Miracle-dz/UniFAR-FTUs huggingface dataset:
Amitriptyline induces mitophagy that precedes apoptosis in human HepG2 cells

Systemic treatments for hepatocellular carcinoma (HCC) have been largely unsuccessful. This study investigated the antitumoral activity of Amitriptyline, a tricyclic antidepressant, in hepatoma cells. Amitriptyline-induced toxicity involved early mitophagy activation that subsequently switched to apoptosis. Amitriptyline induced mitochondria dysfunction and oxidative stress in HepG2 cells. Amitriptyline specifically inhibited mitochondrial complex III activity that is associated with decreased mitochondrial membrane potential (∆Ψm) and increased reactive oxygen species (ROS) production. Transmission electron microscopy (TEM) studies revealed structurally abnormal mitochondria that were engulfed by double-membrane structures resembling autophagosomes. Consistent with mitophagy activation, fluorescence microscopy analysis showed mitochondrial Parkin recruitment and colocalization of mitochondria with autophagosome protein markers. Pharmacological or genetic inhibition of autophagy exacerbated the deleterious effects of Amitriptyline on hepatoma cells and led to increased apoptosis. These results suggest that mitophagy acts as an initial adaptive mechanism of cell survival. However persistent mitochondrial damage induced extensive and lethal mitophagy, autophagy stress and autophagolysome permeabilization leading eventually to cell death by apoptosis. Amitriptyline also induced cell death in hepatoma cells lines with mutated p53 and non-sense p53 mutation. Our results support the hypothesis that Amitriptyline-induced mitochondrial dysfunction can be a useful therapeutic strategy for HCC treatment, especially in tumors showing p53 mutations and/or resistant to genotoxic treatments.
Chronicles for On-line Diagnosis of Distributed Systems

The formalism of chronicles has been proposed to monitor and diagnose dynamic physical systems. Even if efficient chronicle recognition algorithms exist, it is now well-known that distributed approaches are better suited to monitor real systems. In this article, we adapt the chronicle-based approach to a distributed context and illustrate this work on the monitoring of software components.
A new sequential-write-constrained cache management to mitigate write amplification for SMR drives

Shingled magnetic recording (SMR) is regarded as a promising solution for fulfilling the capacity requirement of next-generation big data applications. However, due to the sequential-write constraint of SMR drives, random-write requests could only be achieved via read-merge-write (RMW) operations, which leads to a huge amount of write amplification. SMR drives nowadays employ an on-disk persistent cache area for absorbing random-write traffic. Nevertheless, the on-disk persistent cache area cannot absorb duplicate write traffic via overwriting due to the sequential-write constraint. Such observation motivates us to propose a sequential-write-constrained cache (SWC2) management to mitigate the write amplification issue of SMR drives. The proposed strategy is implemented within the Linux system and the experimental results show that the amount of write amplification can be reduced by an average of 52.27%.
CodeAlchemist: Semantics-Aware Code Generation to Find Vulnerabilities in JavaScript Engines

JavaScript engines are an attractive target for attackers due to their popularity and flexibility in building exploits. Current state-of-the-art fuzzers for finding JavaScript engine vulnerabilities focus mainly on generating syntactically correct test cases based on either a predefined context-free grammar or a trained probabilistic language model. Unfortunately, syntactically correct JavaScript sentences are often semantically invalid at runtime. Furthermore, statically analyzing the semantics of JavaScript code is challenging due to its dynamic nature: JavaScript code is generated at runtime, and JavaScript expressions are dynamically-typed. To address this challenge, we propose a novel test case generation algorithm that we call semantics-aware assembly, and implement it in a fuzz testing tool termed CodeAlchemist. Our tool can generate arbitrary JavaScript code snippets that are both semantically and syntactically correct, and it effectively yields test cases that can crash JavaScript engines. We found numerous vulnerabilities of the latest JavaScript engines with CodeAlchemist and reported them to the vendors.
Hybrid molecule-based information retrieval

The increased availability of interdependent heterogeneous data generated from different sources is fostering the incorporation of semantic knowledge-based graphs and ontologies in information management and search applications. Most of the existing Information Retrieval systems mainly focus on the semantic analysis of the information contained in heterogeneous data. In their results, they provide documents as query answers without considering (i) detailed information regarding relevant granularity levels of the documents, and most importantly (ii) dependencies between the documents or parts of the documents. To overcome these limitations, we propose a graph-based search and ranking algorithm within a generic framework that retrieves the data in the form of a novel augmented data structure for query answers, which we call hybrid molecules. The latter consist of well-defined subgraphs representing relevant contextual information regarding domain-specific information coupled with structural information related to the document. This improves the search results and reduces users' efforts in tracking and interpreting them. Experiments conducted on real world data corpus using projects from the building construction industry validate the effectiveness of our approach.
Requirements for preventing logic flaws in the authentication procedure of web applications

