Information Security Commons^™

Stealthy Backdoor Attack For Code Models, Zhou Yang, Bowen Xu, Jie M. Zhang, Hong Jin Kang, Jieke Shi, Junda He, David Lo

Research Collection School Of Computing and Information Systems

Code models, such as CodeBERT and CodeT5, offer general-purpose representations of code and play a vital role in supporting downstream automated software engineering tasks. Most recently, code models were revealed to be vulnerable to backdoor attacks. A code model that is backdoor-attacked can behave normally on clean examples but will produce pre-defined malicious outputs on examples injected with that activate the backdoors. Existing backdoor attacks on code models use unstealthy and easy-to-detect triggers. This paper aims to investigate the vulnerability of code models with backdoor attacks. To this end, we propose A (dversarial eature as daptive Back). A achieves stealthiness …

Flgan: Gan-Based Unbiased Federated Learning Under Non-Iid Settings, Zhuoran Ma, Yang Liu, Yinbin Miao, Guowen Xu, Ximeng Liu, Jianfeng Ma, Robert H. Deng

Research Collection School Of Computing and Information Systems

Federated Learning (FL) suffers from low convergence and significant accuracy loss due to local biases caused by non-Independent and Identically Distributed (non-IID) data. To enhance the non-IID FL performance, a straightforward idea is to leverage the Generative Adversarial Network (GAN) to mitigate local biases using synthesized samples. Unfortunately, existing GAN-based solutions have inherent limitations, which do not support non-IID data and even compromise user privacy. To tackle the above issues, we propose a GAN-based unbiased FL scheme, called FlGan, to mitigate local biases using synthesized samples generated by GAN while preserving user-level privacy in the FL setting. Specifically, FlGan first …

Going Viral: Case Studies On The Impact Of Protestware, Youmei Fan, Dong Wang, Supastsara Wattanakriengkrai, Hathaichanok Damrongsiri, Christoph Treude, Hideaki Hata, Raula Gaikovina Kula

Research Collection School Of Computing and Information Systems

Maintainers are now self-sabotaging their work in order to take political or economic stances, a practice referred to as "protestware". In this poster, we present our approach to understand how the discourse about such an attack went viral, how it is received by the community, and whether developers respond to the attack in a timely manner. We study two notable protestware cases, i.e., Colors.js and es5-ext, comparing with discussions of a typical security vulnerability as a baseline, i.e., Ua-parser, and perform a thematic analysis of more than two thousand protest-related posts to extract the different narratives when discussing protestware.

Intelligent Tutoring System Ontology, Wael Mohamed Hassan

Theses

The integration of pedagogical rules into Intelligent Tutoring Systems (ITS) using semantic web technologies, particularly the Web Ontology Language (OWL), holds great promise for enhancing the capabilities of these systems. However, a significant challenge arises from the labor-intensive process of manually constructing ontologies, which can consume valuable time and resources. While ontologies offer numerous advantages, including robust knowledge inference and scalability, the limitations of manual ontology creation are evident in terms of time and flexibility. Therefore, the primary objective of this research is to develop an efficient and automated solution that harnesses the benefits of ontologies while reducing the time …

Enhancing Health Analytics: Secure And Private Federated Learning Solutions, Nisha Thorakkattu Madathil

Dissertations

Federated Learning (FL) is a collaborative method allowing individuals to train a model jointly without sharing their local datasets. It utilizes decentralized data sources to protect privacy, making it particularly promising in medical contexts where data confidentiality is paramount. FL facilitates the use of diverse datasets from various healthcare organizations while upholding patient confidentiality. It also plays a crucial role in advancing medical research and healthcare services while adhering to data distribution and compliance requirements. The primary challenges within federated healthcare encompass privacy preservation among sensitive distributed data, ensuring efficient communication, addressing data heterogeneity, and ultimately guaranteeing model accuracy. To …

Cybersecurity Education And Continuous Learning Towards Uae Ncsp Fulfilment, Saleh Hamad Aldaajeh

Dissertations

This dissertation delves into enhancing cybersecurity education by aligning academic curricula with national cybersecurity strategic plan (NCSP) objectives, emphasizing the crucial role of Higher Education Institutions (HEIs) in developing a skilled cybersecurity workforce. Analyzing ten NCSPs, it identifies strategic themes and gaps between national goals and HEI offerings. The study reviews NCSP guidelines, international cybersecurity indices, and literature, including the NICE-NIST framework, to develop a framework that bridges the educational gap, improving learning outcomes and arming students with vital skills, knowledge, and competencies. Furthermore, it introduces a platform for continuous cybersecurity learning, employing micro-credentials, blockchain technology, and AI-driven systems. Based …

