Open Access. Powered by Scholars. Published by Universities.®

Information Security Commons™

Open Access. Powered by Scholars. Published by Universities.®

Research Collection School Of Computing and Information Systems

Discipline
Keyword
Publication Year

Articles 91 - 120 of 1051

Full-Text Articles in Information Security

A Survey Of Protocol Fuzzing, Xiaohan Zhang, Cen Zhang, Xinghua Li, Zhengjie Du, Bing Mao, Yeting Li, Pan Li Oct 2024

A Survey Of Protocol Fuzzing, Xiaohan Zhang, Cen Zhang, Xinghua Li, Zhengjie Du, Bing Mao, Yeting Li, Pan Li

Research Collection School Of Computing and Information Systems

Communication protocols form the bedrock of our interconnected world, yet vulnerabilities within their implementations pose significant security threats. Recent developments have seen a surge in fuzzing-based research dedicated to uncovering these vulnerabilities within protocol implementations. However, there still lacks a systematic overview of protocol fuzzing for answering the essential questions such as what the unique challenges are, how existing works solve them, and so on. To bridge this gap, we conducted a comprehensive investigation of related works from both academia and industry. Our study includes a detailed summary of the specific challenges in protocol fuzzing and provides a systematic categorization …

Go to article

Pias: Privacy-Preserving Incentive Announcement System Based On Blockchain For Internet Of Vehicles, Yonghua Zhan, Yang Yang, Hongju Cheng, Xiangyang Luo, Zhuangshuang Guan, Robert H. Deng Sep 2024

Pias: Privacy-Preserving Incentive Announcement System Based On Blockchain For Internet Of Vehicles, Yonghua Zhan, Yang Yang, Hongju Cheng, Xiangyang Luo, Zhuangshuang Guan, Robert H. Deng

Research Collection School Of Computing and Information Systems

More vehicles are connecting to the Internet of Things (IoT), transforming Vehicle Ad hoc Networks (VANETs) into the Internet of Vehicles (IoV), providing a more environmentally friendly and safer driving experience. Vehicular announcement networks show promise in vehicular communication applications. However, two major issues arise when establishing such a system. Firstly, user privacy cannot be guaranteed when messages are forwarded anonymously, thus the reliability of these messages is in question. Secondly, users often lack interest in responding to announcements. To address these problems, we introduce a Blockchain-based incentive announcement system called PIAS. This system enables anonymous message commitment in a …

Go to article

Fdi : Attack Neural Code Generation Systems Through User Feedback Channel, Zhensu Sun, Xiaoning Du, Xiapu Luo, Fu Song, David Lo, Li Li Sep 2024

Fdi : Attack Neural Code Generation Systems Through User Feedback Channel, Zhensu Sun, Xiaoning Du, Xiapu Luo, Fu Song, David Lo, Li Li

Research Collection School Of Computing and Information Systems

Neural code generation systems have recently attracted increasing attention to improve developer productivity and speed up software development. Typically, these systems maintain a pre-trained neural model and make it available to general users as a service (e.g., through remote APIs) and incorporate a feedback mechanism to extensively collect and utilize the users' reaction to the generated code, i.e., user feedback. However, the security implications of such feedback have not yet been explored. With a systematic study of current feedback mechanisms, we find that feedback makes these systems vulnerable to feedback data injection (FDI) attacks. We discuss the methodology of FDI …

Go to article

Efficient And Secure Federated Learning Against Backdoor Attacks, Yinbin Miao, Rongpeng Xie, Xinghua Li, Zhiquan Liu, Kim-Kwang Raymond Choo, Robert H. Deng Sep 2024

Efficient And Secure Federated Learning Against Backdoor Attacks, Yinbin Miao, Rongpeng Xie, Xinghua Li, Zhiquan Liu, Kim-Kwang Raymond Choo, Robert H. Deng

