Compromised Clients Research Articles

SAFe‐Health: Guarding federated learning‐driven smart healthcare with federated defense averaging against data poisoning

AbstractFederated learning (FL) serves as a decentralized training framework for machine learning (ML) models, preserving data privacy in critical domains such as smart healthcare. However, it has been found that attackers can exploit this decentralized learning framework to perform data and model poisoning attacks, specifically in FL‐driven smart healthcare. This work delves into the realm of FL‐driven smart healthcare systems, consisting of multiple hospitals based architecture and focusing on heart disease detection using FL. We carry out data poisoning attacks, using two different attacking methods, label flipping attack and input data/feature manipulation attack to demonstrate that such FL‐driven smart healthcare systems are vulnerable to attacks. To guard the system against such attack, we propose a novel federated averaging defense mechanism to stop the identified poisoned clients in weight aggregation. This mechanism effectively detects and thwarts data poisoning attempts by identifying compromised clients during weight aggregation. The proposed mechanism is based on the idea of weighted averaging, where each client's contribution is weighted according to its trustworthiness. The proposed work addresses a critical gap in the literature by focusing on the often‐overlooked issue of poisoning attacks in tabular text datasets, which are crucial to the smart healthcare system. We conduct the testbed‐based experiment to demonstrate that the proposed mechanism is effectively detecting and mitigating data poisoning attacks in selected FL‐driven smart healthcare scenarios, while maintaining high accuracy and convergence rates.

Designing secure PUF-based authentication protocols for constrained environments

Physical Unclonable Functions (PUFs) are widely used in cryptographic authentication and key-agreement protocols due to their unique physical properties. This article presents a comprehensive cryptanalysis of two recently developed authentication protocols, namely PLAKE and EV-PUF, both relying on PUFs. Our analysis reveals significant vulnerabilities in these protocols, including susceptibility to impersonation and key leakage attacks, which pose serious threats to the security of the underlying systems. In the case of PLAKE, we propose an attack that can extract the shared secret key with negligible complexity by eavesdropping on consecutive protocol sessions. Similarly, we demonstrate an efficient attack against EV-PUF that enables the determination of the shared key between specific entities. Furthermore, we highlight the potential for a single compromised client in the EV-PUF protocol to compromise the security of the entire network, leaving it vulnerable to pandemic attacks. These findings underscore the critical importance of careful design and rigorous evaluation when developing PUF-based authentication protocols. To address the identified vulnerabilities, we present an improved PUF-based authentication protocol that ensures robust security against all the attacks described in the context of PLAKE and EV-PUF. Through this research, we contribute to the field by exposing vulnerabilities in existing PUF-based authentication protocols and offering an improved protocol that enhances security and safeguards against various attack vectors. This work serves as a valuable reference for researchers and practitioners involved in the design and implementation of secure authentication schemes for IoT systems and dynamic charging systems for electric vehicles.

Defending local poisoning attacks in multi-party learning via immune system

Multi-party learning provides effective solutions for building a jointly-trained model with scattered data while meeting user privacy, data security and government regulations. Nevertheless, since the knowledge sharing process among multiple participants is conducted by uploading model parameters instead of individual private data, local poisoning attacks in the multi-party setting could be more covert and destructive. In this paper, we propose a novel immune system deployed in the multi-party learning scenario (MPIS) to defend against local poisoning attacks. We investigate the commonality between the biological immunity and the defense against poisoning attacks, and analogize the secure defense framework as an immune system. The approach achieves antigen recognition, immune response and immunological memory with an adversarial pipeline, which is not limited by the number of compromised clients or the duration of their involvement, and it is capable of adaptively determine the aggregation weight of different local models. Extensive experimental results on image and text datasets with different neural networks demonstrate the superiority of the MPIS framework in both model performance and robustness against poisoning attacks.

