Reviewerly/exHarmony huggingface dataset:
Data Driven based Malicious URL Detection using Explainable AI

With the ever-increasing reach of the internet, and its increasing access through various types of devices, the spread of malware, phishing attempts, etc. have steadily been increasing, along with their level of sophistication. Thus it becomes very important to conduct research on different methods to prevent such harmful attacks on systems and users. Using a malicious URL is the common way for hackers to attack a system, thus, to accommodate the variety attack vectors of malicious websites, 21 features were extracted from 651,191 URLs to train the proposed model. A two-stage stacked ensemble learning model, based on gradient boosting methods and random forest, has been trained and tested in the 70:30 ratio of the 651,191 URLs, and an accuracy of 97% has been achieved. Then Explainable AI (XAI) has been used to clearly explain the working of the model, and study the impact of each of the 21 features on the 4 class predictions (benign, defacement, phishing and malware).
CCTVCV: Computer Vision model/dataset supporting CCTV forensics and privacy applications

The increased, widespread, unwarranted, and unaccountable use of Closed-Circuit TeleVision (CCTV) cameras globally has raised concerns about privacy risks for the last several decades. Recent technological advances implemented in CCTV cameras, such as Artificial Intelligence (AI)-based facial recognition and Internet of Things (IoT) connectivity, fuel further concerns among privacy advocates. Machine learning and computer vision automated solutions may prove necessary and efficient to assist CCTV forensics of various types.In this paper, we introduce and release the first and only computer vision models are compatible with Microsoft common object in context (MS COCO) and capable of accurately detecting CCTV and video surveillance cameras in street view, generic images, and video frames.Our best detectors were built using 8,387 images, which were manually reviewed and annotated to contain 10,419 CCTV camera instances, and achieved an accuracy rate of up to 98.7%. This work proves fundamental to a handful of present and future applications that we discuss, such as CCTV forensics, pro-active detection of CCTV cameras, providing CCTV-aware routing, navigation, and geolocation services, and estimating their prevalence and density globally and on geographic boundaries.
Predictive Mutation Analysis of Test Case Prioritization for Deep Neural Networks

Testing deep neural networks requires high-quality test cases, but using new test cases would incur the labor-intensive test case labeling issue in the test oracle problem. Test case prioritization for failure-revealing test cases alleviates the problem. Existing metric-based techniques analyze vector-based prediction outputs. They cannot handle regression models. Existing mutation-based techniques either remain ineffective or incur high computational costs. In this paper, we propose EffiMAP, an effective and efficient test case prioritization technique with predictive mutation analysis. In the test phase, without performing a comprehensive mutation analysis, EffiMAP predicts whether model mutants are killed by a test case by the information extracted from the execution trace of the test case. Our experiment shows that EffiMAP significantly outperforms the previous state-of-the-art technique in both effectiveness and efficiency in the test phase of handling test cases of both classification and regression models. This paper is the first work to show the feasibility of predictive mutation analysis to rank test cases with a higher probability of exposing model prediction failures in the domain of deep neural network testing.
A Multidimensional Blockchain Framework For Mobile Internet of Things

The adoption of blockchain in the Internet of Things (IoT) has been increasing due to the various benefits that blockchain brings, such as security and privacy. Current blockchain models for mobile IoT assume there are fixed, powerful edge devices capable of providing global communication to all the nodes in the network. However, due to the mobile nature of IoT or network partitioning problems (NPP), nodes can move out of a cell area and split into smaller independent peer-to-peer subnetworks. Existing blockchain structures either do not support the network partitioning problem or have limitations. This paper introduces a multidimensional, graph-based blockchain structure, that utilizes k-dimensional spatiotemporal space, to address the challenges of applying blockchain in mobile networks with limited resources. Experimental results show that a multidimensional blockchain structure can improve scalability and efficiency as the blockchain grows in size, similar to logarithmic growth, and reduce the longest chain length by more than 99.99% compared to the traditional chain-based blockchain structure.
Robust Document Image Forgery Localization Against Image Blending

Digital documents, as a twin of hard copy, are increasingly being used as credible evidence. Unfortunately, digital document images easily suffer forgery or malicious manipulation, with the availability of sophisticated image editing tools. To verify and detect the possible forgeries for a given document, a number of forensic schemes have been developed. However, in the real-world scenario, the doctored image could be further processed or transmitted over a channel with unknown distortion, which dramatically degrade the forgery detection performance. In this work, we make the first step towards designing a robust document image forgery localization against image blending. Specifically, we propose an encoder-decoder neural network architecture consisting of three modules. The first module is responsible for capturing the multi-scale features from the high-level feature maps, and the remaining two attention-based modules aim to extract low-level local features and high-level global features. For training the model, we construct a dedicated forgery document database processed by several recent image blending procedures. Extensive experiments demonstrate the effectiveness and superiority of the proposed method in detecting the forgery that undergoes image blending. The source code, models and the constructed image dataset are publicly available at https://github.com/lwp0201/Image-Forgery-Localization-Against-Image-Blending.
ParGCN: Abnormal Transaction Detection based on Graph Neural Networks