Research Collection School Of Computing and Information Systems

Due to the powerful representation ability and superior performance of Deep Neural Networks (DNN), Federated Learning (FL) based on DNN has attracted much attention from both academic and industrial fields. However, its transmitted plaintext data causes privacy disclosure. FL based on Local Differential Privacy (LDP) solutions can provide privacy protection to a certain extent, but these solutions still cannot achieve adaptive perturbation in DNN model. In addition, this kind of schemes cause high communication overheads due to the curse of dimensionality of DNN, and are naturally vulnerable to backdoor attacks due to the inherent distributed characteristic. To solve these issues, …

Go to article

Meta-Learning For Multi-Family Android Malware Classification, Yao Li, Dawei Yuan, Tao Zhang, Haipeng Cai, David Lo, Cuiyun Gao, Xiapu Luo, He Jiang Sep 2024

Meta-Learning For Multi-Family Android Malware Classification, Yao Li, Dawei Yuan, Tao Zhang, Haipeng Cai, David Lo, Cuiyun Gao, Xiapu Luo, He Jiang

Research Collection School Of Computing and Information Systems

With the emergence of smartphones, Android has become a widely used mobile operating system. However, it is vulnerable when encountering various types of attacks. Every day, new malware threatens the security of users' devices and private data. Many methods have been proposed to classify malicious applications, utilizing static or dynamic analysis for classification. However, previous methods still suffer from unsatisfactory performance due to two challenges. First, they are unable to address the imbalanced data distribution problem, leading to poor performance for malware families with few members. Second, they are unable to address the zero-day malware (zero-day malware refers to malicious …

Go to article

Anopay: Anonymous Payment For Vehicle Parking With Updatable Credential, Yang Yang, Wenyi Xue, Yonghua Zhan, Minming Huang, Yingjiu Li, Robert H. Deng Aug 2024

Anopay: Anonymous Payment For Vehicle Parking With Updatable Credential, Yang Yang, Wenyi Xue, Yonghua Zhan, Minming Huang, Yingjiu Li, Robert H. Deng

Research Collection School Of Computing and Information Systems

Many existing anonymous parking payment schemes lack high efficiency and flexibility. For instance, the calculation and communication costs involved in payment may linearly increase with the payment amount. In this paper, we propose an anonymous payment system (dubbed AnoPay) for vehicle parking, which leverages updatable attribute-based anonymous credentials and efficient zero-knowledge proof (ZKP) to achieve user anonymity and constant overhead for parking fee payment. To further improve the efficiency, we design a secure parking fee aggregation protocol based on linear homomorphic encryption to aggregate parking transactions, where the amount of each parking transaction is hidden and the privacy of the …

Go to article

Simc 2.0: Improved Secure Ml Inference Against Malicious Clients, Guowen Xu, Xingshuo Han, Tianwei Zhang, Shengmin Xu, Jianting Ning, Xinyi Huang, Hongwei Li, Deng, Robert H. Aug 2024

Simc 2.0: Improved Secure Ml Inference Against Malicious Clients, Guowen Xu, Xingshuo Han, Tianwei Zhang, Shengmin Xu, Jianting Ning, Xinyi Huang, Hongwei Li, Deng, Robert H.

Research Collection School Of Computing and Information Systems

In this paper, we study the problem of secure ML inference against a malicious client and a semi-trusted server such that the client only learns the inference output while the server learns nothing. This problem is first formulated by Lehmkuhl et al. with a solution (MUSE, Usenix Security’21), whose performance is then substantially improved by Chandran et al.'s work (SIMC, USENIX Security’22). However, there still exists a nontrivial gap in these efforts towards practicality, giving the challenges of overhead reduction and secure inference acceleration in an all-round way. Based on this, we propose SIMC 2.0, which complies with the underlying …

Go to article

Anopas: Practical Anonymous Transit Pass From Group Signatures With Time-Bound Keys, Rui Shi, Yang Yang, Yingjiu Li, Huamin Feng, Hwee Hwa Pang, Robert H. Deng Aug 2024

Anopas: Practical Anonymous Transit Pass From Group Signatures With Time-Bound Keys, Rui Shi, Yang Yang, Yingjiu Li, Huamin Feng, Hwee Hwa Pang, Robert H. Deng

