Miracle-dz/UniFAR-FTUs huggingface dataset:
A Collaborative Intelligent Intrusion Response Framework for Smart Electrical Power and Energy Systems

Smart grid systems build upon existing electrical grid infrastructure by integrating power and information technologies allowing electrical power service providers to optimise their services. The combination of complex networks formed by interconnected heterogeneous devices, and the bidirectional nature of communications between end users and service providers makes security a challenging task. As implicit trust relations formed by smart grid components expand the attack surface considerably, a highly adaptable solution is required to secure these systems. In this paper, the design of an intelligent intrusion response system is explored, which can respond to ongoing multi-stage attacks in an optimal manner with respect to service availability. The smart grid infrastructure’s vulnerabilities are modelled with a graphical network security model allowing the application of probabilistic risk management methods for quantifying threats and their corresponding risks. A game-theoretic approach has been implemented that leverages the security models to efficiently respond to cyber-attacks, whose performance is tightly coupled with the system’s attack detection capabilities. To achieve better results and ensure inter-component privacy a federated learning approach was adopted. Preliminary testing on a simulated home area network with attacks against the Modbus, BACnet, and MQTT protocols, in addition to Mirai and BlackEnergy attacks, was performed to test the viability of this approach. The results illustrated the successful mitigation of attacks but also highlighted the need to implement collaborative mechanisms into the intrusion response part of the model.
Fault-Tolerant SDN Solution for Cybersecurity Applications

The rapid growth of computer networks in various sectors has led to new services previously hard or impossible to implement. Internet of Things has also assisted in this evolution offering easy access to data but at the same time imposing constraints on both security and quality of service. In this paper, an SDN fault tolerant and resilient SDN controller design approach is presented. The proposed solution is suitable for a wide range of environments. Benefits stemming from actual scenarios are presented and discussed among other solutions.
Secret sharing a key in a distributed way, Lagrange vs Newton

In secret sharing, a dealer knows the secret it shares. In a distributed key generation (DKG) protocol, a shared secret is collectively generated in a group in a completely distributed way such that any subset of size greater than a threshold can reveal or use the shared secret, while smaller subsets do not have any knowledge about it. The most important aspect is that there is no dealer or trusted party. The core idea of secret sharing schemes is Shamir’s secret sharing method, which uses Lagrange’s interpolation to reconstruct the shared secret key. This paper investigates an alternative method, called Newton’s interpolation and it cites the probability of implementing it on current DKG protocols.
Evading Deep Reinforcement Learning-based Network Intrusion Detection with Adversarial Attacks

An Intrusion Detection System (IDS) aims to detect attacks conducted over computer networks by analyzing traffic data. Deep Reinforcement Learning (Deep-RL) is a promising lead in IDS research, due to its lightness and adaptability. However, the neural networks on which Deep-RL is based can be vulnerable to adversarial attacks. By applying a well-computed modification to malicious traffic, adversarial examples can evade detection. In this paper, we test the performance of a state-of-the-art Deep-RL IDS agent against the Fast Gradient Sign Method (FGSM) and Basic Iterative Method (BIM) adversarial attacks. We demonstrate that the performance of the Deep-RL detection agent is compromised in the face of adversarial examples and highlight the need for future Deep-RL IDS work to consider mechanisms for coping with adversarial examples.
Lightweight Parsing and Slicing for Bug Identification in C

Program slicing has been used to semi- or fully-automatically help developers find errors and vulnerabilities in their programs. For example, Dashevskyi et al. (IEEE TSE 2018) introduced a lightweight slicer for Java that can be used for vulnerability analysis. However, a similar lightweight slicer for C/C++ is still missing. In this work we propose a comparison method for parsers, evaluate it on two commonly-used parsers, and develop a lightweight slicer for C/C++ using the “better” parser from our comparison. From our evaluation, the Joern parsing method (island grammar) could parse non-standard C/C++ code but its resulting structure may contain semantic errors that can affect subsequent analysis. ANTLR4 is faster in returning a result, and when manually cleared of non-standard C/C++ codes, it is more accurate than Joern. We then built our C/C++ thin slicer extension using ANTLR4, and we observed that it is promising from both precision and performance perspectives. As a future work, we plan to improve the logic behind processing pointers. In particular, we consider doing deeper pointer analysis.
Shedding Light on the Targeted Victim Profiles of Malicious Downloaders

