overcome
this barrier, [7] used the driver 340.34 which
supports the methods presented in this paper.
Table 4. Successful recovery attempts.
GPU GPU Drivers
GTX560M 340.43
GTS450 340.62
Drivers 340.43 for the GTX560M GPU and
340.62 for the GTS450 support the method
presented in this paper. All beta drivers of
NVIDIA for Windows 7 and Windows 8 sup-
port the method introduced in this paper and
allow the data collection process. On the other
hand, it was not possible to recover dump data
from the AMD Radeon GPU as the return
value of the dump file is zero.
4.4 Operating system (OS) results
Several OSs were tested to measure the impact
of using different OSs on the GPU forensics
process introduced in this paper.
Table 5. Operating system test results.
Operating System Same identified patterns? GPU
W indows7 →Windows 7 No GTS450
W indows7 →Windows 8 No GTS450
Windows 10 Couldnt generate any patterns GTX960
The OSs tested were Windows 7, Windows 8,
and Windows 10. The pixel patterns recov-
ered in Section 3.1 were recovered using Win-
dows 7, and once the system was upgraded
to Windows 8 the combination of the patterns
changed. Therefore, new patterns had to be
generated in order to successfully recover the
tested image. The recovery attempt on Win-
dows 10 was not successful because the new
OS supports only the latest drivers, which, as
indicated in Section 4.2, do not support the
18
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
method introduced in Section 3. The GTS
450 GPU was moved to a new desktop with
the same OS tested in Section 3 (Windows
7), which yielded different patterns than those
generated on the previous desktop.
In conclusion, the only way to generate the cor-
rect set of pixel patterns is using an identical
OS platform and GPU as the ones used for pre-
viously opening the image we want to recover.
In a real setting, it would mean that the investi-
gator needs to clone the suspect storage device,
recover the dump data from the GPU and then
generate the set of patterns needed to recover
the processed images. The only obstacle would
be locating the dump data that is linked to the
processed image. In this experiment, this issue
has been tackled by first cleaning the memory,
but in a real setting cleaning the memory is not
an option.
4.5 GPU forensics challenges
We considered several factors to determine
their potential influences on the image recov-
ery process introduced in Section 3. It was
observed that the only set of circumstances in
which an investigator can generate the correct
image patterns is when the same OS platform
and GPU are used. Using a different OS or a
different GPU will not help in generating the
correct patterns. In fact, even having the same
OS will not generate the correct patterns. The
limitations to applying forensics to GPU are as
follows:
• In a real setting, the memory cleaning pro-
cess presented in Section 3.1 is the most
obvious barrier, because the investigator
cannot clear the global memory, other-
wise the dump data stored there will be
lost.
• As indicated in Section 4.2, not all drivers
support the forensics process.
• As indicated in section 4.4, the Windows
10 OS didnt support the proposed method,
thus, the pixel patterns could not be iden-
tified.
ISBN: 978-1-941968-46-8
5 CONCLUSIONS
Since the use of digital technology has be-
come an indispensable part of human life, the
need for digital forensics is evident. GPUs
hold valuable data that could very well solve
cases. However, implementing forensics tech-
niques on volatile data and volatile memory
has its own challenges due to the volatility.
This paper discussed a method using OpenCL
to recover graphics content and webpages from
GPUs. During the research, all of the tested
images were recovered successfully using a
set of unique pixel patterns. In sum, it was
observed that the larger the image size, the
more unique pixel patterns there are. Although
the proposed technique could only partially re-
cover the webpage, the recovered data, in this
case, provided enough information to deter-
mine what the user was reading and browsing.
GPUs consist of different types of memories,
and each type of memory holds different types
of data which can be helpful for forensic in-
vestigations. As future work, testing different
types of data other than images and webpages
as well as more AMD GPUs is essential. Once
we have addressed the challenges presented in
this research, the ultimate goal of developing a
forensics model for GPU analysis can be real-
ized.
ACKNOWLEDGEMENT
This project is partially funded by Intel Grant
#21626857.
REFERENCES
[1] Balzarotti, D., Di Pietro, R., and Villani, A.: The
impact of GPU-assisted malware on memory foren-
sics: A case study. Digital Investigation, 14, S16-
S24. (2015).
[2] Garcia, G. L.. Forensic physical memory analy-
sis: an overview of tools and techniques. Paper
presented at Helsinki University of Technology,
Helsinki, Canada. (2007).
[3] Howes, L., and Munshi, A. The OpenCL Specifica-
tion. Khronos Group. (2015).
[4] Lee, S., Kim, Y., Kim, J., and Kim, J. Stealing
19
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

Webpages Rendered on Your Browser by Exploit-

ing GPU Vulnerabilities. 2014 IEEE Symposium on
Security and Privacy. (2014).

[5] NVIDIA. NVIDIA GeForce GTS 450. Retrieved

from http://www.nvidia.co.uk/object/product-
geforce-gts-450-uk.html (2017).

[6] Urrea, J. M. An analysis of Linux RM forensics

(Unpublished master’s thesis). Naval Postgraduate
School, Monterey, CA. (2006).

[7] Zhang, Y. Recovering image data from a GPU using

a forensic sound method. Purdue University, West
Lafayette, Indiana. (2015).

[8] Ladakis, E., Koromilas, L., Vasiliadis, G., Poly-

chronakis, M., and Ioannidis, S. You Can Type, but
You Cant Hide: A Stealthy GPU-based Keylogger.
In 6th European Workshop on System Security (Eu-
roSec). (2013).

[9] In Lin, H.-X, In Alexander, M., In Forsell, M.,

In Knu pfer, A., In Prodan, R., Sousa, L., Streit,
A. Euro-Par 2009 - Parallel Processing Workshops:
HPPC, HeteroPar, PROPER, ROIA, UNICORE,
VHPC, Delft, the Netherlands, August 25-28, 2009,
Revised Selected Papers. (2010).