This paper improves GraphSAGE from two aspects: 1) performing a sampling compensation before the training to avoid the possible information losses due to the sampling; and 2) adding a hopping connection with the initial inputs in the aggregating phase to avert the potential loss of the initial features of nodes. The empirical study shows that FastGCN can obtain a relatively higher recall of detection but with a lower precision due to its randomness of Monte-Carlo methods and ignoring the special impacts of neighbors; while the improved GraphSAGE gets a relatively higher precision of detection but with a lower recall due to only focusing on neighbors. This paper proposes a graph-based approach to improve both precision and recall of the abnormal transaction detection by hybridizing the improved GraphSAGE with FastGCN, called ParGCN (Precision and recall), describes the mathematical formulas of the hybrid model, and analyzes the time complexity. A set of experiments on the two data-sets with significant differences of the numbers of features are performed to compare and evaluate the proposed approach to demonstrate the validity in terms of the precision and recall.
Parameter Description Generation with the Code Parameter Flow

Prior study shows that comprehending parameters can help developers understand the code’s critical information (e.g., the argument) and enhance the comprehension of the functionality. However, commenting parameter is often ignored in practice. For example, a statistic of 18 popular open-source projects shows the ratio of methods with one or more parameters but lacking "@param" comment ranges from 31% to 97%, indicating the necessity of parameter comments.To fill this gap, we propose ParamDesGen to generate a descriptive code comment (description) for each parameter given a method with one or more formal parameters. ParamDesGen consists of (1) a code analysis component to identify the Parameter Flow and extract "parameter-related code parts" and (2) a machine-learning component to generate parameter comments. We build a large-scale dataset for the task and perform experiments on it to evaluate ParamDesGen. The evaluation results show that the proposed approach substantially outperforms the baselines in terms of BLEU-4 scores (22.54 absolute improvement and 138.79% relative improvement) and ROUGE-L scores (3.12 absolute improvement and 5.90% relative improvement). We further perform ablation experiments to prove the effectiveness of the Parameter Flow.
Continuous Usability Requirements Evaluation based on Runtime User Behavior Mining

Usability requirements have been widely recognized as an essential quality requirement for systems that interact with people. However, evaluating the satisfaction of usability requirements usually involves user interactions, which is intrusive and time-consuming. In this paper, we propose a novel framework for systematically and automatically evaluating the satisfaction of usability requirements at runtime. Specifically, a behavior-centric conceptual model is proposed to comprehensively characterize user behaviors. An analysis process is then proposed based on the conceptual model, which systematically refines high-level usability requirements into observable and measurable user behaviors in order to automatically evaluate their satisfaction. Moreover, we investigate and mine patterns of user behaviors, which further explain the results of the satisfaction analysis. We systematically design and conduct a case study to evaluate our proposed framework, the results of which show that our approach is able to identify most usability issues and precisely assess the satisfaction of participants’ usability requirements. Importantly, our approach enables continuous usability requirements evaluation without interfering with users, pragmatically contributing to trade-off analysis among quality requirements at runtime.
Haxss: Hierarchical Reinforcement Learning for XSS Payload Generation

Web application vulnerabilities are an ongoing problem that current black-box techniques and scanners do not entirely solve, suffering in particular from a lack of payload diversity that prevents them from capturing the long tail of vulnerabilities caused by uncommon sanitisation mistakes.In order to increase the diversity of payloads that can be automatically generated in a black-box fashion, we develop a hierarchical reinforcement learning approach where agents focus separately on the tasks of escaping the current context, and evading sanitisation. We implement this in an end-to-end prototype we call HAXSS.We compare our approach against a number of state-of-the-art black-box scanners on a new micro-benchmark for XSS payload generation, and on a macro-benchmark of established vulnerable web applications. HAXSS outperforms the other scanners on both benchmarks, identifying 131 vulnerabilities (a 20% improvement over the closest scanner), reporting 0 false positives. Finally, we demonstrate that our approach is practically useful, as HAXSS re-discovers 4 existing CVEs and discovers 5 new CVEs in 3 production-grade web applications.
GOV: A Verification Method for Smart Contract Gas-Optimization