A Trustworthy Self-Sovereign Data And Identity Management Framework, Efat Fathalla

Electrical & Computer Engineering Theses & Dissertations

Data is a fundamental building block in the digital world, providing a basis for decision making and growth across numerous applications. In our modern world, we have become accustomed to collecting data on everything, including devices, machines, and people. The increased value of such data has led to aggressive harvesting mechanisms that prioritize data collection, storage, and pervasiveness while often disregarding security, privacy concerns, and compliance with regulations and standards. Such a pervasive attitude towards data has resulted in a loss of control, prompting concerns among individuals and mobilizing the scientific community towards advocating for data self-sovereignty.

Self-Sovereign Identity (SSI) …

Improving Educational Delivery And Content In Juvenile Detention Centers, Yomna Elmousalami

Undergraduate Research Symposium

Students in juvenile detention centers have the greatest need to receive improvements in educational delivery and content; however, they are one of the “truly disadvantaged” populations in terms of receiving those improvements. This work presents a qualitative data analysis based on a focus group meeting with stakeholders at a local Juvenile Detention Center. The current educational system in juvenile detention centers is based on paper worksheets, single-room style teaching methods, outdated technology, and a shortage of textbooks and teachers. In addition, detained students typically have behavioral challenges that are deemed "undesired" in society. As a result, many students miss classes …

An Analysis And Ontology Of Teaching Methods In Cybersecurity Education, Sarah Buckley

LSU Master's Theses

The growing cybersecurity workforce gap underscores the urgent need to address deficiencies in cybersecurity education: the current education system is not producing competent cybersecurity professionals, and current efforts are not informing the non-technical general public of basic cybersecurity practices. We argue that this gap is compounded by a fundamental disconnect between cybersecurity education literature and established education theory. Our research addresses this issue by examining the alignment of cybersecurity education literature concerning educational methods and tools with education literature.

In our research, we endeavor to bridge this gap by critically analyzing the alignment of cybersecurity education literature with education theory. …

Artificial Intelligence Usage And Data Privacy Discoveries Within Mhealth, Jennifer Schulte

Research & Publications

Advancements in artificial intelligence continue to impact nearly every aspect of human life by providing integration options that aim to supplement or improve current processes. One industry that continues to benefit from artificial intelligence integration is healthcare. For years now, elements of artificial intelligence have been used to assist in clinical decision making, helping to identify potential health risks at earlier stages, and supplementing precision medicine. An area of healthcare that specifically looks at wearable devices, sensors, phone applications, and other such devices is mobile health (mHealth). These devices are used to aid in health data collection and delivery. This …

On Global Security Governance’S New Trends And China’S Responses From Perspective Of Scientific And Technological Revolution, Haoguang Liang, Linman Wu, Zhujun Liu, Yaojun Zhang

Bulletin of Chinese Academy of Sciences (Chinese Version)

Due to the new round of sci-tech revolution and industrial transformation, the relation between scientific progress and national security has been upgraded to an unprecedented strategic height. Therefore, it is vitally important to explore the current situation and future trajectory of the relation between the two. This study discusses the new trends between global scientific progress and the security of sovereign countries. It believes that scientific progress has catalyzed the new geopolitical contests, development contradiction and hegemonic tools in global security governance, thereby enlightening China’s approach to national security. To maintain holistic national security, China should formulate an overall strategic …

Breaking Through “Data Bottleneck” Of Ai Large Models—Reflections On Building A National Corpus Operation Platform, Xingteng Li, Feng Feng, Liqiang Huang

Bulletin of Chinese Academy of Sciences (Chinese Version)

At present, the competition within the global artificial intelligence (AI) large model industry is intensifying, and corpus resources emerging as a critical determinant for enhancing the technical performance and practical efficacy of AI systems. Nevertheless, China’s corpus development faces dual challenges in both quantity and quality, struggling to meet the escalating training demands of the rapidly evolving AI large model sector. Internationally, nations are ramping up efforts to develop their corpus infrastructures, particularly prioritizing the creation and deployment of high-quality linguistic datasets. In this context, through comparative analysis of international benchmarks and domestic conditions, this study proposes a strategic framework …

