Reviewerly/exHarmony huggingface dataset:
FORMATION OF UNIVERSAL COMPETENCIES AMONG CADETS BASED ON INTEGRATIVE APPROACH WHEN TEACHING A FOREIGN LANGUAGE

The article is devoted to the current issue of the formation of universal competencies among cadets of the Branch of the Military Academy of Strategic Missile Forces named after Peter the Great in Serpukhov when studying foreign language, the essence of communicative competence and competence of intercultural interaction and their value for the development of the personality of future rocket officers are described. The annual increasing importance and at the same time the need to learn a foreign language in the modern world was noted, the problem of reducing the motivation of students and the importance of finding an approach to future military specialists in order to increase their level of interest in professional and personal growth were described. To form the universal competencies, an integrative approach was chosen as the leader, its characteristics and structure were given based on analyzed scientific research in the field of pedagogical integration. The result of pedagogical integration is supposed to increase the level of formation of the universal competencies. Based on the knowledge gained, the methodological basis for the design of the integrative model is presented. The design of the training model for cadets in the discipline was carried out taking into account the implementation of integrative processes at four levels: inter-subject, intra-subject, interpersonal and intra-person. The principle of integration was chosen as the leading principle of modeling the content and course of training of cadets, which ensures the effective achievement of the goals of the educational process by forming an integral idea of the discipline "Foreign Language" as an integral part of education in the university as a whole. The article justifies the need to use an integrative approach to form the universal competencies in a military university among cadets when studying English. The model at the four integration levels is represented graphically. Conclusions were made about the further practical development of the studies obtained.
Three-dimensional basic typological design of personal characteristics of the head

The subject of the study is a three-dimensional basic typological design of the personal characteristics of the head. The purpose of the work is to build a measuring three–dimensional basis test for a manager. The methodology of the work is a systematic classification of the pairwise observed parameters of the personality of the head. Methods – comparison, typologization, modeling, design. The number of respondents – 108. Results of the work - correlations were found between the personality types of the manager and the professional personality types. The scope of application of the results is the development of the managerial potential of the head. Novelty - two more opposite types of ego states have been added to the typology of ego states according to E. Bern. Conclusions - a three-dimensional basic typological model of the personality of the head was built. In the study, three-dimensional basic design was used, which is associated with "modeling", with "construction" and with "measurement". In this case, the "measurement" is associated with the transformation of the evaluation layers.
A STUDY ON FURNITURE FOR GROUP ACTIVITIES INSTALLED IN EXISTING ELEMENTARY SCHOOL CLASSROOMS AND LESSON DEVELOPMENT

In order to promote classes from the perspective of active learning, an AL room was constructed in an elementary school in A city. This room was renovated from an existing classroom, but furniture different from existing classrooms has been installed. It was clarified that there are many classes that promote communication between children. Table of circle shape is effective for discussion and chair without backrest is effective for reorientation of the body and they can start next activity without thinking interrupted. Therefore, it can be said that the AL room is effective when conducting exchange activities among children.
Dark channel a priori defogging algorithm based on a combination of bright channel inversion and dark channel weighting

The classical traditional dark channel priori algorithm causes colour distortion in bright areas of the sky, snow and other surfaces when processing images, and the overall darkness of the recovered image is complicated, resulting in slow processing speed. In this paper, we propose an adaptive modified dark channel priori defogging algorithm that combines inverse bright channel and dark channel weighting. Firstly, the brightest channel of the RGB channel of the fogged image is inverted, and then the dark channel is weighted and combined with the dark channel to correct the dark channel and adaptively correct the transmittance. Secondly, the mean value of the brightest 0.1% of pixels in the new dark channel is used in estimating atmospheric light values; finally, the transmittance estimation is optimised using multiwindow fitting and guided filtering methods. Experimental results show that the algorithm improves the dark channel priori colour distortion in bright regions, with faster processing and more effective defogging.
An image defogging algorithm based on gaussian mixture model and transmittance compensation

An improved image defogging method is proposed to address the problem that the use of dark channel a priori principle for image defogging is likely to cause distortion in the sky region and the overall darkness of the recovered image. In this paper, based on the idea of sky segmentation, we use Gaussian mixture model and EM algorithm to divide the fogged image containing sky region into sky region and non-sky region, and take the mean value of the pixel value of the sky part as the atmospheric light value after getting the sky region. The transmittance is estimated by calculating the RAS color channel to eliminate the effect of atmospheric scattering, based on which the transmittance compensation function is constructed, and the transmittance is corrected by using the constructed transmittance compensation function to reduce the transmittance estimation error. The experimental results show that the algorithm proposed in this paper has a good defogging effect.
Img2Sim-V2: A CAD Tool for User-Independent Simulation of Circuits in Image Format

