Reviewerly/exHarmony huggingface dataset:
GeeSolver: A Generic, Efficient, and Effortless Solver with Self-Supervised Learning for Breaking Text Captchas

Although text-based captcha, which is used to differentiate between human users and bots, has faced many attack methods, it remains a widely used security mechanism and is employed by some websites. Some deep learning-based text captcha solvers have shown excellent results, but the labor-intensive and time-consuming labeling process severely limits their viability. Previous works attempted to create easy-to-use solvers using a limited collection of labeled data. However, they are hampered by inefficient preprocessing procedures and inability to recognize the captchas with complicated security features.In this paper, we propose GeeSolver, a generic, efficient, and effortless solver for breaking text-based captchas based on self-supervised learning. Our insight is that numerous difficult-to-attack captcha schemes that "damage" the standard font of characters are similar to image masks. And we could leverage masked autoencoders (MAE) to improve the captcha solver to learn the latent representation from the "unmasked" part of the captcha images. Specifically, our model consists of a ViT encoder as latent representation extractor and a well-designed decoder for captcha recognition. We apply MAE paradigm to train our encoder, which enables the encoder to extract latent representation from local information (i.e., without masking part) that can infer the corresponding character. Further, we freeze the parameters of the encoder and leverage a few labeled captchas and many unlabeled captchas to train our captcha decoder with semi-supervised learning.Our experiments with real-world captcha schemes demonstrate that GeeSolver outperforms the state-of-the-art methods by a large margin using a few labeled captchas. We also show that GeeSolver is highly efficient as it can solve a captcha within 25 ms using a desktop CPU and 9 ms using a desktop GPU. Besides, thanks to latent representation extraction, we successfully break the hard-to-attack captcha schemes, proving the generality of our solver. We hope that our work will help security experts to revisit the design and availability of text-based captchas. The code is available at https://github.com/NSSL-SJTU/GeeSolver.
Not Yet Another Digital ID: Privacy-Preserving Humanitarian Aid Distribution

Humanitarian aid-distribution programs help bring physical goods to people in need. Traditional paper-based solutions to support aid distribution do not scale to large populations and are hard to secure. Existing digital solutions solve these issues, at the cost of collecting large amount of personal information. This lack of privacy can endanger recipients’ safety and harm their dignity. In collaboration with the International Committee of the Red Cross, we build a safe digital aid-distribution system. We first systematize the requirements such a system should satisfy. We then propose a decentralized solution based on the use of tokens that fulfills the needs of humanitarian organizations. It provides scalability and strong accountability, and, by design, guarantees the recipients’ privacy. We provide two instantiations of our design, on a smart card and on a smartphone. We formally prove the security and privacy properties of these solutions, and empirically show that they can operate at scale.
Exploring The Viability And Effectiveness of Lightweight Cryptographic Techniques in Enhancing The Iot Data Security of Smart Cities

Smart cities have evolved into a new model that provides a better quality of life, and efficiently optimizes the resources in the city to provide improved facilities. However, despite the evolution of smart cities, privacy and security challenges are a concern that needs to be addressed. Therefore, in this paper, we thoroughly explore the complications that arise in the protection of data in smart cities, and the various lightweight cryptographic algorithms available that can be implemented as a viable and feasible solution. Smart cities are immensely equipped with IoT devices, therefore we present various accessible methods to protect the data of IoT devices, which indirectly results in the protection of data in smart cities. The paper aims to provide various lightweight cryptographic algorithms and methods available that are suitable for the security of smart cities. Moreover, explain the challenges towards the implementation of each algorithm to exploit all challenges of smart city security. Each algorithm provides a certain level of security in its own manner, however, no algorithm can be defined as ideal and perfect for all types of cyberattacks, so we present a comparison among various algorithms that can be implemented. Further, we present a list of recent advancements in the security of smart cities to provide extensive information on recent innovations, new security models, new communication protocols, new authentication schemes, etc. which are all under the same domain of security of smart cities.
An Innovative Resource-based Dynamic Scheduling Video Computing and Network Convergence System

Live video streaming services have experienced significant growth, and it has imposed more stringent requirements on current media delivery networks. However, traditional media distribution methods have difficulty meeting the low latency and high bandwidth requirements of emerging live-streaming services. Therefore, for the live video service scenario, we propose a video computing and network convergence (VNCN) model containing multiple nodes and multiple users, which integrates the network and computing resource occupancy of each node in the system and the impact of the media delivery method on the live service. In addition, we also propose a resource-aware dynamic scheduling (RDS) algorithm, which dynamically schedules user requests based on the resources of each node to maximize user Quality of Service (QoS). Finally, the experimental results show that, compared with the commonly used Round-robin (RR) algorithm and the K-Nearest Neighbor (KNN) algorithm, our system can not only provide users with a high QoS live streaming service but also ensure a more balanced load on the resources of each node.
A Lightweight Blockchain for the Internet of Medical Things Using Hash-based Message Authentication Codes

