Computer Sciences Commons^™

An Explainable Transformer-Based Model For Phishing Email Detection: A Large Language Model Approach, Mohammad Amaz Uddin, Md Mahiuddin, Iqbal H. Sarker

Research outputs 2022 to 2026

Phishing email is a serious cyber threat that tries to deceive users by sending false emails with the intention of stealing confidential information or causing financial harm. Attackers, often posing as trustworthy entities, exploit technological advancements and sophistication to make the detection and prevention of phishing more challenging. Despite extensive academic research, phishing detection remains an ongoing and formidable challenge in the cybersecurity landscape. In this research paper, we present a fine-tuned transformer-based masked language model, RoBERTa (Robustly Optimized BERT Pretraining Approach), for phishing email detection. In the detection process, we employ a phishing email dataset and apply the preprocessing …

Explainable Artificial Intelligence Models For Detecting Suspicious Bank Transactions, Narasimha Kumar Narasapuram, Syed Afaq Ali Shah, Mohd Fairuz Shiratuddin, Ferdous Sohel

Research outputs 2022 to 2026

Detecting financial crime is a complex challenge due to evolving criminal strategies and fragmented detection systems, particularly in the areas of money laundering and fraud. While it is easy to implement, traditional rule-based approaches lack adaptability to new threats, and machine learning models, though more effective, often function as opaque "black boxes," limiting their practical use in regulated domains like banking, where interpretability and accountability are essential. This research presents a novel framework that combines intrinsic and post-hoc XAI techniques to detect suspicious bank transactions. Intrinsic methods provide model-inherent transparency, while post-hoc methods offer behavior-level explanations, enabling robust cross-verification of …

Deep Learning Approaches For Anti-Money Laundering On Mobile Transactions: Review, Framework, And Directions, Jiani Fan, Lwin Khin Shar, Ruichen Zhang, Ziyao Liu, Wenzhuo Yang, Dusit Niyato, Kwok-Yan Lam

Research Collection School Of Computing and Information Systems

Money laundering is a financial crime that obscures the origin of illicit funds, necessitating the development and enforcement of anti-money laundering (AML) policies by governments and organizations. The proliferation of mobile payment platforms and smart IoT devices has significantly complicated AML investigations. As payment networks become more interconnected, there is an increasing need for efficient real-time detection to process large volumes of transaction data on heterogeneous payment systems by different operators such as digital currencies, cryptocurrencies, and account-based payments. Most of these mobile payment networks are supported by connected devices, many of which are considered loT devices in the FinTech …

Private Set Intersection: A Systematic Review, Yunbo Yang, Defan Zhu, Jianting Ning, Qi Feng, Xiaoguo Li, Yuejia Cheng, Guomin Yang, Kui Ren

Research Collection School Of Computing and Information Systems

Various services, such as search engines, are increasingly deployed in cloud-based and distributed systems. However, data are typically managed by trusted servers, making user privacy and data security critical concerns. Private set intersection (PSI) is a powerful cryptographic primitive that enables multiple parties to compute the intersection of their datasets without revealing private inputs. It has been extensively studied over the past two decades, leading to significant gains in computational and communication efficiency. Yet, in many real-world scenarios, revealing the raw intersection may still leak sensitive information. To address this, numerous PSI variants have been developed to meet different application …

Empowering Neurodiverse Talent In Cybersecurity Through Fair And Inclusive Ai Education, Sheikh Rabiul Islam, Yansi Keim, Mohiuddin Ahmed, Maanak Gupta, Ingrid Russell, Mahmoud Abdelsalam

Research outputs 2022 to 2026

Cybersecurity demands creativity, persistence, and sharp pattern recognition—strengths frequently reported among neurodivergent people (e.g., autism, ADHD, dyslexia). Yet AI-driven hiring pipelines can systematically disadvantage neurodivergent applicants by misreading communication styles or valuing narrow proxies of “fit.” Demand for cybersecurity talent is growing, and experts note that neurodiverse individuals are both underrepresented and highly valuable to security teams. However, progress remains uneven without targeted educational interventions [1]. We present a curricular module that simultaneously (a) centers neurodiversity as a strength in the cybersecurity workforce and (b) trains students to audit and redesign AI hiring systems using open-source fairness and explainability toolkits …

