Miracle-dz/UniFAR-FTUs huggingface dataset:
Differential uptake and effects of digital sexually transmitted and bloodborne infection testing interventions among equity-seeking groups: a scoping review

Background Digital sexually transmitted and bloodborne infection (STBBI) testing interventions have gained popularity. However, evidence of their health equity effects remains sparse. We conducted a review of the health equity effects of these interventions on uptake of STBBI testing and explored design and implementation factors contributing to reported effects. Methods We followed Arksey and O’Malley’s framework for scoping reviews (2005) integrating adaptations by Levac et al (2010). We searched OVID Medline, Embase, CINAHL, Scopus, Web of Science, Google Scholar and health agency websites for peer-reviewed articles and grey literature comparing uptake of digital STBBI testing with in-person models and/or comparing uptake of digital STBBI testing among sociodemographic strata, published in English between 2010 and 2022. We extracted data using the Place of residence, Race, Occupation, Gender/Sex, Religion, Education, Socioeconomic status (SES), Social capital and other disadvantaged characteristics (PROGRESS-Plus) framework, reporting differences in uptake of digital STBBI testing by these characteristics. Results We included 27 articles from 7914 titles and abstracts. Among these, 20 of 27 (74.1%) were observational studies, 23 of 27 (85.2%) described web-based interventions and 18 of 27 (66.7%) involved postal-based self-sample collection. Only three articles compared uptake of digital STBBI testing with in-person models stratified by PROGRESS-Plus factors. While most studies demonstrated increased uptake of digital STBBI testing across sociodemographic strata, uptake was higher among women, white people with higher SES, urban residents and heterosexual people. Co-design, representative user recruitment, and emphasis on privacy and security were highlighted as factors contributing to health equity in these interventions. Conclusion Evidence of health equity effects of digital STBBI testing remains limited. While digital STBBI testing interventions increase testing across sociodemographic strata, increases are lower among historically disadvantaged populations with higher prevalence of STBBIs. Findings challenge assumptions about the inherent equity of digital STBBI testing interventions, emphasising the need to prioritise health equity in their design and evaluation.
Is Neighborhood Nature an Ecological Precursor of Parenting Practices, Infant-Parent Bonding, and Infant Socioemotional Function?

Nurturing relationships are crucial for adaptive child development. The objectives of the study were to investigate whether nature availability was associated with early nurturing parenting practices, mother-infant bonding, and infant socioemotional function. Data were from the Australian Temperament Project (n = 809 infants to 515 parents residing in Victoria, Australia) and were linked cross-sectionally to residential greenness (i.e., Normalized Difference in Vegetation Index). There were no observable associations between residential greenness within a 1,600 m network radius and parenting practices, mother-infant bonding, or infant socioemotional function. The findings were largely corroborated by sensitivity analyses (i.e., NDVI within 100, 250, 500, and 1,000 m and distance to park). Shorter distances to a park were associated with less hostile parenting. More residential greenness (1,000 and 1,600 m) was associated with stronger father-infant bonding and more hostile parenting amongst the most stressed parents in exploratory analyses. Residential greenness might be a socioecological precursor for father-infant bonding.
A New PAC-Bayesian View of Domain Adaptation

We propose a new theoretical study of domain adaptation for majority vote classifiers (from a source to a target domain). We upper bound the target risk by a trade-off between only two terms: The voters’ joint errors on the source domain, and the voters’ disagreement on the target one. Hence, this new study is simpler than other analyses that usually rely on three terms. We also derive a PAC-Bayesian generalization bound leading to a DA algorithm for linear classifiers.
Tracing the Sustainability Components in the Indian Tourism Curricula: An Exploratory Study