ISBN: 978-1-941968-46-8 20
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
Common Attributes of Security Breach Types
Jan Svoboda, Luděk Lukáš
Tomas Bata University in Zlín, Czech Republic
j3svoboda@utb.cz
lukas@utb.cz
ABSTRACT
The security breach is the phenomenon when
a detriment affects to reference object. The
reference object is an individual, a legal entity
or a state. The security breach has a typical signs
and these typical signs exactly define the security
breach too. The aim of article is introducing the
main typical attributes of selected parts
(cyberattacks, terrorist attack, leakage
of dangerous substance and blackout). In the last
part of this article is introduced the common
attributes and these common attributes are
together for all the parts of security and they are
really important for critical infrastructure too.
We can suppose than, all new common attributes
can help to find out all options in security
management. New common attributes can help
in risk analysis and security verification too.
KEYWORDS
Attribute, Relevance, Harm, Type, Safety,
Security
1 INTRODUCTION
Many of Scientists work on theory of
security. A security department targets on
question about classification of type security
breach. Many examples of security breach
exist now for example the theft belongs to
physical security, hacker attack belongs to
cyber security and accident belongs to traffic
safety. Many of scientists are analysing
pragmatically type of security breach also we
try to work on theory of security separately
and we are going to try to make the new
classification of the most security breach
types. The classification can target important
attributes of security breach and the
classification can find out new measures. The
measures can influence consequences of
ISBN: 978-1-941968-46-8
security breach. We suppose that we can
solve some security breaches same along
common categories, common types and
common gist. For first we need to identify the
most important attributes of security breach
types and then we are going to try to make
new classification of security breach.
A security breach is a phenomenon when the
selected object is directly at risk, or the
selected object was already at risk. Risk
means risk at life, health, property or
environment. The attributes collection was
made comparative method of selected security
breach types. The analysis contained selected
types of security breach. The types of security
breach are selected from cyber security
(cyber-attack), protection of public order
(terrorist attack), industrial safety (leakage of
dangerous substance), and energy security
(blackout). The common attributes were
obtained generalization of typical attributes of
selected security breach types.
The level of general security is increased the
needs and the development of the current
society. The security requirements are
increasing according to globalization,
technological progress and technological
dependence of society. The function of
critical infrastructure is basic and important
part of society system and this function
secures elementary living needs. Main role of
function is not substitutable, and in short time
horizon is irreplaceable too. It can be assumed
that, the level of security is influenced
relationship between general security and an
element of critical infrastructure and this
relationship is created to the quality of the
general security and quality of the security
education and the security knowledge.
21
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
2 THE ATTRIBUTES OF SECURITY
BREACH
The selection of security breach was
conceived by number of occurrences in the
society and according to dangerous of
security breach. The elements of the energy
industry, chemical industry, public
administration and communication and
information technologies belong to critical
infrastructure. As mentioned above, the
research common attributes is targeted to
long-term blackout, terrorist attack, leakage of
dangerous chemicals and cyber-attack. If we
want to research all typical attributes so we
have to target to common signs. The common
signs reveal attributes of security breach
types.
2.1 Blackout
Blackout is the phenomenon 21st century.
This threat increase technological dependence
and technological progress of the society.
Currently the electrical energy is used as
easy-transform energy to mechanical energy,
thermal energy and light energy. The
electrical energy belongs to a large of number
manufacturing processes and this energy is
used as a signal in communication and
information systems. The blackout usually
means stop of heavy current systems but it
means stop of control and information
systems too. This is main reason why this
department belong between secure parts of
critical infrastructure. The main blackout
attributes are:
 Speed of blackout;
 Range of blackout;
 Time of blackout;
The range of Blackout can be assumed to
range from an object (building, area) to a
region (state, country). The border of the
Blackout time cannot be supposed, there are
many cases which lasted few days and a few
weeks too. It can be assumed that when the
blackout will be caused by other different
threat (war, civil war) so the time of blackout
ISBN: 978-1-941968-46-8
will be same like the primary threat. The
range of blackout together with time of
blackout can be marked like attributes which
influence caused damage.
2.1.1. Main Sign of Blackout
Main sign of the blackout is unavailability
electrical energy and the reason of blackout
point to the relevance and options of
managing extraordinary event. The blackout
can be caused a technical problem in the
production, in the transport network but in the
final user too. The Blackout can be caused a
natural disaster, serious accident but war or
civil ear too.
The time course is another main sing and this
sing influences the level of damage in the
affected area or the region. It can be assumed
that the blackout can cause, but need not
cause the damage if the blackout lasts just
some second. Compared to that the blackout
causes really serious problem when it lasts
some days and weeks because the electrical
energy is really important medical rescue
service, water management, traffic,
communication and security.
Restriction of activities and services depends
on technological dependence and
technological progress of the society in the
blackout area. The technological dependence
is understood the society addict to electrical
energy because this energy is necessary for
work and interest activities and other daily
life. When the society in not ready for
blackout, so the blackout can be caused
serious restriction of activities.
Potential damage responds with the affect
area, the time of blackout, the technological
dependence and the level of security
environment. The damages are determined for
each object differently. The personal damage
is calculated along the damage of property
and damage of health. Currently damage in
the company or another the legal entity is
calculated from damage of property and loss
of profits. The damage in the state, the
22
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
country or the region is calculated differently
thus this damage is calculated according to
the GDP decline or like loss of income tax
and the paid work.
Potential relevance of the blackout is formed
threat for the critical infrastructure system and
so for the society. The level of potential
relevance can be determined number of forces
and resources (Integrated Rescue System) for
crisis resolution.
2.1 Leakage of Dangerous Substance
The leakage of dangerous substance is really
serious threat for society. The leakage of
dangerous substance means phenomenon
when the dangerous substance (flammable,
explosive, toxic, radioactive and corrosive
substance) escapes into the environment
which is not determined to storage, transport,
and processing. The dangerous substance is
used in most of part of industrial processing.
The most of leakage of dangerous substance
so can be cause really serious damage. The
main leakage of dangerous substance
attributes are:
 The level of chemical hazard;
 The amount of dangerous substance;
 The time of occurrence of the substance in
the environment;
The leakage of dangerous substance presents
main threat for occurrence of health damage,
death, property damage and damage of
environment. The leakage is consequence of
security breach in the processing, distribution,
or transfer of dangerous substance. All three
attributes are in common relations ever.
2.2.1 Main Sign of the Leakage of
Dangerous Substance
The Leakage is definitely a main sign. Main
factors of leakage of dangerous substance are
attributes of dangerous substance and amount
of dangerous substance. Next accompanying
factors are speed of leakage of dangerous
ISBN: 978-1-941968-46-8
substance (immediate, long-term) and
protection of environmental resistance.
The damage is connected with every leakage
of dangerous substance. The damage can be
divided into the potential damage and the real
damage. The potential damage is caused by
failure to solve the security breach (maximum
damage) and real damage is caused by
relationship between leakage of dangerous
substance and working integrated rescue
systems (rescue and disposal work).
The contamination of place dangerous
substance leakage appears with every leakage
of dangerous substance. The contamination is
phenomenon which can be solved by rescue
and disposal working. The contamination
sometimes can be so low that the dangerous is
negligible for society, but exist the
contaminations too which are enormous and
global and despite are negligible for global
society too.
Relevance of the leakage of dangerous
substance is formed threat for the critical
infrastructure system and so for the society.
The level of potential relevance can be
determined number of forces and resources
(Integrated Rescue System) for crisis
resolution.
2.3 Terrorist Attack
The terrorist attack is really specific act. The
target of act is intimidation and influence
target society. The basic characteristic of
terrorism is committing terror. Reason of
terror is enforcement own ideas, culture,
religions and profit too. The main terrorist
attack attributes are:
 Destruction;
 Spreading fear;
 Addressing the widest circle of people;
 Deviation of the personality of the
attacker (terrorists);
Currently the number of terrorist attack is
increased and the purpose of increasing is
23
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
globalization, economic policy of major
states, international armed conflicts,
suppressing religion or political interests of
major states.
2.3.1 Main Sign of Terrorist attack
Keeping an attack is first and main sign of
terrorist attack. The attack can be defined by
target of attacker. The target of attack is
enforcement own ideas, attention and
intimidation. The attack on life and health is
only the instrument to attainment of target.
The attack can be defined by method of
execution and the method of execution is
influenced by organizational and financial
possibilities terrorist organization or other
society.
Attacker personality is perceived by the dual
way. The attacker is perceived like individual
person, like evil, or someone who caused
whole situation. The “target society” difficult
understands global reasons of terrorism and
own fault, but in the attacker society is the
attacker a hero and someone who sacrificed
himself.
The target of terrorist attack is enforcement
own ideas, intimidation, culture, religions and
profit too.
The damage can be defined like secondary
target of attacker. The secondary target causes
enormous damage of health, death and
environment. The primary target is
enforcement own ideas.
The illegality belongs to every terrorists
attack in every society. Illegality is defined in
the rule of law and this means that, the
illegality is defined by danger for society and
legal punishment. In fact any activities belong
to preparation of terrorist attack is illegal and
is affected by the law.
Relevance of the terrorist attack is formed
threat for the critical infrastructure system and
so for the society. The level of potential
ISBN: 978-1-941968-46-8
relevance can be determined by damage of
health, death and environment.
2.4 Cyber-attack
Cyber-attack is the phenomenon which
appears every day and maybe every minute.
Cyber-attack is activity and this activity
usually does someone or group of people.
This people use own knowledge or special
software (malware, rootkit) and they reason is
stealing information, new advantage for them
of someone else, domination, causing damage
and interrupting of functionality or
destruction of the target. Currently the cyber-
attack is really serious threat and the most
dangerous attack is a ransomware. The
ransomware encrypts victim’s data. The
attacker can blackmail victim because the
victim can have own data back only for
money. The main cyber-attack attributes are:
 Profit or advantage;
 Hidden identity of attacker;
 Controlling targets or monitoring targets;
2.4.1 Main Sign of Cyber-attack
Performing an attack is a basic sign of cyber-
attack. The target of attack is controlling
victim’s information system. And the reason
of cyber-attack is stealing new information,
causing damage and interrupting of
functionality or destruction of the target. The
next target can be monitoring victim’s
information system and so searching some
information too.
The attacker’s identity is hidden and
everything what he is doing is illegal. The
attacker can be one person but he can be
person who works for some group of people
or for some company or for some state
service. The attacker can be more than one
person too. The level of attack is influenced to
knowledge, experience and next possibilities
of the attacker. There are two types of cyber-
attack. First type of attack is use a social
engineering. Second type of attack is attack
24
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
when someone uses the knowledge of IT or
software engineering.
The target of cyber-attack is the profit or the
advantage for the attacker. The attacker can
sell stealing data or he can use your new
advantage. The second possibility is using
cyber-attack for causing damage. The second
possibility means that the attack can cause
interrupting of functionality or destruction of
the target.
The damage can be defined like loss of profit,
price of steal data, response and recovery
costs and next cost. Firstly the damage is
direct and the damage afflicts a person or a
company when the damage is caused to
directly the target. Secondly the damage is
indirect and the damage afflicts the people
whose are not the target. It means the people
are customers of company and this company
is the target of cyber-attack.
The illegality belongs to every cyber-attack in
every society. Illegality is defined in the rule
of law and this means that, the illegality is
defined by danger for society and legal
punishment. In fact any activities belong to
preparation of terrorist attack is illegal and is
affected by the law.
Relevance of the terrorist attack is formed
threat for the critical infrastructure system and
so for the society. The level of potential
relevance can be determined by damage of
health, death and environment.
3 THE COMMON ATTRIBUTES OF
SECURITY BREACH
There were defined six basic common
attributes of security breach from the analysis.
The purpose of research is search of common
attributes and the purpose of research is work
with common attributes too. We can be
assumed that we can make an instrument or
an application which will be able to determine
the right advance of risk analysis for a
ISBN: 978-1-941968-46-8
universal asset. We suppose that it is the right
way to maximal protection.
3.1 Common Attributes
 The type of security breach (cause,
department, area of the emergence);
 The time course of security breach
(immediate change, slow, fast and gradual
development);
 The range of (point, area);
 The direction of security breach
(unidirectional, bidirectional)
 The size of security breach (the level of
threat)
 The impact to a reference object (the
damage, life, health, property and
environment);
4 USE OF SECURITY BREACH
TYPOLOGY IN PRACTICE
Formation of common attributes introduces
the basic for new typology security breach.
The new typology can classify security
breach. The new typology can:
 The system view to security breach, easy
analysis of new types of security breach;
 Assessment by attributes of types of
security breach;
 The monitoring of new trends of new
types of security breach;
 The generalization of same types of
security breach;
 The transfer protection from same types
security breach to new types of security
breach;
 The improving prevention like the base
system to minimalize of number of
security breach;
If new types of security are detected, so we
can do some new analysis of security breach
with using all attributes and signs. We can do
the transfer all ways to protection from exist
types of security.
25
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

5 THE CONCLUSION

It is found out that the terrorist attack and

cyber-attack have a similar attributes and
signs and the leakage of dangerous substance
and the blackout have similar attributes and
signs too. New common attributes of security
breach define the general development of
security breach. The relevance like common
attribute exists only for strategic object. The
strategic object can be the element of crisis
infrastructure.

Next step will be analysing new attribute and

we going to research any possibilities for
creating new typology of security breach.

If we can create new typology of security

breach so we can suppose that all information
can be used to creating new methodology for
risk analysis, because risk analysis is main
part of risk management.

REFERENCES

[1] L. Hofreiter, “Bezpečnostné prostredie súčasného

sveta,” Radim Bačuvčík - VeRBuM, Zlín 2016.

[2] L. Lukáš, “Bezpečnostní technologie, systémy a

management,” Radim Bačuvčík – VeRBuM, Zlín
2015.

[3] D. Cooke, “Energy Market Experience Learning

from the Blackouts Transmission System Security
in Competitive Electricity Markets,” International
Energy Agency, Paris: OECD, 2005.

[4] O. Filipec, „Fenomén terorismus: česká

perspektiva,“ Olomouc: Univerzita Palackého
v Olomouci, 2017.

[5] L. Polívka, O. J. Mika, J. Sabol, „Nebezpečné

chemické látky a průmyslové havárie,“ Praha:
Policejní akademie České republiky v Praze,
2017.

[6] R. Jašek, D. Malaník, „Bezpečnost informačních

systémů,“ Zlín: Univerzita Tomáše Bati ve Zlíně,
2013.

ISBN: 978-1-941968-46-8 26
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

The Strategy of Brazilian Government to Improve the Information Security

Risk Management and the Cyber Security in Brazilian Public Sector

Anderson Araújo, Loriza Melo, Luiz Henrique Andrade, Jansen Fonseca, José Ney Lima, Juliana
Moreira, Rodrigo Maeda, Tássio Silva

Ministry of Planning, Development and Management

Secretariat of Information and Communication Technology
Presidency Of The Republic
Information Technology National Institute
Brasília-DF / Brazil

anderson.araujo@iti.gov.br; {loriza.melo, luiz.sandrade, jansen.fonseca, joseney.lima,

juliana.m.moreira, rodrigo.maeda, tassio.silva}@planejamento.gov.br

ABSTRACT threaten sovereignty, individual rights and

This paper presents the Strategy of Brazilian
Government to improve the Information Security
Risk Management and the Cyber Security in
Brazilian Public Sector (BPS). It presents the
Information Security Risk Management
Methodology for the BPS and its support tool,
based on best practices consolidated in
international standards and considering the needs
identified within the Brazilian public agencies.
This initiative aims to bring a greater level of
protection to Information Assets and Information
and Communication Technologies in the scope of
Brazilian Public Sector. It also aims to create a
risk management culture within the BPS and
optimize investments in Information Security and
Cyber Security.
KEYWORDS
Risk Management, Information Security, Cyber
Security, Public Sector.
1 INTRODUCTION
privacy.
Surveys carried out in Brazilian public
agencies [1] suggest that, even with important
initiatives came out by the Brazilian
government over the last 15 years [2], there is
a need for strategic action to improve
information security and cyber security within
the Brazilian public sector.
This context led to the elaboration of an
Information Security Risk Management
Methodology and its Support Tool available
for all Brazilian public agencies. The main
goal is to systematize risk management in
order to provide objective information that
makes threat identification more effective and
guides the adoption of cost-effective controls.
Other goal is to disseminate a culture of risk
management in BPS. It aims at a practical
approach that leads to a higher level of
protection of Information Assets and
Information and Communication
Technologies (ICT) in the scope of BPS.