Cybersecurity In Higher Education Institutions: Awareness, Policy, And Experience On Employee Behaviour, Abdullahi Abiodun Yusuf, Adriana A. Steyn

Journal of Cybersecurity Education, Research and Practice

The digital transformation of higher education institutions (HEIs) has introduced unprecedented connectivity and operational efficiency, but it has also heightened their exposure to cyber threats. South African HEIs, in particular, face increasing vulnerability due to their reliance on technology, openness, and diverse user communities. This study examines the influence of the institutional cybersecurity environment on employee cybersecurity-compliant behaviour (CCB), emphasising the critical roles of awareness, policy engagement, and experience. Drawing on Protection Motivation Theory and the Theory of Planned Behaviour, a conceptual model was developed to explore how cybersecurity awareness, policy familiarity, and prior experience shape employees’ attitudes, subjective norms, …

Efficient Privacy-Preserving Conjunctive Searchable Encryption For Cloud-Iot Healthcare Systems, Jiadi Ma, Tianqi Peng, Gong Bei, Muhammad Waqas, Hisham Alasmary, Sheng Chen

Research outputs 2022 to 2026

In cloud-Internet of Things (IoT) healthcare systems, private medical data leakage is a serious concern as the cloud server is not fully trusted. Dynamic searchable symmetric encryption (DSSE), with necessary forward and backward privacy security properties, enables doctors to retrieve ciphertexts while guaranteeing data privacy. However, existing forward and backward private DSSE schemes are not well-suited for cloud-IoT healthcare systems with attribute-value type databases. To this end, we propose an efficient privacy-preserving conjunctive searchable encryption scheme for cloud-IoT healthcare systems, called PC-SE. It is the first conjunctive DSSE scheme designed for attribute-value type databases. Specifically, we design flexible search capabilities …

Cyber Science Education Meets Healthcare Technology, Angela Spencer

Journal of Cybersecurity Education, Research and Practice

The research investigates how cyber science education combines with healthcare technology during the digital age to resolve a fundamental research gap in these two advancing areas. A combined approach utilizing extensive surveys and detailed interviews evaluates the functionality of learning platforms as well as cybersecurity measures and potential uses of emerging virtual reality (VR) and augmented reality (AR) tools to improve both educational and clinical environments. The research document describes its methodologies thoroughly while. The research documents multiple quantitative and qualitative results before performing its analysis, which leads to strategy development for digit. The researchers worked to find ways that …

Defending Code Language Models Against Backdoor Attacks With Deceptive Cross-Entropy Loss, Guang Yang, Yu Zhou, Xiangyu Zhang, Xiang Chen, Terry Yue Zhuo, David Lo, Taolue Chen

Research Collection School Of Computing and Information Systems

Code Language Models (CLMs), particularly those leveraging deep learning, have achieved significant success in code intelligence domain. However, the issue of security, particularly backdoor attacks, is often overlooked in this process. The previous research has focused on designing backdoor attacks for CLMs, but effective defenses have not been adequately addressed. In particular, existing defense methods from natural language processing, when directly applied to CLMs, are not effective enough and lack generality, working well in some models and scenarios but failing in others, thus fall short in consistently mitigating backdoor attacks. To bridge this gap, we first confirm the phenomenon of …

Fcghunter: Towards Evaluating Robustness Of Graph-Based Android Malware Detection, Shiwen Song, Xiaofei Xie, Ruitao Feng, Qi Guo, Sen Chen

Research Collection School Of Computing and Information Systems

Graph-based detection methods leveraging Function Call Graph (FCG) have shown promise for Android malware detection (AMD) due to their semantic insights. However, the deployment of malware detectors in dynamic and hostile environments raises significant concerns about their robustness. While recent approaches evaluate the robustness of FCG-based detectors using adversarial attacks, their effectiveness is constrained by the vast perturbation space, particularly across diverse models and features. To address these challenges, we introduce FCGHunter, a novel robustness testing framework for FCG-based AMD systems. Specifically, FCGHunter employs innovative techniques to enhance exploration and exploitation within this huge search space. Initially, it identifies critical …

