Leakage Of Sensitive Information Research Articles

Defend Against Property Inference Attack for Flight Operations Data Sharing in FedMeta Framework

Flight operations data play a central role in ensuring flight safety, optimizing operations, and driving innovation. However, these data have become a key target for cyber-attacks, and are especially vulnerable to property inference attacks. Aiming at property inference attacks in shared application model training, we proposed FedMeta-CTGAN, a novel approach that leverages federated meta-learning and conditional tabular generative adversarial networks (CTGANs) to protect flight operations data. Motivated by the need for secure data sharing in aviation, as highlighted by the Federal Aviation Administration’s requirement for ADS-B Out equipment on aircraft to create a shared situational awareness environment, our method aims to prevent sensitive information leakage while maintaining model performance. FedMeta-CTGAN exploits the natural privacy-preserving properties of a two-stage update in meta-learning, using real data to train the CTGAN model and synthetic fake data as query data during meta-training. Comprehensive experiments using a real flight operation dataset demonstrate the effectiveness of our proposed method. FedMeta-CTGAN adapts quickly to unbalanced data, achieving a prediction accuracy of 96.33%, while reducing the attacker’s inference AUC score to 0.51 under property inference attacks. Our contribution lies in the development of a secure and efficient data-sharing solution for flight operations data, which has the potential to revolutionize the aviation industry.

Anti‐Leakage Method of Sensitive Information of Network Documents Based on Differential Privacy Model

ABSTRACTThis article proposes a method for preventing sensitive information leakage in network documents based on differential privacy models to ensure the security of sensitive information in network documents. Based on the definition of differential privacy and its Laplace mechanism, a differential privacy model was constructed to prevent sensitive information leakage in network documents. Using differential privacy based Laplace mechanism to protect the sensitive information dataset of network documents, and inputting the sensitive information dataset of network documents into the differential privacy model, the sensitive information in network documents is generalized and perturbed, and Laplace noise is added after transformation and compression to prevent leakage. Using roulette wheel sampling technology to sample and sort the original histograms of sensitive data in network documents, using a hierarchical partitioning algorithm to group the sorted histograms, and adding Laplace noise to the groups based on differential confidentiality Laplace mechanism to achieve leak prevention when publishing sensitive messages in network documents. The experimental results show that this method can ensure the security of sensitive information data in network documents and prevent sensitive information leakage in network documents. There is no data loss during the data conversion and compression process of sensitive information. At the same time, the protection effect of sensitive information is less affected by the amount of data, and the loss rate of sensitive information is lower.

Android Security Vulnerabilities, Malware, Anti-Malware Solutions, and Evasion Techniques

This paper investigates the vulnerabilities inherent in the Android operating system architecture and examines how malware developers exploit these weaknesses to execute a variety of attacks. These include aggressive advertising, remote control capabilities, financial fraud, privilege escalation, and the leaking of sensitive information. In this paper, we survey a collection of anti-malware techniques and organize these techniques into three canonical classes (static methods, dynamic methods, hybrid methodologies) according to how they are used or implemented with respect to the host operating system. We also evaluate the effectiveness of these techniques against certain types of attacks and summarize them under test categories for reporting results. We also examine the typical countermeasures used by malware authors to disguise their approaches against existing detection methods, such as reintegrating with real applications, using update payloads, executing dynamic code, scrambling dangerous content, and setting traps to act upon only purposely triggered situations. In future work, we suggest research into the capability of reinforcement learning methods to further increase sustainability and adaptability of anti-malware strategies. This Research study aimed at creating more dynamic detection systems for malware by utilizing machine learning techniques that could change in parallel with the tactics used by malware developers. By leveraging this technique, you could drastically boost the efficacy of existing anti-malware solutions that are unable to respond to new threats. As the digital environment changes (and continues to change), Mobile provides threat analysts, fraud / security managers and legal authorities up-to-date circumstantial direction so users can move with confidence within their mobile landscapes.