Composition of the simulation-ready representations of circuits may be laborius and also vulnerable to human-induced errors, which results in wasted effort before the design process. Artificial intelligence (AI)-aided approaches are used in various applications to minimize the human error, and automatize the Netlist generation process. In literature, presented studies are mostly focused on the recognition of circuit components. In the previous version of Img2Sim, both active and passive components can be detected with 90% accuracy while the netlist for a given circuit can be generated automatically. In this study, we propose Img2Sim-V2, which is an AI assisted mobile application that provides high detection accuracy for hand or computer-drawn electrical circuits, generates related circuit netlist and produces a circuit schematic. Additionally, proposed system performs basic electrical analyses (DC, AC, and Transient) through Python packages.
Faulting original McEliece’s implementations is possible How to mitigate this risk?

Private and public actors increasingly encounter use cases where they need to implement sensitive operations on mass-market peripherals for which they have little or no control. They are sometimes inclined to attempt this without using hardware-assisted equipment, such as secure elements. In this case, the white-box attack model is particularly relevant and includes access to every asset, retro-engineering, and binary instrumentation by attackers. At the same time, quantum attacks are becoming more and more of a threat and challenge traditional asymmetrical ciphers, which are treasured by private and public actors.The McEliece cryptosystem is a code-based public key algorithm introduced in 1978 that is not subject to well-known quantum attacks and that could be implemented in an uncontrolled environment. During the NIST post-quantum cryptography standardization process [17], a derived candidate commonly referred to as classic McEliece was selected. This algorithm is however vulnerable to some fault injection attacks while a priori, this does not apply to the original McEliece. In this article, we thus focus on the original McEliece cryptosystem and we study its resilience against fault injection attacks on an ARM reference implementation [18]. We disclose the first fault injection based attack and we discuss on how to modify the original McEliece cryptosystem to make it resilient to fault injection attacks.
Reconstructing Individual Data Points in Federated Learning Hardened with Differential Privacy and Secure Aggregation

Federated learning (FL) is a framework for users to jointly train a machine learning model. FL is promoted as a privacy-enhancing technology (PET) that provides data minimization: data never "leaves" personal devices and users share only model updates with a server (e.g., a company) coordinating the distributed training. While prior work showed that in vanilla FL a malicious server can extract users’ private data from the model updates, in this work we take it further and demonstrate that a malicious server can reconstruct user data even in hardened versions of the protocol. More precisely, we propose an attack against FL protected with distributed differential privacy (DDP) and secure aggregation (SA). Our attack method is based on the introduction of sybil devices that deviate from the protocol to expose individual users’ data for reconstruction by the server. The underlying root cause for the vulnerability to our attack is a power imbalance: the server orchestrates the whole protocol and users are given little guarantees about the selection of other users participating in the protocol. Moving forward, we discuss requirements for privacy guarantees in FL. We conclude that users should only participate in the protocol when they trust the server or they apply local primitives such as local DP, shifting power away from the server. Yet, the latter approaches come at significant overhead in terms of performance degradation of the trained model, making them less likely to be deployed in practice.
Chrowned by an Extension: Abusing the Chrome DevTools Protocol through the Debugger API

The Chromium open-source project has become a fundamental piece of the Web as we know it today, with multiple vendors offering browsers based on its codebase. One of its most popular features is the possibility of altering or enhancing the browser functionality through third-party programs known as browser extensions. Extensions have access to a wide range of capabilities through the use of APIs exposed by Chromium. The Debugger API—arguably the most powerful of such APIs—allows extensions to use the Chrome DevTools Protocol (CDP), a capability-rich tool for debugging and instrumenting the browser. In this paper, we describe several vulnerabilities present in the Debugger API and in the granting of capabilities to extensions that can be used by an attacker to take control of the browser, escalate privileges, and break context isolation. We demonstrate their impact by introducing six attacks that allow an attacker to steal user information, monitor network traffic, modify site permissions (e.g., access to camera or microphone), bypass security interstitials without user intervention, and change the browser settings. Our attacks work in all major Chromium-based browsers as they are rooted at the core of the Chromium project. We reported our findings to the Chromium Development Team, who already fixed some of them and are currently working on fixing the remaining ones. We conclude by discussing how questionable design decisions, lack of public specifications, and an overpowered Debugger API have contributed to enabling these attacks, and propose mitigations.
Unsafe Behavior Detection with Adaptive Contrastive Learning in Industrial Control Systems

