TOP 10 CITED PAPERS FOR CRYPTOGRAPHY AND INFORMATION SECURITY

TTOOPP 1100
CCIITTEEDD PPAAPPEERRSS
International Journal on Cryptography and Information
Security (IJCIS)
ISSN : 1839-8626
https://wireilla.com/ijcis/index.html

Citation Count – 53
ECG Based Human Authentication using Wavelets and Random Forests
Noureddine Belgacem1
, Amine Nait-Ali2
, Regis Fournier2
and Fethi Bereksi-Reguig1
1
Abou Bekr Belkaid University, Algeria and 2
UPEC University, France
ABSTRACT
The electrocardiogram (ECG) is an emerging novel biometric for human identification. It can be
combined in a multi-modal biometric identification system or used alone for authentication of
subjects. His primary application can be in health care systems where the ECG is used for health
measurements. It does furthermore, better than any other biometrics measures, deliver the proof
of subject’s being alive as extra information which other biometrics cannot deliver as easily. The
main purpose of this study is to present a novel personal authentication approach for human
authentication based on their ECG signals. We present a methodology for identity verification
that quantifies the minimum number of heartbeats required to authenticate an enrolled individual.
The cardiac signals were used to identify a total of 80 individuals obtained from four ECG
databases from the Physionet database (MIT-BIH, ST-T, NSR, PTB) and an ECG database
collected from 20 student volunteers from Paris Est University. Feature extraction was
performed by using Discrete Wavelet Transform (DWT). Wavelets have proved particularly
effective for extracting discriminative features in ECG signal classification. The Random Forest
was then presented for the ECG signals authentication. Preliminary experimental results indicate
that the system is accurate and can achieve a low false negative rate, low false positive rate and a
100% subject recognition rate for healthy subjects with the reduced set of features.
KEYWORDS
ECG; human authentication; wavelet decomposition; random forests.
Full Text : https://wireilla.com/papers/ijcis/V2N2/2212ijcis01.pdf

REFERENCES
[1] Biel L, Pettersson 0, Philipson L, Wide P. ECG analysis: A new approach in human identification.
IEEE Trans Instrum Meas 2001;50(3):808-12.
[2] Kyoso M, Uchiyama A. Development of an ECG identification system. In Proc. of the 23rd IEEE
EMBS Conference, volume 4.2001; 3721-23.
[3] Shen T, Tompkins W, Hu Y. One-lead QRS for identity verification. In Proc. of the Second Joint
EMBS/BMES Conference. 2002; 62-3.
[4] Wtibbeler G, Stavridis M, Kreiseler D, Bousseljot RD, Elster C. Verification of humans using the
electrocardiogram. Pattern Recognition Letters 2007;28: 1172-75.
[5] Wang Y, Agrafioti F, Hatzinakos D, Plataniotis K. Analysis of human electrocardiogram for
biometric recognition. EURASIP Journal on Advances in Signal Processing 2008.
[6] Batchvarov V, Bortolan G, Christov I. Effect of heart rate and body position on the complexity of
the qrs and t wave in healthy subjects. In Computers in Cardiology. 2008; 225-8.
[7] Fang SC, Chan HL. Human identification by quantifying similarity and dissimilarity in
electrocardiogram phase space. Pattern Recogn September 2009;42:1824-1831.
[8] Irvine JM, Israel SA. A sequential procedure for individual identity verification using ECG.
EURASIP Journal on Advances in Signal Processing 2009.
[9] Fabienne Poree, A.Gallix, G.Carrault, “Biometric Identification of Individuals based on the ECG.
Which Conditions?” Computing in Cardiology 2011;38:761-764.
[10] Yogendra Narain Singh, S. K. Singh, “Evaluation of Electrocardiogram for Biometric
Authentication”, Journal of Information Security, 2012, 3, 39-48. 2012.
[11] G. B. Moody and R. G. Mark, The impact of the MIT-BIH arrhythmia database, IEEE Engineering
in Medicine and Biology Magazine (2001) 45-50.
[12] A. Taddei, A. Biagini, et al., The European ST-T database: Development, distribution and use, IEEE
Computers in Cardiology (1991) 177-180.
[13] Goldsmith RL, Bigger JT, Steinman RC, et al. Comparison of 24-hour parasympathetic activity in
endurance-trained and untrained young men. J Am Coll Cardiol 1992; 20:552-558.
[14] Bousseljot R, Kreiseler D, Schnabel, A. Nutzung der EKG-Signaldatenbank CARDIODAT der PTB
über das Internet. Biomedizinische Technik, Band 40, Ergänzungsband 1 (1995) S 317.
[15] Maglaveras N. ECG pattern recognition and classificationnon linear transformations and neural
networks: a review. Int. J. Med. Inf., 52: 191-208. NIST report to Congress (2004).
[16] Haykin S . Adaptive filter theory. 4th Ed., New Jersey: Prentice- Hall, pp. 313-322. 2001.
[17] S. A. Israel, J. M. Irvine, A. Cheng, M. D. Wiederhold, and B.K. Wiederhold, ”ECG to identify
individuals”, Pattern Recognition 38 (1): 133-142, 2005.

[18] Worck W. J. Irvine J. M. Israel S. A., Scruggs W. T., “Fusing face and ecg for person
identification,” IEEE App. Imag. Paternt. Recogn. Workshop,, p. 226, 2003.
[19] Hu Y. H. Shen T. W., Tompkins W. J., “One-lead ecg for identity verification,” Proc. IEEE
EMBS/BMES Conf,, pp. 62–63, 2002.
[20] Morteza Elahi Naraghi ,” ECG Based Human Identification using Wavelet Distance Measurement.
IEEE, June 2007, vol. IEEE 4th International Conference on Biomedical Engineering and
Informatics (BMEI). 2011.
[21] Shanxiao Yang, and Guangying Yang ,” ECG Pattern Recognition Based on Wavelet Transform and
BP Neural Network. Proceedings of the Second International Symposium on Networking and
Network Security (ISNNS ’10) Jinggangshan, P. R. China, 2-4, April. 2010, pp. 246-249.
[22] S. G. Mallat, A Wavelet Tour of Signal Processing, third edition, Elsevier Inc., 1999.
[23] S. A. Israel, W. T. Scruggs, W. J. Worck, J. M. Irvine, “Fusing Face and ECG for Person
Identification”, Proceedings of the 32nd IEEE Applied Imagery Pattern Recognition Workshop, p.
226, 2003.
[24] Frederick Livingston: Implementation of Breiman‘s Random Forest Machine Learning Algorithm, in
ECE591Q Machine Learning conference, Fall 2005.
AUTHORS
Noureddine Belgacem was born in 1975 in Tlemcen (Algeria); he received his B.Sc.
degree in Electronics at the University of Abou Bekr Belkaïd of Tlemcen, then his first
post graduation degree in Signals and Systems in 2002. Since 2003 he is an Assistant
Professor in the Department of Electrical and Electronics Engineering, University of
Abou Bekr Belkaïd of Tlemcen, Algeria. His current areas of interest are Pattern
recognition, physiological processing and biometrics.
Amine Naït-Ali was born in 1972 in Oran (Algeria); he received his B.Sc. degree in
Electrical Engineering at the University of Sciences and Technology of Oran, then his
DEA degree in Automatic and Signal Processing at University Paris 11 and his Ph.D.
degree in Biomedical Engineering from the University Paris 12 in 1998 and the ability to
manage research. He is now Professor in Applied Signal Processing. His research
interests are focused on physiological processing, processes modelling and medical
signal and image compression.
Fethi Bereksi Reguig received the engineering degree in Electronics from the University
of Science and Technology, Oran, Algeria in 1983 and the MSc and PhD degrees in
Modern Electronics from the University of Nottingham, England in 1985 and 1989
respectively. Currently, he is a Professor in the Department of Electronics at the
University of Tlemcen, Algeria and the Director of the research Laboratory in
Biomedical Engineering. His area of research interests includes biomedical signal
processing and microcomputer-based medical instrumentation.