Developers may not understand the Gas mechanism of Ethereum, so many smart contracts consume a lot of unnecessary Gas. To address this issue, existing studies have proposed several methods to optimize the code of the contracts to reduce Gas consumption. To verify the effectiveness, most of the methods deploy a private chain to make verification. However, a more reasonable way is to employ the real transactions on Ethereum to trigger the contracts before and after optimization, and then compare the Gas consumption. To achieve this goal, we proposed a method, GOV, to estimate the Gas consumption of the optimized contract by using the real transactions on Ethereum. Our method enables the optimized contract to follow the execution path of the contract before optimization, thus solving the problem of inconsistent execution paths before and after optimization. A preliminary evaluation shows that GOV can effectively estimate the Gas consumption of optimized contract.
Separating the Wheat from the Chaff: Using Indexing and Sub-Sequence Mining Techniques to Identify Related Crashes During Bug Triage

Bug triaging entails a laborious process wherein triagers spend time examining new bug reports, localizing the bugs, and assigning them to the appropriate developer(s) to fix the bugs. In recent years, the adoption of automated software testing techniques (e.g., fuzzing) further complicates the process because bug hunters can submit an overwhelming number of reports in a short period. To lessen these pain points, we present an approach that extracts a fingerprint from crash information within a bug report, and returns a group of bugs with similar behaviors. Our approach uses symptoms of the crash to create a robust fingerprint, and leverages MinHashing and Locality Sensitive Hashing to match crashes, as well as a sequential pattern mining algorithm to find frequent closed sequences among bugs. Our evaluation shows that our approach outperforms contemporary approaches (e.g., finding previously unknown duplicates among 81 CVEs), and saves triagers time and effort.
TFCFI:Transparent Forward Fine-grained Control-Flow Integrity Protection

Code-reuse attacks (including ROP/JOP) severely threaten computer security. Control-flow integrity (CFI), which can restrict control flow in legal scope, is recognised as an effective defence mechanism against code-reuse attacks. Hardware-based CFI uses Instruction Set Architecture (ISA) extensions with additional hardware modules to implement CFI and achieve better performance. However, hardware-based fine-grained CFI adds new instructions to the ISA, which can not be executed on old processors and breaks the compatibility of programs. Some coarse-grained CFI designs, such as Intel IBT, maintain the compatibility of programs but can not provide enough security guarantees.To balance the security and compatibility of hardware CFI, we propose Transparent Forward CFI (TFCFI). TFCFI implements hardware-based fine-grained CFI designs without changing the ISA. The software modification of TFCFI utilizes address information and hint instructions in RISC-V as transparent labels to mark the program. The hardware module of TFCFI monitors the control flow during execution. The program modified by TFCFI can be executed on old processors without TFCFI. Benefiting from transparent labels, TFCFI also solves the destination equivalence problem. The experiment on FPGA shows that TFCFI incurs negligible performance overhead (1.82% on average).
Enabling Anonymous Authenticated Encryption with a Novel Anonymous Authenticated Credential Key Agreement (AACKA)

Anonymous credential schemes based on elliptic curve pairings are often used to implement privacy-friendly cryptographic protocols, with Direct Anonymous Attestation and Enhanced Privacy IDentification being the most prominent anonymous credential schemes. However, all those schemes are signature-based and do not immediately provide for agreement of (symmetric) encryption keys.In this paper we present a scheme for Anonymous Authenticated Credential Key Agreement, which can be used in anonymously authenticated encryption schemes. This novel building-block combines Camenisch-Lysyanskaya credentials with elliptic curve Diffie-Hellman key agreement.We show how the Authenticated Anonymous Key Agreement protocol can be used to design an anonymous credential based Elliptic Curve Integrated Encryption scheme and argue that it is more efficient than conventional hybrid approaches. We show the applicability of our scheme on performance-restricted Internet of Things devices in Cloud-, Fog-, or Edge-Computing scenarios. In particular, we provide an implementation and a performance evaluation for a standard-compliant Java Card 3.1 device.
Conceptualizing the Secure Machine Learning Operations (SecMLOps) Paradigm

Due to the proliferation of machine learning in various domains and applications, Machine Learning Operations (MLOps) was created to improve efficiency and adaptability by automating and operationalizing ML products. Because many machine learning application domains demand high levels of assurance, security has become a top priority and necessity to be involved at the beginning of ML system design. To provide theoretical guidance, we first introduce the Secure Machine Learning Operations (SecMLOps) paradigm, which extends MLOps with security considerations. We use the People, Processes, Technology, Governance and Compliance (PPTGC) framework to conceptualize SecMLOps, and to discuss challenges in adopting SecMLOps in practice. Since ML systems are often multi-concerned, analysis on how the adoption of SecMLOps impacts other system qualities, such as fairness, explainability, reliability, safety, and sustainability are provided. This paper aims to provide guidance and a research roadmap for ML researchers and organizational-level practitioners towards secure, reliable, and trustworthy MLOps.
Test Case Generation for Ethereum Smart Contract based on Data Dependency Analysis of State Variable