Unsafe behavior detection is crucial for maintaining safe and reliable operations in various industrial control systems. However, the scarcity of labeled samples for model training poses significant challenges for existing methods. Self-supervised learning, particularly contrastive learning, offers a promising solution due to its ability to learn from unlabelled data. In this paper, we present AdaTCL, a contrastive learning framework with adaptive augmentations, to detect unsafe behavior in industrial control systems. By dividing instances into task-irrelevant and informative parts and applying lossless transform functions, AdaTCL prevents ad-hoc decisions and laborious trial-and-error tuning for augmentation selection, which improves the generalization capability of contrastive learning. Our experiments demonstrate that AdaTCL significantly outperforms classic and recent baselines highlighting the potential of state-of-the-art self-supervised learning techniques for industrial control systems.
Revelio: A Network-Level Privacy Attack in the Lightning Network

The Lightning Network (LN) is a widely-adopted off-chain protocol that not only addresses Bitcoin's scaling problem but also enables anonymous payments.Prior attacks have shown that an adversary controlling several peers at the central position of the network (e.g., by hijacking payment routes) can deanonymize such payments.However, these attacks are highly observable or require many parties to collude.This paper presents Revelio, a stealthier, passive network-level privacy attack against LN that exploits its joint centralization at the application and the network layers.Indeed, network-level adversaries can see most of the LN traffic (e.g., five autonomous systems can see up to 80 % of all observable communication channels) despite the encrypted communication between LN nodes and the widespread usage of Tor.This comprehensive view allows Revelio adversaries not only to estimate the payment amount but also to effectively reduce the anonymity size of its endpoints.We show that the Revelio attack is practical: it perfectly deanonymizes the senders or the receiver in almost one-third of tested payments in today's LN and underlying network topologies.
Towards Automated Detection of Single-Trace Side-Channel Vulnerabilities in Constant-Time Cryptographic Code

Although cryptographic algorithms may be mathematically secure, it is often possible to leak secret information from the implementation of the algorithms.Timing and power side-channel vulnerabilities are some of the most widely considered threats to cryptographic algorithm implementations.Timing vulnerabilities may be easier to detect and exploit, and all high-quality cryptographic code today should be written in constanttime style.However, this does not prevent power sidechannels from existing.With constant time code, potential attackers can resort to power side-channel attacks to try leaking secrets.Detecting potential power side-channel vulnerabilities is a tedious task, as it requires analyzing code at the assembly level and needs reasoning about which instructions could be leaking information based on their operands and their values.To help make the process of detecting potential power side-channel vulnerabilities easier for cryptographers, this work presents Pascal: Power Analysis Side Channel Attack Locator, a tool that introduces novel symbolic register analysis techniques for binary analysis of constant-time cryptographic algorithms, and verifies locations of potential power side-channel vulnerabilities with high precision.Pascal is evaluated on a number of implementations of post-quantum cryptographic algorithms, and it is able to find dozens of previously reported single-trace power side-channel vulnerabilities in these algorithms, all in an automated manner.
On Gaps in Enterprise Cyber Attack Reporting

It has long been lamented that firms underreport cyber attacks. In recent years, regulators have begun mandating that certain organizations must publicly report when incidents occur. Adherence to these requirements is an empirical question that has been largely unexamined to date. In this paper, we study regulatory filings by U.S. public companies to the Securities Exchange Commission and to the Department Health and Human Services that discuss cyber attacks. We also compare the findings against crowdsourced reports of cyber incidents appearing in media outlets. We find substantial gaps in coverage, both in terms of attacks that make the news but do not appear in regulatory filings and vice versa. We conclude by discussing the implications for the study of cyber attack and defense as well as for policymakers.
MicroProfiler: Principled Side-Channel Mitigation through Microarchitectural Profiling

Preventing information leakage through microarchitectural side channels is notoriously challenging and, as a result, an important research question. Recent work has shown the viability of compiler-assisted instruction balancing for small, embedded processors with deterministic timing behavior. However, even in such small processors, more subtle microarchitectural side channels continue to be discovered, complicating mitigation efforts.We propose a methodology for augmenting an existing instruction set architecture (ISA) specification with instruction-specific microarchitectural leakage traces obtained through principled microarchitectural profiling. Building on this augmented ISA, it becomes possible to construct software tools to detect and mitigate certain side-channel vulnerabilities. As a case study, we instantiate our methodology on a recently uncovered microarchitectural side channel, which is based on cycle-level timing differences of direct memory access (DMA) requests on 16-bit openMSP430 processors. Using the augmented ISA obtained for this side channel through microarchitectural profiling, we develop practical attack scenarios and extend a state-of-the-art compiler-based mitigation and a binary validation tool, both of which originally targeted a coarser-grained, instruction-granular side channel. Our benchmarks show that our extended compiler mitigation, while still mitigating the instruction-granular leakage, also eliminates the cycle-accurate DMA information leakage without incurring any additional overhead.
An Investigation of Quality Issues in Vulnerability Detection Datasets