Image Encryption Using Fibonacci-Lucas Transformation
Minati Mishra1
, Priyadarsini Mishra2
, M.C. Adhikary1
and Sunit Kumar3
1
F.M. University, India, 2
District Rural Development Agency, India and 3
Kolhan University,
India
ABSTRACT
Secret communication techniques are of great demand since last 3000 years due to the need of
information security and confidentiality at various levels of communication such as while communicating
confidential personal data , patients’ medical data, countries’ defence and intelligence information, data
related to examinations etc. With advancements in image processing research, Image encryption and
Steganographic techniques have gained popularity over other forms of hidden communication techniques
during the last few decades and a number of image encryption models are suggested by various
researchers from time to time. In this paper, we are suggesting a new image encryption model based on
Fibonacci and Lucas series.
KEYWORDS
Digital Image, Fibonacci series, Lucas series, Image scrambling, Fibonacci-Lucas map
Full Text: https://wireilla.com/papers/ijcis/V2N3/2312ijcis12.pdf

REFERENCES
[1] http://en.wikipedia.org/wiki/Arnold%27s_cat_map
[2] V. I. Arnold; A. Avez (1968). Ergodic Problems in Classical Mechanics. New York: Benjamin.
[3] Ma, Z.G. and S.S. Qiu, 2003. “An image cryptosystem based on general cat map”, J. China Inst.
Commun., 24: 51-57.
[4] Kong, T. and Z. Dan, 2004. A new anti-Arnold transform algorithm. J. Software, 15: 1558-1564.
[5] Hong, C.Y. and W.G. Zou, 2005. “Digital image scrambling technology based on three dimensions
Arnold transform and its period”, J. Nanchang Univ. Nat. Sci., 29: 619-621.Wang,
[6] Z.H., 2006. “On the period of 2D “Random matrix scrambling transform and its application in image
hiding”, Chinese J. Comput., 29: 2218-2225.
[7] Yang, D.L., N. Cai and G.Q. Ni, 2006. “Digital image scrambling technology based on the
symmetry of arnold transform”, J. Beijing Inst. Technol., 15: 216-220.
[8] Minati Mishra, A.R. Routray, Sunit Kumar: “High Security Image Steganography with modified
Arnold’s cat map”, IJCA, Vol.37, No.9:16-20, January 2012.
[9] Minati Mishra, Sunit Kumar and Subhadra Mishra: “Security Enhanced Digital Image
Steganography Based on Successive Arnold Transformation”, Advances in Intelligent and Soft
Computing, 2012, Volume 167/2012, pp. 221-229, DOI: 10.1007/978-3-642-30111-7_21.
[10] Qi, D.X., J.C. Zou and X.Y. Han, 2000. “A new class of transform and its application in the image
transform covering”. Sci. China (Series E), 43: 304-312.
[11] Zou, J.C., R.K. Ward and D.X. Qi, 2004. “A new digital image scrambling method based on
Fibonacci numbers”. Proceedings of the International Symposium on Circuits and Systems, May 23-
26, Vancouver, Canada, pp: 965-968.
[12] Zou, J.C., R.K. Ward and X.D. Qi, 2004. “The generalized fibonaci transformatios and application to
image scrambling”. Proceeding of the IEEE International Conference on Acoustic, Speech and
Signal Processing, May 17-21, Canada, pp: 385-388.
[13] Li-Ping Shao, Zheng Qin, Hong-Jiang Gao and Xing-Chen Heng, 2008. “2D Triangular Mappings
and Their Applications in Scrambling Rectangle Image”, Information Technology Journal, 7: 40-47.

Video Surveillance in the Cloud?
DJ Neal and Syed (Shawon) Rahman, Capella University, USA
ABSTRACT
A high-resolution video surveillance management system incurs huge amounts of storage and
network bandwidth. The current infrastructure required to support a high-resolution video
surveillance management system (VMS) is expensive and time consuming to plan, implement
and maintain. With the recent advances in cloud technologies, opportunity for the utilization of
virtualization and the opportunity for distributed computing techniques of cloud storage have
been pursued on the basis to find out if the various cloud computing services that are available
can support the current requirements to a highresolution video surveillance management system.
The research concludes, after investigating and comparing various Software as a Service (SaaS),
Platform as a Service (PaaS), and Infrastructure as a Service (IaaS) cloud computing provides
what is possible to architect a VMS using cloud technologies; however, it is more expensive and
it will require additional reviews for legal implications, as well as emerging threats and
countermeasures associated with using cloud technologies for a video surveillance management
system.
KEYWORDS
Video Surveillance, Cloud-Computing, IP-Camera, SPI Model, Cloud storage, virtualization

REFERENCES
[1] Robert I. Rubin and Mark J. Stemplar, "Video Surveillance in Personal Injury Cases," Florida Bar
Journal, vol. 85, no. 6, pp. 98-102, June 2011.
[2] Peter Mell and Timothy Grance, "The NIST Definition of Cloud Computing Recommendations of
the National Institute of Standards and Technology," NIST Special Publication, vol. 145, no. 6, pp.
1-7, 2011.
[3] Lee Badger, Robert Patt-corner, and Jeff Voas, "DRAFT Cloud Computing Synopsis and
Recommendations Recommendations of the National Institute of Standards and Technology," Nist
Special Publication, vol. 117, no. 5, p. 84, 2011.
[4] Michael E. Whitman and Herbert J. Mattord, PRINCIPLES OF INFORMATION SECURITY, 4th
ed., Steve Helba and MarahBellegrade, Eds. Boston, United States of America: Course Technology,
2011.
[5] Marianne Swanson and Barbara Guttman, "Generally Accepted Principles and Practices for Securing
Information Technology Systems," Work, vol. 800-14, 1996. [Online].
http://csrc.nist.gov/publications/nistpubs/800-14/800-14.pdf
[6] Tavis Ormandy. (2007) An Empirical Study into the Security Exposure to Hosts of Hostile
Virtualized Environments. Document. [Online].
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.105.6943&rep=rep1&type=pdf
[7] Wayne Jansen and Timothy Grance. (2011) Guidelines on Security and Privacy in Public Cloud
Computing. Document. [Online]. http://csrc.nist.gov/publications/nistpubs/800-144/SP800-144.pdf
[8] David Rath, "surveillance jumps on the network," T H E Journal, vol. 38, no. 10, pp. 30-35,
December 2011.
[9] Arecont Vision. (2012) Arecont Vision Web site. [Online]. http://www.arecontvision.com/
[10] Axis Communications. (2012) Axis Communications Web site. [Online]. http://www.axis.com/
[11] ipConfigure, Inc. (2011) ipConfigure Web site. [Online]. http://www.ipconfigure.com/products/SCS/
[12] OrangeScape. (2012) OrangeScape Web site. [Online]. http://www.orangescape.com/
[13] Wolf Frameworks. (2011) Wolf Frameworks Web site. [Online]. http://www.wolfframeworks.com/
[14] Microsoft. (2012) Windows Azure Web Site. [Online]. http://www.windowsazure.com/en-us/
[15] Gartner. (2011) Magic Quadrant for Public Cloud Infrastructure as a Service. Document. [Online].
http://www.gartner.com/technology/reprints.do?id=1-18BON1E&ct=111214&st=sb
[16] Amazon Inc. (2012) Amazon Web Services. [Online]. http://aws.amazon.com/
[17] Benson, Karen and Rahman, Syed (Shawon); "Security Risks in Mechanical Engineering
Industries", International Journal of Computer Science and Engineering Survey (IJCSES)