Mitigating Malware Prevalence In Networks With Arbitrary Topologies: A Flip-It Cyber Game Approach Integrated With Epidemic Modeling, Mousa Tayseer Jafar, Lu Xing Yang, Gang Li, Robin Doss, Kon Mouzakis, Rajesh Vasa, Helge Janicke, Ahmed Ibrahim, Ahmed Mohsin, Iqbal H. Sarker, Kristen Moore, Seyit Camtepe, Diksha Goel

Research outputs 2022 to 2026

Cyber threats have evolved in complexity, aiming at a wide range of sectors using advanced methods and tools. This evolving threat landscape challenges existing cybersecurity frameworks, many of which lack the adaptability to counteract the complex tactics of sophisticated adversaries. Developing robust cyber defense strategies requires simulating dynamic interactions between attackers and defenders across high, moderate, and low-impact scenarios. The Flip-It cyber game serves as an intelligent framework for simulating these interactions, enabling the analysis of adaptive strategies in cybersecurity. This paper aims to address the problem of mitigating malware prevalence with full consideration of attack/defense capabilities in arbitrary network …

Prisrv+: Privacy And Usability-Enhanced Wireless Service Discovery With Fast And Expressive Matchmaking Encryption, Yang Yang, Guomin Yang, Yingjiu Li, Pengfei Wu, Rui Shi, Minming Huang, Jian Weng, Hwee Hwa Pang, Deng, Robert H.

Research Collection School Of Computing and Information Systems

The evolution of decentralized identity (DID) and self-sovereign identity (SSI) frameworks, as endorsed by W3C Verifiable Credentials (VC) and eIDAS 2.0, underscores the need for secure, efficient, and privacy-preserving credential management. However, existing credential systems often depend on centralized issuers, lack efficient aggregation mechanisms, or fail to ensure unlinkability across authentication sessions. To address these challenges, we propose DISC (Decentralized Identity System with Self-Sovereign Credential Aggregation), a novel credential system that enables multi-authority credential issuance, user-controlled credential aggregation, and unlinkable authentication. DISC allows users to aggregate credentials from multiple issuers while maintaining constant-size authentication tokens and supporting batch verification for …

Mm-Attackg: A Multimodal Approach To Attack Graph Construction With Large Language Models, Yongheng Zhang, Xinyun Zhao, Yunshan Ma, Haokai Ma, Yingxiao Guan, Guozheng Yang, Yuliang Lu, Xiang Wang

Research Collection School Of Computing and Information Systems

Cyber Threat Intelligence (CTI) parsing aims to extract key threat information from massive data, transform it into actionable intelligence, enhance threat detection and defense efficiency, including attack graph construction, intelligence fusion, and indicator extraction. Among these research topics, Attack Graph Construction (AGC) is essential for visualizing and understanding the potential attack paths of threat events from CTI reports. Existing approaches primarily construct the attack graphs purely from the textual data to reveal the logical threat relationships between entities within the attack behavioral sequence. However, they typically overlook the specific threat information inherent in visual modalities, which preserves key threat details …

Vercation: Precise Vulnerable Open-Source Software Version Identification Based On Static Analysis And Llm, Yiran Cheng, Ting Zhang, Lwin Khin Shar, Shouguo Yang, Chaopeng Dong, David Lo, Shichao Lv, Zhiqiang Shi, Limin Sun

Research Collection School Of Computing and Information Systems

Open-source software (OSS) has experienced a surge in popularity, attributed to its collaborative development model and cost-effective nature. However, the adoption of specific software versions in development projects may introduce security risks when these versions bring along vulnerabilities. Current methods of identifying vulnerable versions typically analyze and extract the code features involved in vulnerability patches using static analysis with pre-defined rules. They then use code clone detection to identify the vulnerable versions. These methods are hindered by imprecision due to (1) the exclusion of vulnerability- irrelevant code in the analysis and (2) the inadequacy of code clone detection. This paper …

