Safeguard confidential web information from malicious browser extension using Encryption and Isolation techniques

Ill-intentioned browser extensions pose an emergent security risk and have become one of the most common attack vectors on the Internet due to their wide popularity and high privilege. Once installed, malicious extensions are executed and attempt to compromise a victim’s browser. To detect malicious browser extensions, security researchers have put forward several techniques. These techniques primarily concentrate on the usage of API calls by malicious extensions, imposing restricted policies for extensions, and monitoring extension’s activities. In this paper, we propose a machine-learning-based approach to detect malicious extensions. We apply static and dynamic techniques to analyse an extension for extracting features. The analysis process extracts features from the source codes including JavaScript codes, HTML pages, and CSS files and the execution activities of an extension. To guarantee the robustness of the features, a feature selection method is then applied to retain the most relevant features while discarding low-correlated features. The detection models based on machine-learning techniques are subsequently constructed by leveraging these features. As can be seen from evaluation results, our detection model, containing over 4,600 labelled extension samples, is able to detect malicious extensions with an accuracy of 96.52% in validation set and 95.18% in test set, with a false positive rate of 2.38% in validation set and 3.66% in test set.

CHAPTER 1 - Cross-Site Scripting

The popularity and improvement in features provided by various Internet services are leading us to a situation where personal information items can be stored and managed online. Personal Information Management (PIM) refers to a set of activities a person performs in order to acquire or create, store, organize, maintain, retrieve, use and distribute personal information for different purposes, including preserving personal and family information assets. The main purpose of this study was to investigate perceptions of university students of Internet services for managing their personal information; the type of information stored by them; how they organize, manage, access and control information distribution; and their concerns regarding privacy and security of their personal information. A pre-tested questionnaire was used for data collection and 212 students from two public universities took part in this study. It was found that 75% of the respondents were using Internet services for storing and managing some of their personal information items. The Internet services were mainly used by the students for storing email addresses and messages, personal text documents and photos. Only a small number of the students were using online storage for maintaining information about their appointments, telephone numbers, draft documents, audio and video recordings, and list of thing to be done. Over two-thirds of the respondents revealed that they only store non-sensitive personal information due to their concerns related to privacy and security of personal information. The paper also suggests certain measures for the improvement of personal information management skills of students and the general public.KeywordsPersonal information managementinternet servicessocial networking servicesinformation fragmentationSingapore

The increasing use of digital technologies in public health management has significantly expanded the processing of sensitive personal data, requiring legal mechanisms capable of ensuring the protection of privacy and fundamental rights. In this context, the Brazilian General Data Protection Law establishes regulatory parameters governing the processing of personal information by public and private institutions, including those operating in the healthcare sector. This study aims to analyze the legal challenges related to the application of the General Data Protection Law in the processing of sensitive data within the public health system of Manaus, Amazonas. The research is characterized as a qualitative and descriptive literature review, based on recent scientific articles and academic studies addressing personal data protection, information governance and public sector responsibility in health data processing. The results indicate that the implementation of the legislation faces challenges related to technological infrastructure, the absence of consolidated institutional information security policies and the need for training of public agents responsible for data processing. It is observed that the effectiveness of data protection regulations depends on the integration between legal norms, administrative practices and governance mechanisms capable of ensuring transparency, security and accountability in the use of personal information. The study concludes that strengthening institutional strategies aimed at protecting sensitive data represents an essential element for the consolidation of safer public health services aligned with the protection of fundamental rights, particularly within the Amazonian context.

<p>Web data extraction is the process of extracting user required information from web page. The information consists of semi-structured data not in structured format. The extraction data involves the web documents in html format. Nowadays, most people uses web data extractors because the extraction involve large information which makes the process of manual information extraction takes time and complicated. We present in this paper WEIDJ approach to extract images from the web, whose goal is to harvest images as object from template-based html pages. The WEIDJ (Web Extraction Image using DOM (Document Object Model) and JSON (JavaScript Object Notation)) applies DOM theory in order to build the structure and JSON as environment of programming. The extraction process leverages both the input of web address and the structure of extraction. Then, WEIDJ splits DOM tree into small subtrees and applies searching algorithm by visual blocks for each web page to find images. Our approach focus on three level of extraction; single web page, multiple web page and the whole web page. Extensive experiments on several biodiversity web pages has been done to show the comparison time performance between image extraction using DOM, JSON and WEIDJ for single web page. The experimental results advocate via our model, WEIDJ image extraction can be done fast and effectively.</p>