In the scope of the Brazilian Public Sector 2 RELATED INITIATIVES

(BPS), the maturity level of Information
Security (IS) and Cyber Security is very
important to guarantee the provision of
services to the Brazilian society, especially in
critical sectors such as energy, transportation,
telecommunications and finance.
Furthermore, it helps to prevent acts of
espionage, terrorism, fraud and crime, which
Several guidelines for the improvement of IS
and Cyber Security, in the scope of the BPS,
can be identified, such as the Brazilian
Information Access Law, which establishes a
differential treatment for classified
information [3]. Also noteworthy is the
framework published by the Institutional

ISBN: 978-1-941968-46-8 27
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
Security Office of the Presidency of the
Federative Republic of Brazil (GSI/PR) in
recent years, highlighting the regulation [4]. It
presents guidelines for Information Security
Management. The regulation [04] sets the
process of Information Security Risk
Management for the BPS.
Information Security Risk Management
(ISRM) is recognized as an effective way to
deal with IS issues systematically and focused
on optimizing and prioritizing investments.
The standard [5] presents an approach to
establish, implement, operate, critically
analyze, maintain, improve and monitor an IS
Management System. A critical element
identified is the need for a model for risk
analysis, assessment and acceptance. This
point is addressed by the standard [6].
Another initiative related to the IS Risk
Management Methodology and a Support
Tool is the IT-Grundschutz methodology [7],
developed by the German Information
Security Agency (BSI), which establishes an
IS Management System that aims to "achieve
and maintain an appropriate level of
Information Security".
In addition, the importance of the National
Institute of Standards and Technology (NIST)
approach [8], an agency of the United States
Department of Commerce, which integrates
best risk management practices in ICT,
complemented by [9] which presents a guide
for conducting the risk assessment activity. As
a highlight, we have the abstraction of layers
to address risks presented in Figure 1.
Figure 1. set of layers to address risks
ISBN: 978-1-941968-46-8
3 THE STRATEGY OF BRAZILIAN
GOVERNMENT TO IMPROVE THE
INFORMATION SECURITY RISK
MANAGEMENT IN BRAZILIAN
PUBLIC SECTOR.
In order to guarantee the provision of services
to citizens and organizations, especially in
critical sectors such as energy, transportation,
telecommunications and finance, preventing
acts of espionage, terrorism, fraud and crime,
which threaten sovereignty, individual rights
and privacy, the Brazilian Government
decided to standardize the procedures to deal
with information security risks (MGR-SISP)
applicable to all Brazilian public agencies: the
Information Security Risk Management
Methodology (MGR-SISP).
In addition, this strategy include to provide,
for all Brazilian public agencies, a cloud
computing service (FAMGR-SISP), in order
to make threats identification more effective
and guides the adoption of cost-effective
controls, helping the Brazilian public agencies
to reach a higher level of protection of your
Information Assets and Information and
Communication Technologies (ICT): the
Support Tool for the MGR-SISP (FAMGR-
SISP).
The following is a brief presentation of the
MGR-SISP its Support Tool (FAMGR-SISP).
3.1 Structuring and Representation
The MGR-SISP is composed of processes,
which in turn are decomposed into activities,
and these into tasks. The processes are
associated with specific partial objectives
related to risk management and they are
defined based on the main phases established
in ISO/IEC 27005, 2011 [6].
Each process is characterized by descriptions
and workflow diagrams. Each activity (of
each process) is characterized by the
following elements: name; description;
workflow; task description and their
responsible role; condition to be fulfilled;
information used; information produced;
condition to be completed; templates and
examples.
28
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
The MGR-SISP processes and activities
generate information that must be evaluated
and validated (usually by a role at a higher
risk management level) at the end of the
process or activity. Repetitions of information
and decision-making activities are also
foreseen, as are repetitions of processes where
information is inadequate or insufficient for
support decision-making.
The MGR-SISP also establishes roles (actors),
according to the idea described in NIST 800-
39, 2011 [8], actions and responsibilities at all
levels of the organization, namely: i)
Representatives of the High Administration;
ii) Risk Managers; iii) Responsible for
Organizational Units; And iv) Asset Owners.
3.2 Processes and Activities
Figure 2 shows the workflow of the MGR-
SISP processes. The processes and activities,
described briefly below, are carried out with
the support of FAMGR-SISP.
Figure 2. workflow of the MGR-SISP
Context Establishment (CE)
This process addresses the points to be
defined for the beginning of the use of MGR-
SISP and FAMGR-SISP in the organization.
The main activities and tasks are:
• To define roles, responsibilities and to
allocate human resources.
• To define goals to ISRM, scope, and
constraints.
• To conduct pre-analysis of the
organization. It is the application of an
evaluation questionnaire based on the
Safety Level Assessment Method [10].
• To carry out pre-analysis of
organizational units. It is also the
application of an evaluation
questionnaire in each unit (sector).
The goal is to evaluate the critical
ISBN: 978-1-941968-46-8
level of its primary assets (business
processes and information) related to
attributes: Confidentiality; Integrity;
Availability; And Authenticity on a
scale between 1 and 5.
• To define criteria. It defines support
questions that guide the evaluations to
be carried out in later activities, in
which the consequences and
probabilities of risks are identified in 5
classes (according to NIST 800-30,
2011) [9]:
1 Very Low VL
2 Low L
3 Moderate M
4 High H
5 Very High VH
The information generated by this process is
the basis for all subsequent actions.
Risk Identification (RI)
This process identifies the existing risks and
the adequacy of the controls used by each
organizational unit. It gets several information
(simultaneously and independently) which are
validated by the Risk Manager.
The heads of each organizational unit (and/or
asset owners) must identify and document the
assets (business processes, hardware,
software, physical locations, etc.) and their
related information. FAMGR-SISP filters,
from a generic list of threats, those that apply
to each type of asset in order to facilitate the
identification and description of threats
associated with the assets. Similarly, for each
threat, FAMGR-SISP filters, from a generic
list of controls, those that protect the asset
from the threat. The status of each control
should be investigated, documented, and
evaluated as follows: not implemented,
implemented, or not applicable. Finally, for
each non implemented control, FAMGR-SISP
filters from a generic list of vulnerabilities
those related to the lack of controls for the
threats to the assets, also assisting in the
identification and documentation of
vulnerabilities. All the information is
consolidated in a Risk Map.
29
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

Risk Analysis (RA)
This process estimates each identified risk
and must be performed in each organization
unity. It is possible to be executed
simultaneously and independently too.
It begins with the identification and
evaluation of possible risk consequences. For
each asset and threat (a risk), the FAMGR-
SISP presents registered support questions, so
that the responsible one can estimate the
consequence of the risk for each attribute
(Confidentiality, Integrity, Availability and
Authenticity), associating it in a class (VL, L,
M, H, VH). The same is true for probability
estimation, by associating risk with one of the
classes (VL, L, M, H, VH). The consequences
of the risks and the justifications for the
estimates should be documented. Based on
the estimates made, the FAMGR-SISP
generates (by applying a consequence-
probability matrix) the estimate of the level
(numerical value between 1 and 9) and the
class (VL, L, M, H, or VH) for each risk.
Estimates are generated separately in each
unit of the organization.
The Risk Map is updated by associating one
level for each risk (threat to asset).
Risk Evaluation (RE) and Risk Treatment
(RT)
In these processes the risks are evaluated and
treated. The risk consolidation of all the
organizational units is made in a single Risk
Map, which presents all risks, sorted by level,
in a decreasing way. At this point, it is
decided to return to previous processes for
more information or to refine them.
All information is used to make decisions
about how to treat each risk: reduce, retain,
The consolidated and ordered Risk Map with
risk treatment options and respective
estimates is used to make decisions about the
treatments to be performed. Decisions should
be documented, as well as the way to
monitoring the risks. Finally, Risk
Management Plans (RMP) should be
developed and allocated to a role.
Risk Communication (RC) and Risk
Monitoring (MR)
These processes address communication and
monitoring activities, which are embedded in
the other processes and are supported by
FAMGR-SISP too. In addition to these, we
highlight the activities to monitor the
execution status of the RMPs, to monitor the
risks and to identify the need for
reassessments.
4 THE ARCHITECTURE OF THE
FAMGR-SISP
The FAMGR-SISP is a service will be
provided by the cloud computing of the
Secretariat of Information Technology of the
Brazilian Ministry of Planning, Development
and Management. It is available for all
Brazilian Public Agencies, including, as a
future view, public agencies from others
unites of federation, from judicial system and
legislative branch. Figure 3 presents the
architecture of the FAMGR-SISP.
Public
Public
Agencies of
Agencies of
Municipalities
Public ISRM Public
Agencies ofof
Agencies
Agencies of
States ISRM
States ISRM
Judicial
System ISRM

transfer, or avoid. They also allow planning

for future actions. Federal Public FAMGR-
Public
Agencies of
Agencies
For each risk and each treatment alternative, ISRM SISP Legislative
branch ISRM
cost and time estimates should be made, and
possible constraints should be raised. In
particular, for the "reduce risk" option, the Figure 3. architecture of FAMGR-SISP
FAMGR-SISP recovers information on the
controls that are not implemented. Each
control of these represents a treatment option
(the one to implement the control), for which
the estimates must be made.

ISBN: 978-1-941968-46-8 30
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

5 FINAL CONSIDERATIONS 2 – The risk management approach consider

all organizational units or all public agencies
Earlier versions of the MGR-SISP were (integrated approach), or consider only one
evaluated by IS experts and BPS experts, organizational unit or only one public agency
resulting in modifications that led to the (isolated approach).
content described herein. The FAMGR-SISP
is being used in a validation stage, which is a Paper Feature 1 Feature 2
pilot project running in some Brazilian public This paper Public Integrated
agencies.
Vijayakumar, A. N.;
It is important to highlight that several points Nagaraja, N. Internal
of the methodology and the tool were Control Systems:
established in order to meet the needs and Effectiveness of
constraints identified in the BPS, such as: Internal Audit in Risk
Public Isolated
i. compliance with existing laws, Management at Public
Sector Enterprises.
standards and the IS strategy for the BVIMR Management
BPS; Edge. 2012, Vol. 5
ii. flexibility and applicability to Issue 1, p1-8. 8p.
organizations with different needs and Ezeosa Dafikpaku.
realities, leading to the incorporation The Strategic
of pre-analysis for the diagnosis of Implications of
needs; Enterprise Risk
Management:
iii. practicality, since FAMGR-SISP
A Framework. In: Private Integrated
implements the risk list concept, Enterprise Risk
which will serve as a reference for the Management
Republic analysis and treatment of Symposium. Society
risks of the assets, streamlining the of Actuaries, March
14-16, 2011.
processes of Risk Identification and
Risks Analysis. These lists contain the Dong-Young Yoo,
major risks that can affect the assets of Jong-Whoi Shin,
Gang Shin Lee, and
the organization. It lists the key Jae-I Lee. Improve of
elements of risk such as vulnerability, Evaluation Method
threat and control. For each risk, its for Information
impact and probability as well as its Security Levels of
impact related to availability, integrity, CIIP (Critical
Information
confidentiality and authenticity may Infrastructure Public Isolated
also be informed. The list should be Protection).
created by the process experts, system International
or technology experts, so their Scholarly and
analysis and treatment can be Scientific Research &
Innovation 1(12),
performed by any professional, as it 2007, World Academy
will serve as guidelines for the asset. of Science,
Engineering and
In addition, the Table 1 presents a Technology.
comparative analysis with recent research
articles considering the following specific Table 1. Comparative analysis with recent research
articles considering specific features of study
features:
1 – The research consider the risk
management process in public sector or in
private sector?