Challenges On Public Security System In Ai Era—Preface For Special Column “Artificial Intelligence And Public Security”, Juan Cao, Qiang Sheng, Guojie Li

Bulletin of Chinese Academy of Sciences (Chinese Version)

The rapid development of artificial intelligence generated content (AIGC) technology has triggered new public security risks, posing a serious threat to national security and social stability. This study exhibits the recent advances of artificial intelligence (AI) content generation and detection techniques, points out the challenges of detection techniques in real-world scenarios, and advocates that it is necessary to develop AIGC detection technology for public security needs and build a whole-process detection technology system from generative models to online platforms, which supports AIGC to be labeled at the generation phase, identifiable during dissemination and source-traceable after the incident occurs.

Research On Artificial Intelligence Crime And China’S Countermeasures, Jianxin Gao, Jinping Sun, Yukun Cai, Chongpeng Wang, Yanyan Yang, Kaiyue Wang

Bulletin of Chinese Academy of Sciences (Chinese Version)

The rapid development of artificial intelligence technology has constantly given rise to new scenarios, models, and markets, changing the way information and knowledge are generated. Nevertheless, the security risks exposed by technology, such as algorithm bias, data leakage, false content generation, and improper use, are also prone to trigger various new types of crimes. There are still loopholes in legal regulation and technological prevention under the current situation, which poses severe challenges to crime crackdown. In order to effectively meet the new challenges of China’s artificial intelligence (AI) crime, we should supplement and improve the existing legal norms, improve the …

Intelligent Algorithm Safety: Concepts, Scientific Problems And Prospects, Xueqi Cheng, Wei Chen, Huawei Shen, Shiguang Shan, Xilin Chen, Guojie Li

Bulletin of Chinese Academy of Sciences (Chinese Version)

Intelligent algorithms refer to the methods embodied in the computational processes that realize intelligence. These methods are often characterized by being data-driven, involving uncertain computations, and with unexplainable model inferences. These characteristics simultaneously introduce potential safety risks to the application of intelligent algorithms and AI. This study firstly explores the concepts of intelligent algorithm safety. Specifically, intelligent algorithm safety, based on the degree of human-machine integration, extends from the univariate safety of the algorithm itself to the bivariate applicational safety when the algorithm serves humans, and finally evolves into the multivariate systemic safety arises within complex socio-technical systems of human-machine …

Embodied Artificial Intelligence Security And Governance, Wenyuan Xu, Xiaoyu Ji, Chen Yan, Yushi Cheng

Bulletin of Chinese Academy of Sciences (Chinese Version)

Embodied artificial intelligence (EAI) is progressively integrated into the fabric of our daily lives, enhancing various sectors such as industrial production, healthcare, and national defense. Nevertheless, the diverse range of hardware devices, software algorithms, and data communications that constitute these complex systems may contain vulnerabilities that could be exploited by attackers, posing a serious threat to personal, social, and national security. Thus, this study examines the security implications and proposes a security framework of EAI, from the perspectives of the information domain, physical domain, and social domain, focusing on its ontological security, interaction security, and application security. To mitigate these …

Computing Power Security Governance From Perspective Of Overall National Security Concept, Hui Li, Na Wang, Long Wang

Bulletin of Chinese Academy of Sciences (Chinese Version)

Currently, with the rapid development of computing technology and the continuous expansion of computing applications, various types of computing security incidents occur frequently. As an emerging security issue, computing security has become a key fact affecting national security. Strengthening the governance of computing power security has become an important part of the modernization of the national security governance system and governance capacity in China. To clarify the theoretical connotation, risk manifestations, and governance strategies of computing power security governance, this study takes the overall national security concept as guidance and the logical guidance of “issue identification-risk deconstruction-governance response” to analyze …

From Asset Flow To Status, Action And Intention Discovery: Early Malice Detection In Cryptocurrency, Ling Cheng, Feida Zhu, Yong Wang, Ruicheng Liang, Huiwen Liu

Research Collection School Of Computing and Information Systems

Cryptocurrency has been subject to illicit activities probably more often than traditional financial assets due to the pseudo-anonymous nature of its transacting entities. An ideal detection model is expected to achieve all three critical properties of early detection, good interpretability, and versatility for various illicit activities. However, existing solutions cannot meet all these requirements, as most of them heavily rely on deep learning without interpretability and are only available for retrospective analysis of a specific illicit type. To tackle all these challenges, we propose Intention Monitor for early malice detection in Bitcoin, where the on-chain record data for a certain …

Developing Singapore As A Smart Nation, Josephine Teo

Asian Management Insights

Mrs Josephine Teo, Singapore’s Minister for Communications and Information, and Minister-in-charge of Smart Nation and Cybersecurity, speaks about leading the country’s Smart Nation drive.