Ensuring the security is one of the most daunting challenges that web applications are facing nowadays. Authentication and authorization are two main security fields that web applications must consider to be protected against unauthorized accesses. Various approaches that detect well-known vulnerabilities and flaws exist. However, these approaches mainly focus on detecting input validation flaws. Another kind of flaws that affect web applications are logic flaws, but they lack of considerations. This paper proposes an approach that helps to considering logic flaws in the context of web applications. The goal of the proposal is to strengthen the authentication procedure of web applications and thus enforce the security early in the design phase. We conducted an empirical study in nine well-known web-based applications to demonstrate that logic flaws may put at risk the authentication procedure. The results showed that logic flaws may be either caused by security issues or usability issues. To overcome such flaws, we provide ten relevant requirements that should be followed in the design of an authentication procedure.
Catfish density estimation by aerial images analysis and deep learning

The food economic chain of many rivers is based on an important control of the presence of predatory fish in the water. The assessment of the predation pressure on migratory species cannot be done manually. Therefore some automatic techniques are needed. In this paper we propose, for the first time, a deep neural architecture to estimate the catfish density from Aerial Images taken on the Loire river. The proposed architecture is adapted to the problem in hand and some variations to existing approaches, never applied in this application context, are designed to better fit the needs of the problem. Preliminary results show the appropriateness of the proposal and form the foundations for future developments on this new application.
Thermodynamic Entropy in Quantum Statistics for Stock Market Networks

The stock market is a dynamical system composed of intricate relationships between financial entities, such as banks, corporations, and institutions. Such a complex interactive system can be represented by the network structure. The underlying mechanism of stock exchange establishes a time-evolving network among companies and individuals, which characterise the correlations of stock prices in the time sequential trades. Here, we develop a novel technique in quantum statistics to analyse the financial market evolution. We commence from heat bath analogy where the normalised Laplacian matrix plays the role of the Hamiltonian operator of the network. The eigenvalues of the Hamiltonian specify energy states of the network. These states are occupied by either indistinguishable bosons or fermions with corresponding Bose-Einstein and Fermi-Dirac statistics. Using the relevant partition functions, we develop the thermodynamic entropy to explore dynamic network characterisations. We conduct the experiments to apply this novel method to identify the significant variance in network structure during the financial crisis. The thermodynamic entropy provides an excellent framework to represent the variations taking place in the stock market.
Using untranscribed user utterances for improving language models based on confidence scoring

This paper presents a method for reducing the effort of transcribing user utterances to develop language models for conversational speech recognition when a small number of transcribed and a large number of untranscribed utterances are available. The recognition hypotheses for untranscribed utterances are classified according to their confidence scores such that hypotheses with high confidence are used to enhance language model training. The utterances that receive low confidence can be scheduled to be manually transcribed first to improve the language model. The results of experiments using automatic transcription of the untranscribed user utterances show the proposed methods are effective in achieving improvements in recognition accuracy while reducing the effort required from manual transcription.
On Differences in the Tagging Behavior of Spammers and Regular Users

In recent literature, several models have been proposed for reproducing and understanding the tagging behavior of regular users. Until now, they all have been evaluated by visually comparing their ability to reproduce characteristic properties found in tagging systems. This paper is the ﬁrst which applies statistical methods for comparing the diﬀerent tagging models and for measuring the statistical signiﬁcance of the results. During our evaluation, we also show that spam-mers have a signiﬁcant inﬂuence on the characteristic properties of tagging systems. This shows that they violate basic assumptions about regular user’s tagging behavior and thus existing models need to be extended for taking the behavior of spammers into account.
Expressive cardinality constraints on ALCSCC concepts

In two previous publications we have, on the one hand, extended the description logic (DL) ALCQ by more expressive number restrictions using numerical and set constraints expressed in the quantifier-free fragment of Boolean Algebra with Presburger Arithmetic (QFBAPA). The resulting DL was called ALCSCC. On the other hand, we have extended the terminological formalism of the well-known description logic ALC from concept inclusions (CIs) to more general cardinality constraints expressed in QFBAPA, which we called extended cardinality constraints. Here, we combine the two extensions, i.e., we consider extended cardinality constraints on ALCSCC concepts. We show that this does not increase the complexity of reasoning, which is NExpTime-complete both for extended cardinality constraints in ALC and ALCSCC. The same is true for a restricted version of such cardinality constraints, where the complexity of reasoning decreases to ExpTime, not just for ALC, but also for ALCSCC.
The influence of trust cues on the trustworthiness of online reviews for recommendations