ISBN: 978-1-941968-46-8 31
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

REFERENCES [11] Brazilian Association of Technical Standards.

[1] BRAZIL, Federal Court of Accounts. “Evaluation
of Information Technology Governance in the
Brazilian Federal Public Administration”.
Avaliação da Governança de Tecnologia da
Informação na Administração Pública Federal.
Brasília: 2012.
[2] BRAZIL, Presidency Of The Republic.
Institutional Security Office. Information Security
and Communications Department. “National
Strategy for Information Security and Cyber
Security in Brazilian federal Public
Administration”. Estratégia de Segurança da
Informação e Comunicações (SIC) e de Segurança
Cibernética da Administração Pública Federal
(APF). Brasília: 2015.
[3] BRAZIL, “Access to Information Law”. Lei de
Acesso à Informação. Brasília: November, 2011.
[4] BRAZIL, Presidency Of The Republic.
Institutional Security Office. Information Security
and Communications Department. Complementary
Regulation NC 04/IN01/DSIC/GSIPR: “Guidelines
for the Information Security and Communications
Risk Management Process for the Federal Public
Administration”. Diretrizes para o processo de
Gestão de Riscos de Segurança da Informação e
Comunic. nos órgãos e entidades da Administração
Pública Federal. Brasília: 2013.
ABNT NBR ISO/IEC 31010 - “Risk Management:
Techniques for the process of risk assessment”.
Gestão de Riscos: Técnicas para o processo de
avaliação de riscos. Rio de Janeiro, 2012.
[12] BRAZIL, Presidency Of The Republic.
Institutional Security Office. Information Security
and Communications Department. Complementary
Regulation NC 02/IN01/DSIC/GSIPR:
“Information and Communications Security
Management Methodology”. Metodologia de
Gestão de Segurança da Informação e
Comunicações, 2008.
[13] BRAZIL, Presidency Of The Republic.
Institutional Security Office. Information Security
and Communications Department. Complementary
Regulation NC 03/IN01/DSIC/GSIPR: “Guidelines
for the Elaboration of Information and
Communication Security Policy in the Federal
Public Administration”. Diretrizes para a
Elaboração de Política de Segurança da
Informação e Comunic. nos Órgãos e Entidades da
Administração Pública Federal, 2009.

[5] Brazilian Association of Technical Standards.

ABNT NBR ISO/IEC 27001 - “Information
Technology, Security Techniques, Information
Security Management Systems, Requirements”.
Tecnologia da informação, Técnicas de Segurança,
Sistemas de Gestão da Segurança da Informação,
Requisitos. Rio de Janeiro, 2013.

[6] Brazilian Association of Technical Standards.

ABNT NBR ISO/IEC 27005 - “Information
Technology, Security Techniques, Information
Security Risk Management”. Tecnologia da
Informação, Técnicas de Segurança, Gestão de
Riscos de Segurança da Informação. Rio de
Janeiro, 2011.

[7] BSI Standard 100-2 - “IT-Grundschutz

Methodology”, Version 2.0, May 2008.

[8] NIST 800-39 – “Managing Information Security

Risk”, 2011. Available at: <http://csrc.nist.gov/publ
ications/nistpubs/800-39/SP800-39-final.pdf>.

[9] NIST 800-30 – “Guide for Conducting Risk

Assessment”, 2011. Available at: <http://csrc.nist.g
ov/publications/nistpubs/800-39/SP800-30final.pd
f>.

[10] Dong-Young Yoo, Jong-Whoi Shin, Gang Shin

Lee, and Jae-I Lee. “Improve of Evaluation
Method for Information Security Levels of CIIP
(Critical Information Infrastructure Protection)”.
International Scholarly and Scientific Research &
Innovation 1(12), 2007, World Academy of
Science, Engineering and Technology.

ISBN: 978-1-941968-46-8 32
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
Project of building Security in Zoological garden
Miroslav Budín
Tomas Bata University in Zlín, Czech Republic
budin@fai.utb.cz
ABSTRACT
The introductory part presents an analysis
of the possibility of physical security
systems. This part is supplemented by
analysis of characteristic properties of
selected objects of zoological garden with
respect to their security. Crucial output of
this work consists the security design object
model, developed on the basis of the
security assessment. The conclusion
provides information about modern
technical devices of security, suitable for
application in zoological garden buildings.
KEYWORDS
zoological garden, security, intrusion alarm
system, animal.
INTRODUCTION
Not all of us realize that zoos are
sanctuaries for endangered species as well
as places to conduct scientific research on
them. Zoos also allow the public to learn
about the wild while relaxing and having a
good time. The rare animal trade is a
serious global problem, and in terms of
smuggling and theft of animals and plants,
Czechs are dishonourably high up in the
notional rankings. Zoos provide the
opportunity for such parties to pursue their
criminal objectives.
The use of technology to secure zoos can
be divided into three categories. Firstly,
zoos naturally attract large numbers of
ISBN: 978-1-941968-46-8
visitors, and that carries the potential for
terrorist attacks. Secondly, zoos frequently
experience theft of rare species for
subsequent sale on the black market.
Finally, zoos store drugs that can be used
to create illegal narcotics.
1. SIGNIFICANCE OF ZOO
SECURITY
From AD 1 until the year 1800, one animal
species went extinct approximately every
55 years. In the 19th century, that interval
decreased drastically to only 18 months,
and since 1900, several species go extinct
every year. [4] In the interest of conserving
animal species for future generations, the
protection of animals is the most important
criteria for the existence of zoos. Zoos
serve as scientific and educational
institutions for breeding animals in
captivity in conditions that resemble as
closely as possible natural life in the wild.
Today, roughly 3% of the planet’s known
animal species are kept in zoos all over the
world.
Zoos are members of various global and
regional organizations, such as WAZA,
EAZA, and others, which provide them
with support in their breeding and
conservation efforts. The primary goal of
these joint activities is the return of
endangered species to the wild and
safeguarding of genetic diversity among
them.
33
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

1.1. Origins of zoos 1.2. List of selected foreign Zoological

The origins of building zoos date to the garden
beginnings of agriculture; however, the There are approximately 2,700 registered
first zoo was built in the middle of the 15 th zoos throughout the world. Half of the ten
century. most important zoos are in Europe.
The discovery of America (12 October  ZOO Linz, 110 different species,
1492) led to important contributions to founded 1964, Wingflachweg 1,
European collections, not only because 4040 Linz [www.zoo-linz.at];
Europeans were seeing many yet unknown  Tiergarten Schönbrunn Wien,
animals that lived on the American 700 different species, founded
continent at the time, they were also 1752, Maxingstraße 13b, 1130
discovering the rare collections of the Wien [www.zooviena.at];
Maya, Inca, and Aztec civilizations.  Attica Zoological Park, 350
th
Between the 16 and 18 centuries, th different species, founded 2000,
animals were being brought to Europe Spata, 190 04 Athens
from all over the world. The most [www.atticapark.com];
important collections of animals were in  ZOO Berlin, 1500 different
Vienna, Paris, and London. By opening species, founded 1844,
these collections to the public for Hardenbergplatz 8, 10787 Berlin
educational and research purposes, the [www.zoo-berlin.de];
foundations for the creation of the modern  ZOO Zürich, 340 different species,
zoo, as we know it today, were laid. founded 1925, Zürichbergstrasse
221, 8044 Zürich [www.zoo.ch];
The 19th century is considered the golden  Parc Zoologique de Paris, 180
age of zoos. In this period, modern zoos different species, founded 1934,
were founded in the form we know to this Parc Zoologique de Paris, 53
day (e.g., Jardin des Plantes in Paris and avenue de Saint Maurice, 75012
Regent’s Park Zoo in London). Natural Paris
history museums and botanical gardens [www.parczoologiquedeparis.fr];
were also gaining in importance. This was
 London ZOO at low Prices, 800
fundamentally driven by the voyages of
different species, founded 1828,
Charles Darwin, who brought back new
Regent`s Park, London, NW1 4RY
specimens of exotic plants and animals
[www.londonpass.com/London-
from all corners of the world. [5] By the
zoo].
end of the 19th century, another 100 zoos
had been established, 18 of which were in 1.3. Legislative reguirements
the United States of America. Previously
The legislative requirements for
unknown regions of the dark continent,
establishing and operating zoos comprise a
South America, and Indonesia were giving
group of regulations relating to animal
up their natural riches for them. The
breeding and the conditions under which
populations of wild animals seemed to be
scientific research is to be carried out. The
invulnerable. Ships and trains provided
second group is the protection of animals,
faster transport, and the captured animals
the establishing of rules international trade,
had a chance of surviving the journey. [1]
and the fight against poaching and
smuggling. The third group consists of
requirements for establishing and operating

ISBN: 978-1-941968-46-8 34
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

premises intended for animal breeding as
well as those intended for zoo operations.
The legislation that governs the operation
of zoos is based on the requirements of the
directives and regulations of the European
Union and the European Commission.
European law is based on the United
Nations Universal Declaration on Animal
Welfare, which was drafted by WSPA, a
global organization for the protection of
animals. The goal of uniform legislation is
to secure adequate protection for animals
not only in countries of the European
Union but also in terms of animal
conservation on the planet. The EU
legislation also creates conditions for
Europe’s zoos to participate in global
animal protection programmes.
Zoos are such complicated facilities that
legislation and normative requirements
from a wide range of fields must be
applied, from zoology to medicine, the
establishment and operation of premises,
and, last but not least, regulations on
science, research, and education.
2. BASIC ASPECTS OF
PHYSICAL SECURITY OF
OBJECTS
Guaranteeing physical security on zoo
premises is a complicated and continuously
evolving process. Zoos are vulnerable to a
wide variety of contemporary threats, such
as terrorist attacks, assault, theft of rare
plants and animals, drugs, and funds,
various activities of sexual deviants, and
misdemeanours, for example
pickpocketing. Modern devices and
methods of physical and electronic
premises security are available to counter
these modern-day threats.
2.1. Regime measures
The purpose of regime measures is to
establish principles, rules, authorization for
the movement of employees and other
persons throughout the zoo premises, the
methods for handling important security
elements, rules for conducting security
checks, etc. [3].
Zoos require establishment of regime
measures for the rules governing:
 movement of zoo employees, part-
time workers, interns, etc;
 movement of visitors, children,
and disabled persons;
 movement of employees of vendor
companies, including movement
of materials, goods, utility
services, etc.;
 zoo employee alcohol and/or drug
testing;
 movement of medical personnel
and accompanying individuals;
 securing the transfer of animals
outside of their pavilions;
 physical security activities;
 provision of regular worker
training;
 safeguarding the operation,
regular inspection, and
maintenance of technological
security devices.
2.2. Physical security
Security guards provide both permanent
and temporary surveillance on zoo
premises. With respect to the character and
operation of such premises, this is a
nonstop, multiple-shift service.
Zoo are also visited in great numbers by
foreign tourists; therefore, it is necessary
that selected security personnel speak at
least one world language, especially
workers providing security at the main
entrance, carpark, certain pavilions, and at
least one member of the field response
team.