Research Collection School Of Computing and Information Systems

An anonymous transit pass system allows passengers to access transport services within fixed time periods, with their privileges automatically deactivating upon time expiration. Although existing transit pass systems are deployable on powerful devices like PCs, their adaptation to more user-friendly devices, such as mobile phones with smart cards, is inefficient due to their reliance on heavy-weight operations like bilinear maps. In this paper, we introduce an innovative anonymous transit pass system, dubbed Anopas, optimized for deployment on mobile phones with smart cards, where the smart card is responsible for crucial lightweight operations and the mobile phone handles key-independent and time-consuming …

Go to article

An Llm-Assisted Easy-To-Trigger Poisoning Attack On Code Completion Models: Injecting Disguised Vulnerabilities Against Strong Detection, Shenao Yan, Shen Wang, Yue Duan, Hanbin Hong, Kiho Lee, Doowon Kim, Yuan Hong Aug 2024

An Llm-Assisted Easy-To-Trigger Poisoning Attack On Code Completion Models: Injecting Disguised Vulnerabilities Against Strong Detection, Shenao Yan, Shen Wang, Yue Duan, Hanbin Hong, Kiho Lee, Doowon Kim, Yuan Hong

Research Collection School Of Computing and Information Systems

Large Language Models (LLMs) have transformed code completion tasks, providing context-based suggestions to boost developer productivity in software engineering. As users often fine-tune these models for specific applications, poisoning and backdoor attacks can covertly alter the model outputs. To address this critical security challenge, we introduce CODEBREAKER, a pioneering LLM-assisted backdoor attack framework on code completion models. Unlike recent attacks that embed malicious payloads in detectable or irrelevant sections of the code (e.g., comments), CODEBREAKER leverages LLMs (e.g., GPT-4) for sophisticated payload transformation (without affecting functionalities), ensuring that both the poisoned data for fine-tuning and generated code can evade strong …

Go to article

G2face: High-Fidelity Reversible Face Anonymization Via Generative And Geometric Priors, Haoxin Yang, Xuemiao Xu, Cheng Xu, Huaidong Zhang, Jing Qin, Yi Wang, Pheng-Ann Heng, Shengfeng He Aug 2024

G2face: High-Fidelity Reversible Face Anonymization Via Generative And Geometric Priors, Haoxin Yang, Xuemiao Xu, Cheng Xu, Huaidong Zhang, Jing Qin, Yi Wang, Pheng-Ann Heng, Shengfeng He

Research Collection School Of Computing and Information Systems

Reversible face anonymization, unlike traditional face pixelization, seeks to replace sensitive identity information in facial images with synthesized alternatives, preserving privacy without sacrificing image clarity. Traditional methods, such as encoder-decoder networks, often result in significant loss of facial details due to their limited learning capacity. Additionally, relying on latent manipulation in pre-trained GANs can lead to changes in ID-irrelevant attributes, adversely affecting data utility due to GAN inversion inaccuracies. This paper introduces G 2 Face, which leverages both generative and geometric priors to enhance identity manipulation, achieving high-quality reversible face anonymization without compromising data utility. We utilize a 3D face …

Go to article

Peep With A Mirror: Breaking The Integrity Of Android App Sandboxing Via Unprivileged Cache Side Channel, Yan Lin, Joshua Wong, Xiang Li, Haoyu Ma, Debin Gao Aug 2024

Peep With A Mirror: Breaking The Integrity Of Android App Sandboxing Via Unprivileged Cache Side Channel, Yan Lin, Joshua Wong, Xiang Li, Haoyu Ma, Debin Gao

Research Collection School Of Computing and Information Systems

Application sandboxing is a well-established security principle employed in the Android platform to safeguard sensitive information. However, hardware resources, specifically the CPU caches, are beyond the protection of this software-based mechanism, leaving room for potential side-channel attacks. Existing attacks against this particular weakness of app sandboxing mainly target shared components among apps, hence can only observe system-level program dynamics (such as UI tracing). In this work, we advance cache side-channel attacks by demonstrating the viability of non-intrusive and fine-grained probing across different app sandboxes, which have the potential to uncover app-specific and private program behaviors, thereby highlighting the importance of …

