Learn More
Phishing is a significant problem involving fraudulent email and web sites that trick unsuspecting users into revealing private information. In this paper, we present the design, implementation, and evaluation of CANTINA, a novel, content-based approach to detecting phishing web sites, based on the TF-IDF information retrieval algorithm. We also discuss the(More)
There are currently dozens of freely available tools to combat phishing and other web-based scams, many of which are web browser extensions that warn users when they are browsing a suspected phishing site. We developed an automated test bed for testing anti-phishing tools. We used 200 verified phishing URLs from two sources and 516 legitimate URLs to test(More)
There are currently dozens of freely available tools to combat phishing and other web-based scams, many of which are web browser extensions that warn users when they are browsing a suspected phishing site. We developed an automated test bed for testing anti-phishing tools. We used 200 verified phishing URLs from two sources and 516 legitimate URLs to test(More)
Generalized Temporal Role Based Access Control (GTRBAC) [1] is an extension of the well known RBAC model that supports temporal constraints on access control policies. GTRBAC is an expressive but complex model supporting many types of temporal constraints. Presence of such many constraints poses a great challenge in implementing the GTRBAC model, making it(More)
A role hierarchy defines permission acquisition and role-activation semantics through role--role relationships. It can be utilized for efficiently and effectively structuring functional roles of an organization having related access-control needs. The focus of this paper is the analysis of hybrid role hierarchies in the context of the <i>generalized(More)
Recently, administration of RBAC systems using role-based approach has become very appealing because of the benefits that a role-based approach typically brings. This approach uses RBAC itself to manage RBAC policies so that the administration functions can be decentralized and made more efficient. ARBAC97, ARBAC99, and ARBAC02 are series of well-known(More)
A key issue in RBAC systems is how to efficiently handle the user authorization process. That is, whether or not to grant a user's request to acquire a set of requested permissions or to activate a set of requested roles in a single session. The presence of hybrid hierarchies as well as the cardinality and dynamic separation of duty constraints make the(More)
Recently, administration of RBAC systems using a role-based approach has become very appealing because of the benefits that such an approach typically brings. This approach uses RBAC itself to manage RBAC policies so that the administration functions can be decentralized and made more efficient. Existing RBAC administration models, however, fail to deal(More)
Multi-domain environments where distributed multiple organizations interoperate with each other are becoming a reality as witnessed by emerging Internet-based enterprise applications. Ensuring secure interoperation in such multi-domain environments has drawn considerable research works in the past, especially in tightly coupled, federated environments.(More)
i To my wife Phoebe Chao, for her loving support every step along the way. ii ACKNOWLEDGMENTS I would like to thank all the people who have helped and inspired me during my doctoral study. I especially want to thank my advisor, Prof. Lorrie Cranor, for her guidance during my research and study at Carnegie Mellon. Her warm and encouraging spirit, enthusiasm(More)