Open Access. Powered by Scholars. Published by Universities.®

Information Security Commons™

Open Access. Powered by Scholars. Published by Universities.®

Research Collection School Of Computing and Information Systems

Discipline
Keyword
Publication Year

Articles 181 - 210 of 1051

Full-Text Articles in Information Security

Fine-Grained Commit-Level Vulnerability Type Prediction By Cwe Tree Structure, Shengyi Pan, Lingfeng Bao, Xin Xia, David Lo, Shanping Li May 2023

Fine-Grained Commit-Level Vulnerability Type Prediction By Cwe Tree Structure, Shengyi Pan, Lingfeng Bao, Xin Xia, David Lo, Shanping Li

Research Collection School Of Computing and Information Systems

Identifying security patches via code commits to allow early warnings and timely fixes for Open Source Software (OSS) has received increasing attention. However, the existing detection methods can only identify the presence of a patch (i.e., a binary classification) but fail to pinpoint the vulnerability type. In this work, we take the first step to categorize the security patches into fine-grained vulnerability types. Specifically, we use the Common Weakness Enumeration (CWE) as the label and perform fine-grained classification using categories at the third level of the CWE tree. We first formulate the task as a Hierarchical Multi-label Classification (HMC) problem, …


Colefunda: Explainable Silent Vulnerability Fix Identification, Jiayuan Zhou, Michael Pacheco, Jinfu Chen, Xing Hu, Xin Xia, David Lo, Ahmed E. Hassan May 2023

Colefunda: Explainable Silent Vulnerability Fix Identification, Jiayuan Zhou, Michael Pacheco, Jinfu Chen, Xing Hu, Xin Xia, David Lo, Ahmed E. Hassan

Research Collection School Of Computing and Information Systems

It is common practice for OSS users to leverage and monitor security advisories to discover newly disclosed OSS vulnerabilities and their corresponding patches for vulnerability remediation. It is common for vulnerability fixes to be publicly available one week earlier than their disclosure. This gap in time provides an opportunity for attackers to exploit the vulnerability. Hence, OSS users need to sense the fix as early as possible so that the vulnerability can be remediated before it is exploited. However, it is common for OSS to adopt a vulnerability disclosure policy which causes the majority of vulnerabilities to be fixed silently, …


C-Wall: Conflict-Resistance In Privacy-Preserving Cloud Storage, Xiaoguo Li, Tao Xiang, Yi Mu, Fuchun Guo, Zhongyuan Yao Apr 2023

C-Wall: Conflict-Resistance In Privacy-Preserving Cloud Storage, Xiaoguo Li, Tao Xiang, Yi Mu, Fuchun Guo, Zhongyuan Yao

Research Collection School Of Computing and Information Systems

Following the success of cloud computing, it has been shown its importance to realize various access control models in the cloud storage setting. Chinese Wall is a traditional access control model in business for solving the conflict of interest (CoI) problem, and it would be very interesting to achieve conflict-resistant in cloud storage system. However, the access control model does not ensure the privacy of users, and it may reveal the user's interest, investment tendency, etc. Therefore, it raises a big challenge to implement the Chinese Wall without compromising the user's privacy. In this paper, we focus on the Chinese …


Volere: Leakage Resilient User Authentication Based On Personal Voice Challenges, Rui Zhang, Zheng Yan, Xuerui Wang, Robert H. Deng Mar 2023

Volere: Leakage Resilient User Authentication Based On Personal Voice Challenges, Rui Zhang, Zheng Yan, Xuerui Wang, Robert H. Deng

Research Collection School Of Computing and Information Systems

Voiceprint Authentication as a Service (VAaS) offers great convenience due to ubiquity, generality, and usability. Despite its attractiveness, it suffers from user voiceprint leakage over the air or at the cloud, which intrudes user voice privacy and retards its wide adoption. The literature still lacks an effective solution on this issue. Traditional methods based on cryptography are too complex to be practically deployed while other approaches distort user voiceprints, which hinders accurate user identification. In this article, we propose a leakage resilient user authentication cloud service with privacy preservation based on random personal voice challenges, named VOLERE (VOice LEakage REsilient). …


