Legitimate Ones Research Articles

Time-Aware Attention-Based Gated Network for Credit Card Fraud Detection by Extracting Transactional Behaviors

With the popularity of credit cards worldwide, timely and accurate fraud detection has become critically important to ensure the safety of their user accounts. Existing models generally utilize original features or manually aggregated features as their transactional representations, while they fail to reveal the hidden fraudulent behaviors. In this work, we propose a novel model to extract transactional behaviors of users and learn new transactional behavioral representations for credit card fraud detection. Considering the characteristics of transactional behaviors, two time-aware gates are designed in a recurrent neural net unit to learn long- and short-term transactional habits of users, respectively, and to capture behavioral changes of users caused by different time intervals between their consecutive transactions. A time-aware-attention module is proposed and employed to extract the behavioral information from their consecutive historical transactions with time intervals, which enables the proposed model to capture behavioral motive and periodicity inside their historical transactional behaviors. An interaction module is designed to learn more comprehensive and rational representations. To prove the effectiveness of the learned transactional behavioral representations, experiments are conducted on a large real-world transaction dataset and a public one. The results show that the learned representation can well distinguish fraudulent behaviors from legitimate ones, and the proposed method can improve the performance of credit card fraud detection in terms of various evaluation criteria over the state-of-the-art methods.

Bad USB as HID and it’s Mitigations

Abstract: A bug known as "Bad USB" allows a hacker to manipulate a USB flash drive's firmware. Malicious code is automatically activated when the Bad USB device is connected into the USB port of the host system. It is challenging to identify the malicious code since the host system interprets the harmful activities as legitimate ones required to load the USB device. Additionally, antivirus software is unable to detect firmware that has been modified because it examines the storage region rather than the firmware area. The vulnerability has a detrimental knock-on impact since a large number of computer peripherals (similar to USB flash drives, keyboards) are connected to the host machine using the USB protocols. Universal Serial Bus (USB) has become the primary connecting port for cutting-edge computers as a result of its universality. Programmability makes it easier for operating system and tackle manufacturers to develop their goods and associated firmware, but as of right now, a fix for the issue is unknown. In this article, we analyze the tampered area of the firmware that occurs when a good USB device is switched out with a bad one and provide a fix to ensure the integrity of the area when the USB thrills

Intelligent Hyperparameter-Tuned Deep Learning-Based Android Malware Detection and Classification Model

Recently, Android applications have been playing a vital part in the everyday life as several services are offered via mobile applications. Due of its market dominance, Android is more at danger from malicious software, and this threat is growing. The exponential growth of malicious Android apps has made it essential to develop cutting-edge methods for identifying them. Despite the prevalence of a number of security-based approaches in the research, feature selection (FS) methods for Android malware detection methods still have to be developed. In this research, researchers provide a method for distinguishing malicious Android apps from legitimate ones by using a intelligent hyperparameter tuned deep learning based malware detection (IHPT-DLMD). Extraction of features and preliminary data processing are the main functions of the IHPT-DLMD method. The proposed IHPT-DLMD technique initially aims to determine the considerable permissions and API calls using the binary coyote optimization algorithm (BCOA)-based FS technique, which aids to remove the unnecessary features. Besides, bidirectional long short-term memory (Bi-LSTM) model is employed for the detection and classification of Android malware. Finally, the glowworm swarm optimization (GSO) algorithm is applied to optimize the hyperparameters of the BiLSTM model to produce effectual outcomes for Android application classification. This IHPT-DLMD method is checked for quality using a benchmark dataset and evaluated in several ways. The test data demonstrated overall higher performance of the IHPT-DLMD methodology in comparison to the most contemporary methods that are currently in use.

A methodology to identify identical single-board computers based on hardware behavior fingerprinting