Malware affects millions of users worldwide, impacting the daily lives of many people as well as businesses. Malware infections are increasing in complexity and unfold over a number of stages. A malicious downloader often acts as the starting point as it fingerprints the victim’s machine and downloads one or more additional malware payloads. Although previous research was conducted on these malicious downloaders and their Pay-Per-Install networks, limited work has investigated how the profile of the victim machine, e.g., its characteristics and software configuration, affect the targeting choice of cybercriminals. In this paper, we operate a large-scale investigation of the relation between the machine profile and the payload downloaded by droppers, through 151,189 executions of malware downloaders over a period of 12 months. We build a fully automated framework which uses Virtual Machines (VMs) in sandboxes to build custom user and machine profiles to test our malicious samples. We then use changepoint analysis to model the behavior of different downloader families, and perform analyses of variance (ANOVA) on the ratio of infections per profile. With this, we identify which machine profile is targeted by cybercriminals at different points in time. Our results show that a number of downloaders present different behaviors depending on a number of features of a machine. Notably, a higher number of infections for specific malware families were observed when using different browser profiles, keyboard layouts and operating systems, while one keyboard layout obtained fewer infections of a specific malware family. Our findings bring light to the importance of the features of a machine running malicious downloader software, particularly for malware research.
Introducing quest: a query-driven framework to explain classification models on tabular data

Machine learning models are everywhere now; but only few of them are transparent in how they work. To remedy this, local explanations aim to show users how and why learned models produce a certain output for a given input (data sample). However, most existing approaches for are oriented around images or text data and, thus, cannot leverage the structure and properties of tabular data. Therefore, we present Quest, a new framework for generating explanations that are a better fit for tabular data. The main idea is to create explanations in the form of relational predicates (called queries hereafter) that approximate the behavior of a classifier around the given sample. In an initial evaluation, we show anecdotally how Quest can be used on a tabular data set compared to existing approaches that can be applied on tabular data.
SAMM: Situation Awareness with Machine Learning for Misbehavior Detection in VANET

Vehicular Ad hoc Network (VANET) is a foundation stone for connected vehicles. As vehicles’ safety depends heavily on the exchanged data’s accuracy, VANET has a low tolerance for false data. The process of intentionally exchanging inaccurate data is called misbehaving. Machine learning (ML)-based solutions were heavily invested in detecting misbehavior messages. However, they also have some limitations with respect to how much they can detect. To overcome such limitations, we introduce situation awareness (SA) as a powerful concept that can break the limits of the used ML models, leading to more accurate and reliable solutions. Situation awareness uses environmental elements and events to gain a holistic view of the system at any given time. In this paper, we propose using SA to predict the trust of the surrounding cars and consequently reevaluate the outcome of the used ML model. Based on the collected data and SA information, we may reject a message classified as benign by the ML model or vice versa. We used VeReMi dataset to evaluate the proposed approach called SAMM (Situation Awareness with Machine Learning for Misbehavior Detection in VANET) on different ML models with a wide range of features. The results show that the proposed approach improves the system’s accuracy for various misbehavior attacks by enhancing the recall rate up to 24% and 50% in some cases.
Cookie Disclaimers: Impact of Design and Users’ Attitude

Dark patterns in cookie disclaimers are factors that are used to lead users to accept more cookies than needed and more than they are aware of. The contributions of this paper are (1) evaluating the efficacy of several of these factors while measuring actual behavior; (2) identifying users’ attitude towards cookie disclaimers including how they decide which cookies to accept or reject. We show that different visual representation of the reject/accept option have a significant impact on users’ decision. We also found that the labeling of the reject option has a significant impact. In addition, we confirm previous research regarding biasing text (which has no significant impact on users’ decision). Our results on users’ attitude towards cookie disclaimers indicate that for several user groups the design of the disclaimer only plays a secondary role when it comes to decision making. We provide recommendations on how to improve the situation for the different user groups.
Job Adverts Analyzer for Cybersecurity Skills Needs Evaluation

This article presents a new free web-based application, the Cybersecurity Job Ads Analyzer, which has been created to collect and analyse job adverts using a machine learning algorithm. This algorithm enables the detection of the skills required in advertised cybersecurity work positions. The application is both interactive and dynamic allowing for automated analyses and for the underlying database of job adverts to be easily updated. Through the Cybersecurity Job Ads Analyzer, it is possible to explore the skills required over time, and thereby enable academia and other training providers to better understand and address the needs of the industry. We will describe in detail the user interface and technical background of the application, as well as highlight the preliminary statistical results we have obtained from analysing the current database of job adverts.
Revealing MageCart-like Threats in Favicons via Artificial Intelligence

