Leak Users Research Articles

MCRPL: A Pretrain, Prompt, and Fine-tune Paradigm for Non-overlapping Many-to-one Cross-domain Recommendation

Cross-domain Recommendation is the task that tends to improve the recommendations in the sparse target domain by leveraging the information from other rich domains. Existing methods of cross-domain recommendation mainly focus on overlapping scenarios by assuming users are totally or partially overlapped, which are taken as bridges to connect different domains. However, this assumption does not always hold, since it is illegal to leak users’ identity information to other domains. Conducting Non-overlapping MCR (NMCR) is challenging, since (1) the absence of overlapping information prevents us from directly aligning different domains, and this situation may get worse in the MCR scenario, and (2) the distribution between source and target domains makes it difficult for us to learn common information across domains. To overcome the above challenges, we focus on NMCR and devise MCRPL as our solution. To address Challenge 1, we first learn shared domain-agnostic and domain-dependent prompts and pre-train them in the pre-training stage. To address Challenge 2, we further update the domain-dependent prompts with other parameters kept fixed to transfer the domain knowledge to the target domain. We conduct experiments on five real-world domains, and the results show the advance of our MCRPL method compared with several recent SOTA baselines. Moreover, our source codes have been publicly released. 1

Multidomain active defense: Detecting multidomain backdoor poisoned samples via ALL-to-ALL decoupling training without clean datasets

Deep learning is vulnerable to backdoor poisoning attacks in which an attacker can easily embed a hidden backdoor into a trained model by injecting poisoned samples into the training set. Many prior state-of-the-art techniques for detecting backdoor poisoning attacks are based on a potential separability assumption. However, current adaptive poisoning strategies can significantly reduce ’distinguishable behavior’, making most prior state-of-the-art techniques less effective. In addition, we note that existing detection methods are not practical for multidomain datasets and may leak user privacy because they require and collect clean samples. To address the above issues, we propose a multidomain active defense approach that does not use clean datasets. The proposed approach can generate diverse clean samples from different domains and decouple neural networks round by round using clean samples to disassociate features and labels, making backdoor poisoned samples easier to detect without fitting clean samples. We demonstrate the advantage of our approach through an extensive evaluation of CIFAR10, CelebA, MNIST & MNIST-M, MNIST & USPS & MNIST-M, MNIST & USPS & SVHN and CIFAR10 & Tiny-ImageNet.

A Novel Traffic Obfuscation Technology for Smart Home

With the widespread popularity of smart home devices and the emergence of smart home integration platforms such as Google, Amazon, and Xiaomi, the smart home industry is in a stage of vigorous development. While smart homes provide users with convenient and intelligent living, the problem of smart home devices leaking user privacy has become increasingly prominent. Smart home devices give users the ability to remotely control home devices, but they also reflect user home activities in traffic data, which brings the risk of privacy leaks. Potential attackers can use traffic classification technology to analyze traffic characteristics during traffic transmission (e.g., at the traffic exit of a smart home gateway) and infer users’ private information, such as their home activities, causing serious consequences of privacy leaks. To address the above problems, this paper focuses on research on privacy protection technology based on traffic obfuscation. By using traffic obfuscation technology to obscure the true traffic of smart home devices, it can prevent malicious traffic listeners from analyzing user privacy information based on traffic characteristics. We propose an enhanced smart home traffic obfuscation method called SHTObfuscator (Smart Home Traffic Obfuscator) based on the virtual user technology concept and a virtual user behavior construction method based on logical integrity. By injecting traffic fingerprints of different device activities into the real traffic environment of smart homes as obfuscating traffic, attackers cannot distinguish between the real device working status and user behavior privacy in the current home, effectively reducing the effect of traffic classification attack models. The protection level can be manually or automatically adjusted, achieving a balance between privacy protection and bandwidth overhead. The experimental results show that under the highest obfuscation level, the obfuscation method proposed in this paper can effectively reduce the classification effect of the attack model from 95% to 25%.

Visual privacy behaviour recognition for social robots based on an improved generative adversarial network

AbstractAlthough social robots equipped with visual devices may leak user information, countermeasures for ensuring privacy are not readily available, making visual privacy protection problematic. In this article, a semi‐supervised learning algorithm is proposed for visual privacy behaviour recognition based on an improved generative adversarial network for social robots; it is called PBR‐GAN. A 9‐layer residual generator network enhances the data quality, and a 10‐layer discriminator network strengthens the feature extraction. A tailored objective function, loss function, and strategy are proposed to dynamically adjust the learning rate to guarantee high performance. A social robot platform and architecture for visual privacy recognition and protection are implemented. The recognition accuracy of the proposed PBR‐GAN is compared with Inception_v3, SS‐GAN, and SF‐GAN. The average recognition accuracy of the proposed PBR‐GAN is 85.91%, which is improved by 3.93%, 9.91%, and 1.73% compared with the performance of Inception_v3, SS‐GAN, and SF‐GAN respectively. Through a case study, seven situations are considered related to privacy at home, and develop training and test datasets with 8,720 and 1,280 images, respectively, are developed. The proposed PBR‐GAN recognises the designed visual privacy information with an average accuracy of 89.91%.