Leveraging Multi-Agent Reinforcement Learning for Digital Transformation in Supply Chain Inventory Optimization

In today’s volatile supply chain (SC) environment, competition has shifted beyond individual companies to the entire SC ecosystem. Reducing overall SC costs is crucial for success and benefits all participants. One effective approach to achieve this is through digital transformation, enhancing SC coordination via information sharing, and establishing decision policies among entities. However, the risk of unauthorized leakage of sensitive information poses a significant challenge. We aim to propose a Privacy-preserving Multi-agent Reinforcement Learning (PMaRL) method to enhance SC visibility, coordination, and performance during inventory management while effectively mitigating the risk of information leakage by leveraging machine learning techniques. The SC inventory policies are optimized using multi-agent reinforcement learning with additional SC connectivity information to improve training performance. The simulation-based evaluation results illustrate that the PMaRL method surpasses traditional optimization methods in achieving cost performance comparable to full visibility methods, all while preserving privacy. This research addresses the dual objectives of information security and cost reduction in SC inventory management, aligning with the broader trend of digital transformation.

Inferring TLB Configuration with Performance Tools

Modern computing systems are primarily designed for maximum performance, which inadvertently introduces vulnerabilities at the micro-architecture level. While cache side-channel analysis has received significant attention, other Central Processing Units (CPUs) components like the Translation Lookaside Buffer (TLB) can also be exploited to leak sensitive information. This paper focuses on the TLB, a micro-architecture component that is vulnerable to side-channel attacks. Despite the coarse granularity at the page level, advancements in tools and techniques have made TLB information leakage feasible. The primary goal of this study is not to demonstrate the potential for information leakage from the TLB but to establish a comprehensive framework to reverse engineer the TLB configuration, a critical aspect of side-channel analysis attacks that have previously succeeded in extracting sensitive data. The methodology involves detailed reverse engineering efforts on Intel CPUs, complemented by analytical tools to support TLB reverse engineering. This study successfully reverse-engineered the TLB configurations for Intel CPUs and introduced visual tools for further analysis. These results can be used to explore TLB vulnerabilities in greater depth. However, when attempting to apply the same methodology to the IBM Power9, it became clear that the methodology was not transferable, as mapping functions and performance counters vary across different vendors.

MAPPING: debiasing graph neural networks for fair node classification with limited sensitive information leakage

MAPPING: debiasing graph neural networks for fair node classification with limited sensitive information leakage

Security Protection of Video-GIS Data Based on Data Encryption and Digital Watermarking

Abstract. Video-GIS data, a novel generation of multimedia produced through the integration of geographic videos and GIS, has evolved into an innovative form of geospatial data representation. As a kind of digital products, Video-GIS data is vulnerable to unauthorized replication, dissemination, and usage. The potential for large-scale leakage of sensitive or confidential information, including commercial, political, military, and personal privacy data, poses a significant threat to the rights of data producers and may even compromise national security. Given this context, the primary concern is ensuring the security protection of video data in an open and shared data environment. To address this issue, we propose a novel scheme for the security protection of Video-GIS data in this paper, which collaboratively utilizes digital watermarking and data encryption. In the proposed scheme, Video-GIS data is divided into two categories, i.e., general and confidential, based on the presence or absence of sensitive information within the image frames. Appropriate security measures were meticulously designed for each data type to ensure effective prevention and control. Experimental results indicate that this watermarking algorithm exerts minimal influence on the quality of the Video-GIS data, while simultaneously maintaining optimal invisibility and robustness. The employed audio denoising method is characterized by its low complexity, simplicity, and feasibility, thereby ensuring the security of audio signal storage and transmission. This approach effectively realizes the dual protection objective for Video-GIS data, audio, and video.

Privacy Risks in the Storytelling of Open Government Data: A Study from the Perspective of User Cognitive Reasoning

ABSTRACTIn recent years, there has been an increase in the openness of government data. Data storytelling has emerged as a means to enhance communication by transforming mundane data into easily understandable narratives. However, it is crucial to pay attention to privacy risks. This paper delves into the concept of storytelling government data, integrating cognitive reasoning and the S‐O‐R model, and evaluates privacy risks. Through comparative experiments and interviews, this study examines how users may infer sensitive information. The research reveals that storytelling data has a positive impact on users' cognition. De‐storytelling, on the other hand, can mitigate privacy risks, reduce information relevance, simplify narratives, and strike a balance between user experience and privacy. Building on this research, the paper proposes a strategy to address privacy risks, recommends strengthening privacy protection awareness from the perspectives of both users and platforms, optimizing data presentation methods, reducing the risk of sensitive information leakage, and ensuring the convenience and security of government data disclosure.