Modern malware increasingly takes advantage of information hiding to avoid detection, spread infections, and obfuscate code. A major offensive strategy exploits steganography to conceal scripts or URLs, which can be used to steal credentials or retrieve additional payloads. A recent example is the attack campaign against the Magento e-commerce platform, where a web skimmer has been cloaked in favicons to steal payment information of users. In this paper, we propose an approach based on deep learning for detecting threats using least significant bit steganography to conceal malicious PHP scripts and URLs in favicons. Experimental results, conducted on a realistic dataset with both legitimate and compromised images, demonstrated the effectiveness of our solution. Specifically, our model detects ∼ 100% of the compromised favicons when examples of various malicious payloads are provided in the learning phase. Instead, it achieves an overall accuracy of ∼ 90% when in the presence of new payloads or alternative encoding schemes.
Themis: A Secure Decentralized Framework for Microservice Interaction in Serverless Computing

In serverless computing, applications are composed of stand-alone microservices that are invoked and scale up independently. Peer-to-peer protocols can be used to enable decentralized communication among the services that compose each application. This paper presents Themis, a framework for secure service-to-service interaction targeting these environments and the underlying service mesh architectures. Themis builds on a notion of decentralized identity management to allow confidential and authenticated service-to-service interaction without the need for a centralized certificate authority. Themis adopts a layered architecture. Its lower layer forms a core communication protocol pair that offers strong security guarantees without depending on a centralized point of authority. Building on this pair, an upper layer provides a series of actions related to communication and identifier management—e.g., store, find, and join. This paper analyzes the security properties of Themis’s protocol suite and shows how it provides a decentralized and flexible communication platform. The evaluation of our Themis prototype targeting serverless applications written in JavaScript shows that these security benefits come with small runtime latency and throughput overheads, and modest startup overheads.
Context sight: model understanding and debugging via interpretable context

Model interpretation is increasingly important for successful model development and deployment. In recent years, many explanation methods are introduced to help humans understand how a machine learning model makes a decision on a specific instance. Recent studies show that contextualizing an individual model decision within a set of relevant examples can improve the model understanding. However, there is a lack of systematic study on what factors are considered when generating and using the context examples to explain model predictions, and how context examples help with model understanding and debugging in practice. In this work, we first identify a taxonomy of context generation and summarization through literature review. We then present Context Sight, a visual analytics system that integrates customized context generation and multiple-level context summarization to assist context exploration and interpretation. We evaluate the usefulness of the system through a detailed use case. This work is an initial step for a set of systematic research on how contextualization can help data scientists and practitioners understand and diagnose model behaviors, based on which we will gain a better understanding of the usage of context.
GTM: Game Theoretic Methodology for optimal cybersecurity defending strategies and investments

Investments on cybersecurity are essential for organizations to protect operational activities, develop trust relationships with clients, and maintain financial stability. A cybersecurity breach can lead to financial losses as well as to damage the reputation of an organization. Protecting an organization from cyber attacks demands considerable investments; however, it is known that organisations unequally divide their budget between cybersecurity and other technological needs. Organizations must consider cybersecurity measures, including but not limited to security controls, in their cybersecurity investment plans. Nevertheless, designing an effective cybersecurity investment plan to optimally distribute the cybersecurity budget is a primary concern. This paper presents GTM, a methodology depicted as a tool dedicated to providing optimal cybersecurity defense strategies and investment plans. GTM utilizes attack graphs to predict all possible cyber attacks, game theory to simulate the cyber attacks and 0-1 Knapsack to optimally allocate the budget. The output of GTM is an optimal cybersecurity strategy that includes security controls to protect the organisation against potential cyber attacks and enhance its cyber defenses. Furthermore, GTM’s effectiveness is evaluated against three use cases and compared against different attacker types under various scenarios.
Geomagnetic Energy Approach to Space Debris Deorbiting in a Low Earth Orbit