ISLAMIC STRATEGIC MANAGEMENT OF VILLAGE OWNED ENTERPRISES IN INCREASING VILLAGE ORIGINAL INCOME

Background. Each Nagari or village has the potential to be developed in order to increase the income and welfare of its people , one of which is the management of Village Owned Enterprises or BUMNag through good managerial skills by the leader of the organization, moreover the leader is based on Islam, according to the philosophy of West Sumatra, "Adat Basandi Syarak, Syarak Basandi Kitabullan", is a reflection of the pattern of behavior in social life and Islamic leadership in the Minangkabau.Purpose. The research aims to determine the factors that influence the increase in the village's original income from the operation of Village-Owned Enterprises based on Islamic Strategic Management.Method. The reseach use the Delphi Method, informants are 6 experts (experts) and carry out a SWOT Analysis to determine the right strategy.Results. Research findings, the factors that influence the increase in the village's original income, from an average strengths score of 4.93 or 96.67, Government policies and Commitment of the Village Head with the same score and an average score of 3.83 or 76.67, administration and cooperation with other agencies with the same score. The Weaknesses factor has an average score of 5.00 or 100, the sanctions are not strict enough for the management of Village-Owned Enterprises and leakage of user fees/consumer contributions with an average score of 2.5 is less effective. Opportunity factor with an average score of 5.00 or 100 for good public services supported by advances in information technology with an average score of 4.17. Threaths of illegal waste disposal with an average score of 4.83 and closure of waste collection points in jorong-jorong with an average score of 4.17 or 46.67 with the criteria of Ineffective.Conclusion. In managing Village Owned Enterprises with the implementation of Islamic strategic management, there are several factors that influence the income of Village Owned Enterprises to increase Village Original Income.

A Privacy Protection Scheme for Bidding Users of Peer-to-Peer Electricity Call Auction Trading in Microgrids

Renewable energy generation is greatly affected by the weather, and electricity is not easily stored in large quantities. So, the call auction trading based on the rule of the maximum trading volume is of great significance to promote the electricity consumption of microgrids. Therefore, in microgrid electricity call auction trading, aiming at the problems, such as bidding messages may leak users’ privacy, they may also be eavesdropped or tampered with in the bidding process, and the balance between privacy protection and supervision cannot be achieved, a privacy protection scheme for bidding users of peer-to-peer electricity call auction trading in microgrids is proposed. It consists of a market layer and a blockchain layer. Based on the improved certificateless ring signcryption and timed-release encryption algorithms, the market layer is used to hide the user's real identity while encrypting the bidding message and track illegal users. The blockchain layer is used for trading settlement and trading record storage to ensure data storage security. The security is proved theoretically. Performance analysis and simulation results indicate that computational and communication costs are low. Especially the verification cost is low and increases slowly with the increase in the number of ring members.

ZPA: A Smart Home Privacy Analysis System Based on ZigBee Encrypted Traffic

Currently, the ZigBee protocol is widely used in smart homes and provides convenience to people. However, smart home devices often carry a large amount of real physical world information, which may result in information leakage problems. In this paper, to reveal the privacy security issues existing in ZigBee-based smart home networks, we design a smart home privacy analysis system based on ZigBee-encrypted traffic, called ZPA. ZPA can extract ZigBee data features based on the device’s operating mode and time window and use state-of-the-art machine-learning models to identify the type and status of smart home devices that could leak users’ private information. Through the analysis of 20 different devices from 5 manufacturers, the results show that even if the ZigBee traffic is protected by encryption, the accuracy of the proposed method in device type identification and state inference can reach approximately 93% and 98%, respectively. The types and statuses of devices in smart homes will reveal the user’s activity information to a certain extent. The privacy security of ZigBee-based smart devices still needs to be further strengthened.