The connectivity and resource-constrained nature of single-board devices open the door to cybersecurity concerns affecting Internet of Things (IoT) scenarios. One of the most important issues is the presence of unauthorized IoT devices that want to impersonate legitimate ones by using identical hardware and software specifications. This situation can provoke sensitive information leakages, data poisoning, or privilege escalation in IoT scenarios. Combining behavioral fingerprinting and Machine/Deep Learning (ML/DL) techniques is a promising approach to identify these malicious spoofing devices by detecting minor performance differences generated by imperfections in manufacturing. However, existing solutions are not suitable for single-board devices since they do not consider their hardware and software limitations, underestimate critical aspects such as fingerprint stability or context changes, and do not explore the potential of ML/DL techniques. To improve it, this work first identifies the essential properties for single-board device identification: uniqueness, stability, diversity, scalability, efficiency, robustness, and security. Then, a novel methodology relies on behavioral fingerprinting to identify identical single-board devices and meet the previous properties. The methodology leverages the different built-in components of the system and ML/DL techniques, comparing the device internal behavior with each other to detect variations that occurred in manufacturing processes. The methodology validation has been performed in a real environment composed of 15 identical Raspberry Pi 4 Model B and 10 Raspberry Pi 3 Model B＋ devices, obtaining a 91.9% average TPR with an XGBoost model and achieving the identification for all devices by setting a 50% threshold in the evaluation process. Finally, a discussion compares the proposed solution with related work, highlighting the fingerprint properties not met, and provides important lessons learned and limitations.

Introduction

Introduction

Performance Evaluation for Secure Communications in Mobile Internet of Vehicles With Joint Reactive Jamming and Eavesdropping Attacks

Internet of Vehicles (IoV) is considered to be a backbone of smart transportation system where vehicles are expected to exchange traffic information and other data using vehicle-to-vehicle (V2V) communications. Furthermore, V2V communications is regarded as a medium to send upcoming traffic information to vehicles/drivers or passengers using wireless technology in a timely manner. This will help reduce traffic accidents, traffic jams, fuel consumption caused by traffic jams, loss of hours caused by delayed commuting and carbon emission caused by vehicles. Because of the critical nature of IoV for smart transportation systems, secure wireless communication is one of the critical and essential components to offer trustworthy services through IoV. Like in other wireless systems, wireless communication is open in air, which makes attackers’ job easy to launch the malicious actions in IoV. In this paper, we investigate the impact of mobility of vehicles for secure communications in IoV with joint jamming and eavesdropping attacks. We investigate different scenarios, when vehicles (legitimate ones and attackers) travel in same and opposite directions with low speed (school zone speed) limit to highway speed limit. Furthermore, we study the impact of association time and encryption time not only for establishing the connection between vehicles for V2V communications but also for exchanging messages for vehicles after successful association between vehicles and encryption of the message. In addition, we also study the joint impact of jamming and eavesdropping attacks in IoV for different speed limits, transmission ranges and wireless bandwidths. We investigate the extra cost in terms of transmit power and bandwidth incurred by jamming and eavesdropping attacks while maintaining the same secrecy rate as it could have been without those attacks. Numerical results are used to support the analysis.

De Facto Adoption and Transnational Kinship Formation: Rearticulating Paper Children Immigration during the Chinese Exclusion Era and After

Abstract This article situates Chinese paper children immigration during the Exclusion Era and the pre–1965 period in the combined framework of ancient Chinese adoption and transnational kinship formation. It examines, by reading paper children's oral histories and related sources, how the paper children system was rooted in, borrowed from, and modified ancient Chinese adoption practices, through which Chinese immigrants formed transnational, fictive kinship in the United States that were mixed with both blood and non-blood relationships. Since the Exclusion Era, a discourse about Chinese immigrants, especially paper children being illegal, was so powerful that immigration historians seldom question this assumption, even as they critique the institutionalized exclusion that created such illegality. This article, however, challenges this assumption by arguing that paper children immigration generated de facto adoptive relationships between paper children and their paper families, and that these adoptive relationships further sustained paper children's legal status as American citizens. Treating paper children as de facto adoptive members of their paper families, this article brings to the surface a fact that by emphasizing their illegality, the dominant discourse only acknowledged their hidden, original identities and deemed parent-child relationships based on blood ties as the only legitimate ones.

Third-party enabled auditing for uniqueness-based integrity and data sharing with information hiding

The majority data are now kept in the cloud. There are many Cloud storage applications used to exchange data that range from normal to highly sensitive. Among the most essential security measures in cloud is Cloud auditing. It is the process of validating the reliability of data stored in the cloud. As of the inevitability of hardware problems, system failures and errors by people these data may be corrupted or lost. An efficient auditing system to determine whether or not the data is corrupted is a challenging task among the recent research. This paper proposes a third-party enabled auditing methodology to ensure data integrity, privacy data sharing and protect against outside attackers in the public cloud. In this proposed method, the record / data owner generates signatures or add sanitizer before importing sensitive data blocks into the cloud. The record blocks that report sensitive data are sanitized, and the signatures of those records blocks are converted into legitimate ones for the sanitized report. As a result, the records saved in the cloud have the identical signature. Then a third-party auditor is implemented to confirm the cloud's storage accuracy by validating the reliability of the cloud records on the person's behalf.