ISBN: 978-1-941968-46-8 35
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
2.3. Technological security
Together with physical security, the
components of technological security
represent the basic security measures for
the premises. The objective of
technological components is to support the
implementation of regime measures,
enhance the operations of physical
security, and deter intruders from their
actions or make their actions considerably
more difficult and prolong the amount
required for them to gain access to
protected assets. [3]
The first essential step to creating suitable
measures – and thus achieve the required
state – is to prepare a comprehensive
design for a system of physical security
with multi-stage, automated, and sufficient
breach resistance. In order to accomplish
the required state of physical security, we
must adopt and secure necessary measures,
both from the standpoint of the subsequent
building of a physical security system as
well as providing effective regime
measures.
Signals from alarm systems, electronic fire
signalization, and other systems will be
monitored in the zoo’s surveillance centre.
Integration will be secured by means of
system management software, which will
also make it possible to carry out actions
for other associated systems, such as
control of lighting, heating and/or cooling,
etc. depending on the operating mode.
3. ANALYSIS OF PROPERTIES
OF CHARACTERISTICS OF
ZOO PREMISES WITH
RESPECTS TO SECURITY
POSSIBILITES
Assessing the collective characteristics of
zoo premises will be carried out by means
of analysis of characteristics. The goal of
this analysis is also to extract information
and then obtain realistic data for creating a
ISBN: 978-1-941968-46-8
reference model of the premises of the zoo.
The basis for creating the analysis of the
characteristics of the premises of the zoo
will be the selection of zoos according to
size, specialization, and location
throughout the Czech Republic.
In order to create a model premises for
technological security, we will assess the
aforesaid characteristics data according to
the following parameters:
 the size of the premises and
characteristics of the location;
 number of animals, species,
workers – employees;
 pedestrian and automobile access
points, outer perimeter;
 characteristics of buildings,
premises;
 opening hours.
The selection of criteria for creating a
premises model is only a representative
sample. For future applications, the scope
and number of parameters can be set
according to specific requirements for
technological security. The selection of
criteria must be determined in compliance
with the required degree of technological
security.
Table Nr.1 Resulting analyzes of selected
zoos
The chart of resulting values shows that
the size of the model zoo premises is 40
hectares situated at the edge of a city. The
number of species is 400 of a total number
of 2,200 captive animals. The zoo premises
is cared for by 110 employees. An access
road leads to each zoo to its carpark, which
36
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
is near the main visitor entrance. In
addition to the road, there are also a tourist
path and bike path that lead to the zoo. The
majority of the buildings are brick or
wood. The model zoo premises will also
include buildings with glass walls and
other building materials.
Figure Nr. 1 Comparison of selected zoos
The column graph shows that for the
representative sample from across the
Republic, three larger and three smaller
zoos were chosen. The resulting values
demonstrate that there is no direct
proportionality between the number of
employees, the number of species, and the
total number of individual captive animals.
Figure Nr. 2 Location of selected zoos
The location of the selected sample zoos is
divided equally according to the stipulated
criteria. In general, the selection of locality
for a zoo depends on many factors, but
does not depend on city size. In the case of
the selected samples, there is a zoo situated
near the centre of the largest and smallest
city.
The analysis of the selected zoos
demonstrates that each zoo is unique, thus
the values obtained for creating the
premises model are crucial to the design of
a technological security system. If we
choose entry values for the analysis based
ISBN: 978-1-941968-46-8
on inadequate criteria, the results can have
a negative impact on, for example,
insufficient requirements for the provision
of physical security. The future design of
the technological security system may then
contain weaknesses or even faults.
4. SECURITY ASSESSMENT OF
THE PREMISES MODEL
Security assessment is part of the first
stage of the process of establishing
warning, security, and emergency systems
during which analysis is conducted on
secured values, buildings, and internal and
external influences that might affect the
warning, security, and emergency system.
The main objective of the security
assessment is to determine, based on risk
analysis and assessment of other
influences, the required level of security as
the starting point for designing the system.
[2]
Using the analysis of the characteristics of
the selected zoos in the Czech Republic, a
premises model was created with the
parameters hereunder, which will serve as
the basis for the security assessment.
Table. Nr. 2 Input parameters of the
model object
4.1. Level of security
According to Czech technical standard
ČSN EN 50 131-1, ed. 2, zoos are
classified as level 1 security facilities. On
the zoo premises, however, there are
37
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
structures that the standard classifies at the
following levels of security:
 Archive, registry
security level 2 - 3
 Cafeteria (no kiosk)
security level 2
 Pharmaceutical, medical supplies
security level 2 - 3
 Ticket office, safe
security level 2 – 4
 Security command centre
security level 3
4.2. History of theft, other incidents
Analysis of the history of theft and other
criminal acts confirms that zoos are the
target of theft, and not only of animals;
zoos are of interest to a variety of
criminals. Damage assessments do not
always represent realistic values or actual
damage. If a zoo has devoted itself to an
animal for several years, the damage is,
from a breeding standpoint, inestimable.
Pickpocketing robs visitors of cash,
identification, and other valuables. Vehicle
break-ins primarily involve the theft of
items left in vehicles, but may also include
car vehicle equipment (radio, navigations,
etc.). There have even been cases of fuel
being stolen from parked cars.
Theft of actual animals represents a serious
danger to their lives, health, and is also a
highly stressful experience with possible
permanent consequences. Breaking into an
animal pavilion with the intent of stealing
physical objects can cause damage to and
destroy the integrity of mechanical
barriers, allowing animals to escape and
exposing them to the risk of serious injury.
4.3. Risk analysis
A zoo is a closed complex, so the inner
buildings experience the same degree of
crime in the monitored areas. A higher
degree of crime can be regarded only for
ISBN: 978-1-941968-46-8
remote buildings or sections of them and
their surroundings.
4.4. Other factors
The interior spaces of technical buildings
with increased fire risk and gas boiler
rooms and adjacent spaces should be
designated Environments with Class II
Explosion Danger. When designing a
technological security system, it is
necessary to adhere to all regulations and
normative standards.
From the standpoint of assessing the
effects of the environment, animal
pavilions represent a heavy burden to the
components of technological security
systems in the form of high humidity,
temperatures, lighting, draughts, etc. In
addition to demanding climatic conditions,
pavilions for tropical animals contain
moving plants. In their behaviour, animals
present a great risk of damage both to
components and cabling.
The common denominator for negative
external influences in zoos is reckless
behaviour on the part of visitors,
vandalism, and the weather.
The zoo is situated near a tram line and
several hundred meters from an electrified
train line. This means electrical devices
can be affected by so-called stray voltage.
5. SECURITY DESIGN FOR
MODEL PREMISES
In the previous chapters, we conducted a
security analysis of the characteristics of
the zoo premises, on the basis of which a
model premises was created and used to
produce a security assessment. We can use
these documents to design a zoo premises
security system for a specific customer.
The security design for the model zoo
premises is the result of a process of
characteristics analysis from the standpoint
38
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
of technological security. The person
preparing the design chooses from
technologies currently available on the
market and assigns them to specific
buildings or sections of buildings.
5.1. Outer perimeter security
Fencing, reinforced concrete wall or
chain-link fencing with digging barrier,
height 3 m.
Detection cables generally comprise two
coaxial cables, one functioning as a
transmitter (T x), the other acting as a
receiver (Rx). Slits are created in the
shielding of the transmitter cable that allow
electromagnetic energy to escape. Thanks
to the slits in the shielding, this energy is
detected by the parallel receiver coaxial
cable. The electromagnetic field created
around the detection cables creates a
detection field, which also extends above
the ground.[3] Detection cables can be laid
in soil, concrete, or asphalt. The system
management software can differentiate
between human and animal. The outer
perimeter can also be divided into
individual zones depending on
irregularities in the premises border and
terrain complexity. Locating intruders is
accurate to within one meter.
Outer perimeter security installations can
also make use of excavation work for
laying outer perimeter warning, security,
and emergency systems, CCTV camera
points, utility lighting, and electronic
access control for entrances and gates.
5.2. Administration building
Inner perimeter security will not be applied
universally but rather only to those spaces
with a higher security classification, such
as the economics department, ticket office,
archive, and security command centre. The
windows of these spaces will be fitted with
security bars. The exterior of buildings that
ISBN: 978-1-941968-46-8
make up the outer perimeter will be fitted
with exterior cameras.
The entrance to the administration building
will be fitted with an access system
scanner, surveillance camera, and alarm,
security, and emergency system control
panel. Motion detectors will be installed in
offices and hallways. Access control
scanners and door locks will be used for
the director’s office, meetings rooms, the
economic department, ticket office, etc.
Control panels will be located in the
hallways so that employees can execute
necessary user commands on their floor.
5.3. Predator pavilion
The entrance to the predator pavilion will
be equipped with a contactless card
scanner, electronic lock, and surveillance
camera. The interior spaces will be
monitored by means of fixed cameras and
other interior security elements. Arming
and disarming the security alarm system
will be conducted by means of the entry
scanner. Openings in the structure of the
utility section of the pavilion will be fitted
with security bars.
The predator pavilion will be equipped
with fire detectors and acoustic fire alarms.
The alarms will be positioned so that
animals are not subjected to unnecessary
stress in the event of evacuation.
5.4. Cabling requirements
In spaces where there are animals, cabling
must run beneath either the plaster or other
form of protection against thieving
animals.
5.5. Physical security
Vehicle entry to the zoo premises will be
authorized only for those with permission
from the zoo director and at times
approved in advance. The rear gate may be
opened only during regular hours of
operation.
39
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