In recent years, recommender systems have started to exploit user-generated content, in particular online reviews, as an additional means of personalizing and explaining their predictions. However, reviews that are poorly written or perceived as fake may have a detrimental effect on the users' trust in the recommendations. Embedding so-called "trust cues" in the user interface is a technique that can help users judge the trustworthiness of presented information. We report preliminary results from an online user study that investigated the impact of trust cues---in the form of helpfulness votes---on the trustworthiness of online reviews for recommendations.
ExSpectre: Hiding Malware in Speculative Execution

—Recently, the Spectre and Meltdown attacks revealed serious vulnerabilities in modern CPU designs, allowing an attacker to exﬁltrate data from sensitive programs. These vulnerabilities take advantage of speculative execution to coerce a processor to perform computation that would otherwise not occur, leaking the resulting information via side channels to an attacker. In this paper, we extend these ideas in a different direction, and leverage speculative execution in order to hide malware from both static and dynamic analysis. Using this technique, critical portions of a malicious program’s computation can be shielded from view, such that even a debugger following an instruction-level trace of the program cannot tell how its results were computed. We introduce ExSpectre , which compiles arbitrary malicious code into a seemingly-benign payload binary. When a separate trigger program runs on the same machine, it mistrains the CPU’s branch predictor, causing the payload program to speculatively execute its malicious payload, which communicates speculative results back to the rest of the payload program to change its real-world behavior.
Component-Based Formal Analysis of 5G-AKA: Channel Assumptions and Session Confusion

—The 5G mobile telephony standards are nearing completion; upon adoption these will be used by billions across the globe. Ensuring the security of 5G communication is of the utmost importance, building trust in a critical component of everyday life and national infrastructure. We perform ﬁne-grained formal analysis of 5G’s main authentication and key agreement protocol (AKA), and provide the ﬁrst models to explicitly consider all parties deﬁned by the protocol speciﬁcation. Our analysis reveals that the security of 5G-AKA critically relies on unstated assumptions on the inner workings of the underlying channels. In practice this means that following the 5G-AKA speciﬁcation, a provider can easily and ‘correctly’ implement the standard insecurely, leaving the protocol vulnerable to a security-critical race condition. We provide the ﬁrst models and analysis considering component and channel compromise in 5G, whose results further demonstrate the fragility and subtle trust assumptions of the 5G-AKA protocol. We propose formally veriﬁed ﬁxes to the encountered issues, and have worked with 3GPP to ensure these ﬁxes are adopted.
Quantitative comparison of unsupervised anomaly detection algorithms for intrusion detection

Anomaly detection algorithms aim at identifying unexpected fluctuations in the expected behavior of target indicators, and, when applied to intrusion detection, suspect attacks whenever the above deviations are observed. Through years, several of such algorithms have been proposed, evaluated experimentally, and analyzed in qualitative and quantitative surveys. However, the experimental comparison of a comprehensive set of algorithms for anomaly-based intrusion detection against a comprehensive set of attacks datasets and attack types was not investigated yet. To fill such gap, in this paper we experimentally evaluate a pool of twelve unsupervised anomaly detection algorithms on five attacks datasets. Results allow elaborating on a wide range of arguments, from the behavior of the individual algorithm to the suitability of the datasets to anomaly detection. We identify the families of algorithms that are more effective for intrusion detection, and the families that are more robust to the choice of configuration parameters. Further, we confirm experimentally that attacks with unstable and non-repeatable behavior are more difficult to detect, and that datasets where anomalies are rare events usually result in better detection scores.
Engineering privacy by design: lessons from the design and implementation of an identity wallet platform

In the last decade, there has been more and more focus on the topic of information privacy, especially considering the ever increasing digital transformations that both businesses and the society are experiencing. As a right of individuals to "control when, how and to what extent information about them is communicated to others" [29], privacy has become an important expectation of users. A recent study in the EU showed that more than 70% of the citizens are not willing to sacrifice their privacy in exchange for a service [17]. The paradigm of Privacy-by-Design (PbD) [14] has become more important nowadays, which has also become a regulatory requirement by the EU General Data Protection Regulation (GDPR), which came into force in May 2018 [2]. PbD as a paradigm defines principles promoting the integration of privacy goals already during the design of an ICT system. However, translating those principles into engineering requirements is seen as a challenge.
Secure multi-execution in Android