Collusion-Resistant Processing of SQL Range Predicates

Prior solutions for securely handling SQL range predicates in outsourced Cloud-resident databases have primarily focused on passive attacks in the Honest-but-Curious adversarial model, where the server is only permitted to observe the encrypted query processing. We consider here a significantly more powerful adversary, wherein the server can launch an active attack by clandestinely issuing specific range queries via collusion with a few compromised clients. The security requirement in this environment is that data values from a plaintext domain of size N should not be leaked to within an interval of size H. Unfortunately, all prior encryption schemes for range predicate evaluation are easily breached with only O(log _2psi ) range queries, where psi = N{/}H. To address this lacuna, we present SPLIT, a new encryption scheme where the adversary requires exponentially more—{mathbf{O}}(psi )—range queries to breach the interval constraint and can therefore be easily detected by standard auditing mechanisms. The novel aspect of SPLIT is that each value appearing in a range-sensitive column is first segmented into two parts. These segmented parts are then independently encrypted using a layered composition of a secure block cipher with the order-preserving encryption and prefix-preserving encryption schemes, and the resulting ciphertexts are stored in separate tables. At query processing time, range predicates are rewritten into an equivalent set of table-specific sub-range predicates, and the disjoint union of their results forms the query answer. A detailed evaluation of SPLIT on benchmark database queries indicates that its execution times are well within a factor of two of the corresponding plaintext times, testifying its efficiency in resisting active adversaries.

PAT: A precise reward scheme achieving anonymity and traceability for crowdcomputing in public clouds

While providing anonymity at terminal devices (e.g. Android and iOS devices) is beneficial for users (e.g. consuming services and resources without the risk of being traced), relevant stakeholders (e.g. providers and governments) may require conditional anonymity for billing purpose or to locate dishonest or compromised client devices. In a cloud computing deployment where large number of computation tasks are submitted to the public cloud, the public cloud server may encounter computation peak and hence, responses to the terminal devices may be delayed. Thus, in this paper, we design the first precise reward scheme achieving both anonymity and traceability for crowdcomputing in public clouds. We then prove the security of the proposed scheme in the random oracle model, and demonstrate the practicality of the scheme using simulations.

A method for identifying compromised clients based on DNS traffic analysis

DNS is widely abused by Internet criminals in order to provide reliable communication within malicious network infrastructure as well as flexible and resilient hosting of malicious content. This paper presents a novel detection method that can be used for identifying potentially compromised clients based on DNS traffic analysis. The proposed method identifies suspicious agile DNS mappings, i.e., mappings characterized by fast changing domain names or/and IP addresses, often used by malicious services. The approach discovers clients that have queried domains contained within identified suspicious domain-to-IP mappings, thus assisting in pinpointing potentially compromised clients within the network. The proposed approach targets compromised clients in large-scale operational networks. We have evaluated the proposed approach using an extensive set of DNS traffic traces from different operational ISP networks. The evaluation illustrates a great potential of accurately identifying suspicious domain-to-IP mappings and potentially compromised clients. Furthermore, the achieved performance indicate that the novel detection approach is promising in view of the adoption in operational ISP networks. Finally, the proposed approach targets both Fast-flux and Domain-flux, thus having an advantage over existing detection methods that identify compromised clients.

List-Free ID-Based Mutual Authentication and Key Agreement Protocol for Multiserver Architectures

A multiserver architecture consisting of multiple servers provides resources and services for clients by way of open channels. Thus, a cryptographic protocol should be offered to ensure the legitimacy of both clients and servers, and to provide communication confidentiality. In the past, a large number of ID-based mutual authentication and key agreement (ID-MAKA) protocols have been proposed regarding this issue. Several circumstances require a revocation mechanism to revoke misbehaving/compromised clients and servers before their intended expiration dates. To do so, the existing ID-MAKA protocols generally adopt a black/white list to revoke/permit clients for access authorization. So far, no work addresses the revocation problem on servers in the sense that clients should be notified to avoid malicious services or applications provided by revoked servers. In this letter, we propose the first list-free ID-MAKA protocol with an efficient revocation mechanism for multiserver architectures. Compared with previously proposed protocols, our protocol possesses three main merits. First, it provides a simple revocation mechanism to solve the management problem of both compromised clients and servers. Second, neither clients nor servers need to keep any black/white list. Finally, it is well suitable for mobile clients by performance analysis and experimental data.