The Impact of an Automation System Built with Jenkins on the Efficiency of Container-Based System Deployment.

This paper evaluated deployment efficiency by comparing manual deployment with automated deployment through a CI/CD pipeline using Jenkins. This study involved moving from a manual deployment process to an automated system using Jenkins and experimenting with both deployment methods in a real-world environment. The results showed that the automated deployment system significantly reduced the deployment time compared to manual deployment and significantly reduced the error rate. Manual deployment required human intervention at each step, making it time-consuming and prone to mistakes, while automated deployment using Jenkins automated each step to ensure consistency and maximized time efficiency through parallel processing. Automated testing verified the stability of the code before deployment, minimizing errors. This study demonstrates the effectiveness of adopting a CI/CD pipeline and shows that automated systems can provide high efficiency in real-world production environments. It also highlights the importance of security measures to prevent sensitive information leakage during CI/CD, suggesting the use of secrecy management tools and environment variables and limiting access rights. This research will contribute to exploring the applicability of CI/CD pipelines in different environments and, in doing so, validate the universality of automated systems.

Feature-Based Dataset Fingerprinting for Clustered Federated Learning on Medical Image Data

ABSTRACT Federated Learning (FL) allows multiple clients to train a common model without sharing their private training data. In practice, federated optimization struggles with sub-optimal model utility because data is not independent and identically distributed (non-IID). Recent work has proposed to cluster clients according to dataset fingerprints to improve model utility in such situations. These fingerprints aim to capture the key characteristics of clients’ local data distributions. Recently, a mechanism was proposed to calculate dataset fingerprints from raw client data. We find that this fingerprinting mechanism comes with substantial time and memory consumption, limiting its practical use to small datasets. Additionally, shared raw data fingerprints can directly leak sensitive visual information, in certain cases even resembling the original client training data. To alleviate these problems, we propose a Feature-based dataset FingerPrinting mechanism (FFP). We use the MedMNIST database to develop a highly realistic case study for FL on medical image data. Compared to existing methods, our proposed FFP reduces the computational overhead of fingerprint calculation while achieving similar model utility. Furthermore, FFP mitigates the risk of raw data leakage from fingerprints by design.

Assessment of Web Security Vulnerabilities for Common Open Source Virtualization Software

Open-source hypervisors have emerged as an integral technology for virtualizing server resources in cloud and data center computing. Hypervisor security efficiency is determined by virtual machine isolation, which is a de facto adoption factor in the selection process, as well as its ability to respond to web attacks. This paper assesses the security performance of Proxmox VE and XenServer for type 1 hypervisors, and Kernel Virtual Machine and Oracle Virtual Box for type 2 hypervisors. Security analysis was conducted using common exposures extracted from vulnerability databases and mapped against the OWASP 2013 and 2017 projects. For clarity, experiments were carried out on a testbed with prebuilt virtual machines, each hosting one hypervisor installed as an attack target. Kali Linux was configured in one virtual machine to run recursive penetration testing for information gathering, vulnerability detection, penetration attempts, and exploitation of weak spots. The infrastructure was set in both homogeneous and heterogeneous execution environments, with a series of tests nested with each other. All four hypervisors are vulnerable to physical kernel isolation, as unprivileged users can gain root access and launch guest-to-guest and host-to-guest attacks. Among the two, guest-to-guest attacks were found to be more common than host-to-guest attacks, indicating that virtual machine isolation is weaker than the underlying host. Type 1 hypervisors have a lower rate of host-to-guest attacks than guest to-guest attacks, implying that XenServer and Proxmox VE provide better isolation than KVM and OVB due to the near-native speed, security, and efficiency of their virtual machines. All four hypervisors were found to be vulnerable to buffer overflow exploits and error-triggering sensitive information leaks, which were primarily caused by adopter default misconfigurations in the deployment process rather than software design flaws. This implies that greater efforts are required by open-source adopters when shifting from physical to virtual computing.