Blockchains allow to create and maintain distributed immutable registries of data. The internet of things (IoT) is one of possible applications, where blockchain technologies are demanded. Due to their properties and possibilities, blockchains can essentially improve characteristics of IoT systems in many applications, therefore at the moment a lot of attempts are made to adopt blockchains to use them in the IoT (including the internet of medical things (IoMT) that is a particular case of the IoT). One of the main approaches of such adoption is creating lightweight blockchains optimized for specific cases of use. In this paper, we propose a scheme of a lightweight blockchain for processing the data in the IoMT with low-resourced sensor devices. Our scheme is built upon the use of hash-based message authentication codes (HMAC) to provide the integrity and authenticity of circulated data and on a simplistic consensus algorithm that is adequate to the use scenario.
Accuracy-Privacy Trade-off in Deep Ensemble: A Membership Inference Perspective

Deep ensemble learning has been shown to improve accuracy by training multiple neural networks and averaging their outputs. Ensemble learning has also been suggested to defend against membership inference attacks that undermine privacy. In this paper, we empirically demonstrate a trade-off between these two goals, namely accuracy and privacy (in terms of membership inference attacks), in deep ensembles. Using a wide range of datasets and model architectures, we show that the effectiveness of membership inference attacks increases when ensembling improves accuracy. We analyze the impact of various factors in deep ensembles and demonstrate the root cause of the trade-off. Then, we evaluate common defenses against membership inference attacks based on regularization and differential privacy. We show that while these defenses can mitigate the effectiveness of membership inference attacks, they simultaneously degrade ensemble accuracy. We illustrate similar trade-off in more advanced and state-of-the-art ensembling techniques, such as snapshot ensembles and diversified ensemble networks. Finally, we propose a simple yet effective defense for deep ensembles to break the trade-off and, consequently, improve the accuracy and privacy, simultaneously.
REGA: Scalable Rowhammer Mitigation with Refresh-Generating Activations

Mitigating Rowhammer requires performing additional refresh operations to recharge DRAM rows before bits start to flip.These refreshes are scarce and can only happen periodically, impeding the design of effective mitigations as newer DRAM substrates become more vulnerable to Rowhammer, and more "victim" rows are affected by a single "aggressor" row.We introduce REGA, the first in-DRAM mechanism that can generate extra refresh operations each time a row is activated.Since row activations are the sole cause of Rowhammer, these extra refreshes become available as soon as the DRAM device faces Rowhammer-inducing activations.Refresh operations are traditionally performed using sense amplifiers.Sense amplifiers, however, are also in charge of handling the read and write operations.Consequently, the sense amplifiers cannot be used for refreshing rows during data transfers.To enable refresh operations in parallel to data transfers, REGA uses additional low-overhead buffering sense amplifiers for the sole purpose of data transfers.REGA can then use the original sense amplifiers for parallel refresh operations of other rows during row activations.The refreshes generated by REGA enable the design of simple and scalable in-DRAM mitigations with strong security guarantees.As an example, we build REGAM, the first deterministic in-DRAM mitigation that scales to small Rowhammer thresholds while remaining agnostic to the number of victims per aggressor.REGAM has a constant 2.1% area overhead, and can protect DDR5 devices with Rowhammer thresholds as small as 261, 517, and 1029 with 23.9%, 11.5%, and 4.7% more power, and 3.7%, 0.8% and 0% performance overhead.
Blockchain Scalability Solved via Quintessential Parallel Multiprocessor

The increase in usage and interest in blockchain technology has shown its benefits and potential uses and its drawbacks and issues. The amount of time it takes to mine, make transactions, and perform other functions is one of the several scalability issues being analyzed. This paper presents a quintessential parallel multiprocessor approach to implement proof of work distributed blockchain to increase the number of transactions and lower mining latency and cost by applying vertical scaling, consensus, and reduced overheads. The proposed approach is providing promising results by increasing the number of transactions per second (tps) and reducing latency for mining. The distributed approach aims to partition blocks among processes, where processes work for blocks, and each block holds a distinct part of the ledger of the blockchain. The transaction process involves validation and reaching a consensus when the storage location is available only to the intended block. The proposed approach is achieving scalability. It is observed that the given approach has low latency, high throughput, and lower cost in comparison to some existing approaches.
OneSketch: A Generic and Accurate Sketch for Data Streams