Integrating Adversarial Scenarios Into Llm Security Labs: An Experience Report On A Hands-On Approach, Dominic A. Wilson

Journal of Cybersecurity Education, Research and Practice

This paper presents an exploratory case study detailed as a pedagogical experience report on integrating adversarial Large Language Model (LLM) scenarios into a graduate cybersecurity curriculum. In addition to prompt injection, sophisticated techniques such as jailbreaking and model inversion pose emerging threats that traditional computer security curricula often lack. We present the design and implementation of a structured, hands-on module addressing this gap, utilizing a custom Retrieval-Augmented Generation (RAG) platform with local open-source LLMs. A cohort of 16 graduate students participated in this two-week pilot module, engaging in "red team" activities to actively exploit model alignment and privacy vulnerabilities. The …

A Review Of Routing Attacks In Routing Protocol Over Low-Power And Lossy-Based Iot Networks, Lanka Chris Sejaphala Mr., Vusimuzi Malele Prof, Francis Lugayizi Prof.

Journal of Cybersecurity Education, Research and Practice

Low-power and Lossy IoT Networks (LLNs) comprise physical sensors, processing capability, power, and other technologies to exchange information between systems and devices over the internet. However, these networks are susceptible to routing attacks affecting resources, traffic flow, and topology formation. In the related work, it has been discovered that many previous studies do not consider algorithms and implementation approaches for routing attacks. This research study provides a comprehensive in-depth synthesis insight into the description, effects, and algorithms & implementation of four routing attacks in LLNs i.e., rank, sinkhole, DIS-flooding, and worst parent attacks. The findings of this research study highlight …

Bridging The Gap: A Systematic Review Of Cyber Conflict Forecasting Models And The Case For Ai-Driven Dynamic Frameworks, Salim Arfaoui, Youssef Harrath, Omar El-Gayar

Research & Publications

Cyber conflict forecasting remains constrained by static models that overlook the integration of geopolitical context with technical indicators. This systematic literature review examines 58 studies (2010–2025) using PRISMA guidelines and an InputProcess-Output framework to classify approaches and identify key gaps. Quantitative methods dominate (67%), yet only 14% incorporate geopolitical variables, despite the political nature of cyber conflict. Major limitations include adversarial adaptation blindness (85% assume static behavior), coarse temporal granularity (72% use daily+ intervals), lack of uncertainty quantification (75%), and minimal modeling of cross-domain escalation (92% cyber-only focus). Strategic forecasting is rare, with just 14% providing long-term insights and 16% …

Ransomware As Organization: A Comparative Analysis Of Corporate And Criminal Structures In Conti, George Urling

Theses, Dissertations and Capstones

Cybercriminal groups continue to pose major threats to global cybersecurity. One of the most common types of cybercriminal groups are, “Ransomware-as-a-Service (RaaS)" groups, who create and sell ransomware. While research is conducted into the development of ransomware, there is limited reporting on the organizational structure and habits of RaaS groups. In 2022, prominent RaaS group Conti had their chat logs leaked, with the logs ranging from 2020 to 2022. This study seeks to provide a deeper understanding of RaaS group structures by utilizing the Conti leaked logs as a case study. The study, entitled “Ransomware as Organization: A Comparative Analysis …

Enhancing Healthcare Security: Manifold-Aware Machine Learning For Robust Adversarial Attack Detection In Iomt Networks, Mohmmad Al-Fawa’Reh, Mohammed Kaosar

Research outputs 2022 to 2026

The widespread adoption of Internet of Medical Things (IoMT) devices and the increasing movement towards telehealth have revolutionized healthcare delivery but also introduced significant security challenges. Tiny Machine Learning (TinyML) models deployed on resource-constrained medical devices are vulnerable to adversarial attacks that can compromise patient data and device functionality, posing risks to patient safety. To address these critical security concerns, this paper proposes MARD (Manifold-Aware Robust Defense), a defense mechanism designed to enhance the robustness of TinyML models. MARD trains a compact student model by transferring knowledge from a teacher model that incorporates Graph-based Manifold Regularization (GMR) and Manifold Mixup …