Abstract Tourism for its intrinsic character of people, planet and profit has been an enduring area of research for sustainable policy and practices. Planning and implementing sustainable tourism in India are largely shaped and groomed in the classrooms. Currently, over two hundred universities across the country offer tourism programs. The current study involves a two-stage process. Available literature was first summarized into items of sustainability components required of a program structure such as sustainability aspects; viz. socio-economic, environmental, and business, case study approach, interaction with stakeholders, research & practices in local settings and timely update of the syllabus. Such components in the second stage of the research formed the basis of the questionnaire used for qualitative research involving senior academics responsible for designing the syllabi. Findings present a model on the effective integration of sustainable tourism theories and practices into tourism curricula.
Metamaterials at Southampton University and beyond

At the University of Southampton research in metamaterials started in 2000 with a paper describing “a metallic microstructure, comprising an ensemble of fully metallic "molecules"“. In the sixteen years since then metamaterials have evolved from an approach to designing unusual electromagnetic properties by structuring matter at the sub-wavelength scale to become a universal paradigm for active functional media with optical properties on demand at any given point in time and space. Metamaterials are now recognized as a promising enabling technology and one of the most buoyant and exciting research disciplines at the crossroads between photonics and nanoscience. Many "made in Southampton" concepts have influenced the global research community and now we work in collaboration with our sister research centre in Nanyang Technological University, Singapore. In this article, I provide a historical overview of the metamaterials research field from early studies to recent developments through the lens of the Southampton group and discuss promising future directions.
SPEAR-V: Secure and Practical Enclave Architecture for RISC-V

Trusted Execution Environments (TEEs) and enclaves have become increasingly popular and are used from embedded devices to cloud servers. Today, many enclave architectures exist for different ISAs. However, some suffer from performance issues and controlled-channel attacks, while others only support constrained use cases for embedded devices or impose unrealistic constraints on the software. Modern cloud applications require a more flexible architecture that is both secure against such attacks and not constrained by, e.g., a limited number of physical memory ranges. In this paper, we present SPEAR-V, a RISC-V-based enclave that provides a fast and flexible architecture for trusted computing that is compatible with current and future use cases while also aiming at mitigating controlled-channel attacks. With a single hardware primitive, our novel architecture enables two-way sandboxing. Enclaves are protected from hosts and vice versa. Furthermore, we show how shared memory and arbitrary nesting can be achieved without additional performance overheads. Our evaluation shows that, with minimal hardware changes, a flexible, performant, and secure enclave architecture can be constructed, imposing zero overhead on unprotected applications and an average overhead of 1% for protected applications.
POSTER: Toward Intelligent Cyber Attacks for Moving Target Defense Techniques in Software-Defined Networking

Moving Target Defenses (MTD) are proactive security countermeasures that change the attack surface in a system in ways that make it harder for attackers to succeed. These techniques have been shown to be effective, and their application in software-defined networking (SDN) against simple automated attacks is growing in popularity. However, with the increased knowledge of and ease of access to Artificial Intelligence (AI) techniques, AI is starting to be used to enhance cyber attacks, which are becoming increasingly complex. Hence, the evaluation of MTDs against simple automated attacks is no longer enough to demonstrate their effectiveness in increasing system security. With this in mind, we propose a novel framework to evaluate MTD techniques in SDN. To this end, first, we develop a taxonomy of possible intelligent attacks against MTD techniques. Second, we show how our framework can be used to generate datasets to realize these intelligent attacks for evaluating and enhancing MTD techniques. Third, we experimentally demonstrate the feasibility of the proposed machine learning (ML) powered attacks, with an attacker who can determine the MTD trigger time from network traffic using ML, which they can use to maximize their attack window and increase their chances of success.
Uncovering Vulnerabilities of Bluetooth Low Energy IoT from Companion Mobile Apps with Ble-Guuide