In this paper, we propose a generic sketch algorithm capable of achieving more accuracy in the following five tasks: finding top- <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$k$</tex-math></inline-formula> frequent items, finding heavy hitters, per-item frequency estimation, and heavy changes in the time and spatial dimension. The state-of-the-art (SOTA) sketch solution for multiple measurement tasks is ElasticSketch (ES). However, the accuracy of its frequency estimation has room for improvement. The reason for this is that ES suffers from overestimation errors in the light part, which introduces errors when querying both frequent and infrequent items. To address these problems, we propose a generic sketch, OneSketch, designed to minimize overestimation errors. To achieve the design goal, we propose four key techniques, which embrace hash collisions and minimize possible errors by handling highly recurrent item replacements well. Experimental results show that OneSketch clearly outperforms 12 SOTA schemes. For example, compared with ES, OneSketch achieves more than 10× lower Average Absolute Error on finding top- <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$k$</tex-math></inline-formula> frequent items and heavy hitters, as well as 48.3% and 38.4% higher F1 Scores on two heavy changes under 200KB memory, respectively.
Care to share? Experimental evidence on code sharing behavior in the social sciences

Transparency and peer control are cornerstones of good scientific practice and entail the replication and reproduction of findings. The feasibility of replications, however, hinges on the premise that original researchers make their data and research code publicly available. This applies in particular to large-N observational studies, where analysis code is complex and may involve several ambiguous analytical decisions. To investigate which specific factors influence researchers' code sharing behavior upon request, we emailed code requests to 1,206 authors who published research articles based on data from the European Social Survey between 2015 and 2020. In this preregistered multifactorial field experiment, we randomly varied three aspects of our code request's wording in a 2x4x2 factorial design: the overall framing of our request (enhancement of social science research, response to replication crisis), the appeal why researchers should share their code (FAIR principles, academic altruism, prospect of citation, no information), and the perceived effort associated with code sharing (no code cleaning required, no information). Overall, 37.5% of successfully contacted authors supplied their analysis code. Of our experimental treatments, only framing affected researchers' code sharing behavior, though in the opposite direction we expected: Scientists who received the negative wording alluding to the replication crisis were more likely to share their research code. Taken together, our results highlight that the availability of research code will hardly be enhanced by small-scale individual interventions but instead requires large-scale institutional norms.
Perspectival Kinaesthetic Imaging

Perspectival Kinaesthetic Imaging is being proposed as a method designed to facilitate the heightened sensitivity needed for the anthropological study of the relationship between making and thinking, during the creative engagement with form-generating materials. Technically, this objective is achieved through the juxtaposition of perspectival view points on the process of making. We follow the ways of the hand using a combination of multimodal visual captures (i.e., photography, video, observational drawing and mobile eye-tracking). Each of these multimodal visual captures affords a specific spatio-temporal perspective from which to identify and observe morphogenetic events of interest (e.g. creative gestures and modes of enactive signification). The basic idea is that the juxtaposition of different media affects how we observe and what can be observed by enabling the discovery of connections and material relations that are often obscured when seen from a single perspectival point.
Towards reliable object representation via sparse directional patches and spatial center cues

In the process of image understanding, the human visual system (HVS) performs multiscale analysis on various objects. HVS primarily focuses on marginally conspicuous image patches located within or around distinct objects rather than scanning the image pixels point by point. Inspired by the HVS mechanism, in this paper, we aimed to describe and exploit multiscale decomposition-based patch detection models for automatic visual feature representation and object localization in images. Our investigation into mimicking and modeling the HVS to capture conspicuous sparse patches and their spatial distribution clues makes a profound contribution to the automatic comprehension and characterization of images by machines. This study demonstrates that the sparse patch-based visual representation with spatial center cues is intrinsically tolerant to object positioning and understanding beyond object variations in spatial position, multiresolution, and chrominance, which has significant implications for many vision-based automatic object grabbing and perception applications, such as robotics, human‒machine interaction, and unmanned aerial vehicles (UAVs).
Attack on “A Privacy-Preserving Online Ride-Hailing System Without Involving a Third Trusted Server”

Recently, Xie, Guo, and Jia (IEEE Transactions on Information Forensics and Security, vol. 16, pp. 3068-3081, 2021) proposed a privacy-preserving Online Ride-Hailing (ORH) protocol that does not make use of a trusted third-party server. The primary goal of such privacy-preserving ORH protocols is to ensure the privacy of riders’ and drivers’ location data w.r.t. the ORH Service Provider (SP). In this work, we demonstrate a passive attack by the SP in the protocol of Xie, Guo, and Jia that enables it to completely recover the location of the rider as well as that of the responding drivers in each and every ride request query. The running time of our attack is independent of the security parameter.
Canary in Twitter Mine: Collecting Phishing Reports from Experts and Non-experts