Go to article

Evilscreen Attack: Smart Tv Hijacking Via Multi-Channel Remote Control Mimicry, Yiwei Zhang, Siqi Ma, Tiancheng Chen, Juanru Li, Robert H. Deng, Elisa Bertino Jul 2024

Evilscreen Attack: Smart Tv Hijacking Via Multi-Channel Remote Control Mimicry, Yiwei Zhang, Siqi Ma, Tiancheng Chen, Juanru Li, Robert H. Deng, Elisa Bertino

Research Collection School Of Computing and Information Systems

Modern smart TVs often communicate with their remote controls (including the smartphone simulated ones) using multiple wireless channels (e.g., Infrared, Bluetooth, and Wi-Fi). However, this multi-channel remote control communication introduces a new attack surface. An inherent security flaw is that remote controls of most smart TVs are designed to work in a benign environment rather than an adversarial one, and thus wireless communications between a smart TV and its remote controls are not strongly protected. Attackers can leverage such a flaw to abuse the remote control communication and compromise smart TV systems. In this paper, we propose EvilScreen, a novel …

Go to article

Mtdscout : Complementing The Identification Of Insecure Methods In Android Apps Via Source-To-Bytecode Signature Generation And Tree-Based Layered Search, Zicheng Zhang, Haoyu Ma, Daoyuan Wu, Debin Gao, Xiao Yi, Yufan Chen, Yan Wu, Lingxiao Jiang Jul 2024

Mtdscout : Complementing The Identification Of Insecure Methods In Android Apps Via Source-To-Bytecode Signature Generation And Tree-Based Layered Search, Zicheng Zhang, Haoyu Ma, Daoyuan Wu, Debin Gao, Xiao Yi, Yufan Chen, Yan Wu, Lingxiao Jiang

Research Collection School Of Computing and Information Systems

Modern Android apps consist of both host app code and third-party libraries. Traditional static analysis tools conduct taint analysis for API misuses on the entire app code, while third-party library (TPL) detection tools focus solely on library code. Both approaches, however, are prone to some inherent false negatives: taint analysis tools may neglect third-party libraries or face timeouts/errors in whole app-based analysis, and TPL detection tools are not designed for pinpointing specific vulnerable methods. These challenges underscore the need for enhanced identification of insecure methods in Android apps, particularly for app markets addressing open-source security incidents. In this paper, we …

Go to article

Double Issuer-Hiding Attribute-Based Credentials From Tag-Based Aggregatable Mercurial Signatures, Rui Shi, Yang Yang, Yingjiu Li, Huamin Feng, Guozhen Shi, Hwee Hwa Pang, Robert H. Deng Jul 2024

Double Issuer-Hiding Attribute-Based Credentials From Tag-Based Aggregatable Mercurial Signatures, Rui Shi, Yang Yang, Yingjiu Li, Huamin Feng, Guozhen Shi, Hwee Hwa Pang, Robert H. Deng

Research Collection School Of Computing and Information Systems

Attribute-based anonymous credentials offer users fine-grained access control in a privacy-preserving manner. However, in such schemes obtaining a user's credentials requires knowledge of the issuer's public key, which obviously reveals the issuer's identity that must be hidden from users in certain scenarios. Moreover, verifying a user's credentials also requires the knowledge of issuer's public key, which may infer the user's private information from their choice of issuer. In this article, we introduce the notion of double issuer-hiding attribute-based credentials ( DIHAC ) to tackle these two problems. In our model, a central authority can issue public-key credentials for a group …

Go to article

Secure And Flexible Wildcard Queries, Qing Wang, Donghui Hu, Meng Li, Guomin Yang Jul 2024

Secure And Flexible Wildcard Queries, Qing Wang, Donghui Hu, Meng Li, Guomin Yang