Automatic Identification Of Crash-Inducing Smart Contracts, Chao Ni, Cong Tian, Kaiwen Yang, David Lo, Jiachi Chen, Xiaohu Yang Mar 2023

Automatic Identification Of Crash-Inducing Smart Contracts, Chao Ni, Cong Tian, Kaiwen Yang, David Lo, Jiachi Chen, Xiaohu Yang

Research Collection School Of Computing and Information Systems

Smart contract, a special software code running on and resided in the blockchain, enlarges the general application of blockchain and exchanges assets without dependence of external parties. With blockchain's characteristic of immutability, they cannot be modified once deployed. Thus, the contract and the records are persisted on the blockchain forever, including failed transactions that are caused by runtime errors and result in the waste of computation, storage, and fees. In this paper, we refer to smart contracts which will cause runtime errors as crash-inducing smart contracts. However, automatic identification of crash-inducing smart contracts is limited investigated in the literature. The …


Lightweight And Non-Invasive User Authentication On Earables, Changshuo Hu, Xiao Ma, Dong Ma, Ting Dang Feb 2023

Lightweight And Non-Invasive User Authentication On Earables, Changshuo Hu, Xiao Ma, Dong Ma, Ting Dang

Research Collection School Of Computing and Information Systems

The widespread adoption of wireless earbuds has advanced the developments in earable-based sensing in various domains like entertainment, human-computer interaction, and health monitoring. Recently, researchers have shown an increased interest in user authentication using earables. Despite the successes witnessed in acoustic probing and speech based authentication systems, this paper proposed a lightweight and non-invasive ambient sound based user authentication scheme. It employs the difference between the in-ear and out-ear sounds to estimate the individual-specific occluded ear canal transfer function (OECTF). Specifically, the {out-ear, in-ear} scaling factors at different frequency bands are captured via linear regression and treated as the OECTF …


Learning To Count Isomorphisms With Graph Neural Networks, Xingtong Yu, Zemin Liu, Yuan Fang, Xinming Zhang Feb 2023

Learning To Count Isomorphisms With Graph Neural Networks, Xingtong Yu, Zemin Liu, Yuan Fang, Xinming Zhang

Research Collection School Of Computing and Information Systems

Subgraph isomorphism counting is an important problem on graphs, as many graph-based tasks exploit recurring subgraph patterns. Classical methods usually boil down to a backtracking framework that needs to navigate a huge search space with prohibitive computational costs. Some recent studies resort to graph neural networks (GNNs) to learn a low-dimensional representation for both the query and input graphs, in order to predict the number of subgraph isomorphisms on the input graph. However, typical GNNs employ a node-centric message passing scheme that receives and aggregates messages on nodes, which is inadequate in complex structure matching for isomorphism counting. Moreover, on …


Safe Delivery Of Critical Services In Areas With Volatile Security Situation Via A Stackelberg Game Approach, Tien Mai, Arunesh Sinha Feb 2023

Safe Delivery Of Critical Services In Areas With Volatile Security Situation Via A Stackelberg Game Approach, Tien Mai, Arunesh Sinha

Research Collection School Of Computing and Information Systems

Vaccine delivery in under-resourced locations with security risks is not just challenging but also life threatening. The COVID pandemic and the need to vaccinate added even more urgency to this issue. Motivated by this problem, we propose a general framework to set-up limited temporary (vaccination) centers that balance physical security and desired (vaccine) service coverage with limited resources. We set-up the problem as a Stackelberg game between the centers operator (defender) and an adversary, where the set of centers is not fixed a priori but is part of the decision output. This results in a mixed combinatorial and continuous optimization …