[18] Slaughter, Jason and Rahman, Syed (Shawon); " Information Security Plan for Flight Simulator
Applications"; International Journal of Computer Science & Information Technology (IJCSIT),
Vol.3, No 3, June 2011
[19] Jungck, Kathleen and Rahman, Syed (Shawon); " Cloud Computing Avoids Downfall of
Application Service Providers";International Journal of Information Technology Convergence and
services (IJITCS), Vol.1, No.3, June 2011
[20] Schuett, Maria and Rahman, Syed (Shawon); “Information Security Synthesis in Online
Universities”; International Journal of Network Security & Its Applications (IJNSA), Vol.3, No.5,
Sep 2011
[21] Hood, David and Rahman, Syed (Shawon);“IT Security Plan for Flight Simulation Program”;
International Journal of Computer Science, Engineering and Applications (IJCSEA)
[22] Dees, Kyle and Rahman, Syed (Shawon);“Enhancing Infrastructure Security in Real Estate”;
International Journal of Computer Networks & Communications (IJCNC),
[23] Mohr, Stephen and Rahman, Syed (Shawon);“IT Security Issues within the Video Game Industry”;
International Journal of Computer Science & Information Technology (IJCSIT), Vol 3, No 5, Oct
2011
[24] Halton, Michael and Rahman, Syed (Shawon); "The Top 10 Best Cloud-Security Practices in Next
Generation Networking"; International Journal of Communication Networks and Distributed
Systems (IJCNDS); Special Issue on: "Recent Advances in Next-Generation and Resource-
Constrained Converged Networks", Vol. 8, Nos. ½, 2012
AUTHORS’ BIO
DJ Neal (Security+, Network+) holds a Master of Science Degree in Information
Assurance and Security from Capella University (2012), Bachelor of Science in
Computer Science from University of Las Vegas (2000), and an Associate Degree in
Nuclear Technology from University of Phoenix (1997). DJ Neal’s current interests
include, networking, database security, cloud computing, security architecture, physical
access controls, surveillance systems, and computer forensics.
Syed (Shawon) M. Rahman is an assistant professor in the Department of Computer
Science and Engineering at the University of Hawaii-Hilo and an adjunct faculty of
information Technology, information assurance and security at the Capella University.
Dr.Rahman’s research interests include software engineering education, data
visualization, information assurance and security, web accessibility, and software testing
and quality assurance. He has published more than 75 peer-reviewed papers. He is a
member of many professional organizations including ACM, ASEE, ASQ, IEEE, and UPE.

Chaos Based Mixed Key stream Generation for Voice Data Encryption
Musheer Ahmad1
, Bashir Alam1
and Omar Farooq2
, 1
Jamia Millia Islamia, India and 2
ZH College of
Engineering and Technology, India
ABSTRACT
In this paper, a high dimensional chaotic systems based mixed key stream generator is proposed to secure
the voice data. As the voice-based communication becomes extensively vital in the application areas of
military, voice over IP, voice-conferencing, phone banking, news telecasting etc. It greatly demands to
preserve sensitive voice signals from the unauthorized listening and illegal usage over shared/open
networks. To address the need, the designed key stream generator is employed to work as a symmetric
encryption technique to protect voice bit streams over insecure transmission channel. The generator
utilizes the features of high dimensional chaos like Lorenz and Chen systems to generate highly
unpredictable and random-like sequences. The encryption key stream is dynamically extracted from the
pre-processed chaotic mixed sequences, which are then applied to encrypt the voice bit stream for
integrity protection of voice data. The experimental analyses like auto-correlation, signal distribution,
parameter-residual deviation, key space and key-sensitivity demonstrate the effectiveness of the proposed
technique.
KEYWORDS
High dimensional chaotic systems, security, mixed key stream, voice encryption.

REFERENCES
[1] VoIP Security Alliance. VoIP Security and Privacy Threat Taxonomy, version 1.0,
http://www.voipsa.org/Activities/taxonomy.php. (Last accessed in July 2011)
[2] M. J. Orceyre and R. M. Heller, (1978) “An Approach to Secure Voice Communication Based on
the Data Encryption Standard”, IEEE Communications Society Magazine, pp. 41–50.
[3] Q. H. Lin, F. L. Yin, T. M. Mei and H. Liang, (2006) “A Blind Source Separation Based Method for
Speech Encryption”, IEEE Transaction on circuits and systems-I, Vol. 53, No. 6, pp. 1320–1328.
[4] Z. Su, J. Jiang, S. Lian, D. Hu, C. Liang and G. Zhang, (2009) “Selective Encryption for G.729
Speech using Chaotic Maps”, International Conference on Multimedia Information Networking and
Security, pp. 488–492.
[5] J. I. Guo, J. C. Yen and H. F. Pai, (2002) “New Voice over Internet Protocol technique with
Hierarchical Data Security Protection”, IEE Proceedings Vision, Image & Signal Processing, Vol.
149, No. 4, pp. 237–243.
[6] K. W. Wong, K. P. Man, S. Li and X. Liao, (2005) “A more Secure Chaotic Cryptographic scheme
based on Dynamic Look-up table”, Circuits, Systems and Signal Processing , Vol. 24, No. 5, pp.
571– 584.
[7] K. W. Tang, and W. K. S. Tang, (2005) “A Chaos-based Secure Voice Communication System”,
International Conference on Industrial Technology, pp. 571–576.
[8] K. P. Man, K. W. Wong and K. F. Man, (2006) “Security Enhancement on VoIP using Chaotic
Cryptography”, International Conference on Industrial Electronics, pp. 3703–3708.
[9] H. F. Qi, X. H. Yang, R. Jiang, B. Liang, and S. J. Zhou, (2008) “Novel End-to-End Voice
Encryption Method in GSM System”, International Conference on Networking, Sensing and
Control, 217–220.
[10] F. Palmieri, and U. Fiore, (2009) “Providing true end-to-end security in converged voice over IP
infrastructures”, Computers & Security, Vol. 28, No. 6, pp. 433–449.
[11] M. Ahmad and Izharuddin, (2010) “Randomness Evaluation of Stream Cipher for Secure Mobile
Communication”, International Conference on Parallel, Distributed and Grid Computing, pp. 165–
168.
[12] S. Mukhopadhyay and P. Sarkar, (2006) "Application of LFSRs for Parallel Sequence Generation in
Cryptologic Algorithms", Applied Cryptography and Information Security, LNCS, Vol. 3982, pp.
426–435.
[13] R. Mita, G. Palumbo, S. Pennisi and M. Poli, (2002) “A novel pseudo random bit generator for
cryptography applications”, International Conference on Electronics, Circuits and Systems, Vol. 2,
pp. 489–492.
[14] C. Fu, Z. Zhang and Y. Cao, (2007) “An Improved Image Encryption Algorithm Based on Chaotic
Maps”, International Conference on Natural Computation, pp. 189–193.