Purpose – Personal projects are any kind of projects whose management is left to an individual untrained in project management and is greatly influenced by this individual’s personal touch. This includes the majority of knowledge workers who daily manage information relating to several personal projects. The authors have conducted an in-depth qualitative investigation on information management of such projects and the tacit knowledge behind its processes that cannot be found in the organisational structures of current personal information management (PIM) tools (file managers, e-mail clients, web browsers). The purpose of this paper is to reveal and understand project information management practices in details and provide guidelines for personal project management tools. Design/methodology/approach – Semi-structured interviews similar to that in several other PIM exploratory studies were carried out focusing on project fragmentation, information overlap and project context recreation. In addition, the authors enhanced interviews with sketching approach not yet used to study PIM. Sketches were used for articulating things that were not easily expressed through words, they represented a time stamp of a project context in the projects’ lifetime, uncovered additional tacit knowledge behind project information management not mentioned during the interviews, and were also used to find what they have in common which might be used in prototype designing. Findings – The paper presents first personal project definition based on the conceptualisations derived from the study. The study revealed that the extensive information fragmentation in the file hierarchy (due to different organisational needs and ease of information access) poses a significant challenge to context recreation besides cross-tool fragmentation so far described in the literature. The study also reveals the division of project information into core and support and emphasises the importance of support information in relation to project goals. Other findings uncover the division of input/output information, project overlaps through information reuse, storytelling and visualising information relations, which could help with user modelling and enhancing project context recreation. Research limitations/implications – On of the limitations is the group of participants that cannot represent the ideally generalised knowledge worker as there are many different kinds of knowledge workers and they all have different information needs besides different management practices. However, participants of variety of different backgrounds were observed and the authors converged observations into points of project information management similarities across the spectrum of different professions. Nevertheless, its observations and conceptualisations should be repeatable. For one, some of the issues that emerged during this work have been to different extents discussed in other studies. Practical implications – The empirical findings are used to create guidelines for designing personal project information management tools: support the selective focus on information with the division into core and supportive information; visualise changes in project information space to support narratives for context recreation; overcome fragmentation in the file system with selective unification; visualising project’s information relationship to better understand the complexity of project information space; and support navigating in project information space on two axes: time and between projects (overlaps through information). Originality/value – The study presents a longitudinal insight into personal project information management. As such it provides a first formal definition of personal project from the information point of view. The method used in the study presented uses a new approach – sketching in which participants externalised and visualised personal information and projects they discussed. The insights derived from the study form design implications for personal project management tools for knowledge workers.

This study focuses on the data protection of Indonesian citizens in transborder personal data transfers between Indonesia and Japan, which is increasingly relevant in the era of global connectivity and digital advances. Concerns about protection of personal data and security of personal data is increasing following existing progress. This research uses a comparative juridical approach, which allows for a comparison between the legal and regulatory frameworks protecting personal data in the two countries and conducts a comparative study of the two principles. The findings from this study show that Indonesia and Japan have implemented laws to protect the personal data of their citizens. Although there are similarities in the protection of personal data, there are differences in the mechanisms governing the requirements for transborder transfers of personal data between the two countries. This study uses a descriptive-analytic method to provide an overview and analysis of the application of regulations based on applicable legal provisions. The main objective is to analyze the differences and similarities between the two laws to draw general conclusions regarding the approaches and rules applied to the protection of personal data in Indonesia and Japan. Thus, this research provides important insights into the safeguarding of personal data in the context of transborder data transfers between the two country.This study focuses on the data protection of Indonesian citizens in transborder personal data transfers between Indonesia and Japan, which is increasingly relevant in the era of global connectivity and digital advances. Concerns about protection of personal data and security of personal data is increasing following existing progress. This research uses a comparative juridical approach, which allows for a comparison between the legal and regulatory frameworks protecting personal data in the two countries and conducts a comparative study of the two principles. The findings from this study show that Indonesia and Japan have implemented laws to protect the personal data of their citizens. Although there are similarities in the protection of personal data, there are differences in the mechanisms governing the requirements for transborder transfers of personal data between the two countries. This study uses a descriptive-analytic method to provide an overview and analysis of the application of regulations based on applicable legal provisions. The main objective is to analyze the differences and similarities between the two laws to draw general conclusions regarding the approaches and rules applied to the protection of personal data in Indonesia and Japan. Thus, this research provides important insights into the safeguarding of personal data in the context of transborder data transfers between the two country.

Identity theft has become one of the fastest growing white collar crimes in the world. It occurs when an individual's personal information such as inter alia his or her name, date of birth or credit card details is used by another individual to commit identity fraud. Identity theft can be committed via physical means or online. The increased use of the Internet for business and financial transactions, social networking and the storage of personal information has facilitated the work of identity thieves. Identity theft has an impact on the personal finances and emotional well-being of victims, and on the financial institutions and economies of countries. It presents challenges for law enforcement agencies and governments worldwide. This article examines how identity thieves use the personal information of individuals to commit identity fraud and theft, and looks at legislative solutions introduced in South Africa, the United States of America, the United Kingdom and India to combat identity theft crimes. The article examines measures introduced by the respective governments in these countries to counteract such crimes. Finally, the article will propose a way forward to counteract such crimes in the future. The study reveals that identity theft is a growing and evolving problem that requires a multi-faceted and multi-disciplinary approach by law enforcement agencies, businesses, individuals and collaboration between countries. It is advocated that businesses and institutions should take measures to protect personal information better and that individuals should be educated about their rights, and be vigilant and protect their personal information offline and in cyberspace.