Fa3: Fine-Grained Android Application Analysis, Yan Lin, Weng Onn Wong, Debin Gao Feb 2023

Fa3: Fine-Grained Android Application Analysis, Yan Lin, Weng Onn Wong, Debin Gao

Research Collection School Of Computing and Information Systems

Understanding Android applications' behavior is essential to many security applications, e.g., malware analysis. Although many systems have been proposed to perform such dynamic analysis, they are limited by their applicable analysis environment (on device vs. emulator), transparency to subject apps, applicable runtime (Dalvik vs. ART), applicable system stack, or granularity. In this paper, we propose FA3 (Fine-Grained Android Application Analysis), a novel on-device, non-invasive, and fine-grained analysis platform by leveraging existing profiling mechanisms in the Android Runtime (ART) and kernel to inspect method invocations and control-flow transfers for both Java methods and third-party native libraries. FA3 embeds its tracing capability …


T-Counter: Trustworthy And Efficient Cpu Resource Measurement Using Sgx In The Cloud, Chuntao Dong, Qingni Shen, Xuhua Ding, Daoqing Yu, Wu Luo, Pengfei Wu, Zhonghai Wu Jan 2023

T-Counter: Trustworthy And Efficient Cpu Resource Measurement Using Sgx In The Cloud, Chuntao Dong, Qingni Shen, Xuhua Ding, Daoqing Yu, Wu Luo, Pengfei Wu, Zhonghai Wu

Research Collection School Of Computing and Information Systems

As cloud services have become popular, and their adoption is growing, consumers are becoming more concerned about the cost of cloud services. Cloud Service Providers (CSPs) generally use a pay-per-use billing scheme in the cloud services model: consumers use resources as they needed and are billed for their resource usage. However, CSPs are untrusted and privileged; they have full control of the entire operating system (OS) and may tamper with bills to cheat consumers. So, how to provide a trusted solution that can keep track of and verify the consumers’ resource usage has been a challenging problem. In this paper, …


Automatic Detection And Analysis Towards Malicious Behavior In Iot Malware, Sen Li, Mengmeng Ge, Ruitao Feng, Xiaohong Li, Kwok Yan Lam Jan 2023

Automatic Detection And Analysis Towards Malicious Behavior In Iot Malware, Sen Li, Mengmeng Ge, Ruitao Feng, Xiaohong Li, Kwok Yan Lam

Research Collection School Of Computing and Information Systems

Our society is rapidly moving towards the digital age, which has led to a sharp increase in IoT networks and devices. This growth requires more network security professionals, who are focused on protecting IoT systems. One crucial task is to analyze malicious software to gain a deeper understanding of its functionalities and response methods. However, malware analysis is a complex process that requires the use of various analysis tools, including advanced reverse engineering techniques. For beginners, parsing complex binary data can be particularly challenging as they may be strange with these tools and the basic principles of analysis. Even for …


Crowdfa: A Privacy-Preserving Mobile Crowdsensing Paradigm Via Federated Analytics, Bowen Zhao, Xiaoguo Li, Ximeng Liu, Qingqi Pei, Yingjiu Li, Robert H. Deng Jan 2023

Crowdfa: A Privacy-Preserving Mobile Crowdsensing Paradigm Via Federated Analytics, Bowen Zhao, Xiaoguo Li, Ximeng Liu, Qingqi Pei, Yingjiu Li, Robert H. Deng

Research Collection School Of Computing and Information Systems

Mobile crowdsensing (MCS) systems typically struggle to address the challenge of data aggregation, incentive design, and privacy protection, simultaneously. However, existing solutions usually focus on one or, at most, two of these issues. To this end, this paper presents CROWD FA, a novel paradigm for privacy-preserving MCS through federated analytics (FA), which aims to achieve a well-rounded solution encompassing data aggregation, incentive design, and privacy protection. Specifically, inspired by FA, CROWD FA initiates an MCS computing paradigm that enables data aggregation and incentive design. Participants can perform aggregation operations on their local data, facilitated by CROWD FA, which supports various …