Research on Key Technologies of Personal Information Security Protection in Big Data

Big data is composed of linear associated data and nonlinear data. Big data is characterized by multiple types, large data scale, fast data processing, high data value and low value density. As more information can be obtained through big data mining or web crawler, the leakage of users' personal information occurs from time to time, which seriously endangers the stability of social order. Therefore, protecting personal information from infringement in the era of big data has become an urgent problem to be solved. This paper constructs the technical framework of the life cycle and protection of personal information in big data, and summarizes the key technologies such as authorization, access control, security audit, traceability audit and data desensitization. In addition, in-depth research on these key technologies will be conducted to provide complete solutions for the protection of personal information in big data, crack down on illegal behaviors of user information trading, and create a positive network security environment.

THREAT ANALYSIS AND SECURITY OF PERSONAL DATA USING USER DEVICES WITH EYE-TRACKERS

Eye-tracking technology has been extensively used in web development, marketing, and gaming mechanics because of the ability to obtain data regarding the trajectory and gaze fixation points. Eye movement information may be effectively used to study complex cognitive processes and human visual perception. However, a significant issue of leaking user privacy has arisen with the expansion of eye-tracking technology. Since the technology can obtain highly sensitive information regarding user behavior and preferences, measures for protecting personal data are required. At the current stage of the development of technology, research on threats and means to ensure the security of personal data has become a high priority in this field. Proper diligence in the development and use of eye-tracking devices is becoming an integral part of the process. Potential threats associated with collecting, storing, and trans mitting information about users' gaze should be considered. Various methods have been proposed to ensure the security of personal data through the use of eye-tracking devices. The anonymization of data, which is the removal or replacement of personal identifying elements, appears to be among these. Transparency and user agreement to the collection and use of gaze data has also been an important aspect. This can be accomplished by explicitly providing information about the purpose of the data collection and the ability to control privacy. Threats related to the use of eye-tracking technology were considered, providing methods of ensuring the security of personal data. These are important steps in the development of the field to protect user privacy while improving the safety and ethics of using eye-tracking devices.

LightFR: Lightweight Federated Recommendation with Privacy-preserving Matrix Factorization

Federated recommender system (FRS), which enables many local devices to train a shared model jointly without transmitting local raw data, has become a prevalent recommendation paradigm with privacy-preserving advantages. However, previous work on FRS performs similarity search via inner product in continuous embedding space, which causes an efficiency bottleneck when the scale of items is extremely large. We argue that such a scheme in federated settings ignores the limited capacities in resource-constrained user devices ( i.e. , storage space, computational overhead, and communication bandwidth), and makes it harder to be deployed in large-scale recommender systems. Besides, it has been shown that transmitting local gradients in real-valued form between server and clients may leak users’ private information. To this end, we propose a lightweight federated recommendation framework with privacy-preserving matrix factorization, LightFR , that is able to generate high-quality binary codes by exploiting learning to hash technique under federated settings, and thus enjoys both fast online inference and economic memory consumption. Moreover, we devise an efficient federated discrete optimization algorithm to collaboratively train model parameters between the server and clients, which can effectively prevent real-valued gradient attacks from malicious parties. Through extensive experiments on four real-world datasets, we show that our LightFR model outperforms several state-of-the-art FRS methods in terms of recommendation accuracy, inference efficiency and data privacy.

Privacy Protection Scheme for the Internet of Vehicles Based on Private Set Intersection

Performing location-based services in a secure and efficient manner that remains a huge challenge for the Internet of Vehicles with numerous privacy and security risks. However, most of the existing privacy protection schemes are based on centralized location servers, which makes them all have a common drawback of a single point of failure and leaking user privacy. The employment of anonymity and cryptography is a well-known solution to the above problem, but its expensive resource consumption and complex cryptographic operations are difficult problems to solve. Based on this, designing a distributed and privacy-secure privacy protection scheme for the Internet of Vehicles is an urgent issue for the smart city. In this paper, we propose a privacy protection scheme for the Internet of Vehicles based on privacy set intersection. Specially, using privacy set intersection and blockchain techniques, we propose two protocols, that is, a dual authentication protocol and a service recommendation protocol. The double authentication protocol not only ensures that both communicating parties are trusted users, but also ensures the reliability of their session keys; while the service recommendation protocol based on pseudorandom function and one-way hash function can well protect the location privacy of users from being leaked. Finally, we theoretically analyze the security that this scheme has, i.e., privacy security, non-repudiation, and anti-man-in-the-middle attack.