The rise in phishing attacks via e-mail and short message service (SMS) has not slowed down at all. The first thing we need to do to combat the ever-increasing number of phishing attacks is to collect and characterize more phishing cases that reach end users. Without understanding these characteristics, anti-phishing countermeasures cannot evolve. In this study, we propose an approach using Twitter as a new observation point to immediately collect and characterize phishing cases via e-mail and SMS that evade countermeasures and reach users. Specifically, we propose CrowdCanary, a system capable of structurally and accurately extracting phishing information (e.g., URLs and domains) from tweets about phishing by users who have actually discovered or encountered it. In our three months of live operation, CrowdCanary identified 35,432 phishing URLs out of 38,935 phishing reports, 31,960 (90.2%) of these phishing URLs were later detected by the anti-virus engine. We analyzed users who shared phishing threats by categorizing them into two groups: experts and non-experts. As a results, we discovered that CrowdCanary extracts non-expert report-specific information, like company brand name in tweets, phishing attack details from tweet images, and pre-redirect landing page information.
Unlabeled backdoor poisoning on trained-from-scratch semi-supervised learning

Semi-supervised learning (SSL) aims to achieve competitive performance by labeling only a few training examples. However, unlabeled training examples from the wild are vulnerable to backdoor poisoning. Hence, networks trained by SSL tend to be injected with backdoors. Most existing backdoor attacks focus on labeled examples, while some backdoor poisoning methods on unlabeled examples require that SSL networks must be pre-trained on labeled examples. In this paper, we propose a backdoor poisoning method on unlabeled examples of trained-from-scratch SSL networks. We find that backdoor poisoning always fails when the poisoned unlabeled examples come from different classes, which is different from poisoning the labeled examples. The reason is that SSL algorithms always strive to correct them during training. Therefore, for unlabeled examples, we implement backdoor poisoning on examples from the target class. We propose a gradient matching strategy to craft poisoned examples such that their gradients match the gradients of target examples on the SSL network. This can fit poisoned examples to the target class and realize backdoor injection. Experiments show that our poisoning achieves state-of-the-art attack success rates on most SSL algorithms while ensuring the imperceptibility of backdoor patterns and bypassing modern backdoor defenses.
Implementing Data Sovereignty: Requirements &amp; Challenges from Practice

Data sovereignty, the possibility to keep control over data, is gaining increasing attention in both research and industry. Due to complex supply chains and a strong trend toward digitization, digital assets are essential to be fast and competitive. As a result, companies need to share data while retaining control over it to prevent unwanted leaks of sensitive data. However, implementing effective data governance, access, and usage control mechanisms can be challenging, especially in cross-company data sharing networks and ecosystems like dataspaces. In this paper, we examine the industrial landscape and interview eleven experts from software providers and producing organizations to identify their requirements and challenges of existing data sovereign solutions. Based on Grounded Theory and semi-structured interviews, we explore the motivations and issues behind data sharing from an Information Systems and Software Engineering point of view. The findings include current industrial contexts, use cases, and solutions with data sovereignty’s technical and non-technical implementations. Seven requirements and thirteen challenges were observed throughout a qualitative analysis. Clustered by organizational, technical, personal, and emotional viewpoints, they are discussed with initial approaches for mitigation. The results identify current practical needs and will enable the design of future data sovereignty solutions in theory and different practical domains.
Varying-scale HCA-DBSCAN-based anomaly detection method for multi-dimensional energy data in steel industry

The quality of the acquisition data in the energy system of steel industry is the basis of prediction analysis and scheduling operation. Facing with its multi-dimensional and high-noise characteristics, in this study, an anomaly detection method based on a varying-scale hypercube accelerated density based spatial clustering for applications with noise (VHCA-DBSCAN) is proposed. An HCA-DBSCAN model based on the Gaussian probability density estimation is firstly established, in which the searching radius is adaptively calculated to identify the suspected outliers efficiently. Then, a traversal search strategy for hypercube segmentation is designed, where the lengths of the edges are varying according to the characteristics of each dimension. Finally, a modified local outlier factor (LOF) by using the approximate upper boundary is presented to evaluate the degree of the suspected outliers, and the confirmed ones are identified by collaboratively considering the manufacturing signals. Validation experiments by employing real-world data from a typical steel enterprise are carried out, and the results indicate that the proposed method exhibits reliable performance and high efficiency when facing with the anomaly detection problem of multi-dimensional industrial data.