[15] M. Ahmad and O. Farooq, (2010) “A Multi-level Blocks Scrambling based Chaotic Image Cipher”,
Contemporary Computing, Communications in Computer and Information Science, Ranka, S.,
Banerjee, A., Biswas, K.K., Dua, S., Mishra, P., Moona, R., Poon, S.-H., Wang, C.-L. (eds.), Vol.
94, pp. 171–182. Springer.
[16] A. Rukhin et al., (2001) “A Statistical Test Suite for Random and Pseudo-random Number
Generators for Cryptographic Applications”, NIST Special Publication 800-22.
[17] F. Sufi, F. Han, I. Khalil, and J. Hu, (2011) “A Chaos-based Encryption Technique to Protect ECG
Packets for Time Critical Telecardiology Applications”, Security and Communication Networks,
Vol. 4, No. 5, pp. 515–524.

Information Hiding in CSS: A Secure Scheme Text-Steganography Using
Public Key Cryptosystem
Herman Kabetta, B. Yudi Dwiandiyanta and Suyoto, Atma Jaya Yogyakarta University, Indonesia
ABSTRACT
In many recent years, the programming world has been introduced about a new programming language
for designing websites, it is CSS that can be be used together with HTML to develop a web interface. And
now, these two programming languages as if inseparably from each other. As a client-side scripting, CSS
is visible by all users as the original script, but it cannot be granted changed. Website is a tool of
information disseminator throughout the world, this is certainly can be used to a secret communication by
using CSS as a message hider. This paper proposed a new scheme using web tools like CSS for hiding
informations. This is a secret communication mechanism using text steganography techniques that is
embedded messages on CSS files and is further encrypted using RSA as a public key cryptographic
algorithm.
KEYWORDS
Text Steganography, Cryptography, Cascading Style Sheet (CSS), RSA Algorithm, public key algorithm
Full Text : https://www.wireilla.com/papers/ijcis/V1N1/1111ijcis02.pdf

REFERENCES
[1] Singh, Hitesh, Pradeep Kumar Singh and Kriti Saroha (2009) “A Survey on Text Based
Steganography”, Proceedings of the 3rd National Conference, Computing For Nation Development,
February 26 – 27, 2009.
[2] Aboalsamh, Hatim A., Hassan I. Mathkour , Mona F. M. Mursi and Ghazy M.R. Assassa (2008)
“Steganalysis of JPEG Images: An Improved Approach for Breaking the F5 Algorithm”, 12th
WSEAS International Conference on COMPUTERS, Heraklion, Greece, July 23-25, 2008.
[3] Zaidan, B.B, A.A. Zaidan, Alaa Taqa and Fazida Othman (2009) “Stego-Image Vs Stego-Analysis
System”, International Journal of Computer and Electrical Engineering, Vol. 1, No. 5 December,
2009.
[4] Por, L.Y, T. F. Ang and B. Delina (2008) “WhiteSteg: A New Scheme in Information Hiding Using
Text Steganography”, WSEAS Transactions on Computers, Issue 6, Volume 7, June 2008.
[5] Shahreza, M. Hassan Shirali and Muhammad Shirali Shahreza (2006) “A New Approach to
Persian/Arabic Text Steganography”, International Workshop on Component-Based Software
Engineering, Software Architecture and Reuse (ICIS-COMSAR’06).
[6] Bandyopadhyay , Samir Kumar, Tuhin Utsab Paul and Avishek Raychoudhury (2010) “Genetic
Algorithm Based Substitution Technique Of Image Steganography”, Journal of Global Research in
Computer Science Volume 1, No. 5, December 2010.
[7] Atoum, Mohammed Salem, Mamoun Suleiman Al Rababaa, Subariah Ibrahim, and Osamah
Abdulgader Ahmed (2011) “A Steganography Method Based on Hiding secrete data in
MPEG/Audio Layer III”, IJCSNS International Journal of Computer Science and Network Security,
VOL.11 No.5, May 2011.
[8] Atoum, Mohammed Salem, Osamah Abdulgader Al- Rababah and Alaa Ismat Al-Attili (2011) “New
Technique for Hiding Data in Audio File”, IJCSNS International Journal of Computer Science and
Network Security, VOL.11 No.4, April 2011.
[9] Nosrati, Masoud, Ronak Karimi, Hamed Nosrati and Maryam Karimi (2011) “An introduction to
steganography methods”, World Applied Programming, Vol (1), No (1), April 2011. 37-41.
[10] Memon, Jibran Ahmed, Kamran Khowaja and Hameedullah Kazi (2008) “Evaluation Of
Steganography For Urdu /Arabic Text”, Journal of Theoretical and Applied Information Technology
2008.
[11] Jalab, Hamid.A., A.A Zaidan and B.B Zaidan (2009) “Frame Selected Approach for Hiding Data
within MPEG Video Using Bit Plane Complexity Segmentation”, Journal Of Computing, Volume 1,
Issue 1, December 2009.
[12] Walia, Ekta, Payal Jain and Navdeep (2010) “An Analysis of LSB & DCT based Steganography”,
Global Journal of Computer Science and Technology Vol. 10 Issue 1 (Ver 1.0), April 2010.
[13] Thampi, Sabu M (2004) “Information Hiding Techniques: A Tutorial Review”, ISTE-STTP on
Network Security & Cryptography, LBSCE 2004.