Pairing-free certificateless blind signature scheme for smart grid

The smart grid is an emerging power system that can realize the information exchange between users and power companies in two-way communication and adjust power companies’ power supply according to the real-time power requests from smart meters on the users’ side. However, since malicious attackers can eavesdrop on two-way communication to collect and transmit information, they may leak users’ information. Therefore, this paper proposes a new certificateless blind signature (CLBS) scheme with batch verification function and improves a power request system model for the smart grid to protect users’ privacy. In addition, the proposed CLBS scheme simplifies the certificate management process in the traditional public key cryptosystem and eliminates the hidden key escrow in the identity-based public key cryptosystem. The unforgeability of the scheme is proved through the random oracle model, and the scheme’s security can be reduced to the intractability of the elliptic curve discrete logarithm problem (ECDLP). The analysis results show that our scheme does not use the time-consuming bilinear pairing operation, and has obvious advantages in computing performance compared with the existing signature schemes.

Real-time trajectory privacy protection based on improved differential privacy method and deep learning model

Accurate and real-time trajectory data publishing plays an important role in providing users with the latest traffic and road condition information to help in rationally planning travel time and routes. However, the improper publishing of location information and reverse analysis and reasoning can easily leak users’ personal information, which may threaten users’ privacy and lives. Owing to the inclusion of differential privacy model noise, privacy protection introduces inaccuracies in data publishing and validity. To improve the accuracy and usability of published data, we propose a data publishing method based on deep learning and differential privacy models for securing spatiotemporal trajectory data publishing. The method divides the trajectory data into two-dimensional grid regions, counts the density of trajectories at grids, performs a top-down recursive division of regions, and formulates rules for privacy budget allocation from multiple perspectives as recurrence depth increases. Furthermore, the method integrates spatiotemporal sequence data according to temporal order. Subsequently, it extracts temporal and spatial features of the data by the temporal graph convolutional network model for budget matrix prediction, adds Laplace noise to the regions, and evaluates the effect of differential privacy protection with the original data to protect trajectory data privacy. Experiments demonstrate that under the premise of satisfying ε-difference privacy, the query error and Jensen–Shannon divergence are smaller, the Kendall coefficient is more consistent, and the upper and lower limit values are more stable. Hence, the top-down division method achieves better results than those of the two traditional region division methods of the uniform grid and adaptive grid. The proposed method can be used to allocate the privacy budget more reasonably and achieve privacy protection of trajectories, which can be applied to a large amount of spatiotemporal trajectory data.

Long-Wire Leakage: The Threat of Crosstalk

This article demonstrates how one can leak users’ secrets on a shared field-programmable gate array system by exploiting the delay information of the underlying circuits.

AppClassNet

The recent success of Artificial Intelligence (AI) is rooted into several concomitant factors, namely theoretical progress coupled with abundance of data and computing power. Large companies can take advantage of a deluge of data, typically withhold from the research community due to privacy or business sensitivity concerns, and this is particularly true for networking data. Therefore, the lack of high quality data is often recognized as one of the main factors currently limiting networking research from fully leveraging AI methodologies potential. Following numerous requests we received from the scientific community, we release AppClassNet, a commercial-grade dataset for benchmarking traffic classification and management methodologies. AppClassNet is significantly larger than the datasets generally available to the academic community in terms of both the number of samples and classes, and reaches scales similar to the popular ImageNet dataset commonly used in computer vision literature. To avoid leaking user- and business-sensitive information, we opportunely anonymized the dataset, while empirically showing that it still represents a relevant benchmark for algorithmic research. In this paper, we describe the public dataset and our anonymization process. We hope that AppClassNet can be instrumental for other researchers to address more complex commercial-grade problems in the broad field of traffic classification and management.

A Keyword-Grouping Inverted Index Based Multi-Keyword Ranked Search Scheme Over Encrypted Cloud Data

With the comprehensive development of cloud computing technology, more and more enterprises and individuals tend to outsource computing, data, and other resources to the cloud service providers to save the data management cost. Since the plaintext data outsourcing in the cloud could leak users’ private information, it is highly recommended to encrypt them before outsourcing. However, it is a challenge to perform searches over encrypted cloud data. In this paper, we adopt the keyword grouping idea into the traditional inverted index and propose a keyword-grouping inverted index (KGI-index). Based on the index, we propose a privacy-preserving KGI-index based multi-keywords ranked search scheme (KMRS). To improve the search efficiency, we adopt two strategies including grouping high relevant keywords and using the complete binary tree structure to optimize the index. The security analysis and experimental result show that the proposed scheme is a privacy-preserving and efficient multi-keyword ranked search scheme over encrypted cloud data.