Sigmadiff: Semantics-Aware Deep Graph Matching For Pseudocode Diffing, Lian Gao, Yu Qu, Sheng Yu, Yue Duan, Heng Yin

Research Collection School Of Computing and Information Systems

Pseudocode diffing precisely locates similar parts and captures differences between the decompiled pseudocode of two given binaries. It is particularly useful in many security scenarios such as code plagiarism detection, lineage analysis, patch, vulnerability analysis, etc. However, existing pseudocode diffing and binary diffing tools suffer from low accuracy and poor scalability, since they either rely on manually-designed heuristics (e.g., Diaphora) or heavy computations like matrix factorization (e.g., DeepBinDiff). To address the limitations, in this paper, we propose a semantics-aware, deep neural network-based model called SIGMADIFF. SIGMADIFF first constructs IR (Intermediate Representation) level interprocedural program dependency graphs (IPDGs). Then it uses …

Decentralized Multimedia Data Sharing In Iov: A Learning-Based Equilibrium Of Supply And Demand, Jiani Fan, Minrui Xu, Jiale Guo, Lwin Khin Shar, Jiawen Kang, Dusit Niyato, Kwok-Yan Lam

Research Collection School Of Computing and Information Systems

The Internet of Vehicles (IoV) has great potential to transform transportation systems by enhancing road safety, reducing traffic congestion, and improving user experience through onboard infotainment applications. Decentralized data sharing can improve security, privacy, reliability, and facilitate infotainment data sharing in IoVs. However, decentralized data sharing may not achieve the expected efficiency if there are IoV users who only want to consume the shared data but are not willing to contribute their own data to the community, resulting in incomplete information observed by other vehicles and infrastructure, which can introduce additional transmission latency. Therefore, in this paper, by modeling the …

Stopguess: A Framework For Public-Key Authenticated Encryption With Keyword Search, Tao Xiang, Zhongming Wang, Biwen Chen, Xiaoguo Li, Peng Wang, Fei Chen

Research Collection School Of Computing and Information Systems

Public key encryption with keyword search (PEKS) allows users to search on encrypted data without leaking the keyword information from the ciphertexts. But it does not preserve keyword privacy within the trapdoors, because an adversary (e.g., untrusted server) might launch inside keyword-guessing attacks (IKGA) to guess keywords from the trapdoors. In recent years, public key authenticated encryption with keyword search (PAEKS) has become a promising primitive to counter the IKGA. However, existing PAEKS schemes focus on the concrete construction of PAEKS, making them unable to support modular construction, intuitive proof, or flexible extension. In this paper, our proposal called “StopGuess” …

Ddos Family: A Novel Perspective For Massive Types Of Ddos Attacks, Ziming Zhao, Zhaoxuan Li, Zhihao Zhou, Jiongchi Yu, Zhuoxue Song, Xiaofei Xie, Fan Zhang, Rui Zhang

Research Collection School Of Computing and Information Systems

Distributed Denial of Service (DDoS) defense is a profound research problem. In recent years, adversaries tend to complicate their attack strategies by crafting vast DDoS variants. On the one hand, this trend exacerbates both extremes of classification granularity (i.e., binary and attack level) in existing machine learning methods. On the other hand, massive attack categories make the filter rule table bulky, as well as cause problems of slow reaction presented in the recent state-of-the-art DDoS mitigation system. Therefore, we propose the concept of a DDoS family to reconcile/cope with these issues. The specific technical roadmap includes traffic pattern characterization, attack …

Harnessing The Advances Of Meda To Optimize Multi-Puf For Enhancing Ip Security Of Biochips, Chen Dong, Xiaodong Guo, Sihuang Lian, Yinan Yao, Zhenyi Chen, Yang Yang, Zhanghui Liu