[14] Kumar, Vinay and S.K. Muttoo (2008) “Relevance of Steganography, in General, and Graph
Theoritic Approach in Particular, in Indian Security Concern and Measure”, National Conference of
Computing For Nation Development, February 08-09, 2008.
[15] Nosrati, Masoud, Ronak Karimi, Hamed Nosrati and Maryam Karimi (2011) “An introduction to
steganography methods”, World Applied Programming, Vol (1), No (1), April 2011. 37-41.
[16] Menezes , A ., P. van Oorschot, and S. Vanstone (1996) Handbook of Applied Cryptography. CRC
Press 1996.
[17] Al-Vahed, Ahmed and Haddad Sahhavi (2011) “An overview of modern cryptography”, World
Applied Programming, Vol (1), No (1), April 2011. 3-8.
[18] Hamdi, Mohamed (2010) “Architecture and Insecurity Issues of a Handheld Device”, Journal of
Security Engineering Volume 6-2010.
[19] Thome, Emmanuel (2009) “Abstracts of the CADO workshop on integer factorization”, ACM
Communications in Computer Algebra, Vol. 43, No. 1, March 2009.
[20] Jaseena and Anita John (2011) “Text Watermarking using Combined Image and Text for
Authentication and Protection”, International Journal of Computer Applications (0975 – 8887)
Volume 20– No.4, April 2011.
[21] Por, L. Y. and B. Delina (2008) “Information Hiding: A New Approach in Text Steganography”, 7th
WSEAS Int. Conf. on Applied Computer & Applied Computational Science (ACACOS '08),
Hangzhou, China, April 6-8, 2008.
[22] Memon, Aasma Ghani, Sumbul Khawaja and Asadullah Shah (2008) “Steganography: A New
Horizon For Safe Communication Through XML”, Journal of Theoretical and Applied Information
Technology 2008.
[23] Bandyopadhyay, Samir Kumar and Sarthak Parui (2010) “A Method for Public Key Method of
Steganography”, International Journal of Computer Applications (0975 – 8887) Volume 6– No.3,
September 2010.
[24] Bandyopadhyay, Samir Kumara and Suman Chakraborty (2011) “Image Steganography Using DNA
Sequence”, Asian Journal Of Computer Science And Information Technology1:2 (2011) 50 – 52.
[25] Bandyopadhyay, Samir Kumar and Sarthak Parui (2010) “A Method for Public Key Method of
Steganography”, International Journal of Computer Applications (0975 – 8887) Volume 6– No.3,
September 2010.
[26] Narayana, Sujay and Gaurav Prasad (2010) “Two New Approaches For Secured Image
Steganography Using Cryptographic Techniques And Type Conversions”, Signal & Image
Processing : An International Journal(SIPIJ) Vol.1, No.2, December 2010.
[27] Bandyopadhyay, Samir Kumar, Debnath Bhattacharyya, Debashis Ganguly, Swarnendu Mukherjee
and Poulami Das (2008) “A Tutorial Review on Steganography”, International Conference on
Contemporary Computing 2008.

[28] Geetha, K and P.Vanitha Muthu (2010) “Implementation of ETAS (Embedding Text in Audio
Signal) Model to Ensure Secrecy”, International Journal on Computer Science and Engineering Vol.
02, No. 04, 2010, 1308-1313.
[29] Carro, Fernando Incertis (2007) “Methods of invisibly embedding and hiding data into soft-copy
text documents”, U.S. Patent No. 7240209 B2 July 3rd 2007.
[30] Banerjee, Indradip, Souvik Bhattacharyya and Gautam Sanyal (2011) “Novel Text Steganography
through Special Code Generation”, International Conference on Systemics, Cybernetics and
Informatics 2011 Pentagram Research Centre (P) Limited.
[31] Mir, Nighat and Sayed Afaq Hussain (2010) “Secure web-based communication”, Procedia
Computer Science 3 (2011) 556–562.
[32] Dutta, Ratna, Sourav Mukhopadhyay, Martin Collier (2010) “Computationally secure self-healing
key distribution with revocation in wireless ad hoc networks”, Proceedings of ACNS 2007, LNCS
4521, pp. 385–400.
AUTHORS
Herman Kabetta
Herman Kabetta received his Bachelor Degree in Mathematics from the University of
General Soedirman (Purwokerto, Indonesia). Now He was studying in Master Degree
of Informatics Engineering in Atma Jaya Yogyakarta University.
Yudi Dwiandiyanta
Yudi Dwiandiyanta, S.T., M.T. is a lecturer in Atma Jaya University, He received his
Master Degree in Electrical Engineering from the Gadjah Mada University
(Yogyakarta, Indonesia). Several His researches performed on the subject of soft
computing and another research that is sponsored by Indonesian government.
Suyoto
Prof. Ir. Suyoto, M.Sc.,Ph.D. is a lecturer in Atma Jaya University, He received his
last degree in Universiti Kebangsaan Malaysia. Reviewer of many National and
International Conference, one of which is “The 12th International Conference on
Information Integration and Web-based Applications & Services (iiWAS2010)”.

Avoiding Wormhole Attack in MANET using Statistical Analysis Approach
Saurabh Upadhyay1
and Aruna Bajpai2
,1
Sarvottam Institute of technology and Management,
Greater Noida, India and 2
Samrat Ashok Technological Institute-Vidisha,India.
ABSTRACT
MANET is a collection of mobile hosts with wireless network interfaces that form a temporary network
without any fixed infrastructure or centralized administration. MANET is infrastructure-less, lack of
centralized monitoring and dynamic changing network topology. MANET is highly vulnerable to attack
due to open error prone shared wireless medium. In this paper, we proposed an algorithm for avoiding
and preventing the wormhole attacks in MANET using statistical analysis approach. Simulation results
shows that proposed algorithm provides better security and performance in the presence of wormhole
attack than conventional AODV.
KEYWORDS
MANET, Wormhole attack, Wormhole detection technique, Wormhole Avoidance, Statistical analysis.

REFERENCES
1. Perkins C. and Bhagwat P.: Highly dynamic destination-sequenc distance-vector routing (DSDV) for
mobile computers, In Proceedings of ACM Conference on Communications Architectures, Protocols
and Applications (ACM SIGCOMM ‟94), London, UK, pp. 234-244 (1994)
2. Perkins C. and Royer E.: Ad hoc on-demand distance vector routing, In Proceedings of Second IEEE
Workshop on Mobile Computing Systems and Applications, pp. 90-100 (1999)
3. Perkins.C.E : Ad hoc Networking, Boston, Addison Wesley (2001)
4. Yang H., Luo H., Ye F., Lu S. and Zhang L.: Security in mobile ad hoc networks: challenges and
solutions, In IEEE Wireless Communications, vol. 11, no. 1, pp.38–47 (2004)
5. Zhen J. and Srinivas S.: Preventing replay attacks for secure routing in ad hoc networks, In
ADHOCNOW, LNCS 2865, pp. 140–150 (2003)
6. Hu Y.-C., Perrig A. and Johnson D. B.: Rushing attacks and defense in wireless ad hoc network
routing protocols, In W. D. Maughan and A. Perrig, editors, ACM Workshopon Wireless Security
(WiSe), pp. 30–40 (2003)
7. Tamilselvan L. and Sankaranarayanan D. V.: Prevention of impersonation attack in wireless mobile
ad hoc networks, International Journal of Computer Science and Network Security (IJCSNS), vol. 7,
no. 3, pp.118–123 (2007)
8. Papadimitratos P. and Haas Z. J.: Secure routing for mobile ad hoc networks, In Proceedings of SCS
Communication Networks and Distributed Systems Modeling and Simulation Conference (2002)
9. Hu Y.-C., Johnson D. B. and Perrig A.: SEAD: Secure efficient distance vector routing for mobile
wireless ad hoc networks, In IEEE Workshop on Mobile Computing Systems and Applications
(WMCSA), pp. 3–13 (2002)
10. Upadhyay S. and Chaurasia B. K.: Impact of Wormhole Attacks on MANETs, In International
Journal of Computer Science & Emerging Technologies, vol. 2, issue 1, pp. 77-82 (2011)
11. Yang H., Luo H., Ye F., Lu S. and Zhang L.: Security in mobile ad hoc networks: challenges and
solutions, IEEE Wireless Communications, vol. 11, no. 1, pp. 38–47 (2004)
12. Perkins C., Belding-Royer E. and Das S.: Ad hoc On-Demand Distance Vector (AODV) Routing,
RFC 3561 (2003)
13. Upadhyay S. and Chaurasia B. K.: Detecting and Avoiding Wormhole Attack in MANET using
Statistical Analysis Approach, In the Second International Conference on Computer Science and
Information Technology (CCSIT- 2012), Springer, pp. (2012)