Seqadver: Automatic Payload Construction And Injection In Sequence-Based Android Adversarial Attack, Fei Zhang, Ruitao Feng, Xiaofei Xie, Xiaohong Li, Lianshuan Shi Jan 2023

Seqadver: Automatic Payload Construction And Injection In Sequence-Based Android Adversarial Attack, Fei Zhang, Ruitao Feng, Xiaofei Xie, Xiaohong Li, Lianshuan Shi

Research Collection School Of Computing and Information Systems

Machine learning has achieved a great success in the field of Android malware detection. In order to avoid being caught by these ML-based Android malware detection, malware authors are inclined to initiate adversarial sample attacks by tampering with mobile applications. Although machine learning has high capability, it lacks robustness against adversarial attacks. Currently, many of the adversarial attacking tools not only inject dead code into target applications, which can never be executed, but also require the injection of many benign features into a malicious APK. This can be easily noticeable by program analysis techniques. In this paper, we propose SeqAdver, …


Reks: Role-Based Encrypted Keyword Search With Enhanced Access Control For Outsourced Cloud Data, Yibin Miao, Feng Li, Xiaohua Jia, Huaxiong Wang, Ximeng Liu, Kim-Kwang Raymond Choo, Robert H. Deng Jan 2023

Reks: Role-Based Encrypted Keyword Search With Enhanced Access Control For Outsourced Cloud Data, Yibin Miao, Feng Li, Xiaohua Jia, Huaxiong Wang, Ximeng Liu, Kim-Kwang Raymond Choo, Robert H. Deng

Research Collection School Of Computing and Information Systems

Keyword-based search over encrypted data is an important technique to achieve both data confidentiality and utilization in cloud outsourcing services. While commonly used access control mechanisms, such as identity-based encryption and attribute-based encryption, do not generally scale well for hierarchical access permissions. To solve this problem, we propose a Role-based Encrypted Keyword Search (REKS) scheme by using the role-based access control and broadcast encryption. Specifically, REKS allows owners to deploy hierarchical access control by allowing users with parent roles to have access permissions from child roles. Using REKS, we further facilitate token generation preprocessing and efficient user management, thereby significantly …


Intelligent Adaptive Gossip-Based Broadcast Protocol For Uav-Mec Using Multi-Agent Deep Reinforcement Learning, Zen Ren, Xinghua Li, Yinbin Miao, Zhuowen Li, Zihao Wang, Mengyao Zhu, Ximeng Liu, Deng, Robert H. Jan 2023

Intelligent Adaptive Gossip-Based Broadcast Protocol For Uav-Mec Using Multi-Agent Deep Reinforcement Learning, Zen Ren, Xinghua Li, Yinbin Miao, Zhuowen Li, Zihao Wang, Mengyao Zhu, Ximeng Liu, Deng, Robert H.

Research Collection School Of Computing and Information Systems

UAV-assisted mobile edge computing (UAV-MEC) has been proposed to offer computing resources for smart devices and user equipment. UAV cluster aided MEC rather than one UAV-aided MEC as edge pool is the newest edge computing architecture. Unfortunately, the data packet exchange during edge computing within the UAV cluster hasn't received enough attention. UAVs need to collaborate for the wide implementation of MEC, relying on the gossip-based broadcast protocol. However, gossip has the problem of long propagation delay, where the forwarding probability and neighbors are two factors that are difficult to balance. The existing works improve gossip from only one factor, …


A Secure Emr Sharing System With Tamper Resistance And Expressive Access Control, Shengmin Xu, Jianting Ning, Yingjiu Li, Yinghui Zhang, Guowen Xu, Xinyi Huang, Robert H. Deng Jan 2023