The space debris removal problem needs to be solved urgently. Over 70% of debris is distributed between the 500 km and 1000 km low Earth orbits (LEO), and existing methods may be theoretically feasible but are not the high-efficiency and low-consumption methods for LEO debris removal. Based on the torque effect of a static magnet interacting with the geomagnetic field, a new spin angular momentum exchange (SAME) method by geomagnetic excitation (without working medium consumption) for LEO active debris deorbiting is proposed. The LEO delivery capability of this method is researched. Two kinds of spin angular momentum accumulation (SAMA) strategies are proposed. Then through numerical simulation under the dipole model and International Geomagnetic Reference Field (IGRF11) model, the results confirm the physical feasibility and basic performance of the proposed method. The method can be applied to the regions of the LEO below 1000 km with different altitudes/inclinations and eccentricities, and with existent magnetorquer technology, only several days of preparation is required for about 104 m·kg mechanism-scale-debris-mass deorbiting, which can be used for deorbiting missions in debris-intensive areas (altitude≤1000 km); without consideration of external effects on the geomagnetic field distribution, it has the same deorbiting capability with that of the LEO below 1000 km when the altitude is over 1000 km. Besides, the method is characterized by explicit mechanism, flexible control strategy and application, and low dependence on the scale. Finally, the key technology requirements and future application of LEO active debris removal and on-orbit delivery by using SAME are prospected.
Boosting Relationship Detection in Images with Multi-Granular Self-Supervised Learning

Visual and spatial relationship detection in images has been a fast-developing research topic in the multimedia field, which learns to recognize the semantic/spatial interactions between objects in an image, aiming to compose a structured semantic understanding of the scene. Most of the existing techniques directly encapsulate the holistic image feature plus the semantic and spatial features of the given two objects for predicting the relationship, but leave the inherent supervision derived from such structured and thorough image understanding under-exploited. Specifically, the inherent supervision among objects or relations within an image can span different granularities in this hierarchy including, from simple to comprehensive, (1) the object-based supervision that captures the interaction between the semantic and spatial features of each individual object, (2) the inter-object supervision that characterizes the dependency within the relationship triplet (), and (3) the inter-relation supervision that exploits contextual information among all relationship triplets in an image. These inherent multi-granular supervisions offer a fertile ground for building self-supervised proxy tasks. In this article, we compose a trilogy of exploring the multi-granular supervision in the sequence from object-based, inter-object, and inter-relation perspectives. We integrate the standard relationship detection objective with a series of proposed self-supervised proxy tasks, which is named as Multi-Granular Self-Supervised learning (MGS). Our MGS is appealing in view that it is pluggable to any neural relationship detection models by simply including the proxy tasks during training, without increasing the computational cost at inference. Through extensive experiments conducted on the SpatialSense and VRD datasets, we demonstrate the superiority of MGS for both spatial and visual relationship detection tasks.
Federated learning based IDS approach for the IoV

The Internet of Vehicles (IoV) is an Internet of Things (IoT) application that offers several utilities such as traffic analysis, safe driving, road optimization, and travel comfort. Software-Defined Networking (SDN) technology has been shown to provide various benefits to support the IoV. However, the construction of IoV makes it a complex system posing several challenges among which the important ones are security and privacy of data. Intrusion Detection Systems (IDSs) have been proposed in the IoV to identify cyber attacks and protect private data. Recently work has started to implement IDSs based on Federated learning as collaborative IDSs have proved effective security of IoV. In another hand, trust management has revolutionized the IoV filed, providing decision-making support to secure the network. Stating that an SDN-driven IoV architecture in which nodes trustworthiness gets assessed can provide a promising framework for IDS, we propose in this paper a Federated learning-based IDS for the IoV under the SDN structure. We integrate trust metrics to assist in securing the IoV network. Simulation experiments are conducted to validate the proposal.
SAGA-net

In this paper, we propose a real-time shape-assisted graph attention neural network to perform local pointcloud repairment. The orderless pointclouds require an effective shape encoder to distill local and global geometric feature descriptors. Previous work has attempted to convert pointcloud representation into a voxelized shape or perform grid-transformations. While these approaches can subsequently allow common convolution operations on the structured data, they either pose additional computational cost or disrupt the local geometric information. We present SAGA-Net, an efficient graph attention neural network framework with a prior shape inquiry protocol that effectively extracts local geometric information, locates the descriptor for the missing region and accurately reconstructs the local region in a real-time manner. Our framework has been validated on a benchmark dataset, ShapeNet. We demonstrate that our framework can repair each partial pointcloud with accuracy surpassing other frameworks in most object categories, and improve the computational efficiency by orders of magnitude in terms of time cost.