An SKP-ABE Scheme for Secure and Efficient Data Sharing in Cloud Environments

Security threats such as data forgery and leakage may occur when sharing data in cloud environments. Therefore, it is important to encrypt your data and securely access it when sharing it with other users via a cloud server. Of the various security technologies, research on secure data sharing commonly employs Key Policy Attribute-Based Encryption (KP-ABE). However, existing KP-ABE schemes generally lack ciphertext search features. Furthermore, even if a KP-ABE scheme incorporates it, the number of searches required increases markedly by the number of attributes used in the search. It in turn proportionally increases the ciphertext size. In addition, the attribute authority (AA) could be attacked, which can result in the leakage of users’ decryption keys. AA is a server that manages user attributes and decryption keys when using attribute-based encryption in a cloud environment. If the AA is curious, it can cause problems with the key escrow with the attributes and decryption (secret) key information of the users it knows. In this paper, to solve all these problems, we present a new scheme called Searchable Key-Policy Attribute-Based Encryption (SKP-ABE) for secure and efficient data sharing in the cloud. This proposed SKP-ABE scheme allows fast ciphertext search and keeps the ciphertext of constant size. The key escrow problem is solved via user key generation.

Efficient Certificateless Online/Offline Signcryption Scheme for Edge IoT Devices

The emergence of edge computing brings data processing and storage to the vicinity of terminal equipment, which can quickly respond to user needs and reduce the computational burden of the traditional centralized cloud computing model, resulting in a model of edge computing-assisted cloud computing. In this architecture, how to prevent other untrusted entities from leaking user privacy has become one of the most critical concerns. To address this concern, many cryptographic schemes supporting the traditional cloud model to protect the data security sharing of IoT devices have been proposed. However, resource-constrained devices are an essential component of the Internet of Things (IoT). Its characteristics are one of the main reasons that affect the efficiency of schemes, and traditional cryptographic schemes are not suitable for edge computing. Therefore, in order to ensure secure data sharing between IoT devices, we come up with an improved certificateless online/offline signcryption (CLOOSC) scheme and achieve lower computational overhead, when offline calculation is not considered, the resource-constrained IoT device under the cloud-edge collaboration architecture requires only one point multiplication, while only one bilinear pairing is required in the verification phase. In the random oracle model, our scheme is proved to be IND-CCA2 secure. The experiment results show our scheme can be lightweight in terms of time cost.

Towards Privacy-Preserving Spatial Distribution Crowdsensing: A Game Theoretic Approach

Acquiring the spatial distribution of users in mobile crowdsensing (MCS) brings many benefits to users ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">e.g.,</i> avoiding crowded areas during the COVID-19 pandemic). Although the leakage of users’ location privacy has received a lot of research attention, existing works still ignore the rationality of users, resulting that users may not obtain satisfactory spatial distribution even if they provide true location information. To solve the problem, we employ game theory with incomplete information to model the interactions among users and seek an equilibrium state through learning approaches of the game. Specifically, we first model the service as a game in the satisfaction form and define the equilibrium for this service. Then, we design a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">LEFS</i> algorithm for the privacy strategy learning of users when their satisfaction expectations are fixed, and further design <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">LSRE</i> that allows users to have dynamic satisfaction expectations. We theoretically analyze the convergence conditions and characteristics of the proposed algorithms, along with the privacy protection level obtained by our solution. We conduct extensive experiments to show the superiority and various performances of our proposal, which illustrates that our proposal can get more than 85% advantage in terms of the sensing distribution availability compared to the traditional spatial cloaking based solutions.

Authentication and Authorization in Modern Web Apps for Data Security Using Nodejs and Role of Dark Web

Authentication and Authorization are the base of security for all the Technologies present in this world today. Starting from your smartphone where a user authenticates himself before he could access the data inside to Entering into the White House, you must authenticate yourself, and based on that you are authorized. In this digital world where every Business, MNC, Government Body, Companies, Users, etc. needs a website to inform the world about their presence on the internet, provide services online and become a “Brand”, the risk of leaking user's sensitive information increases. It could be dangerous to the users of the hacked website because their sensitive information like a credit card, bank account details, etc. could be sold in the black market of the “dark web”. The role of the dark web is described in the paper and how the data is sold there and what becomes of it. The paper helps to understand how a secure website is developed that promises the user to keep the sensitive information safe, increases the bond of trust between a client and server which results in a long-term relationship. The aim behind developing an authentication system is to keep users’ sensitive information safe so that hackers cannot steal and sell the information on the dark web's back market. To perform this, the developer needs to understand how to implement authentication. NodeJS, with the help of its framework expressJS and some other packages, is used to develop the authentication and authorization system of the website by the research. Previous papers on this field covered the authentication topic in general. This paper overcame that by going deeper into the field and being server-side language specific. The common types of authentication methods used in different types of websites are discussed in detail and the best methods are purposed for the developer to be implemented for a more secure website. This research put light on Artificial Intelligence and blockchain as the future of security of big data.