Research Collection School Of Computing and Information Systems

Wildcard Keyword Searchable Encryption (WKSE) enables users to search desired encrypted files with wildcard queries. Previous schemes only enabled single-character wildcard queries or restricted multi-character wildcard queries. Even if the two types of queries are supported by several schemes, they are vulnerable to correlation attacks and composition attacks. In this paper, we propose a WKSE scheme Secure Flexible Wildcard Queries (SFWQ) that supports highly flexible wildcard queries and resists correlation and composition attacks. Specifically, we adopt the interval matching method instead of traditional position matching, so that SFWQ supports a variety of queries, including single-character wildcard queries, multi-character wildcard queries, …

Go to article

Esem: To Harden Process Synchronization For Servers, Zhanbo Wang, Jiaxin Zhan, Xuhua Ding, Fengwei Zhang, Ning Hu Jul 2024

Esem: To Harden Process Synchronization For Servers, Zhanbo Wang, Jiaxin Zhan, Xuhua Ding, Fengwei Zhang, Ning Hu

Research Collection School Of Computing and Information Systems

Process synchronization primitives lubricate server computing involving a group of processes as they ensure those processes to properly coordinate their executions for a common purpose such as provisioning a web service. A malfunctioned synchronization due to attacks causes friction among processes and leads to unexpected, and often hard-to-detect, application transaction errors. Unfortunately, synchronization primitives are not naturally protected by existing hardware-assisted isolation techniques e.g., SGX, because their process-oriented isolation conflicts with the primitive's demand for cross-process operations.This paper introduces the Enclave-Semaphore service (ESem) which shelters application semaphores and their operations against kernel-privileged attacks. ESem encapsulates all semaphores in the platform …

Go to article

Privacy-Preserving Arbitrary Geometric Range Query In Mobile Internet Of Vehicles, Yinbin Miao, Lin Song, Xinghua Li, Hongwei Li, Kim-Kwang Raymond Choo, Robert H. Deng Jul 2024

Privacy-Preserving Arbitrary Geometric Range Query In Mobile Internet Of Vehicles, Yinbin Miao, Lin Song, Xinghua Li, Hongwei Li, Kim-Kwang Raymond Choo, Robert H. Deng

Research Collection School Of Computing and Information Systems

The mobile Internet of Vehicles (IoVs) has great potential for intelligent transportation, and creates spatial data query demands to realize the value of data. Outsourcing spatial data to a cloud server eliminates the need for local computation and storage, but it leads to data security and privacy threats caused by untrusted third-parties. Existing privacy-preserving spatial range query solutions based on Homomorphic Encryption (HE) have been developed to increase security. However, in the single server model, the private key is held by the query user, which incurs high computation and communication burdens on query users due to multiple rounds of interactions. …

Go to article

Key Cooperative Attribute-Based Encryption, Luqi Huang, Willy Susilo, Guomin Yang, Fuchun Guo Jul 2024

Key Cooperative Attribute-Based Encryption, Luqi Huang, Willy Susilo, Guomin Yang, Fuchun Guo

Research Collection School Of Computing and Information Systems

Attribute-based encryption (ABE) is an important technology in building access control systems with precise control and scalability. In an ABE system, there exists a private key generator (PKG) that issues all private keys. The PKG has a significant drawback referred to as the huge key management burden in large-scale user systems. To overcome this limitation, we propose a more flexible system that offers users the choice to utilize decryption keys either from the PKG or from trusted users to decrypt the ciphertext, reducing the workload of the PKG. Unfortunately, users are restricted to only receiving private keys from the PKG …

Go to article

Pkt-Sin: A Secure Communication Protocol For Space Information Networks With Periodic K-Time Anonymous Authentication, Yang Yang, Wenyi Xue, Jianfei Sun, Guomin Yang, Yingjiu Li, Hwee Hwa Pang, Robert H. Deng Jun 2024

Pkt-Sin: A Secure Communication Protocol For Space Information Networks With Periodic K-Time Anonymous Authentication, Yang Yang, Wenyi Xue, Jianfei Sun, Guomin Yang, Yingjiu Li, Hwee Hwa Pang, Robert H. Deng