A Secure Emr Sharing System With Tamper Resistance And Expressive Access Control, Shengmin Xu, Jianting Ning, Yingjiu Li, Yinghui Zhang, Guowen Xu, Xinyi Huang, Robert H. Deng

Research Collection School Of Computing and Information Systems

To reduce the cost of human and material resources and improve the collaborations among medical systems, research laboratories and insurance companies for healthcare researches and commercial activities, electronic medical records (EMRs) have been proposed to shift from paperwork to friendly shareable electronic records. To take advantage of EMRs efficiently and reduce the cost of local storage, EMRs are usually outsourced to the remote cloud for sharing medical data with authorized users. However, cloud service providers are untrustworthy. In this paper, we propose an efficient, secure, and flexible EMR sharing system by introducing a novel cryptosystem called dual-policy revocable attribute-based encryption …


Ranked Keyword Search Over Encrypted Cloud Data Through Machine Learning Method, Yinbin Miao, Wei Zheng, Xiaohua Jia, Ximeng Liu, Kim-Kwang Raymond Choo, Robert H. Deng Jan 2023

Ranked Keyword Search Over Encrypted Cloud Data Through Machine Learning Method, Yinbin Miao, Wei Zheng, Xiaohua Jia, Ximeng Liu, Kim-Kwang Raymond Choo, Robert H. Deng

Research Collection School Of Computing and Information Systems

Ranked keyword search over encrypted data has been extensively studied in cloud computing as it enables data users to find the most relevant results quickly. However, existing ranked multi-keyword search solutions cannot achieve efficient ciphertext search and dynamic updates with forward security simultaneously. To solve the above problems, we first present a basic Machine Learning-based Ranked Keyword Search (ML-RKS) scheme in the static setting by using the k-means clustering algorithm and a balanced binary tree. ML-RKS reduces the search complexity without sacrificing the search accuracy, but is still vulnerable to forward security threats when applied in the dynamic setting. Then, …


Compressed Federated Learning Based On Adaptive Local Differential Privacy, Yinbin Miao, Rongpeng Xie, Xinghua Li, Ximeng Liu, Zhuo Ma, Robert H. Deng Dec 2022

Compressed Federated Learning Based On Adaptive Local Differential Privacy, Yinbin Miao, Rongpeng Xie, Xinghua Li, Ximeng Liu, Zhuo Ma, Robert H. Deng

Research Collection School Of Computing and Information Systems

Federated learning (FL) was once considered secure for keeping clients’ raw data locally without relaying on a central server. However, the transmitted model weights or gradients still reveal private information, which can be exploited to launch various inference attacks. Moreover, FL based on deep neural networks is prone to the curse of dimensionality. In this paper, we propose a compressed and privacy-preserving FL scheme in DNN architecture by using Compressive sensing and Adaptive local differential privacy (called as CAFL). Specifically, we first compress the local models by using Compressive Sensing (CS), then adaptively perturb the remaining weights according to their …


Differentiated Security Architecture For Secure And Efficient Infotainment Data Communication In Iov Networks, Jiani Fan, Lwin Khin Shar, Jiale Guo, Wenzhuo Yang, Dusit Niyato, Kwok-Yan Lam Dec 2022

Differentiated Security Architecture For Secure And Efficient Infotainment Data Communication In Iov Networks, Jiani Fan, Lwin Khin Shar, Jiale Guo, Wenzhuo Yang, Dusit Niyato, Kwok-Yan Lam

Research Collection School Of Computing and Information Systems

This paper aims to provide differentiated security protection for infotainment data commu- nication in Internet-of-Vehicle (IoV) networks. The IoV is a network of vehicles that uses various sensors, software, built-in hardware, and communication technologies to enable information exchange between pedestrians, cars, and urban infrastructure. Negligence on the security of infotainment data commu- nication in IoV networks can unintentionally open an easy access point for social engineering attacks. The attacker can spread false information about traffic conditions, mislead drivers in their directions, and interfere with traffic management. Such attacks can also cause distractions to the driver, which has a potential implication …