An Efficient Strategy to Provide Secure Authentication on using TPM

The major objective of the paper is to implement cost effective TPM based software, which reduces the TPM chip as it is implemented in hardware. Also to improve security among computers and to authenticate the users by using secured software based TPM. To improve the authentication of various client devices that are connected to private network. The research has to be exposed to all possible threats involved in TPM based on weaknesses of password based authentication, such as easy to guess, subject to dictionary attack, easy to snoop or lose and easy to share with others. The methodology involved in this paper must protect the compromised client and enable network administrator from causing disrupt to the available network. The systems with TPM must store sensitive data in a secure location instead on separate piece of chip. The major statistical survey of this paper deals with the primary machine, which will be allocated to each individual user by accepting their necessary details like device information. The collected information will be kept as a private connected network in a local server. If new user wants to access the locally connected machine, then his information will be collected separately and username and password will be sent to him through mobile. The temporary users’ information will be kept in the secondary machine for future use. In this way, the system will get improve secure feature and avoid unauthenticated user to access the machine. The proposed system performs well to safeguard the information and it is experimentally verified in various organizations. In banking information system, each employee’s information is verified and stored in the background server. This will protect the information more secure between the clients and the server. As an improvement, the research work will be carried out for business intelligence in Internet of Things using Mobile Application.

Detecting APT Malware Infections Based on Malicious DNS and Traffic Analysis

Advanced persistent threat (APT) is a serious threat to the Internet. With the aid of APT malware, attackers can remotely control infected machines and steal sensitive information. DNS is popular for malware to locate command and control (C&C) servers. In this paper, we propose a novel system placed at the network egress point that aims to efficiently and effectively detect APT malware infections based on malicious DNS and traffic analysis. The system uses malicious DNS analysis techniques to detect suspicious APT malware C&C domains, and then analyzes the traffic of the corresponding suspicious IP using the signature-based and anomaly based detection technology. We extracted 14 features based on big data to characterize different properties of malware-related DNS and the ways that they are queried, and we also defined network traffic features that can identify the traffic of compromised clients that have remotely been controlled. We built a reputation engine to compute a reputation score for an IP address using these features vector together. Our experiment was performed at a large local institute network for two months, and all the features were studied with big data, which includes $\sim 400$ million DNS queries. Our security approach cannot only substantially reduce the volume of network traffic that needs to be recorded and analyzed but also improve the sustainability of the system.

Využití QR kódu pro zajištění nepopíratelnosti a ověřování transakcí

The state-of-the-art methods for securing e-commerce transactions resistant even to compromised client workstation are based on using independent security devices or separate communication channels. These systems either do not support non-repudiation and/or are expensive and thus suitable only for special cases, where such additional costs are justified. In this article a new cheaper transaction verification method, which supports non-repudiation, is described. A cell phone or tablet communicating with the client workstation using qr-codes is used as an independent security device. There are no additional costs for service providers except for initial SW implementation. The proposed method brings better transaction verification to the areas where the usage of current methods is uneconomical.

An application of health literacy research

Finding methods to improve the delivery of educational materials by the practicing nurse is imperative in the current health care arena. Time, energy, and effectiveness are all aspects that are critical as the health care provider attempts to meet the growing needs of the compromised client. Low functional health literacy is one public health problem that impacts the nurse’s ability to effectively provide health instruction in a timely, organized manner. This article presents a pilot research project used to investigate the mastery of educational information by clients in a West Texas area. The research project is used as the foundation for discussion of several interesting facets resulting from the initial research. Ideas are presented as a direction for implementation for practice within the health care community. Low health literacy is a grave challenge, which currently is not understood nor considered by the nurse at the bedside. Practicing health care providers need the opportunity to carefully and specifically investigate the role of health care literacy in producing positive client outcomes.