AUTHORS
Saurabh Upadhyay is working as Asst. Prof . With Sarvottam Institute of Technology and management
,Greater Noida . He received his M. Tech. (Software System) from SATI, Vidisha, India. His area of
interest is Security in Ad-hoc network and Cyber security. (saurabh.cse.cs@gmail.com)
Aruna bajpai is persuing mtech from sati,vidisha. Her area of interest are privacy issue in data mining and
security is wireless and sensor networks .(arunabajpai20@gmail.com)

A Hybrid Approach to Counter Application Layer DDOS Attacks
S. Renuka Devi and P. Yogesh, AnnaUniversity, India
ABSTRACT
Distributed Denial-of-Service (DDoS) attacks are a growing threat across Internet, disrupting access to
Information and services. Now a days, these attacks are targeting the application layer. Attackers are
employing techniques that are very difficult to detect and mitigate. This paper proposes a hybrid detection
scheme based on the trust information and information theory based metrics. Initial filtering is based on
the trust value scored by the client. Then the information based metric, entropy, is applied for final
filltering of suspicious flow. Trust value for a client is assigned by the server based on the access pattern
of the client and updated everytime when the client contacts the server. The request from the client always
includes this trust value to identify itself to the server. The Web user browsing behaviour (HTTP request
rate, page viewing time and sequence of the requested objects) of the client is captured from the system
log during non-attack cases. Based on the observation, Entropy of requests per session is calculated and
used for rate limiting the flow further. A scheduler is included to schedule the session based on the trust
value of the user and the system workload.
KEYWORDS
DDoS, Application Layer, Trust value &Entropy

REFERENCES
[1] Shui Yu, Wanlei Zhou, Robin Doss, &WeijiaJia, (2011) "Traceback of DDoS Attacks using Entropy
Variations", IEEE Transactions on Parallel and Distributed Systems.
[2] SupranamayaRanjan, Ram Swaminathan, Mustafa Uysal, Antonio Nucci, & Edward Knightly,
(2009) “DDoS-Shield: DDoS-Resilient Scheduling to Counter Application Layer attacks”,
IEEE/ACM Transactions on Networking, Vol. 17, No. 1.
[3] Huey-Ing Liu& Kuo-Chao Chang, (2011) “Defending systems Against Tilt DDoS attacks”, 6th
International Conference on Telecommunication Systems, Services, and Applications.
[4] Jin Wang, Xiaolong Yang &Keping Long, (2010) “A New Relative Entropy Based App-DDoS
Detection Method”, IEEE Symposium On Computers And Communications (Iscc).
[5] S. Yu, W. Zhou &R. Doss, (2008) “Information theory based detection against network behavior
mimicking DDoSattack,” IEEE Communications Letters, vol. 12, no. 4, pp. 319–321.
[6] Jie Yu, Chengfang Fang, Liming Lu&Zhoujun Li, (2009) “A Lightweight Mechanism to Mitigate
Application Layer DDoS Attacks”, in Proceedings of Infoscale'2009.
[7] G.Oikonomou&J.Mirkovic, (2009) “Modeling human behavior for defense against flash-crowd
attacks”, ICC2009.
[8] S.Kandula, D.Katabi, MJacob&A.W.Berger, (2005) “Botz-4-sale: surviving organized DDoS
attacks that mimic flash crowds”, in Proc. Second Symp. Networked Systems Design and
Implementation (NSDI).
[9] J. Yu, Z. Li, H. Chen & X. Chen, (2007) “A Detection and Defense Mechanism to Defend Against
Application Layer DDoS Attacks”, in Proceedings of ICNS'07.
[10] `Yi Xie& Shun-Zheng Yu, (2009) “Monitoring the Application-Layer DDoS Attacks for Popular
Websites”, IEEE/ACM Transactions on Networking, Vol. 17, No. 1.
[11]` L. Limwiwatkul& A. Rungsawangr, (2004) “Distributed denial of service detection using TCP/IP
header and traffi measurement analysis,” in Proc. Int. Symp. Commun. Inf. Technol., Sappoo, Japan,
Oct. 26–29, pp. 605–610.
[12] Haining Wang, Cheng Jin& Kang G. Shin, (2007) “Defense Against Spoofed IP Traffic Using
HopCount Filtering”, IEEE Transactions on Networking,vol.15.No.1, pp.40-53.
[13] Perrig A., Song D,&Yaar A., (2003) “StackPi: a new defense mechanism against IP spoofing and
DDoS attacks”, CMU technical report.
[14] Tanachaiwiwat, S. & Hwang, K., (2003) “Differential packet filtering against DDoS flood attacks.”
ACM Conference on Computer and Communications Security (CCS).
[15] Keromytis, A.D., Misra, V., & Rubenstein, D., (2004) “SOS: an architecture for mitigating DDoS
attacks”, Selected Areas in Communications, IEEE Journal vol. 22, no. 1.

[16] J. B. D. Cabrera, L. Lewis, X. Qin, W. Lee, R. K. Prasanth, B. Ravichandran& R. K. Mehra, (2001)
“Proactive detection of distributed denial of service attacks using MIB traffic variables a feasibility
study”, in Proc. IEEE/IFIP Int. Symp. Integr. Netw. Manag., pp. 609–622.
[17] J. Yuan & K. Mills, (2005) “Monitoring the macroscopic effect of DDoS flooding attacks,” IEEE
Trans. Dependable and Secure Computing, vol. 2, no. 4, pp. 324–335.
[18] W. Yen & M.-F. Lee, (2005) “Defending application DDoS with constraint random request
attacks,” in Proc. Asia-Pacific Conf. Commun., Perth, Western Australia, pp. 620–624.