Context-Aware Risk Attribute Access Control

Traditional access control systems exhibit limitations in providing flexible authorization and fine-grained access in the face of increasingly complex and dynamic access scenarios. This paper proposes a context-aware risk access control model to address these challenges. By developing a multi-level contextual risk indicator system, the model comprehensively considers real-time contextual information associated with access requests, dynamically evaluates the risk level of these requests, and compares the outcomes with predefined risk policies to facilitate access decisions. This approach enhances the dynamism and flexibility of access control. To improve the accuracy and reliability of risk assessments, we propose a combination weighting method grounded in game theory. This method reconciles subjective biases and the limitations of objective data by integrating both subjective and objective weighting techniques, thus optimizing the determination process for risk factor weights. Furthermore, smart contracts are introduced to monitor user behavior during access sessions, thereby preventing malicious attacks and the leakage of sensitive information. Finally, the model’s performance and authorization granularity are assessed through empirical experiments. The results indicate that the model effectively addresses the requirements of dynamic and fine-grained access scenarios, improving the system’s adaptability to risk fluctuations while safeguarding sensitive information.

An adversarial network reinforcement method for power data time series generation based on knowledge transfer and Rayleigh differential privacy

Abstract In order to solve the problem of sensitive information leakage of power data in machine learning and artificial intelligence processing, this paper proposes a method of civic-text data reinforcement based on time series generation adversarial network, which combines knowledge transfer and Rényi differential privacy protection framework to balance privacy and availability, while improving the accuracy of the model. First, the generative adversarial network generates training data that is similar to the real data but secure through adversarial learning, ensuring that even if the data is stolen, the original information cannot be inferred. Secondly, through the integration of recurrent neural network training and autoencoder, the dynamic and static characteristics of the power load data can be effectively captured, and the high dimension of the learning space can be reduced. In addition, knowledge distillation technology is used to guide the generator of training student models through a powerful teacher network of knowledge transfer, improving the diversity and quality of the generated data. Finally, from the four aspects of privacy, data similarity and diversity, and practicability, the practical application value and potential of the framework for electricity consumption data are comprehensively evaluated.

Regulating Malpractice in Telemedicine and Digital Health

Abstract This paper employs the IRAC method to examine the legal and regulatory landscape governing malpractice in telemedicine and digital health in Ghana, focusing on patient privacy breaches, negligence by healthcare providers, and leakage of sensitive patient information. Drawing upon relevant Ghanaian laws and regulations, as well as insights from relevant research papers, the analysis highlights the need for updates to existing legal frameworks, development of targeted AI governance mechanisms, and promotion of transparency and accountability in the use of digital health technologies. The paper provides practical recommendations for policymakers, healthcare stakeholders, and legal professionals, emphasizing the importance of public education and provider training to foster a culture of responsible innovation and maintain public trust in the rapidly evolving healthcare system. These findings contribute to the development of evidence-based policies and practices that prioritize patient safety, rights, and trust in the digital health era.

SecCT: Secure and scalable count query models on encrypted genomic data

Recently, due to the continued reduction in DNA sequencing cost, large-scale genetic samples are being gathered for accelerating predispositions to specific diseases, tailoring treatment of efficient drugs and therapies, etc. Massive genetic samples are encrypted-and-then-delegated to a public cloud to both save investment and maintenance costs and prevent the potential leakage of sensitive information. However, such a manner compromises the serviceability of a public cloud, since encryption inevitably breaks the semantic information of genetic samples. Secure count query of single-nucleotide polymorphisms (SNPs), as a kernel component for GWASs and related genomic analysis, is attracting much more attention. Existing methods lack provable security, suffer low efficiency caused by multiple interactions with the cloud, etc. In this paper, a secure virtual CT-Tree (secure vCT-Tree) is carefully constructed to confuse the tree structure by introducing a hash function and a Paillier system. Furthermore, by delegating the secure vCT-Tree to the cloud, concrete models (i.e., SecCT and SecCT+) are presented to resolve secure count query problems on-the-fly. SecCT+ is a solution based on trusted execution environment while SecCT is a pure software solution. Both models advance the provable security of genetic research and are proven to be secure under the adaptive chosen keyword (query) attack (IND-CKA2) model. Furthermore, massive experiments are evaluated on realistic data to show the superiority of SecCT and SecCT+.