Hapticpuppet: A Kinesthetic Mid-Air Multidirectional Force-Feedback Drone-Based Interface, Martin Feick, Anthony Tang, Antonio Kruger Nov 2022

Hapticpuppet: A Kinesthetic Mid-Air Multidirectional Force-Feedback Drone-Based Interface, Martin Feick, Anthony Tang, Antonio Kruger

Research Collection School Of Computing and Information Systems

Providing kinesthetic force-feedback for human-scale interactions is challenging due to the relatively large forces needed. Therefore, robotic actuators are predominantly used to deliver this kind of haptic feedback; however, they offer limited flexibility and spatial resolution. In this work, we introduce HapticPuppet, a drone-based force-feedback interface which can exert multidirectional forces onto the human body. This can be achieved by attaching strings to different parts of the human body such as fingers, hands or ankles, which can then be affixed to multiple coordinated drones - puppeteering the user. HapticPuppet opens up a wide range of potential applications in virtual, augmented …


Towards Automated Safety Vetting Of Smart Contracts In Decentralized Applications, Yue Duan, Xin Zhao, Yu Pan, Shucheng Li, Minghao Li, Fengyuan Xu, Mu Zhang Nov 2022

Towards Automated Safety Vetting Of Smart Contracts In Decentralized Applications, Yue Duan, Xin Zhao, Yu Pan, Shucheng Li, Minghao Li, Fengyuan Xu, Mu Zhang

Research Collection School Of Computing and Information Systems

We propose VetSC, a novel UI-driven, program analysis guided model checking technique that can automatically extract contract semantics in DApps so as to enable targeted safety vetting. To facilitate model checking, we extract business model graphs from contract code that capture its intrinsic business and safety logic. To automatically determine what safety specifications to check, we retrieve textual semantics from DApp user interfaces. To exclude untrusted UI text, we also validate the UI-logic consistency and detect any discrepancies. We have implemented VetSC and applied it to 34 real-world DApps. Experiments have demonstrated that VetSC can accurately interpret smart contract code, …


Fully Deformable Network For Multiview Face Image Synthesis, Cheng Xu, Keke Li, Xuandi Luo, Xuemiao Xu, Shengfeng He, Kun Zhang Nov 2022

Fully Deformable Network For Multiview Face Image Synthesis, Cheng Xu, Keke Li, Xuandi Luo, Xuemiao Xu, Shengfeng He, Kun Zhang

Research Collection School Of Computing and Information Systems

Photorealistic multiview face synthesis from a single image is a challenging problem. Existing works mainly learn a texture mapping model from the source to the target faces. However, they rarely consider the geometric constraints on the internal deformation arising from pose variations, which causes a high level of uncertainty in face pose modeling, and hence, produces inferior results for large pose variations. Moreover, current methods typically suffer from undesired facial details loss due to the adoption of the de-facto standard encoder-decoder architecture without any skip connections (SCs). In this article, we directly learn and exploit geometric constraints and propose a …


Vfirm: Verifiable Fine-Grained Encrypted Image Retrieval In Multi-Owner Multi-User Settings, Qiuyun Tong, Yinbin Miao, Lei Chen, Jian Weng, Kim-Kwang Raymond Choo, Ximeng Liu, Robert H. Deng Nov 2022

Vfirm: Verifiable Fine-Grained Encrypted Image Retrieval In Multi-Owner Multi-User Settings, Qiuyun Tong, Yinbin Miao, Lei Chen, Jian Weng, Kim-Kwang Raymond Choo, Ximeng Liu, Robert H. Deng