Permanent security in the zoo must be especially red. The LED diodes in
provided for the following spaces: infrared camera lighting shine red;
 main entrance and vehicle entry  the monkey is very agile and
gate; explores everything of interest and
 patrol activities; causes damage to it. In the monkey
 surveillance centre (security pavilions, runs, and surrounding
command centre); areas, no security elements can be
 field response team of at least 2 installed that might irritate or harm
security workers. the monkeys;
 horse hearing: 31-46000, elephant
Temporary security in zoos is hearing low frequency 5 - 24 Hz;
possible:
 bats emit signals from frequencies
 in animal pavilions during of 15 Hz to 120 kHz, which they
opening hours; use to hunt and navigate. Their
 in public buildings with fixed audio and hearing system works
opening hours; like an echolocator, in human
 in public spaces, pathways; terms radar or sonar. It is not
 in carparks. recommended to install ultrasound
motion detectors, for example, in
6. SELECTED ANIMAL the vicinity of bats;
CHARACTERISTICS AND  horse hearing ranges from 31 Hz to
ABILITIES 46 kHz, thus the same rules apply
as for bats;
Thanks to the ability and diversity of
 sharks have passive perception of
nature, animals differ from other forms of
electric fields.
life in ways that are often diametrical and
even incomprehensible to us. Unlike 6.2. Birds, other animals
humans, animals are capable of sensing
subtle vibrations in the ground. This means  Parrots need to sharpen their
they can feel earthquakes and other natural beaks, so they are constantly biting
catastrophes. Thanks to sensitive something; therefore, no perimeter
perception of the planet’s magnetic field, security system components can be
animals are able to navigate unknown installed in their aviaries;
territory with ease.  birds see light in the ultraviolet
spectrum;
6.1. Mammals  snakes see light in the infrared
 the African elephant can reach spectrum;
objects as high up as 6 m. The  low frequency hearing in elephants
giraffe is the same height. In the ranges from 5 to 24 Hz, so they
pavilions of these animals, cameras can hear sounds from several
and detectors must be installed kilometres away.
with consideration for the height of
these animals; 7. MODERN TECHNOLOGICAL
 the rhinoceros is more active at SECURITY DEVICES
night than in the day and is Modern technological security devices
irritated by bright colours, available for application in zoos include

ISBN: 978-1-941968-46-8 40
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

new methods for obtaining footage from  acceptability – scanning biometric

CCTV, among which are future use of characteristics is easy and user
pilotless aircraft and face recognition friendly.
systems. Other modern technologies
Face recognition systems are ranked
include intelligent building devices and
among continuously improving biometric
software integrations.
technological resources. The basis for the
Laser detectors provide a new way to system is a camera with very high
detect motion in monitored areas. Thanks resolution, a sufficiently fast transmission
to a special assessment algorithm, laser pathway, and powerful software. Based on
detectors can determine the size, speed, unique biometric markers, the programme
and distance of a moving object. Laser identifies individuals in a crowd. It can be
detectors are capable of providing used at football stadiums, for example, to
surveillance to a distance of up to 30 m identify fans or suspicious individuals. In
and at an angle of 180 degrees. terms of visitor numbers, zoos are
We know how to manufacture pilotless comparable to football league matches.
aircraft on the basis of developed ultralight Due to ever increasing terrorist attack
materials and battery capacities as well as threats, these systems are ideal for
for purposes of obtaining, processing, and supporting camera surveillance systems.
transmitting digital camera footage. For
technological security in zoos, pilotless
surveillance aircraft make it possible to
provide nearly immediate monitoring in
the event of intrusion or other incident.
Biometric systems make use of unique
physiological features of living beings –
people – known as markers. Measurable
biometric characteristics are scanned,
processed, and evaluated. In order to
guarantee security and the protection of
personal data, the data is encoded. From
the perspective of electronic entrance
controls, there are two methods:
identification and verification.
The advantages of using biometric
identification methods are:
 universality – everyone has
biometric characteristics;
 uniqueness – no two people share
the same biometric characteristics;
 permanence – biometric
characteristics are invariable over
time;
 simplicity – biometric
characteristics are quantitatively
measurable, simple, and precise;

ISBN: 978-1-941968-46-8 41
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

CONCLUSION connecting modern electronic devices to

Large modern zoos are home to animals integrated warning system applications.
from every continent; therefore, with a
dose of hyperbole, it can be said that we
must approach security in zoos as though
we were protecting our planet. Each zoo is
unique, so designing a technological
security model is no easy task.
Based on a summary of valid regulations
and requirements, we are able to determine
the elementary aspects of physical security
of zoo premises and divide them into three
main categories: regime measures, physical
security, and technological security. Each
category has clearly defined requirements
for determining the aspects of physical
security.
The next step in preparing a technological
security system is analysis of the
characteristics of the zoo premises. Here, it
is important to determine the requirements
for the selection of zoos so that the
subsequent model corresponds as closely
as possible to real requirements. For the
purposes of this paper, six zoos were
chosen with consideration for the diversity
of specific characteristics. Then the criteria
for determining the specific characteristics
were defined. Next, the obtained values
were processed, and the result is a model
of zoo premises. For the creation of the
zoo premises model, a security analysis
was conducted, including risk analysis and
determining the required level of security
as well as other internal and external
influences that could have a negative effect
on system components. The design of the
technological security system for the
model premises encompasses outer
perimeter security, the carpark, the
administration building, and the predator
pavilion.
In closing, this paper describes the
possibilities of modern technological
security. The current trend also involves

ISBN: 978-1-941968-46-8 42
Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

System requirements," Prague: Czech

office for standards, metrology ang
testing, 2010, p. 42, grading character
REFERENCES 86937.

[1] Team of authors, "Zoo útočiště zvířat,"

Prague: Panorama, 1992, vol. 1, p. 271,
ISBN 80-7038-110-8.
[2] J. Valouch, "Projektování
bezpečnostních systémů." [skriptum].
Zlín : UTB, 2012, p. 155, ISBN 978-
80-7454-230-5.
[3] L. Lukáš, "Bezpečnostní technologie,
systémy a management I.," Zlín:
VeRBuM, 2011, vol. 1, p. 316. ISBN
978-80-87500-05-7.
[4] H. Dobroruka and collective,
"Zoologické zahrady," Prague: Státní
pedagogické nakladatelství, 1989, vol.
1., p. 232, ISBN 80-04-21177-1.
[5] Team of authors, "ZOO animals,
behaviour, management, and welfare,"
Oxford: University Press, 2009, vol. 2.,
p. 643, ISBN 978-0-19-969352-8.
[6] EU, Offitial Journal of the European
Union, "Consolidated versions of the
Treaty on European Union and the
Treaty on the Functioning of the
European union," Luxembourg, Office
for Official Publications of the
European Communities, 2008, p.v153,
ISBN 978-928242572-5.

[7] ČSN EN 50 131-1 ed. 2, "Alarm

systems, Intrusion and hold-up systems,
Part 1: System requirements," Prague:
Czech office for standards, metrology
ang testing, 2007, p. 40, grading
character 78248.
[8] ČSN CLC/TS 50 131-7, "Alarm
systems, Intrusion and hold-up systems,
Part 7: Application guidelines," Prague:
Czech office for standards, metrology
ang testing, 2011, p. 48, grading
character 87986.
[9] ČSN EN 50 132-1 ed. 2, "Alarm
systems. CCTV surveillance systems
for use in security applications – Part 1

ISBN: 978-1-941968-46-8 43
 Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

A Novel Semantic Framework for Cloud Service Ranking and Adoption

Richard Ikechukwu Otuka, Aloysius Adotey Edoh, Ameer Al-Nemrat
School of Architecture Computing & Engineering,
University of East London,
E16 2RD, London, UK.
U0749744@uel.ac.uk, a.a.edoh@uel.ac.uk, al-nemrat@uel.ac.uk

Abstract
In order to tackle the slow adoption of cloud
service by SMEs, a semantically engineered
framework, which is modelled based on a case
study of advertised cloud service provider
offerings is proposed. A novel version of
Analytical hierarchical Process (AHP), which
is a traditional multi-criteria decision method
(MCDM) for solving complex comparison
problems has been created. This new
technique is used to tackle the rank reversal
problem associated with the traditional AHP
method. The ontology issue associated with
cloud service recommendation was solved by
introducing an acceptable standard for each
cloud service attribute. This new framework
with the protocol uses rational relationships to
facilitate an effective cloud service ranking
process, which was verified and evaluated
using Protégé the ontology editor.
Keywords:
SaaS, Ontology, AHP, DSS, SME, service
ranking, Knowledge Management
1- Introduction
Cloud computing in recent years is one of
the biggest breakthrough in technology. A
large number of cloud service providers
exist with each prioritising on different
aspects of cloud services (Google mail,
Google App Engine, Amazon EC2)
provided by Google and Amazon
respectively [1]. To remain competitive in
cloud technology offerings, these service
providers have made effort towards easy
accessibility to their services, which are
known to offer benefits such as reduction
in operational cost and eradication of
upfront investment for businesses.
However, despite their efforts Small and
Medium scale Enterprises (SMEs) are still
slow in the adoption of this technology [2,
3, 4].
Cloud services are divided into three layers
[5]: Software as a Service (SaaS), Platform
as a Service (PaaS), and Infrastructure as a
Service (IaaS).The top layer focuses on
application services (SaaS), which is the
cloud interface that allows computer users
to access software services using a web
browser or thin client computer. The PaaS
layer is the application and software
environment layer that is built on the lower
layer known as the IaaS layer. The upper
layers are developed and provided by third
party service providers, while the service
providers of the IaaS are different as they
focus more on the datacentre provision [6].
Depending on the needs of an
organisation, SaaS services are adopted
based on service application needs, for
example Customer Relationship
Management (CRM) application provided
by Salesforce [7]. PaaS provides a
platform for adoption in instances where a
business is interested in the development
of other applications for example the
Google App Engine [8]. The IaaS layer
offers on- demand storage in terms of
incremental scalability of computer
resources [5].
Furthermore, based on the characteristics
of cloud computing services, businesses
that try to adopt this technology need to
know what service will be most
appropriate for their operations e.g.
(memory size, subscription cost, operating
system, security, trust) and how to rank the
available services from various service