Increasingly, with embedded intelligence and control, IoT devices are being adopted faster than ever. However, the IoT landscape and its security implications are not yet fully understood. This paper seeks to shed light on this by focusing on a particular type of IoT devices, namely the ones using Bluetooth Low Energy (BLE). Our contributions are two-fold: First, we present Ble-Guuide, a framework for performing mobile app-centric security issue identification. We exploit Universally Unique Identifiers (UUIDs), which underpin data transmissions in BLE, to glean rich information regarding device functionality and the underlying security issues. We combine this with information from app descriptions and BLE libraries, to identify the corresponding security vulnerabilities in BLE devices and determine the security or privacy impact they could have depending on the device functionality. Second, we present a large-scale analysis of 17,243 free, BLE-enabled Android APKs, systematically crawled from the official Google Play store. By applying Ble-Guuide to this dataset, we uncover that more than 70% of these APKs contain at least one security vulnerability. We also obtain insights into the identified security vulnerabilities and their impact.
Security Properties of Virtual Remotes and SPOOKing their violations

As Smart TV devices become more prevalent in our lives, it becomes increasingly important to evaluate the security of these devices. In addition to a smart and connected ecosystem through apps, Smart TV devices expose a WiFi remote protocol, that provides a virtual remote capability and allows a WiFi enabled device (e.g., a Smartphone) to control the Smart TV. The WiFi remote protocol might pose certain security risks that are not present in traditional TVs. In this paper, we assess the security of WiFi remote protocols by first identifying the desired security properties so that we achieve the same level of security as in traditional TVs. Our analysis of four popular Smart TV platforms, Android TV, Amazon FireOS, Roku OS, and WebOS (for LG TVs), revealed that all these platforms violate one or more of the identified security properties. To demonstrate the impact of these flaws, we develop Spook, which uses one of the commonly violated properties of a secure WiFi remote protocol to pair an Android mobile as a software remote to an Android TV. Subsequently, we hijack the Android TV device through the device debugger, enabling complete remote control of the device. All our findings have been communicated to the corresponding vendors. Google acknowledged our findings as a security vulnerability, assigned it a CVE, and released patches to the Android TV OS to partially mitigate the attack. We argue that these patches provide a stopgap solution without ensuring that WiFi remote protocol has all the desired security properties. We design and implement a WiFi remote protocol in the Android ecosystem using ARM TrustZone. Our evaluation shows that the proposed defense satisfies all the security properties and ensures that we have the flexibility of virtual remote without compromising security.
An End-to-End Analysis of Covid-Themed Scams in the Wild

Covid19-themed attacks took the Internet by surprise in March 2020. Adversaries updated their attack strategies rapidly and started to exploit users’ attention to this unprecedented event and distribute their malicious payloads. In this work, we perform a retrospective analysis of adversarial operations over the first four months from February 15th, 2020 to June 16th, 2020. By combining a variety of measurement perspectives, we perform a three-step analysis, by (1) analyzing the composition, growth, and reachability of Covid19-themed attack pages, (2) identifying the modus operandi of attackers, and (3) assessing the actual impact on end-users. Our measurements serve as a lens into the fragile parts of the Web ecosystem during a previously unseen attack. We argue that precipitous growth of Covid19-themed attacks in just a few weeks represents adversaries’ technical and operational agility in adapting their attack strategies and also demonstrates how novice attack techniques can bypass common defense mechanisms and expose unsuspecting users to different forms of attacks. Drawing upon these analyses, we discuss what went poorly, in an effort to understand how the technical community can respond more effectively to such events in the future.
Multi-Tag: A Hardware-Software Co-Design for Memory Safety based on Multi-Granular Memory Tagging