Research Collection School Of Computing and Information Systems

To ensure the security of images outsourced to the malicious cloud without affecting searchability on such outsourced (typically encrypted) images, one could use privacy-preserving Content-Based Image Retrieval (CBIR) primitive. However, conventional privacy-preserving CBIR schemes based on Searchable Symmetric Encryption (SSE) are not capable of supporting efficient fine-grained access control and result verification simultaneously. Therefore, in this article, we propose a Verifiable Fine-grained encrypted Image Retrieval scheme in the Multi-owner multi-user settings (VFIRM). VFIRM first utilizes a novel polynomial-based access strategy to provide efficient fine-grained access control. Then, it employs the dual secure kk-nearest neighbor technique to distribute distinct keys to …


Reliable Policy Updating Under Efficient Policy Hidden Fine-Grained Access Control Framework For Cloud Data Sharing, Zuobin Ying, Wenjie Jiang, Ximeng Liu, Shengmin Xu, Robert H. Deng Nov 2022

Reliable Policy Updating Under Efficient Policy Hidden Fine-Grained Access Control Framework For Cloud Data Sharing, Zuobin Ying, Wenjie Jiang, Ximeng Liu, Shengmin Xu, Robert H. Deng

Research Collection School Of Computing and Information Systems

Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is one of the potent encryption paradigms in protecting data confidentiality in the cloud data sharing scenario. However, the access policy of the traditional CP-ABE is in plaintext form that reveals significant sensitive information of data owners and data visitors. To mitigate this problem, two approaches have been proposed in the literature. One is partially hidden, where the attributes in the access policy are divided into two parts: the plaintext attribute names and the hidden attribute values. The other approach fully hides the attributes in the access policy which, unfortunately, hinders efficient and correct decryption as …


M-Edese: Multi-Domain, Easily Deployable, And Efficiently Searchable Encryption, Jiaming Yuan, Yingjiu Li, Jianting Ning, Robert H. Deng Nov 2022

M-Edese: Multi-Domain, Easily Deployable, And Efficiently Searchable Encryption, Jiaming Yuan, Yingjiu Li, Jianting Ning, Robert H. Deng

Research Collection School Of Computing and Information Systems

Searchable encryption is an essential component of cryptography, which allows users to search for keywords and retrieve records from an encrypted database at cloud storage while ensuring the confidentiality of users’ queries. While most existing research on searchable encryption focuses on the single domain setting, we propose the first Multi-Domain, Easily-Deployable, Efficiently-Searchable Encryption (M-EDESE) system that allows users to query keywords cross domains with high efficiency and preserved privacy without additional cooperation from the cloud storage. In the multi-domain setting, a user who belongs to a domain can query keywords from another domain under an inter-domain partnership. Any party can …


Vulcurator: A Vulnerability-Fixing Commit Detector, Truong Giang Nguyen, Cong Thanh Le, Hong Jin Kang, Xuan-Bach D. Le, David Lo Nov 2022

Vulcurator: A Vulnerability-Fixing Commit Detector, Truong Giang Nguyen, Cong Thanh Le, Hong Jin Kang, Xuan-Bach D. Le, David Lo

Research Collection School Of Computing and Information Systems

Open-source software (OSS) vulnerability management process is important nowadays, as the number of discovered OSS vulnerabilities is increasing over time. Monitoring vulnerability-fixing commits is a part of the standard process to prevent vulnerability exploitation. Manually detecting vulnerability-fixing commits is, however, time-consuming due to the possibly large number of commits to review. Recently, many techniques have been proposed to automatically detect vulnerability-fixing commits using machine learning. These solutions either: (1) did not use deep learning, or (2) use deep learning on only limited sources of information. This paper proposes VulCurator, a tool that leverages deep learning on richer sources of information, …


Untouchable Once Revoking: A Practical And Secure Dynamic Ehr Sharing System Via Cloud, Shengmin Xu, Jianting Ning, Xinyi Huang, Yingjiu Li, Guowen Xu Nov 2022

Untouchable Once Revoking: A Practical And Secure Dynamic Ehr Sharing System Via Cloud, Shengmin Xu, Jianting Ning, Xinyi Huang, Yingjiu Li, Guowen Xu