Research Collection School Of Computing and Information Systems

Space Information Network (SIN) enables universal Internet connectivity for any object, even in remote and extreme environments where deploying a cellular network is difficult. Access authentication is crucial for ensuring user access control in SIN and preventing unauthorized entities from gaining access to network services. However, due to the complex communication environment in SIN, including exposed links and higher signal delay, designing a secure and efficient authentication scheme presents a significant challenge. In this paper, we propose a secure communication protocol for SIN with periodic k-time anonymous authentication (named PkT-SIN) that allows satellite users to anonymously authenticate to ground stations …

Go to article

Unmasking The Lurking: Malicious Behavior Detection For Iot Malware With Multi-Label Classification, Ruitao Feng, Sen Li, Sen Chen, Mengmeng Ge, Xuewei Li, Xiaohong Li Jun 2024

Unmasking The Lurking: Malicious Behavior Detection For Iot Malware With Multi-Label Classification, Ruitao Feng, Sen Li, Sen Chen, Mengmeng Ge, Xuewei Li, Xiaohong Li

Research Collection School Of Computing and Information Systems

Current methods for classifying IoT malware predominantly utilize binary and family classifications. However, these outcomes lack the detailed granularity to describe malicious behavior comprehensively. This limitation poses challenges for security analysts, failing to support further analysis and timely preventive actions. To achieve fine-grained malicious behavior identification in the lurking stage of IoT malware, we propose MaGraMal. This approach, leveraging masked graph representation, supplements traditional classification methodology, empowering analysts with critical insights for rapid responses. Through the empirical study, which took three person-months, we identify and summarize four fine-grained malicious behaviors during the lurking stage, constructing an annotated dataset. Our evaluation …

Go to article

Enhancing Code Vulnerability Detection Via Vulnerability-Preserving Data Augmentation, Shangqing Liu, Wei Ma, Jian Wang, Xiaofei Xie, Ruitao Feng, Yang Liu Jun 2024

Enhancing Code Vulnerability Detection Via Vulnerability-Preserving Data Augmentation, Shangqing Liu, Wei Ma, Jian Wang, Xiaofei Xie, Ruitao Feng, Yang Liu

Research Collection School Of Computing and Information Systems

Source code vulnerability detection aims to identify inherent vulnerabilities to safeguard software systems from potential attacks. Many prior studies overlook diverse vulnerability characteristics, simplifying the problem into a binary (0-1) classification task for example determining whether it is vulnerable or not. This poses a challenge for a single deep-learning based model to effectively learn the wide array of vulnerability characteristics. Furthermore, due to the challenges associated with collecting large-scale vulnerability data, these detectors often overfit limited training datasets, resulting in lower model generalization performance. To address the aforementioned challenges, in this work, we introduce a fine-grained vulnerability detector namely FGVulDet. …

Go to article

Attribute-Hiding Fuzzy Encryption For Privacy-Preserving Data Evaluation, Zhenhua Chen, Luqi Huang, Guomin Yang, Willy Susilo, Xingbing Fu, Xingxing Jia May 2024

Attribute-Hiding Fuzzy Encryption For Privacy-Preserving Data Evaluation, Zhenhua Chen, Luqi Huang, Guomin Yang, Willy Susilo, Xingbing Fu, Xingxing Jia

Research Collection School Of Computing and Information Systems

Privacy-preserving data evaluation is one of the prominent research topics in the big data era. In many data evaluation applications that involve sensitive information, such as the medical records of patients in a medical system, protecting data privacy during the data evaluation process has become an essential requirement. Aiming at solving this problem, numerous fuzzy encryption systems for different similarity metrics have been proposed in literature. Unfortunately, the existing fuzzy encryption systems either fail to achieve attribute-hiding or achieve it, but are impractical. In this paper, we propose a new fuzzy encryption scheme for privacy-preserving data evaluation based on overlap …

Go to article

Cmd: Co-Analyzed Iot Malware Detection And Forensics Via Network And Hardware Domains, Ziming Zhao, Zhaoxuan Li, Jiongchi Yu, Fan Zhang, Xiaofei Xie, Haitao Xu, Binbin Chen May 2024