An Ethereum smart contract is an agreement reached by multiple parties, which is guaranteed by blockchain technology to be executed in accordance with the terms expressed in the form of code. Its security needs are particularly prominent due to a large number of digital assets under management. Testing is an effective way to find flaws that threaten the security of smart contracts. However, current smart contract test case generation methods do not regard the impact of other functions in the smart contract on state variables, resulting in the inaccessibility of the control statements related to state variables and low branch coverage of the function under test. To alleviate this problem, this paper proposes SV-Gen. SV-Gen generates test cases for smart contracts through two steps: static analysis and dynamic search. In the first step, SV-Gen considers the read-write relationship between functions and state variables in the smart contract to generate a function invocation sequence for the function to be tested through a backtracking algorithm on state variables. Then the arguments of transactions to invoke each function in the sequence are generated through regex matching to form the primitive test case. In the second step, the primitive test cases constitute an initial population, and a genetic algorithm undertakes the task of evolving them to high branch coverage. The experimental results on one of the VeriSmart datasets show that SV-Gen can effectively enter the control constraints related to state variables and improve the branch coverage of smart contracts.
An Efficient Epsilon Selection Method for DP-ERM with Expected Accuracy Constraints

Nowadays, the leakage of personal information and privacy becomes a major concern in various fields, such as social sciences, genomics, and medicine. To combat this problem, differential privacy has been proposed and soon be widely studied and applied. Meanwhile, the compositional nature of differential privacy has motivated the design and implementation of differentially private machine learning mechanisms. However, as these mechanisms are gradually deployed in practice, a serious problem appears: they find it hard to choose a meaningful ε value or understand the meaning of a chosen ε value in practice. To this end, we propose a novel and efficient approach that would allow users to choose ε according to their utility or accuracy requirement. Specifically, we can efficiently obtain the expected ε value that would generate a private model satisfying the expected empirical loss or expected accuracy, through at least one-round training and some calculations. As product requirements often impose hard accuracy constraints, our approach allows users to focus on their own benefits without paying too much attention to things they don’t understand or care. Both theoretical analysis and experimental results demonstrate high accuracy and broad applicability of our mechanism in practical applications.
AuthROS: Secure Data Sharing Among Robot Operating Systems based on Ethereum

The Robot Operating System (ROS) streamlines human processes, increasing the efficiency of various production tasks. However, the security of data transfer operations in ROS is still in its immaturity. Securing data exchange between several robots is a significant problem. This paper proposes AuthROS, an Ethereum blockchain-based secure data sharing method, for robot communication. It is a ROS node authorization system capable of ensuring the immutability and security of private data flow between ROS nodes of any size. To ensure data security, AuthROS employs the smart contract for permission granting and identification, SM2-based key exchange, and SM4-based plaintext encryption techniques. In addition, we deploy a data digest upload technique to optimize data query and upload performance. Finally, the experimental findings reveal that AuthROS has strong security, time performance, and node forging in cases where data should be recorded and robots need to remain immobile.
Multi-Transaction Sequence Vulnerability Detection for Smart Contracts based on Inter-Path Data Dependency

Smart contracts are commonly used to build finance-related decentralized applications. If a smart contract vulnerability is exploited by an attacker, the contract owner may suffer financial losses. We focus on a particular class of smart contract vulnerabilities that require a specific sequence of multiple transactions to trigger, which we call multi-transaction sequence vulnerabilities. Due to the combinatorial explosion problem caused by the huge number of possible transaction sequences, the efficiency and scalability for existing security analyzers to detect multi-transaction sequence vulnerabilities are limited. To alleviate the problem, we propose a vulnerability detection approach based on symbolic execution and inter-path data dependency. In the approach, we first traverse paths in a contract, and record read and write operations of each path. Then, we selectively execute paths which are conducive to discovering vulnerabilities during the subsequent detection process according to inter-path data dependencies. By pruning out most paths that are not relevant to vulnerabilities, we improve the efficiency and scalability of detecting multi-transaction sequence vulnerabilities. We evaluate our approach on 442 contracts collected from CVE reports and 104 contracts with Ether leakage and suicide defects. The experimental results show that our approach reaches an average 2x speedup comparing to Mythril.