Attacks And Detections In Recommender Systems: A Comprehensive Analysis For Models, Progresses, And Trends, Yan Feng, Zhihai Yang, Kexin Li, Jianxin Li, Pinghui Wang, Zhiquan Liu

Research outputs 2022 to 2026

Recommender systems (RSs), as crucial components of online services, can help users efficiently obtain information they may like. In reality, RSs face long-term threats. Attackers manipulate recommendation results by injecting malicious data in order to obtain benefits. At present, research on the security of RSs lacks a comprehensive understanding of attack capabilities. Moreover, existing defense strategies have not yet been systematically associated with attack characteristics. More importantly, existing defense methods rarely focus on real unlabeled data in practical application scenarios for anomaly detection and forensics. Therefore, this survey systematically analyzes the security of RSs and provides new insights. Specifically, we …

Systematic Approaches To Characterizing Vulnerabilities And Enhancing Robustness Of Text And Vision-Language Models, Poojitha Thota

Computer Science and Engineering Dissertations

The proliferation of artificial intelligence (AI) across critical domains, including news summarization, privacy-policy analysis, and medical decision support, has raised growing concerns about the security and robustness of these systems against adversarial manipulation. This dissertation investigates adversarial robustness in generative AI by addressing three key research goals: (1) characterizing adversarial vulnerabilities across generative models, (2) developing systematic defenses to improve the robustness of generative models, and (3) designing deployment-time safeguards for securing LLM interactions.

Towards the first goal, we characterize adversarial vulnerabilities across text-based and multimodal systems. In abstractive text summarization, we show that inference-time perturbations can exploit lead bias …

Ordered Mini-Batch Training For Differentially Private And Encrypted Logistic Regression, Ryan Leone

Theses, Dissertations and Culminating Projects

Logistic regression has found extensive use as a supervised machine learning algorithm due to its simplicity and efficiency in binary and multivariate classification tasks. As data sharing grows across connected devices, safeguarding sensitive personal and industrial information is of increased importance. Privacy-preserving machine learning techniques such as differential privacy and homomorphic encryption offer mathematically rigorous security guarantees, but introduce difficult accuracy, privacy loss, and computational overhead issues. This thesis investigates PPML for logistic regression through a collaborative mini-batch training framework. I propose and implement an ordered mini-batch strategy, compare it to standard shuffled methods, then integrate differential privacy noise injection …

Tackling The Societal And Regulatory Challenges Of Emerging Technologies: A Case Study Of Deepfake, Jingyao Li

2026

Governing emerging technologies such as Artificial Intelligence (AI) poses enduring challenges for policymakers, industries, and societies. Early-stage governance is often hindered by limited understanding of technological implications, rapid innovation cycles, and resistance from powerful industry actors who favor minimal oversight. Yet, timely and effective governance is essential, as new technologies are most malleable in their formative stages. This dissertation examines how emerging technologies can be governed effectively by using deepfakes technology as a focal case. This dissertation comprises three interrelated studies.

The first paper reviews the literature on deepfakes and emerging technology governance, identifying the distinct characteristics of deepfake technology …

Understanding Phishing Susceptibility Through Expert Consensus Using Digital Marketing Parallels And A Machine Learning-Based Implementation, Mansoor Ahmad

All Graduate Theses, Dissertations, and Other Capstone Projects

Phishing remains one of the most effective attack vectors for gaining unauthorized access to organizational systems, yet defenders often lack systematic methods to assess their exposure before an attack. This study develops a framework that uses machine learning to encode the collective expertise of cybersecurity practitioners into a portable phishing susceptibility assessment tool, with the goal to help security teams proactively identify patterns, prioritize awareness training, and strengthen detection controls. The study surveyed 27 practitioners with extensive experience in social engineering, red teaming, penetration testing, and threat analysis to identify which factors most influence phishing susceptibility. Practitioners provided quantitative ratings …