ISBN: 978-1-941968-46-8 44
 Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
providers that render similar services. To
address this problem, different frameworks
[9, 10] and Management models have been
proposed [11, 12]. The paper [13] was the
first to initiate the application of semantic
modelling towards cloud adoption but it
was limited to only classification. In the
paper [14], a semantically based approach
is proposed to tackle the slow adoption of
cloud services. It states that Semantic web
ontology can enable a higher degree of
automation for both functional and non-
functional aspects of cloud services. This
paper uses the cloud service concept to
model a semantically engineered
framework, which can be used for cloud
service ranking with service
recommendation to facilitate effective
service adoption decision making. The
developed semantic model (ontology) is
built based on a set of semantic rules to aid
SMEs in cloud service adoption process
thereby selecting the most relevant service
that meets their business process
requirement.
The rest of this paper is organized as
follows: section 2 discusses related works
and section 3 explains the methodology
used. Section 4 reviews the Ranking
Protocol while section 5, describes the
case study. Again, Section 6 discusses the
Decision support middleware framework
and Section 7 reviews the Service
Ranking. Finally in sections 8 and 9, has
Evaluation with the Conclusion and future
works.
2. Related works
An increase in awareness of cloud
computing has led many researchers to
propose various frameworks to give
businesses a better understanding of the
cloud technology. For instance the work of
[9] proposes a framework which gives
businesses the ability to analyse and
determine if cloud computing services will
have a positive impact on their business
operation. The work of [10] proposes a
ISBN: 978-1-941968-46-8
method for measuring the quality of cloud
service based on two significant aspects
namely their availability and performance
of service. These metrics are used by
customers for the evaluation of cloud
offerings based their ability to meet user
Quality of Service (QoS) requirements.
Our work complements these previous
works by measuring and evaluating the
QoS offerings advertised by different
cloud service providers according to how
they meet user requirements. Although the
evaluation and ranking of various cloud
services are in their preliminary stage in
cloud computing, other computing areas
such as web services the concept is widely
used. The most related work in the field of
cloud services ranking was done by [15,
16]. Their research also proposed a similar
approach, which is based on AHP concept
for the classification of cloud services.
However, they focused more on the
Infrastructure as a Service (IaaS) aspect of
cloud services offerings. Our work also
adopted an extended version of AHP
concept for the comparison of the
superiority of one cloud service attribute
over another, by assigning weights to each
criteria and adopting acceptable
benchmark for each attribute. This ensures
leads to the introduction and formalisation
of cloud service ranking. Although our
work focuses on SaaS storage aspect of
cloud services but in addition it assigns
sets of rules that a cloud service must
attain to be ranked between 5star and 1
star. Again, our ranking is represented in
a decision support system equipped with
an ontology to aid SME owners in the
decision making towards cloud services
adoption. The work of [17] proposed an
ontology web language (owl) for cloud
computing ontology (CoCoon) that defines
the functional and non-functional
concepts, attributes and relationships of
IaaS cloud offerings. Again [18] proposed
45
 Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
ontology-based cloud service
representation that is applicable to cloud
service discovery and cloud computing
knowledge management. Our study
complements the ontology design concept
used in the above work but extra steps are
added to implement the rules that assist in
solving the issue of complex queries as
well as representing the cloud service
ranking findings within our ontology. In
terms of benchmarks, the international
consortiums are working towards adopting
various measures for evaluating cloud
service performance, however various
researchers have proposed other
benchmarks. The work of [19] proposed
the use of TPC-W benchmarks. While the
work of [20] propose the use of metrics for
measuring the QoS of IaaS cloud services.
The use of traditional High Performance
Computing (HPC) benchmarks and
matrices focus on static systems with
specific performance and pricing. In our
approach, we adopted the use of an
extended version of AHP that is a multi-
criteria decision making method. The
method gives the ability to capture both
functional and non-functional evaluation
metrics for comparison of two cloud
service attributes and adopting an
acceptable benchmark for cloud service
adoption.
3. Methodology
In this paper a novel version of the AHP
approach is introduced to tackle the issue
of rank reversal associated with the
traditional method. Generally, the AHP
method simplifies complex and
unstructured problems by arranging the
decision criteria in hierarchical structure. It
applies pairwise comparison that allows
decision makers to determine the balance
among criteria. Also it has the ability to
check consistency, flexibility and intuitive
appeal to decision makers since it gives an
advantage over other multi-criteria
ISBN: 978-1-941968-46-8
methods. In addition, AHP captures both
subjective and objective evaluation
methods while offering a powerful
mechanism that checks the consistency of
the evaluation measures and alternatives
[21].
There are three major phases within the
AHP mechanism, which are: problem
decomposition, judgement of priorities and
aggregation of priorities.
Phase 1: Problem decomposition
In this phase, a hierarchy structural
representation of cloud services that shows
the interrelationship among the overall
goal, the attributes and the alternative
services is shown. This layer analyses the
goals and how each cloud service attribute
satisfies the requirement of the user.
Phase 2: Judgement and priority phase
This deals with assigning of weights to
each attribute, which is essential for the
comparison of two cloud services to
ascertain their relative importance. In this
regard, weights are assigned using
pairwise comparison scale of 1-9 as shown
in Table1 as recommended in the AHP
method to judge the importance of one
attribute over another. This allows the
quantifying of both functional and non-
functional cloud service preference of a
certain attribute over another. By using the
AHP method, the sum of all weights must
be equal to 1[21].
Table 1: Pairwise comparison scale for
AHP preference [21]
Intensity of
importance Definition Explanation
1 Equal Two elements
importance contribute
equally to the
objective
3 Moderate Somewhat
importance more important
5 Strong Definitely
importance more important
46
 Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
7 Very strong Much more
important important
9 Extreme Highest
importance possible order
of affirmation
of one element
over another
Phase 3: Aggregation of priority phase
This phase addresses the assigning
weights, which is complex because some
of the attributes are not quantifiable.
Therefore, 5 SME managers who are
experts in cloud service storage application
usage assign weights for each service
attribute following the formalism below
and a democratic method is used to arrive
at a final assigned weight as follows:
Let us assume be the weight assigned
by the user for the attributes q. Let and
be the values of attribute q for cloud
services i and j. If and are the cloud
services, then ⁄ represents the relative
comparison of and . Then represent
the value required by the user as . In
order to compare the values and for
cloud services and we need to
confirm that conventional unit for both
values are the same. In an instance where
we want to compare the cost of two
advertised cloud service data storage, they
must have the same currency notation
(USD) and price per 1GB to be able to
carry out a perfect comparison. To contain
the versatility of cloud service attribute the
non-measurable characteristics of some
attributes, a different nature of comparison
is proposed for each type. Again for 2
types of cloud services and with
numeric attributes we can compare them
using two different criteria either higher is
better therefore a higher intensity of
importance is assigned or higher is lower
therefore a lower intensity of importance is
assigned to it. If we consider higher to be
ISBN: 978-1-941968-46-8
better then is the value of ⁄ and if
lower is better then is the value of ⁄ .
4. Ranking Protocol
To address the issue of rank reversal, this
paper differs from the traditional summing
up of weight used in the AHP method by
introducing a protocol and using rational
relationships for ranking our cloud
services as follows: 1. Declare the
acceptable standard for each KPI; 2. obtain
the acceptable KPI standards from the
highest to lowest; 3. The service ranking is
done from 5 star to 1 star where five star
are the services with the highest rank and 1
star are services with the lowest rank.
The service attributes used are based on
the level of importance from highest to
lowest as declared before introducing the
ranking formations as below:
Let M- Be the cloud service
- The weight value of the attribute with
the highest KPI priority
- The acceptable standard for the
attribute
- The weight value of the attribute
with the 2nd KPI priority weight
- The acceptable standard for
attribute
- The weight value of the attribute
with the 3rd priority weight
- The acceptable standard for
attribute
- The weight value of the≥ attribute
of any of the remaining KPI priority
- The acceptable standard for any of
the attribute of
The 5 stars service ranking is characterized
based on the following formation
When M  ( ≥ ) ∧ (( ≥ ) ∨
( )) ∧ ( )
The 4 star service ranking is characterized by
the following formation
When M  ( ) ∧ (( ≥ )∨
( )) ∧ ( )
The 3 star service ranking is characterized by
the following formation
47
 Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

When M  ( )∧( )∧ weights. Finally, we show the acceptable

( )∧( ) standard for each criterion as represented
The 2 star service ranking is characterized by in our middleware. The relative weight
the following formation method was used to determine the relative
When M  ( )∧( )∧ priority of each attribute for each SaaS
( )∧( ) cloud service in our scenario as advertised
The 1 star ranking is characterized by the in service provider’s website.
following formation
When M  ( )∧( )∧ Table 2: Table of case study
( )∧( )
Service Service_A Service_B Service_C Service_D
provider (SaaS) (SaaS) (SaaS) (SaaS)
In the next section, demonstrate our offerings
File size 2GB - 10GB 15GB
approach using a case study of advertised Restriction
(Trialability) 5GB 2GB 15GB 2GB
SaaS storage cloud services. Free Storage
(Cost) $83.88/1TB/1 $99/1TB/1 Year $99/1TB/1 Year $99.99/1TB/
On-Going Year $10/month/1TB $2/month/100G Year
Payment plan $2/month/100GB B $20/month/1
5. Case Study of 4 major SaaS Storage TB

Applications
(Interoperabi Windows, Mac, Windows, Mac, Windows, Mac, Windows,
lity) Android and iOS Linux, Android, Android and Mac,
The selection of SaaS storage is based on Operating
system
iOS iOS Android and
iOS
focus group session with SME owners supported
Trust
from which several parameters were Access rights
Security
SLA SLA SLA SLA

selected and service information is gotten Encrypt per file

basis/no on rest
AES 256- bit
Encryption
128- bits AES
and HTTP
128-bits
AES
from advertised cloud service offerings of Office via
encryption

four major cloud service providers. The web

Bandwidth
Yes Yes Yes Yes

four top SaaS cloud services used in this adjustment No Unlimited User restriction No

case study are OneDrive, Dropbox, Google

Drive and ICloud. Although we use
Service_A, Service_B, Service_C and Furthermore, from the information in
Service_D randomly without using their Table 2, the procedural steps leading to
real names. ranking of cloud services is presented. The
relative weighting method as described in
section 3 is used to assign weights for each
Service Service Service Service_ functional and non-functional property of
_B _C _A D the cloud services. A relative ranking
matrix is constructed for each attribute.
Service_ 0.1818 0.182 0.174 0.222
B
Based on the case study data, the Relative
Service_ 0.1818 0.182 0.174 0.222 Service Ranking Matrix (RSRM) for
C payment (Pa) will be:
Service_ 0.5454 0.5454 0.522 0.444
A = Computing the relative
Service_ 0.091 0.101 0.130 0.111 ranking vector for payment from the
D above as:
total 1 1 1 1 =
( )

Table 2 presents a cloud service provider Similarly, we determine the Relative

offerings in a tabular form as advertised in ranking vector for Operating System
service provider websites. Also, each supported (OPS) as
assigned weight of the compared cloud
services together with their attribute