Cmd: Co-Analyzed Iot Malware Detection And Forensics Via Network And Hardware Domains, Ziming Zhao, Zhaoxuan Li, Jiongchi Yu, Fan Zhang, Xiaofei Xie, Haitao Xu, Binbin Chen

Research Collection School Of Computing and Information Systems

With the widespread use of Internet of Things (IoT) devices, malware detection has become a hot spot for both academic and industrial communities. Existing approaches can be roughly categorized into network-side and host-side. However, existing network-side methods are difficult to capture contextual semantics from cross-source traffic, and previous host-side methods could be adversary-perceived and expose risks for tampering. More importantly, a single perspective cannot comprehensively track the multi-stage lifecycle of IoT malware. In this paper, we present CMD, a co-analyzed IoT malware detection and forensics system by combining hardware and network domains. For the network part, CMD proposes a tailored …

Go to article

Make Revocation Cheaper: Hardware-Based Revocable Attribute-Based Encryption, Xiaoguo Li, Guomin Yang, Tao Xiang, Shengmin Xu, Bowen Zhao, Robert H. Deng, Hwee Hwa Pang May 2024

Make Revocation Cheaper: Hardware-Based Revocable Attribute-Based Encryption, Xiaoguo Li, Guomin Yang, Tao Xiang, Shengmin Xu, Bowen Zhao, Robert H. Deng, Hwee Hwa Pang

Research Collection School Of Computing and Information Systems

As an advanced one-to-many public key encryption system, attribute-based encryption (ABE) is widely believed to be a promising technology for achieving flexible and fine-grained access control of encrypted data on untrusted storage servers (e.g., public cloud servers). However, user revocation in ABE is a critical but challenging problem, and designing efficient revocable ABE has been an active research topic in the past decade. Almost all the existing revocable ABE schemes incorporate a timestamp in the encryption algorithm such that revoked users cannot decrypt ciphertexts generated in future time intervals. To prevent revoked users from decrypting past ciphertexts, the storage server …

Go to article

Factored Mdp Based Moving Target Defense With Dynamic Threat Modeling, Megha Bose, Praveen Paruchuri, Akshat Kumar May 2024

Factored Mdp Based Moving Target Defense With Dynamic Threat Modeling, Megha Bose, Praveen Paruchuri, Akshat Kumar

Research Collection School Of Computing and Information Systems

Moving Target Defense (MTD) has emerged as a proactive defense framework to counteract ever-changing cyber threats. Existing approaches often make assumptions about attacker-side knowledge and behavior, potentially resulting in suboptimal defense. This paper introduces a novel MTD approach, leveraging a Markov Decision Process (MDP) model that eliminates the need for prior knowledge about attacker intentions or payoffs. Our framework seamlessly integrates real-time attacker responses into the defender's MDP using a dynamic Bayesian network. We use a factored MDP model to enable a more comprehensive and realistic representation of the system having multiple switchable aspects and also accommodate incremental updates of …

Go to article

Policy-Based Remote User Authentication From Multi-Biometrics, Yangguang Tian, Yingjiu Li, Robert H. Deng, Guomin Yang, Nan Li May 2024

Policy-Based Remote User Authentication From Multi-Biometrics, Yangguang Tian, Yingjiu Li, Robert H. Deng, Guomin Yang, Nan Li

Research Collection School Of Computing and Information Systems

In this paper, we introduce the first generic framework of policy-based remote user authentication from multiple biometrics. The proposed framework allows an authorized user to remotely authenticate herself to an authentication server using her multiple biometrics, which enhances both the security and usability of user authentications. The authentication server approves a user's authentication request if and only if the user's multiple biometrics satisfies an authentication policy. In particular, the authentication policy can be dynamically updated to satisfy different security and usability requirements in practice. We implement an instantiation of the proposed framework and report its performance under various authentication policies.