Memory safety vulnerabilities are a severe threat to modern computer systems allowing adversaries to leak or modify security-critical data. To protect systems from this attack vector, full memory safety is required. As software-based countermeasures tend to induce significant runtime overheads, which is not acceptable for production code, hardware assistance is needed. Tagged memory architectures, e.g., already offered by the ARM MTE and SPARC ADI extensions, assign meta-information to memory objects, thus allowing to implement memory safety policies. However, due to the high tag collision probability caused by the small tag sizes, the protection guarantees of these schemes are limited. This paper presents Multi-Tag, the first hardware-software co-design utilizing a multi-granular tagging structure that provides strong protection against spatial and temporal memory safety violations. By combining object-granular memory tags with page-granular tags stored in the page table entries, Multi-Tag overcomes the limitation of small tag sizes. Introducing page-granular tags significantly enhances the probabilistic protection capabilities of memory tagging without increasing the memory overhead or the system’s complexity. We develop a prototype implementation comprising a gem5 model of the tagged architecture, a Linux kernel extension, and an LLVM-based compiler toolchain. The simulated performance overhead for the SPEC CPU2017 and nbench-byte benchmarks highlights the practicability of our design.
Cage4Deno: A Fine-Grained Sandbox for Deno Subprocesses

Deno is a runtime for JavaScript and TypeScript that is receiving great interest by developers, and is increasingly used for the construction of back-ends of web applications. A primary goal of Deno is to provide a secure and isolated environment for the execution of JavaScript programs. It also supports the execution of subprocesses, unfortunately without providing security guarantees. In this work we propose Cage4Deno, a set of modifications to Deno enabling the creation of fine-grained sandboxes for the execution of subprocesses. The design of Cage4Deno satisfies the compatibility, transparency, flexibility, usability, security, and performance needs of a modern sandbox. The realization of these requirements partially stems from the use of Landlock and eBPF, two robust and efficient security technologies. Significant attention has been paid to the design of a flexible and compact policy model consisting of RWX permissions, which can be automatically created, and deny rules to declare exceptions. The sandbox effectiveness is demonstrated by successfully blocking a number of exploits for recent CVEs, while runtime experiments prove its efficiency. The proposal is associated with an open-source implementation.
Owner-free Distributed Symmetric Searchable Encryption Supporting Conjunctive Queries

Symmetric Searchable Encryption (SSE), as an ideal primitive, can ensure data privacy while supporting retrieval over encrypted data. However, existing multi-user SSE schemes require the data owner to share the secret key with all query users or always be online to generate search tokens. While there are some solutions to this problem, they have at least one weakness, such as non-supporting conjunctive query, result decryption assistance of the data owner, and unauthorized access. To solve the above issues, we propose an Owner-free Distributed Symmetric searchable encryption supporting Conjunctive query (ODiSC). Specifically, we first evaluate the Learning-Parity-with-Noise weak Pseudorandom Function (LPN-wPRF) in dual-cloud architecture to generate search tokens with the data owner free from sharing key and being online. Then, we provide fine-grained conjunctive query in the distributed architecture using additive secret sharing and symmetric-key hidden vector encryption. Finally, formal security analysis and empirical performance evaluation demonstrate that ODiSC is adaptively simulation-secure and efficient.
Do Users Really Know Alexa? Understanding Alexa Skill Security Indicators

Amazon Alexa’s booming third-party skill market has grown from 160 to 100,000 skills within three years. In this work, we make the first effort in demystifying the Alexa skill permission system by studying its security indicators. Our user study results show that most of the surveyed Alexa users did not understand the security implications of interacting with third parties via Alexa’s voice user interface (VUI). Despite the potential risks of undesired resource sharing, more than two-thirds of the surveyed Alexa users considered third-party skills safe because they think these skills are Alexa- or Amazon-owned applications. Together with other uncovered deficiencies of skill security indicator designs, our study indicates a pressing need for a paradigm shift in designing security indicators for VUI systems.
RaceBench: A Triggerable and Observable Concurrency Bug Benchmark