Design and Production of a Paper Shredding Machine

There are countless cases of cooperate and government espionage, identity theft, sensitive information leaks. This all led to the need for government agencies, private and public institutions and even private individuals to protect their sensitive information and prevent it from falling into the wrong hands. The act of discarding whole, readable documents containing sensitive information poses huge risks to an individual or organization, as these documents can be retrieved from a trash bin and the information they contain easily accessed. This has led to a number of identity theft cases, where a crime is committed using the information of an unsuspecting individual. Although advancements in information technology have resulted in electronic transmission and storage of information, a good number is still communicated via paper. This newly designed paper shredding machine utilized chain and sprocket in the power transmission which offers a high transmission efficiency unlike some paper shredding machines that used belt and pulley which cause slip and transmission losses. The machine architecture is very compact with ergonomically suitable features, and the performance is high. The shredding efficiency was 94%.Improvement on further work to improve the shredding efficiency is required.

Camouflage: Utility-Aware Obfuscation for Accurate Simulation of Sensitive Program Traces

Trace-based simulation is a widely used methodology for system design exploration. It relies on realistic traces that represent a range of behaviors necessary to be evaluated, containing a lot of information about the application, its inputs and the underlying system on which it was generated. Consequently, generating traces from real-world executions risks leakage of sensitive information. To prevent this, traces can be obfuscated before release. However, this can undermine their ideal utility, i.e., how realistically a program behavior was captured. To address this, we propose Camouflage, a novel obfuscation framework, designed with awareness of the necessary architectural properties required to preserve trace utility , while ensuring secrecy of the inputs used to generate the trace. Focusing on memory access traces, our extensive evaluation on various benchmarks shows that camouflaged traces preserve the performance measurements of the original execution, with an average τ correlation of 0.66. We model input secrecy as an input indistinguishability problem and show that the average security loss is 7.8%, which is better than traces generated from the state-of-the-art.

An Engineered Minimal-Set Stimulus for Periodic Information Leakage Fault Detection on a RISC-V Microprocessor

Recent evaluations of counter-based periodic testing strategies for fault detection in Microprocessor (μP) have shown that only a small set of counters is needed to provide complete coverage of severe faults. Severe faults are defined as faults that leak sensitive information, e.g., an encryption key on the output of a serial port. Alternatively, fault detection can be accomplished by executing instructions that periodically test the control and functional units of the μP. In this paper, we propose a fault detection method that utilizes an ’engineered’ executable program combined with a small set of strategically placed counters in pursuit of a hardware Periodic Built-In-Self-Test (PBIST). We analyze two distinct methods for generating such a binary; the first uses an Automatic Test Generation Pattern (ATPG)-based methodology, and the second uses a process whereby existing counter-based node-monitoring infrastructure is utilized. We show that complete fault coverage of all leakage faults is possible using relatively small binaries with low latency to fault detection and by utilizing only a few strategically placed counters in the μP.

NotaryVault: Secure Document Authentication on Blockchain

The Notarial Office(NO), working on providing various essential certificates, still relies on manual handling and requires paper materials from other government departments. That brings lots of inconvenience. The Notarial Office rejects non-local paper materials for their lower credibility in the local place and then cannot provide cross-border services. It also easily causes sensitive information leakage as copies of paper materials have been stored. In this case, a blockchain-based system is suitable to address challenges in this scenario because of its advantages (e.g, decentralized, immutability, transparency, auditability). We implemented this system on top of the Hyperledger Fabric. Moreover, we replace manual operations with smart contracts, set extra ledgers to off-load different types of transactions and provide encryption for private information when needed. In the end, we get the expected result. That is, the modification outperformed the unmodified network in experiments.

Research on Blockchain Transaction Privacy Protection Methods Based on Deep Learning

To address the challenge of balancing privacy protection with regulatory oversight in blockchain transactions, we propose a regulatable privacy protection scheme for blockchain transactions. Our scheme utilizes probabilistic public-key encryption to obscure the true identities of blockchain transaction participants. By integrating commitment schemes and zero-knowledge proof techniques with deep learning graph neural network technology, it provides privacy protection and regulatory analysis of blockchain transaction data. This approach not only prevents the leakage of sensitive transaction information, but also achieves regulatory capabilities at both macro and micro levels, ensuring the verification of the legality of transactions. By adopting an identity-based encryption system, regulatory bodies can conduct personalized supervision of blockchain transactions without storing users’ actual identities and key data, significantly reducing storage computation and key management burdens. Our scheme is independent of any particular consensus mechanism and can be applied to current blockchain technologies. Simulation experiments and complexity analysis demonstrate the practicality of the scheme.