Research Collection School Of Computing and Information Systems

Digital microfluidic biochips (DMFBs) have a significant stride in the applications of medicine and the biochemistry in recent years. DMFBs based on micro-electrode-dot-array (MEDA) architecture, as the next-generation DMFBs, aim to overcome drawbacks of conventional DMFBs, such as droplet size restriction, low accuracy, and poor sensing ability. Since the potential market value of MEDA biochips is vast, it is of paramount importance to explore approaches to protect the intellectual property (IP) of MEDA biochips during the development process. In this paper, an IP authentication strategy based on the multi-PUF applied to MEDA biochips is presented, called bioMPUF, consisting of Delay …

A Study On Ethical Hacking In Cybersecurity Education Within The United States, Jordan Chew

Master's Theses

As the field of computer security continues to grow, it becomes increasingly important to educate the next generation of security professionals. However, much of the current education landscape primarily focuses on teaching defensive skills. Teaching offensive security, otherwise known as ethical hacking, is an important component in the education of all students who hope to contribute to the field of cybersecurity. Doing so requires a careful consideration of what ethical, legal, and practical issues arise from teaching students skills that can be used to cause harm. In this thesis, we first examine the current state of cybersecurity education in the …

Book Review: Tracers In The Dark: The Global Hunt For The Crime Lords Of Cryptocurrency, Marion Jones

International Journal of Cybersecurity Intelligence & Cybercrime

Doubleday released Andy Greenberg’s Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency in November 2022. Through vivid case studies of global criminal investigations, the book dispels myths about the anonymizing power of cryptocurrency. The book details how the ability to identify cryptocurrency users and payment methods successfully brought down several large criminal empires, while also highlighting the continuous cat-and-mouse game between law enforcement officials and criminal actors using cryptocurrency. The book is an excellent resource for law enforcement officials, academics, and general cybersecurity practitioners interested in cryptocurrency-related criminal activities and law enforcement techniques.

Navigating The Digital Frontier: The Intersection Of Cybersecurity Challenges And Young Adult Life, Hannarae Lee

International Journal of Cybersecurity Intelligence & Cybercrime

Papers from this issue advocate for empowering young adults with knowledge and tools to navigate cyberspace safely, emphasizing the necessity of heightened cybersecurity measures and proactive education. As we advance into the digital abyss, this call becomes imperative, ensuring that the young adults' experience remains a journey of growth and enlightenment, unaffected by the shadows of unseen online threats.

The Need For A Cybersecurity Education Program For Internet Users With Limited English Proficiency: Results From A Pilot Study, Fawn T. Ngo, Rustu Deryol, Brian Turnbull, Jack Drobisz

International Journal of Cybersecurity Intelligence & Cybercrime

According to security experts, cybersecurity education and awareness at the user level are key in combating cybercrime. Hence, in the U.S., cybersecurity and Internet safety workshops, classes, and resources targeting children, adolescents, adults, and senior citizens abound. However, most cybercrime prevention programs are only available in English, thus, ignoring a substantial proportion of Internet users and potential cybercrime victims—Internet users with limited English proficiency (LEP). Yet, successfully combating cybercrime requires that all computer and Internet users, regardless of their language abilities and skills, have access to pertinent cybersecurity information and resources to protect themselves online. This paper presents the results …

University Of Johannesburg Institutional Repository Cybersecurity Output: 2015-2021 Interdisciplinary Study, Mancha J. Sekgololo

Journal of Cybersecurity Education, Research and Practice

This study examines cybersecurity awareness in universities by analyzing related research output across different disciplines at the University of Johannesburg. The diffusion of innovation theory is used in this study as a theoretical framework to explain how cybersecurity awareness diffuses across disciplines. The University of Johannesburg Institutional Repository database was the data source for this study. Variations in cybersecurity keyword searches and topic modeling techniques were used to identify the frequency and distribution of research output across different disciplines. The study reveals that cybersecurity awareness has diffused across various disciplines, including non-computer science disciplines such as business, accounting, and social …

Blockchain Applications In Higher Education Based On The Nist Cybersecurity Framework, Brady Lund Ph.D.

Journal of Cybersecurity Education, Research and Practice

This paper investigates the integration of blockchain technology into core systems within institutions of higher education, utilizing the National Institute of Standards and Technology’s (NIST) Cybersecurity Framework as a guiding framework. It supplies definitions of key terminology including blockchain, consensus mechanisms, decentralized identity, and smart contracts, and examines the application of secure blockchain across various educational functions such as enrollment management, degree auditing, and award processing. Each facet of the NIST Framework is utilized to explore the integration of blockchain technology and address persistent security concerns. The paper contributes to the literature by defining blockchain technology applications and opportunities within …