Concurrency bugs are one of the most harmful and hard-to-address issues in multithreaded software. Such bugs are hard to discover, reproduce, diagnose or fix due to their non-deterministic nature. Although more and more bug discovery solutions are proposed in recent years, it is difficult to evaluate them with existing concurrency bug datasets. The demand for building a high-quality benchmark of concurrency bugs emerges. In this paper, we present an automated bug injection solution to automatically inject representative concurrency bugs into real world multithreaded C/C++ programs, and present the first triggerable and observable concurrency bug benchmark RaceBench. We have conducted a large-scale empirical study on concurrency bugs, learned their patterns, and built a program state model to characterize them, which enables us to inject representative bugs. To make the bugs triggerable, we follow the dynamic execution traces of target programs and inject bugs at locations that are reachable from the program entry. To make the bugs observable, these bugs are followed by explicit security assertions, removing the requirement of sophisticated sanitizers to detect the existence of such bugs. We built a benchmark consisting of 1500 bugs injected into 15 programs, and evaluated four concurrency bug discovery tools and one general bug discovery tool with it. Results showed that existing concurrency bug discovery solutions are still in the early stage, and our benchmark could shed light on the future direction of improvements.
Binary Function Clone Search in the Presence of Code Obfuscation and Optimization over Multi-CPU Architectures

Binary function clone search is an essential capability that enables multiple applications and use cases, including reverse engineering, patch security inspection, threat analysis, vulnerable function detection, etc. As such, a surge of interest has been expressed in designing and implementing techniques to address function similarity on binary executables and firmware images. Although existing approaches have merit in fingerprinting function clones, they present limitations when the target binary code has been subjected to significant code transformation resulting from obfuscation, compiler optimization, and/or cross-compilation to multiple-CPU architectures. In this regard, we design and implement a system named BinFinder, which employs a neural network to learn binary function embeddings based on a set of extracted features that are resilient to both code obfuscation and compiler optimization techniques. Our experimental evaluation indicates that BinFinder outperforms state-of-the-art approaches for multi-CPU architectures by a large margin, with 46% higher Recall against Gemini, 55% higher Recall against SAFE, and 28% higher Recall against GMN. With respect to obfuscation and compiler optimization clone search approaches, BinFinder outperforms the asm2vec (single CPU architecture approach) with higher Recall and BinMatch (multi-CPU architecture approach) with higher Recall. Finally, our work is the first to provide noteworthy results with respect to binary clone search over the tigress obfuscator, which is a well-established open-source obfuscator.
FruitFire: a luciferase based on a fruit fly metabolic enzyme

Firefly luciferase is homologous to fatty acyl-CoA synthetases from insects that are not bioluminescent. Here, we determined the crystal structure of the fruit fly fatty acyl-CoA synthetase CG6178 to 2.5 Å. Based on this structure, we mutated a steric protrusion in the active site to create the artificial luciferase FruitFire, which prefers the synthetic luciferin CycLuc2 to D-luciferin by >1000-fold. FruitFire enabled in vivo bioluminescence imaging in the brains of mice using the pro-luciferin CycLuc2-amide. The conversion of a fruit fly enzyme into a luciferase capable of in vivo imaging underscores the potential for bioluminescence with a range of adenylating enzymes from nonluminescent organisms, and the possibilities for application-focused design of enzyme-substrate pairs.
Meta-analysis of macrophage nanoparticle targeting across blood and solid tumors using an eLDA Topic modeling Machine Learning approach

The role of macrophages in regulating the tumor microenvironment has spurned the exponential generation of nanoparticle targeting technologies. With the large amount of literature and the speed at which it is generated it is difficult to remain current with the most up-to-date literature. In this study we performed a topic modeling analysis of the most common usages of nanoparticle targeting of macrophages in solid tumors. The data spans 20 years of literature, providing an extensive meta-analysis of the nanoparticle strategies. Our topic model found 6 distinct topics: Immune and TAMs, Nanoparticles, Imaging, Gene Delivery and Exosomes, Vaccines, and Multi-modal Therapies. We also found distinct nanoparticle usage, tumor types, and therapeutic trends across these topics. Moreover, we established that the topic model could be used to assign new papers into the existing topics, thereby creating a Living Review. This type of meta-analysis provides a useful assessment tool for aggregating data about a large field.