Mobile operating systems, such as Google's Android, have become a fixed part of our daily lives and are entrusted with a plethora of private information. Congruously, their data protection mechanisms have been improved steadily over the last decade and, in particular, for Android, the research community has explored various enhancements and extensions to the access control model. However, the vast majority of those solutions has been concerned with controlling the access to data, but equally important is the question of how to control the flow of data once released. Ignoring control over the dissemination of data between applications or between components of the same app, opens the door for attacks, such as permission re-delegation or privacy-violating third-party libraries. Controlling information flows is a long-standing problem, and one of the most recent and practical-oriented approaches to information flow control is secure multi-execution. In this paper, we present Ariel, the design and implementation of an IFC architecture for Android based on the secure multi-execution of apps. Ariel demonstrably extends Android's system with support for executing multiple instances of apps, and it is equipped with a policy lattice derived from the protection levels of Android's permissions as well as an I/O scheduler to achieve control over data flows between application instances. We demonstrate how secure multi-execution with Ariel can help to mitigate two prominent attacks on Android, permission re-delegations and malicious advertisement libraries.
Design and implementation of emulab-based malware analysis service through EmuLiB

As many malwares adopt evasive techniques, it becomes less trustworthy to use virtual machines for malware analysis. To solve the problem, malware analysts may use real machines, but they will have original issues like hardware management again. As an alternative option, we developed Emulab-based malware analysis service and a programming library that can transform Emulab, a real machine-based research framework, into a malware analysis infrastructure so that researchers test malware on real machines very conveniently. Experiments showed that our system successfully automated analysis setup and pre- and post-process, thus reducing user interaction overhead by 81 percent.
Giving State to the Stateless: Augmenting Trustworthy Computation with Ledgers

In this work we investigate new computational properties that can be achieved by combining stateless trusted devices with public ledgers. We consider a hybrid paradigm in which a client-side device (such as a co-processor or trusted enclave) performs secure computation, while interacting with a public ledger via a possibly malicious host computer. We explore both the constructive and potentially destructive implications of such systems. We first show that this combination allows for the construction of stateful interactive functionalities (including general computation) even when the device has no persistent storage; this allows us to build sophisticated applications using inexpensive trusted hardware or even pure cryptographic obfuscation techniques. We further show how to use this paradigm to achieve censorship-resistant communication with a network, even when network communications are mediated by a potentially malicious host. Finally we describe a number of practical applications that can be achieved today. These include the synchronization of private smart contracts; rate limited mandatory logging; strong encrypted backups from weak passwords; enforcing fairness in multi-party computation; and destructive applications such as autonomous ransomware, which allows for payments without an online party.
Recommender-based privacy requirements elicitation - EPICUREAN: an approach to simplify privacy settings in IoT applications with respect to the GDPR

Due to the Internet of Things (IoT), a giant leap towards a quantified self is made, i. e. , more and more aspects of our lives are being captured, processed, and analyzed. This has many positive implications, e. g. , Smart Health services help to relieve patients as well as physicians and reduce treatment costs. However, the price for such services is the disclosure of a lot of private data. For this reason, Smart Health services were particularly considered by the European General Data Protection Regulation (GDPR): a data subject's explicit consent is required when such a service processes his or her data. However, the elicitation of privacy requirements is a shortcoming in most IoT privacy systems. Either the user is overwhelmed by too many options or s/he is not sufficiently involved in the decision process. For this reason, we introduce EPICUREAN, a recommender-based privacy requirements elicitation approach. EPICUREAN uses modeling and data mining techniques to determine and recommend appropriate privacy settings to the user. The user is thus considerably supported but remains in full control over his or her private data.
Fine-Grained and Controlled Rewriting in Blockchains: Chameleon-Hashing Gone Attribute-Based

—Blockchain technologies recently received a considerable amount of attention. While the initial focus was mainly on the use of blockchains in the context of cryptocurrencies such as Bitcoin, application scenarios now go far beyond this. Most blockchains have the property that once some object, e.g., a block or a transaction, has been registered to be included into the blockchain, it is persisted and there are no means to modify it again. While this is an essential feature of most blockchain scenarios, it is still often desirable—at times it may be even legally required—to allow for breaking this immutability in a controlled way . Only recently, Ateniese et al. (E URO S&P 2017) proposed an elegant solution to this problem on the block level . Thereby, the authors replace standard hash functions with so-called chameleon-hashes (Krawczyk and Rabin, NDSS 2000). While their work seems to offer a suitable solution to the problem of controlled re-writing of blockchains, their approach is too coarse-grained in that it only offers an all-or-nothing solution. We revisit this idea and introduce the novel concept of policy-based chameleon-hashes ( PCH ). PCH s generalize the notion of chameleon-hashes by giving the party computing a hash the ability to associate access policies to the generated hashes. Anyone who possesses enough privileges to satisfy the policy can then ﬁnd arbitrary collisions for a given hash. We then apply this concept to transaction-level rewriting within blockchains, and thus support ﬁne-grained and controlled modiﬁability of blockchain objects. Besides modeling PCH s, we present a generic construction of PCH s (using a strengthened version of chameleon-hashes