Ai-Driven Real-Time Detection Of Zero-Day Browser Exploits Using Webassembly-Based Instrumentation, Temitope Damilola Elijah

College of Graduate Studies: Theses & Dissertations

The rapid evolution of web browsers into fully fledged application execution environments has significantly expanded their attack surface, making them prime targets for sophisticated zero-day exploits that evade traditional signature-based security mechanisms. To address this challenge, this research proposes an AI-driven framework for real-time detection and analysis of zero-day exploits in web browsers by integrating browser-level telemetry monitoring, unsupervised anomaly detection, and large language model–based threat interpretation. The framework introduces a lightweight WebAssembly telemetry agent embedded within the browser runtime to capture low-level execution behaviors, including WASM module instantiation, memory growth patterns, network interactions, and runtime API activity. These telemetry …

Rockyou2024: What’S Your Password?, Yixuan Zhang

Honors Theses

Passwords remain a critical part of almost every account security system. As a result, password guessing attacks remain one of the most widespread yet profitable attacks possible. Setting a password resistant to attacks is thus an important task for account holders. In this paper, we use the RockYou2024 database, a collection of approximately 10 billion real-world passwords collected from data breaches, to analyze the characteristics of passwords found in real life. We start with basic statistical property analysis, such as length, distribution of digits and symbols, and proceed onto more complicated properties such as frequencies of combinations of characters, entropy …

Defending A Soho Network Against Mitm Attacks, Braeden J. Wise

Williams Honors College, Honors Research Projects

Cybersecurity is a vast domain that consists of many threats that target sensitive information found on wired and wireless networks. One of those threats is a man-in-the-middle (MITM) attack, which involves an attacker situating themselves between a sender and a receiver to intercept or redirect network traffic. These kinds of attacks can run rampant on a small office home office (SOHO) network due to the vulnerabilities and lack of enterprise level tools. The intent of this project is to perform and defend against MITM attacks for a SOHO network. In the context of the project, three MITM attacks will be …

Analyzing Network Traffic And Data Exfiltration Via Smb In Post-Vm Escape Scenarios, Noah M. Disanza

Williams Honors College, Honors Research Projects

Virtual machines (VMs) play a crucial role in modern IT infrastructure environments by providing isolation and enhanced security, among other things, for both personal and corporate systems. VMs are heavily rely upon to safely test malware, manage infrastructure, and reduce risk to host systems. This reliance is so substantial that the idea of reducing risk to the host system is believed to be erasing risk entirely. However, this mindset has shown to be challenged time and time again by the emergence of exploits known as virtual machine escapes. These exploits allow malicious actors to break out of the virtualized environment …

Secure The Database: A Red Team, Blue Team Analysis Of Sql Injection, Andrew N. Miller

Williams Honors College, Honors Research Projects

SQL injection (SQLi) attacks are a type of cyberattack that seeks to bypass website logins and gain entry to sensitive information. These pose a significant danger to organizations holding confidential user information. Personally Identifiable Information (PII) like physical addresses, emails, phone numbers, social security numbers are at risk of theft. Login credentials like usernames, passwords, and other sensitive information like financial details and social security numbers are also exposed through SQLi attacks. SQLi attacks harm the confidentiality, integrity, and availability of people’s identity. Additionally, data breaches that reach public battention harm the reputation and trust of organizations. SQLi attacks rank …

Critical Success Factors For An Effective Security Risk Management Program: An Exploratory Case Study, Jason A. Williams, Humayun Zafar, Saurabh Gupta

Faculty Articles

This paper evaluates the perceived effectiveness of the security risk management (SRM) programs at a Fortune 500 firm. Layers of management and staff participated in the study. Perceived effectiveness of their SRM programs was based on nine critical success factors (CSFs). Interviews confirmed six initial CSFs (Executive Management Support, Organizational Maturity, Open Communication, Risk Management Stakeholders, Team Member Empowerment, and Holistic View of an Organization) that were extracted from the literature. They were confirmed and synthesized with three additional CSFs (Security Maintenance, Corporate Security Strategy, and Human Resource Development). Implications for SRM are discussed.