Vulnerability detection is a crucial yet challenging task in ensuring software security, and deep learning (DL) has made significant progress in automating this process. However, a DL model requires a massive amount of labeled data (vulnerable and secure source code) to effectively distinguish between the two. Many datasets have been created for this purpose but they suffer from several issues that can lead to low detection accuracy of DL models. In this paper, we define three critical issues (data imbalance, low vulnerability coverage, and biased vulnerability distribution) and three secondary issues (errors in source code, mislabeling, and noisy historical data) that can affect the model performance. We also conduct a study of 14 papers along with 54 datasets for vulnerability detection to confirm these defined issues. Furthermore, we discuss good practices for using existing datasets and creating new ones to improve the quality of data available for automated vulnerability detection. This paper aims to raise awareness of the importance of data quality in vulnerability detection and provide proper guidelines for researchers and practitioners working in this area.
Masterkey attacks against free-text keystroke dynamics and security implications of demographic factors

This paper presents and systematically evaluates the first masterkey attack against free-text keystroke dynamics. A masterkey is a typing sequence that matches, hence successfully impersonates, a large part of the population. Therefore, masterkeys are effective tools for an adversary who aims to impersonate someone without knowledge of their typing behavior. On top of the attack itself, we present a new unifying evaluation framework for masterkey attacks that allow for the comparison with knowledge-based authentication factors. In other words, we unify the evaluation of password security with that of masterkey attacks and demonstrate that typing biometrics is approximately 20 times less secure than passwords and approximately two times less secure than a 4-digit pin. Lastly, we study the effect of demographics on typing biometrics, which, among others, provides novel insights into the effect of being a well-versed typist on security.
MISO: Legacy-compatible Privacy-preserving Single Sign-on using Trusted Execution Environments

Single sign-on (SSO) allows users to authenticate to third-party applications through a central identity provider. Despite their wide adoption, deployed SSO systems suffer from privacy problems such as user tracking by the identity provider. While numerous solutions have been proposed by academic papers, none were adopted because they require modifying identity providers, a significant adoption barrier in practice. Solutions do get deployed, however, fail to eliminate major privacy issues.Leveraging Trusted Execution Environments (TEEs), we propose MISO, the first privacy-preserving SSO system that is completely compatible with existing identity providers (such as Google and Facebook). This means MISO can be easily integrated into existing SSO ecosystem today and benefit end users. MI SO also enables new functionality that standard SSO cannot offer: MISO allows users to leverage multiple identity providers in a single SSO workflow, potentially in a threshold fashion, to better protect user accounts. We fully implemented MISO based on Intel SGX. Our evaluation shows that MISO can handle high user concurrency with practical performance.
Conjunctive Searchable Symmetric Encryption from Hard Lattices

Searchable Symmetric Encryption (SSE) supports efficient keyword searches over encrypted outsourced document collections while minimizing information leakage. All practically efficient SSE schemes supporting conjunctive queries rely crucially on quantum-broken cryptographic assumptions (such as discrete-log hard groups) to achieve compact storage and fast query processing. On the other hand, quantum-safe SSE schemes based on purely symmetric-key cryptoprimitives either do not support conjunctive searches, or are practically inefficient. In particular, there exists no quantum-safe yet practically efficient conjunctive SSE scheme from lattice-based hardness assumptions.We solve this open question by proposing Oblivious Post-Quantum Secure Cross Tags (OQXT) – the first lattice-based practically efficient and highly scalable conjunctive SSE scheme. The technical centerpiece of OQXT is a novel oblivious cross-tag generation protocol with provable security guarantees derived from lattice-based hardness assumptions. We prove the post-quantum simulation security of OQXT with respect to a rigorously defined and thoroughly analyzed leakage profile. We then present a prototype implementation of OQXT and experimentally validate its practical efficiency and scalability over extremely large real-world databases. Our experiments show that OQXT has competitive end-to-end search latency when compared with the best (quantum-broken) conjunctive SSE schemes.