Go to article

A Survey On Searchable Symmetric Encryption, Feng Li, Jianfeng Ma, Yinbin Miao, Ximeng Liu, Jianting Ning, Robert H. Deng May 2024

A Survey On Searchable Symmetric Encryption, Feng Li, Jianfeng Ma, Yinbin Miao, Ximeng Liu, Jianting Ning, Robert H. Deng

Research Collection School Of Computing and Information Systems

Outsourcing data to the cloud has become prevalent, so Searchable Symmetric Encryption (SSE), one of the methods for protecting outsourced data, has arisen widespread interest. Moreover, many novel technologies and theories have emerged, especially for the attacks on SSE and privacy-preserving. But most surveys related to SSE concentrate on one aspect (e.g., single keyword search, fuzzy keyword search) or lack in-depth analysis. Therefore, we revisit the existing work and conduct a comprehensive analysis and summary. We provide an overview of state-of-the-art in SSE and focus on the privacy it can protect. Generally, (1) we study the work of the past …

Go to article

Baffle : Hiding Backdoors In Offline Reinforcement Learning Datasets, Chen Gong, Zhou Yang, Yunpeng Bai, Junda He, Jieke Shi, Kecen Li, Arunesh Sinha, Bowen Xu, Xinwen Hou, David Lo, Tianhao Wang May 2024

Baffle : Hiding Backdoors In Offline Reinforcement Learning Datasets, Chen Gong, Zhou Yang, Yunpeng Bai, Junda He, Jieke Shi, Kecen Li, Arunesh Sinha, Bowen Xu, Xinwen Hou, David Lo, Tianhao Wang

Research Collection School Of Computing and Information Systems

Reinforcement learning (RL) makes an agent learn from trial-and-error experiences gathered during the interaction with the environment. Recently, offline RL has become a popular RL paradigm because it saves the interactions with environments. In offline RL, data providers share large pre-collected datasets, and others can train high-quality agents without interacting with the environments. This paradigm has demonstrated effectiveness in critical tasks like robot control, autonomous driving, etc. However, less attention is paid to investigating the security threats to the offline RL system. This paper focuses on backdoor attacks, where some perturbations are added to the data (observations) such that given …

Go to article

Stealthy Backdoor Attack For Code Models, Zhou Yang, Bowen Xu, Jie M. Zhang, Hong Jin Kang, Jieke Shi, Junda He, David Lo Apr 2024

Stealthy Backdoor Attack For Code Models, Zhou Yang, Bowen Xu, Jie M. Zhang, Hong Jin Kang, Jieke Shi, Junda He, David Lo

Research Collection School Of Computing and Information Systems

Code models, such as CodeBERT and CodeT5, offer general-purpose representations of code and play a vital role in supporting downstream automated software engineering tasks. Most recently, code models were revealed to be vulnerable to backdoor attacks. A code model that is backdoor-attacked can behave normally on clean examples but will produce pre-defined malicious outputs on examples injected with that activate the backdoors. Existing backdoor attacks on code models use unstealthy and easy-to-detect triggers. This paper aims to investigate the vulnerability of code models with backdoor attacks. To this end, we propose A (dversarial eature as daptive Back). A achieves stealthiness …

Go to article

Flgan: Gan-Based Unbiased Federated Learning Under Non-Iid Settings, Zhuoran Ma, Yang Liu, Yinbin Miao, Guowen Xu, Ximeng Liu, Jianfeng Ma, Robert H. Deng Apr 2024

Flgan: Gan-Based Unbiased Federated Learning Under Non-Iid Settings, Zhuoran Ma, Yang Liu, Yinbin Miao, Guowen Xu, Ximeng Liu, Jianfeng Ma, Robert H. Deng

Research Collection School Of Computing and Information Systems

Federated Learning (FL) suffers from low convergence and significant accuracy loss due to local biases caused by non-Independent and Identically Distributed (non-IID) data. To enhance the non-IID FL performance, a straightforward idea is to leverage the Generative Adversarial Network (GAN) to mitigate local biases using synthesized samples. Unfortunately, existing GAN-based solutions have inherent limitations, which do not support non-IID data and even compromise user privacy. To tackle the above issues, we propose a GAN-based unbiased FL scheme, called FlGan, to mitigate local biases using synthesized samples generated by GAN while preserving user-level privacy in the FL setting. Specifically, FlGan first …

Go to article

First Prev Next Last