Improved Caesar Cipher with Random Number Generation Technique and
Multistage Encryption
S G Srikantaswamy and H D Phaneendra, National Institute of Engineering, Mysore,India
ABSTRACT
Secured Communication involves Encryption process at the sending end and Decryption process at the
receiving end of the communication system. Many Ciphers have been developed to provide data security .
The efficiency of the Ciphers that are being used depends mainly on their throughput and memory
requirement. Using of large key spaces with huge number of rounds with multiple complex operations
may provide security but at the same time affects speed of operation. Hence in this paper we have
proposed a method to improve Caesar cipher with random number generation technique for key
generation operations. The Caesar cipher has been expanded so as to include alphabets, numbers and
symbols. The original Caesar cipher was restricted only for alphabets. The key used for Caesar
Substitution has been derived using a key Matrix Trace value restricted to Modulo 94. The Matrix
elements are generated using recursive random number generation equation, the output of which solely
depends on the value of seed selected . In this paper, we made an effort to incorporate modern cipher
properties to classical cipher. The second stage of encryption has been performed using columnar
transposition with arbitrary random order column selection. Thus the proposed Scheme is a hybrid
version of classical and modern cipher properties. The proposed method provides appreciable Security
with high throughput and occupies minimum memory space. The Method is resistant against brute-force
attack with 93! Combinations of keys, for Caesar encryption.
KEYWORDS:
Encryption, Decryption, Substitution, Cipher, Random Number, Recursive, Primitive root, Plaintext,
Cipher text

REFERENCES :
[1] A.F.A.Abidin, O.Y. Chuan and M.R.K. ariffin-“ A Novel enhancement Technique of the Hill Cipher
for effective Cryptographic Purposes ‘- Journal of Computer science , 7(5): 785-789, 2011
[2] Dharmendra Kumar Gupta , Sumit Kumar Srivastava, Vedpal Singh- “ New Concept of encryption
algorithm A hybrid approach of Caesar Cipher and Columnar transposition in multi stages “ –
Journal of Global Research in Computer Science, Volume 3 , No. 1 , January 2012 , P. No. 60-66
[3] Fauzan Saeed , Mustafa Rashid- “ Integrating Classical Encryption with Modern Technique “ –
IJCSNS, Volume 10, No. 5, May 2010
[4] Prof.K.Govinda , Dr.E. sathiyamoorth-“Multilevel Cryptography Technique Using Graceful Codes
“- JGRCS, Volume 2, No.7, July 2011
[5] Monodeep Banerjee , Saptarshi Naskar , krishnendu Basuli , Samar Sen Sarma- “ A Novel scheme
for Text data encryption “- JGRCS, Volume 3, No.1, January 2012
[6] Phillip I Wilson and Mario Garcia – “ A Modified Version of the Vigenere Algorithm “- IJCSNS,
Vol. 6, No.3B, march 2006
[7] Packirisamy Murali and Gandhi doss Senthil Kumar – “ Modified Version of Playfair cipher using
Linear feedback Shift Register “ – IJCSNS, Vol.8, No.12, December 2008
[8] Raj jain-“The art of Computer Systems Performance Analys is”-John Wiley & sons Inc.
[ 9] Rushdi. A. Hamamreh, Mousa Farajallah – “ Design of a Robust Cryptosystem Algorithm for
NonInvertible Matrices Based on Hill Cipher “- IJCsNS, Volume 9, No.5, May 2009
[10] Sriram Ramanujam , Mrimuthu Karuppiah – “ Designing an algorithm with high Avalanche effect
“- International Journal of Computer Science and Network Security “, - Volume 11, No.1 , January
2011
[11] http://en.wikipedia.org/wiki/Caesar_cipher
[12] William Stallings- “ Cryptography and Network security, Second Edition

Cryptanalyzing of Message Digest Algorithms MD4 and MD5
Md. Alam Hossain, Md. Kamrul Islam, Subrata Kumar Das and Md. Asif Nashiry,Jessore Science &
Technology University Bangladesh.
ABSTRACT
Hash functions are tools used in integrity of messages, digital signatures and digital time stamping.
Message digest algorithms started with public key cryptography for authentication. Digest algorithms
compute some hash functions, which are message digest values based on a simple set of primitive
operations of 32-bit words. Among the digest algorithms MD4 and MD5 are most popular. Both these
algorithms perform a set of bitwise logical operations. They generate 128-bit digest values from a given
message. Time complexity of MD5 is more than MD4 and hence somewhat slower to execute. The
message digest algorithms MD4, MD5 have been discussed in detail. A new method has been introduced
for obtaining collisions for reduced number of rounds of MD4 and MD5 algorithms. The time
complexity, performance and attacks of MD4 and MD5 algorithm have been computed using this method.
The strength has been computed on change in message; the new method can prove its strength.
KEYWORDS
Data integrity, Authentication, Non-repudiation, Time complexity

REFERENCES
[1] T. ELGamal, (1985) “A Public Key Cryptosystem and a Signature Scheme Based on Discrete
Logarithms”, IEEE Transactions on Information Theory, Vol. 31.
[2] R. Rivest, (1992) “The MD5 Message-Digest Algorithm”, RFC 1321.
[3] T.S. Ganesha, M.T. Fredericka, T.S.B. Sudarshanb, and A.K. Somania, (2007) “Hashchip: A shared-
resource multi-hash function processor architecture on FPGA”, The VLSI journal, vol. 40. pp. 11-
19.
[4] W. Diffie and M. E. Hellman, (1976) “New Directions in Cryptography “, IEEE Transactions on
Information Theory, Vol. 22, No. 6.
[5] B. den Boer, and A. Bosselaers, (1994) “Collisions for the compression function of MD5”,
Advances in Cryptology, Proc. Eurocrypt'93, LNCS 765, T. Hellseth, Ed., Springer Verlag,194,
pp.293- 304.
[6] H. Dobbertin, (1996) “Cryptanalysis of MD5 compress”. Announcement on Internet.
[7] Hans Dobbertin, (1998) “Cryptanalysis of MD4” Journal of Cryptology Volume-11, Issue 04, pp
253-271.
[8] J. Deepakumara, H.M. Heys, and R. Venkatesan, (2001) “FPGA implementation of MD5 hash
algorithm”, IEEE , vol.2, pp. 919 – 924.
[9] R. Rivest, (1992) “The MD4 Message-Digest Algorithm”, RFC 1320.
[10] R.L. Rivest, (2001) “The MD4 message Digest Algorithm”, Abstracts Crypto’91, pp.281-291.
[11] R.L Rivest, (1991) “The MD5 message digest algorithm”, Presented at the rump session of
Crypto'91.
[12] A. Menezes, P, van Oorschot, Vanstone S., “The goals of cryptography”, Important Part of
Handbook of Applied Cryptography
[13] R.L. Rivest, (1991) “The MD4 Message Digest Algorithm, Advances in Cryptology”Crypto ’90
Proceedings, Lecture Notes in Computer Science 537, Spring-Verlag, pp. 303-311.
[14] E. Biham, and A. Shamir, (1993) “Differential Cryptanalysis of Full 16-Round DES”, Advances in
Cryptology- CRYPTO ’92 Proceedings, Springer-Verlag.
[15] B. den Boer and A. Bosselaers, (1992) “An attack on the last two rounds of MD4, Advances in
cryptology”, Proc. Crypto'91, LNCS 576, J. Feigenbaum, Ed., Springer-Verlag,192, pp.194-203.
[16] C. Kaufman, (1993) “DASS- Distributed Authentication Security Service”, RFC 1507, September.
[17] B. Den Boer and A. Bosserlaers, (1992) “An Attack on the Last Two Rounds of MD4”, Advances in
Cryptology-Crypto ’91 Proceedings, Spring-Verlag, pp. 194-203.