In a society in which knowledge is one of the main sources of wealth, the internet and Information and Communication Technology (ICT) play an important role in the rapid dissemination of information, connecting people, accelerating the production, distribution and intensive use of information on networks, which allows reflection on how the collection, storage and analysis of this information and data, sometimes sensitive, is being carried out. This research questions the consequences of the absence of personal data in the list of sensitive data provided for in the General Data Protection Law (LGPD). Therefore, the general objective of the study is to investigate the impacts and applicability of the LGPD in protecting the rights to privacy, freedom and security of personal data in Brazil. To this end, the legal bases for the processing of personal and sensitive data in the LGPD were identified, an analysis of the risks of personal data leaks and fraud and the protection measures provided for by the LGPD were carried out, and then the sanctions provided for in the LGPD and their value in liability for data crimes were assessed. This work was developed using a qualitative methodological approach, with a deductive method and bibliographic and documentary research.

Privacy in India: Attitudes and Awareness V 2.0

With the rapid development of mobile Internet, minors' personal information is inevitably collected and processed by various information processors. Due to the characteristics of immature mental development and weak risk prediction ability of minors, it is difficult to effectively protect their personal information security. Although China's "Personal Information Protection Law" makes provisions on the protection of minors' personal information, there are still some problems such as "one-size-fits-all" age limit and imperfect guardian consent system. This paper will test the current hundreds of various types of apps, conduct a questionnaire survey on the protection of personal information of minors and their guardians, analyze the current dilemma of the protection of personal information of minors at the social level, propose countermeasures according to the symptoms, and explore more targeted ways to protect the rights and interests of minors' personal information. Escort the physical and mental healthy development of minors under the background of the information age.

So, you are taking a trip and have booked your flight, paid your bills, bought a travel insurance and made hotel bookings–all without talking to a single person. Of course, you used the Internet to accomplish your tasks. But how can you be sure that your personal information used to book flights, buy a travel insurance and make hotel bookings would not be used by the concerned companies to send you junk email or it is not sold to some direct marketers without your consent? How can you be sure that your personal information and credit card details were transmitted in a secure mode? How can you be sure that online businesses have proper high integrity business processes to handle your private information with due care? You may also have worries that if something does go wrong, i.e., your personal information is stolen, misused or abused, what recourse would you have. These are all legitimate social responsibility concerns which have surfaced more so in the information age because of technological advances and our growing reliance on information and communication technologies to carry out our daily work.

Phishing is a well-known technique used by internet fraudsters for acquiring sensitive and personal information from users by impersonating a real identity. A Phishing attack involves various deceptions & advanced cybercrime techniques, some of them includes email spoofing, exploiting browser side vulnerabilities, fraudulent emails and Phished websites creation techniques using scripting languages and technologies. Phishing causes identity, goodwill and money loss to companies and individuals. One of the major problems we identified is the reduced usage and reliability on the email Infrastructure as a communication medium between customers and companies. Previous schemes for phishing prevention such as those which use browser extension, Quick Response code, Extended Authentication server & device and smart card based techniques are complex and difficult to make use in real world scenario. We present an architecture that can be used by companies for preventing phishing attacks by sharing a piece of secret information with every customer and using it as an authentication mechanism to prove their originality when a customer login to their websites using links provided in their emails. The unavailability of secret information which is securely shared between customer and the company will prevent a phisher in creating deception and hence will prevent phishing attacks which occur due to malicious links in phished emails. This will increase the reliability of email service as an authentic communication medium. The efficacy of this technique does not rely on results of any spam or phishing prevention scheme provided at email service provider side.

As the amount of web pages increase, identifying and retrieving distinct contents from the web has increasingly become more and more difficult. The traditional approach for extracting data from web page documents is to analyze the DOM (Document Object Model) structure of a HTML page and find a common pattern. However, the number of possible DOM layout patterns is virtually infinite, which means that there is no common pattern that can be used for all kinds of web pages. In this paper, we focus on the pages that are linked to a search engine and aim to analyze the features of relevant and meaningful contents instead of a common pattern. Three features of relevant snippets are introduced. They are: quantity of text, correlation between snippet and query that is inputted into a search engine, and HTML structure. Nine parameters are used to describe the three features. Also, a SVM learning experiment is conducted to verify the effectiveness of the three features. The results show that the HTML structure feature is the most effective feature which can determine whether a snippet is relevant or not.

Personal big data pricing method based on differential privacy