Research Collection School Of Computing and Information Systems

Healthcare Internet-of-Things (IoT) enables lightweight devices to observe patients’ vital signals and outsource them to a remote cloud to enjoy flexible data sharing. However, it faces many security threats as the outsourced data is no longer physically controlled by data owners, and the cloud that hosts the outsourced data is not fully trusted. Many privacy protection technologies have been adopted to solve this problem, among which cryptographic mechanisms have become one of the most promising tools. Unfortunately, current cryptographic mechanisms in healthcare IoT mainly suffer from the following challenges: 1) dynamic user groups for managing users’ accessibility; 2) efficient revocation …


Towards Automated Safety Vetting Of Smart Contracts In Decentralized Applications, Yue Duan, Xin Zhao, Yu Pan, Shucheng Li, Minghao Li, Fengyuan Xu, Mu Zhang Nov 2022

Towards Automated Safety Vetting Of Smart Contracts In Decentralized Applications, Yue Duan, Xin Zhao, Yu Pan, Shucheng Li, Minghao Li, Fengyuan Xu, Mu Zhang

Research Collection School Of Computing and Information Systems

We propose VetSC, a novel UI-driven, program analysis guided model checking technique that can automatically extract contract semantics in DApps so as to enable targeted safety vetting. To facilitate model checking, we extract business model graphs from contract code that capture its intrinsic business and safety logic. To automatically determine what safety specifications to check, we retrieve textual semantics from DApp user interfaces. To exclude untrusted UI text, we also validate the UI-logic consistency and detect any discrepancies. We have implemented VetSC and applied it to 34 real-world DApps. Experiments have demonstrated that VetSC can accurately interpret smart contract code, …


Sustaining Patient Portal Continuous Use Intention And Enhancing Deep Structure Usage: Cognitive Dissonance Effects Of Health Professional Encouragement And Security Concerns, Murad Moqbel, Barbara Hewitt, Fiona Fui-Hoon Nah, Rosann M. Mclean Oct 2022

Sustaining Patient Portal Continuous Use Intention And Enhancing Deep Structure Usage: Cognitive Dissonance Effects Of Health Professional Encouragement And Security Concerns, Murad Moqbel, Barbara Hewitt, Fiona Fui-Hoon Nah, Rosann M. Mclean

Research Collection School Of Computing and Information Systems

Sustaining patient portal use is a major problem for many healthcare organizations and providers. If this problem can be successfully addressed, it could have a positive impact on various stakeholders. Through the lens of cognitive dissonance theory, this study investigates the role of health professional encouragement as well as patients’ security concerns in influencing continuous use intention and deep structure usage among users of a patient portal. The analysis of data collected from 177 patients at a major medical center in the Midwestern region of the United States shows that health professional encouragement helps increase the continuous use intention and …


Vpsl: Verifiable Privacy-Preserving Data Search For Cloud-Assisted Internet Of Things, Qiuyun Tong, Yinbin Miao, Ximeng Liu, Kim-Kwang Raymond Choo, Robert H. Deng Oct 2022

Vpsl: Verifiable Privacy-Preserving Data Search For Cloud-Assisted Internet Of Things, Qiuyun Tong, Yinbin Miao, Ximeng Liu, Kim-Kwang Raymond Choo, Robert H. Deng

Research Collection School Of Computing and Information Systems

Cloud-assisted Internet of Things (IoT) is increasingly prevalent used in various fields, such as the healthcare system. While in such a scenario, sensitive data (e.g., personal electronic medical records) can be easily revealed, which incurs potential security challenges. Thus, Symmetric Searchable Encryption (SSE) has been extensively studied due to its capability of supporting efficient search on encrypted data. However, most SSE schemes require the data owner to share the complete key with query users and take malicious cloud servers out of consideration. Seeking to address these limitations, in this paper we propose a Verifiable Privacy-preserving data Search scheme with Limited …