[18] M. E. Hellman, (1978) “An Overview of Public-Key Cryptography”, IEEE Transactions on
Communications, Vol. 16#6, pp. 24-32.
[19] H. S. Kwok Wallace and K. S. Tang, (2004) “ A Chaos-Based Cryptographic Hash Function for
Message Authentication”, International Journal of Bifurcation and Chaos (IJBC), Vol. 15, pp. 4043-
4050.
[21] W. Diffie, (1988) “The First Ten Years of Public-Key Cryptography”, Proceedings of the IEEE, Vol.
7#5, May 1988, pp. 560 - 577.

Penetration Testing in Agile Software Development Projects
Martin Tomanek and Tomas Klima, University of Economics, Czech Republic
ABSTRACT
Agile development methods are commonly used to iteratively develop the information systems and they
can easily handle ever-changing business requirements. Scrum is one of the most popular agile software
development frameworks. The popularity is caused by the simplified process framework and its focus on
teamwork. The objective of Scrum is to deliver working software and demonstrate it to the customer
faster and more frequent during the software development project. However the security requirements for
the developing information systems have often a low priority. This requirements prioritization issue
results in the situations where the solution meets all the business requirements but it is vulnerable to
potential security threats. The major benefit of the Scrum framework is the iterative development
approach and the opportunity to automate penetration tests. Therefore the security vulnerabilities can be
discovered and solved more often which will positively contribute to the overall information system
protection against potential hackers. In this research paper the authors propose how the agile software
development framework Scrum can be enriched by considering the penetration tests and related security
requirements during the software development lifecycle. Authors apply in this paper the knowledge and
expertise from their previous work focused on development of the new information system penetration
tests methodology PETA with focus on using COBIT 4.1 as the framework for management of these
tests, and on previous work focused on tailoring the project management framework PRINCE2 with
Scrum. The outcomes of this paper can be used primarily by the security managers, users, developers and
auditors. The security managers may benefit from the iterative software development approach and
penetration tests automation. The developers and users will better understand the importance of the
penetration tests and they will learn how to effectively embed the tests into the agile development
lifecycle. Last but not least the auditors may use the outcomes of this paper as recommendations for
companies struggling with penetrations testing embedded in the agile software development process.
KEYWORDS
Agile Development, Penetration, Test, Scrum, Project Management, Software

REFERENCES
[1] The Standish Group, “Chaos Manifesto 2013.” The Standish Group, 2013.
[2] J. Kalina, Z. Smutny, and V. Reznicek, “Business Process Maturity as a Case of Managerial
Cybernetics and Effective Information Managemen,” in Proceedings of the 7th European Conference
on IS Management and Evaluation, Sopot, Poland, 2013, pp. 215–221.
[3] J. Basl and P. Doucek, “ICT and Innovations in Context of the Sustainable Development in
Europe,” in 20th Interdisciplinary Information Management Talks, Jindrichuv Hradec, Czech
Republic, 2012, pp. 153–161.
[4] K. Beck, M. Beedle, A. van Bennekum, A. Cockburn, W. Cunningham, M. Fowler, J. Grenning, J.
Highsmith, A. Hunt, R. Jeffries, J. Kern, B. Marick, R. C. Martin, S. Mellor, K. Schwaber, J.
Sutherland, and D. Thomas, “Manifesto for Agile Software Development,” 2001. [Online].
Available: http://agilemanifesto.org/.
[5] S. W. Ambler, “2013 IT Project Success Rates Survey Results,” 2013 IT Project Success Rates
Survey Results, Dec-2013. [Online]. Available:
http://www.ambysoft.com/surveys/success2013.html.
[6] J. Balada and A. Buchalcevova, “Scrum Adoption for Information System Development within
Complex Environments,” in SOFSEM 2013 Theory and Practice of Computer Science, Spindleruv
Mlyn, Czech Republic, 2013, vol. 2013, pp. 42–53.
[7] D. Raithatha, “Making the Whole Product Agile – A Product Owners Perspective,” in Agile
Processes in Software Engineering and Extreme Programming, G. Concas, E. Damiani, M. Scotto,
and G. Succi, Eds. Springer Berlin Heidelberg, 2007, pp. 184–187.
[8] VersionOne, “8th Annual State of Agile Survey.” VersionOne Inc., 30-Jun-2014.
[9] K. Schwaber and J. Sutherland, “The Scrum Guide: The definitive guide to Scrum: The rules of the
game.” SCRUM.org, Jul-2013.
[10] P. van Kessel and K. Allan, “Under cyber attack. EY’s Global Information Security Survey 2013.”
Ernst & Young, Oct-2013.
[11] V. Kettunen, J. Kasurinen, O. Taipale, and K. Smolander, “A study on agility and testing processes
in software organizations,” in Proceedings of the 19th international symposium on Software testing
and analysis, New York, NY, USA, 2010, pp. 231–240.
[12] J. Li, N. B. Moe, and T. Dybaa, “Transition from a plan-driven process to Scrum: a longitudinal
case study on software quality,” in Proceedings of the 2010 ACM-IEEE International Symposium on
Empirical Software Engineering and Measurement, New York, NY, USA, 2010, pp. 13:1–13:10.
[13] M. Stoica, M. Mircea, and B. Ghilic-Micu, “Software Development: Agile vs. Traditional,” Inform.
Econ., vol. 17, no. 4, pp. 64–76, Dec. 2013.
[14] M. Sumrell, “From Waterfall to Agile - How does a QA Team Transition?,” in Proceedings of the
AGILE 2007, Washington, DC, USA, 2007, pp. 291–295.

AUTHORS
Martin Tomanek
Martin Tomanek graduated from applied informatics at the Faculty of Informatics and Statistics,
University of Economics, Prague. Currently, he is PhD student at the Department of Systems Analysis,
Faculty of Informatics and Statistics, University of Economics, Prague, where he develops the integrated
framework based on PRINCE2, Scrum and other best practices used in SW development area.
Tomas Klima
Tomas Klima graduated from applied informatics at the Faculty of Informatics and Statistics, University
of Economics, Prague. Currently, he is PhD student at the Department of Systems Analysis, Faculty of
Informatics and Statistics, University of Economics, Prague, where he deals with information security and
develops a new framework for penetration testing.

TOP 10 CITED PAPERS FOR CRYPTOGRAPHY AND INFORMATION SECURITY

TOP 10 CITED PAPERS FOR CRYPTOGRAPHY AND INFORMATION SECURITY

More Related Content

What's hot (18)

Similar to TOP 10 CITED PAPERS FOR CRYPTOGRAPHY AND INFORMATION SECURITY (20)

Recently uploaded (20)

TOP 10 CITED PAPERS FOR CRYPTOGRAPHY AND INFORMATION SECURITY