ISBN: 978-1-941968-46-8 48
 Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
= =
( )
The relative ranking vector for file size
restriction (FSR) is determined as
=(
Then the relative ranking vector for free
storage (FS) is determined as:
=(
The relative ranking vector for security
(SE) is determined as
=
( )
Then the relative ranking vector for Trust
(TS) is determined as
=(
Then relative ranking vector for
Bandwidth Adjustment (BA) is determined
as
=(
Finally the relative ranking vector for
Office via Web (OVW) is determined as
=(
Furthermore, the combined RSRV for all
the KPI in the case study is determined.
The resulting RSRV for each attribute is
set as the acceptable standard that each
service attribute must attain for a cloud
service to be recommended for adoption.
This is demonstrated in the proposed
semantic ontology. See appendix 1
=
( ) ( ) ( )
[ ]
( ) ( )
To determine the cloud service attribute
combined weighting, the RSRVs for all the
attribute and the RSRV of the four major
service providers are combined and then
multiply the result RSRV with the RSRV
standard for each of the KPI as represented
below
ISBN: 978-1-941968-46-8
( )
) ( )
In the next section, we show our
middleware architecture and we
demonstrate how our middleware aids in
)
service recommendation based on a set of
reasoning techniques and our service
ranking based on a set of semantic rules. In
aiding cloud service adoption decision.
6. Decision Support System
Architecture
The decision support system architecture
)
depicts the sequence of activities that takes
place within the DSS when a user sends a
requirement. In order to complete the
proposed framework, an ontology of SaaS
storage cloud services is added. This
) ontology holds information about cloud
services advertised by service providers
and is used by our system algorithms to
retrieve user requirements. The developed
) cloud service ontology has been tested on
protégé software which is an ontology
editor to check consistencies as explained
in the remainder of this section.
( ) ( )
( )
Fig 3: Showing Middleware Architecture
6.1. Characteristics of each component
of cloud service architecture
49
 Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
The system architecture consists of the
following component: Graphical User
Interface, query processor, Similarity
reasoning domain, cloud service
knowledge management () and service
ranking. First, The SME owner/ manager
sends their requirements to the middleware
from the graphical user interface. The
decision support system carries out the
following functions depending user
request: 1) Query processing 2) Similarity
reasoning 3) Similarity matching 4)
Cloud service ranking.
6.1.1. Query Processing: When a user
requirement is sent from the SME
owner/manager via the graphical user
interface, the query processor initiates
query processing and converts the query to
machine readable format. Then the
processor sends the processed query to the
similarity reasoning component for further
processing based on the required
information.
6.1.2. Similarity Reasoning: The
processed query initiates the similarity
reasoning process. This is done by
consulting the cloud service ontology.
Similarity decision is based on the type of
information the query processed seeks to
fetch. An example of similarity reasoning
is concept similarity reasoning as
presented in Fig 4.
Concept Similarity Reasoning: This is
based on the conceptual modelling of the
ontology to meet user requirements. The
presence of pellet reasoner within the
ontology editor (protégé) aids the DSS to
undergo conceptual reasoning by
consulting the ontology to retrieve
accurate information using system
algorithms to meet user requirements. To
show that our DSS equipped with a
semantically designed ontology of cloud
services can undergo conceptual similarity
reasoning in an attempt to answer user
requirements. Based on the case study
presented in Table 2, when an SME owner
intends to adopt a cloud service for his
ISBN: 978-1-941968-46-8
data storage with a budget of 2 Dollars per
month for 100GBs of storage and consults
the proposed middleware for decision
making. The user requirement can be
summarised as follows. The cloud service
required by the user is a SaaS cloud
service with a storage of 100GB and a
price value of 2 Dollars. The conceptual
modelling is designed within the system
following the RDF format of Subject,
Predicate and Object statements with
Subject and Object representing the
domain and range of the predicate which
helps us to translate the user requirement
into machine language as
follows:(DOMAIN: SaaS, Data
Property: hasPaymentplan1price, Range:
Integer). To get our user requirement, the
following query is processed in machine
readable format as (SaaS and
hasPaymentplan1price value 2 and
haspaymentPlan1GB value of 100).The
query is translated to lay terms as follows
(Software as a service with a payment plan
of 2USD for 100Gigabyte of data per
month) Please note that the price value is
in USD/Month and the GB (Gigabyte).
Fig 4: Example of conceptual
similarity reasoning.
7. Cloud Service Ranking
The service ranking is done using the 5
Stars, 4 Stars, 3 Stars, 2 Stars, as explained
in service ranking protocol in section 4. In
this section we show the use of semantic
rules (Fig5) within the system in machine
50
 Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017
readable form. While fig 6 shows a query
execution listing Service B as the only
SaaS storage service to attain the 5 star
service rank.
Fig 5: Showing Rules within the system
Below is a system query executed to show
the services that meets the 5 star SaaS
service ranking.
Fig 6: Showing Service B as the only SaaS
to meets the 5 Star ranking.
8. Construct Validity Evaluation
Construct validity method is the degree to
which a test measures what it claims or
proposes to measure [22]. In this paper, a
confirmatory case study as presented in
Table 2 as well as the proposed evaluation
benchmarks presented as
as obtained in section 5 in view of
assessing the proposed model ontology
with specific emphasis on its validity and
completeness [23,24,25]. An exploratory
case study of four major SaaS storage
applications cloud services was adopted.
As the research framework proposes a
knowledge management domain, service
recommendation domain and service
ranking for cloud service adoption by
SMEs.
ISBN: 978-1-941968-46-8
9. Conclusion and Future work
Cloud computing is a technology that
provides services over the internet just like
public utilities. Many cloud service
providers present cloud services in their
own format as there is no standardisation
for representing cloud services.
This research work presents a framework
that aids in the SaaS storage cloud service
application adoption by measuring the
quality of service attributes advertised by
SaaS cloud service providers. Also, this
paper proposed the use of an extended
version Analytical Hierarchical Processes
(AHP) to rank each cloud service. Finally,
this paper proposed the use of a decision
support system equipped with a semantic
model of advertised SaaS cloud services
and cloud service rankings. From the
findings in a bid to understand how service
providers meet user requirements, only
cloud service B (not real name) met the
highest rank of 5 star.
In future work, an extended version of the
quantifiable quality of PaaS and IaaS cloud
services in terms of performance from a
user perspective as well as developing a
system that can be used to aggregate the
QOS configuration between cloud service
layers in different applications.
References
[1] Jagannathan, S: ‘Comparison and Evaluation of Open-source
Cloud Management software’. KTH Royal Institute of
Technology Stockholm, Sweden 2012.
[2] Aljabre, A: ‘Cloud Computing for Increased Business Value.
International Journal of Business and Social Science’. 2012 3 (1)
pp 234-239.
[3] Ashwini,R., K. Sanjay, M. Sanjay and T. Rahul: ‘ Decision
Point for Cloud Computing in Small, Medium Enterprises
(SMEs)’.Proceedings of 7th international Conference for
Internet Technology and Secured Transactions (ICITST-2012)
pp.688-691.
[4] Khan, S.U: ‘Elements of Cloud Adoption. IEEE Journal on
Cloud Computing’. 2014 1(1) pp.71-73.
[5] Buyya, R., C.S.Yeo., J.Venugopal, J.Broberg, I.Brandic:
‘Cloud Computing and Emerging IT Platform: Vision, Hype and
Reality for Delivering computing as the 5th Utility Future
Generation computer Systems.’ 2009 25(6) 599-616.
[6] Fortis, T., V.I. Munteanu, V. Negru, 2012. Towards an
Ontology for Cloud Services. IEEE 6TH International
51
 Proceedings of the Third International Conference on Information Security and Digital Forensics, Thessaloniki, Greece, 2017

Conference on Complex, Intelligent and Software Intensive
Systems.pp787-792
[7] Cusumano, M: Cloud Computing and SaaS as New
Computing Platforms, Communications of the ACM 2010 53(4)
27-29.
[8] Ciurana, M.: ‘Developing with Google App Engine’ A press,
Barkley, CA, USA 2009.
[9] Ebneter, D., S.G. Grivas, T.U. Kumar, H. Wache: Enterprise
Architecture Framework for Enabling Cloud Computing. IEEE
3rd International Conference on Cloud Computing.2010 pp542-
543.
[10] Boa. D., Z. Xiao, Y. Sun, J. Zhao: ‘A Method and
Framework for Quality of Cloud Services Measurement’. 3rd
International Conference on Advanced Computer Theory and
Engineering (ICACTE) 2010 pp358-362.
[11] Misra, S.C, A. Mondal: ‘Identification of a company’s
suitability for adoption of Cloud computing and modelling its
corresponding Return on Investment’. Mathematical and
Computer Modelling 2014, 53(2011)504- 521.
[12] Takabi, H. J.B.D .Joshi, G. Ahn. SecureCloud: ‘Towards a
Comprehensive Security Framework for Cloud Computing
Environment’. 34th Annual IEEE Computer software and
Applications conference Workshops.2010 pp393-398.
[13] Youseff, L., M. Butrico, and D. Da Silva: Towards a
Unified ontology of cloud computing, in Grid computing
Environments Workshop, GCE 08, Nov 2008, pp.1-10
[14] Zhang, M.,R. Ranjan, A. Haller, D: ‘Georgakopoulos, M.
Menzel and S.Nepal, An ontology –based system for cloud
infrastructure services discovery. Proceeding of 8th International
Conference on Collaborative Computing: Networking,
Applications and Work sharing (CollaborateCom), 2012 pp.
524-530.
[15]V. Tran, H.Tsuji, R.Masudu, A new QoS ontology and its
QoS –based ranking algorithm for web services, Simulation
Modelling Practice and theory 17(8) (2009)1378-1398.
[16] S. Garg, S. Versteeg, R. Buyya, A Framework for Ranking
of Cloud Computing Services .Future Generation Comp.Sys’
2013 29(4):1012-1023.
[17] M.Zhang,R. Ranjan, A. Haller, D. Georgakopoulos, M.
Menzel, S.Nepal, An ontology –based system for cloud
infrastructure services discovery. Proceedings of 8th
International Conference on Collaborative Computing:
Networking, Applications and Work sharing (CollaborateCom),
2012 pp.524-530.
[18] A.Ali, M. Shamsuddin, F.Eassa, Ontology –Based Cloud
service Representation’. Research Journal of Applied Sciences,
Engineering and Technology. 2014, 8 (1):83-94.
[19] T.Chen,R.Bahson, Self –Adaptive and Sensitity-Aware
QoS Modelling for the Cloud. IEEE SEAMS 2013, San
Francisco, CA, USA
[20] D. Menasce, A. Silberstein, E. Tam, R. Ramakrishnan ,R.
Sears, Benchmarking cloud serving systems with YCSB,in
Proceedings of the 1st ACM Symposium of Cloud
Computing,Indiana,USA,2010.
[21] T .Saaty, Theory and Applications of Analytic Network
Process, vol.4922, RWS Publications Pittsburgh,PA,2005.
[22] S.E Cashin and Elmore, P. B. (2005) 'The Survey of
Attitudes toward Statistics scale: A construct validity study',
Educational and Psychological Measurement, 65(3), pp. 509-
524.
[23] D. Mann (2001) 'Laws of system completeness', TRIZ
Journal, May
[24] S.A Cook, (1978) 'Soundness and completeness of an
axiom system for program verification', SIAM Journal on
Computing, 7(1), pp. 70-90.
[25] Suwa, M., Scott, A. C. and Shortliffe, E. H. (1982) 'An
approach to verifying completeness and consistency in a rule-
based expert system', Ai Magazine, 3(4), pp. 16.

Appendix 1

PA OPS SE FSR BA FS OVW TS

PA 0.1377 0.1828 0.1267 0.2249 0.1739 0.1666 0.1880 0.1121

OPS 0.0688 0.0914 0.0951 0.1687 0.1449 0.1428 0.1504 0.0746

SE 0.4132 0.3656 0.3805 0.2811 0.2318 0.2142 0.2633 0.4484

FSR 0.0344 0.0304 0.0633 0.0562 0.1159 0.1190 0.1128 0.0448

BA 0.0229 0.0182 0.0475 0.0140 0.0289 0.0476 0.0125 0.0324

FS 0.0196 0.0152 0.0761 0.0112 0.0144 0.0238 0.0094 0.0280

OVW 0.0275 0.0130 0.0543 0.0187 0.0869 0.0952 0.0376 0.0373

TS 0.2755 0.2742 0.1902 0.2249 0.2028 0.1904 0.2257 0.2242

ISBN: 978-1-941968-46-8 52