Deep convolutional forest: a dynamic deep ensemble approach for spam detection in text

The increase in people’s use of mobile messaging services has led to the spread of social engineering attacks like phishing, considering that spam text is one of the main factors in the dissemination of phishing attacks to steal sensitive data such as credit cards and passwords. In addition, rumors and incorrect medical information regarding the COVID-19 pandemic are widely shared on social media leading to people’s fear and confusion. Thus, filtering spam content is vital to reduce risks and threats. Previous studies relied on machine learning and deep learning approaches for spam classification, but these approaches have two limitations. Machine learning models require manual feature engineering, whereas deep neural networks require a high computational cost. This paper introduces a dynamic deep ensemble model for spam detection that adjusts its complexity and extracts features automatically. The proposed model utilizes convolutional and pooling layers for feature extraction along with base classifiers such as random forests and extremely randomized trees for classifying texts into spam or legitimate ones. Moreover, the model employs ensemble learning procedures like boosting and bagging. As a result, the model achieved high precision, recall, f1-score and accuracy of 98.38%.

Symmetry and interpretation: a deliberative framework for judging recognition claims

ABSTRACT Can recognition theories distinguish legitimate from illegitimate claims to recognition put forward by social movements? This paper identifies an under-theorised problem of recognition theories: in viewing struggles for recognition as a force for social progress in the mould of the New Social Movements of the 1960s and 1970s, existing accounts have trouble identifying and ruling out illegitimate claims to recognition as formulated by contemporary counter-movements like white supremacists or men’s rights activists. I refer to this issue as the symmetry problem of recognition since it amounts to difficulties in identifying grounds for excluding illegitimate claims to recognition that do not also symmetrically justify the exclusion of legitimate ones (and vice versa). I argue that criteria for telling apart legitimate from illegitimate claims to recognition need to include interpretation issues as a dimension of analysis, which consequently requires incorporating democratic deliberation as a necessary component of recognition theory.

Machine Learning for the Detection and Identification of Internet of Things Devices: A Survey

The Internet of Things (IoT) is becoming an indispensable part of everyday life, enabling a variety of emerging services and applications. However, the presence of rogue IoT devices has exposed the IoT to untold risks with severe consequences. The first step in securing the IoT is detecting rogue IoT devices and identifying legitimate ones. Conventional approaches use cryptographic mechanisms to authenticate and verify legitimate devices’ identities. However, cryptographic protocols are not available in many systems. Meanwhile, these methods are less effective when legitimate devices can be exploited or encryption keys are disclosed. Therefore, noncryptographic IoT-device identification and rogue device detection become efficient solutions to secure existing systems and will provide additional protection to systems with cryptographic protocols. Noncryptographic approaches require more effort and are not yet adequately investigated. In this article, we provide a comprehensive survey on machine learning technologies for the identification of IoT devices along with the detection of compromised or falsified ones from the viewpoint of passive surveillance agents or network operators. We classify the IoT-device identification and detection into four categories: 1) device-specific pattern recognition; 2) deep learning-enabled device identification; 3) unsupervised device identification; and 4) abnormal device detection. Meanwhile, we discuss various ML-related enabling technologies for this purpose. These enabling technologies include learning algorithms, feature engineering on network traffic traces and wireless signals, incremental learning, and abnormality detection.

Model for Phishing Websites Classification Using Artificial Neural Network

Internet users might be exposed to various forms of threats that can create economic harm, identity fraud, and lack of faith in e-commerce and online banking by consumers as the internet has become a necessary part of everyday activities. Phishing can be regarded as a type of web extortions described as the skill of imitating an honest company's website aimed at obtaining private information for example usernames, passwords, and bank information. The accuracy of classification is very significant in order to produce high accuracy results and least error rate in classification of phishing websites. The objective of this research is to model a suitable neural network classifier and then use the model to class the phishing website data set and evaluate the performance of the classifier. This research will use a phishing website data set which was retrieved from UCI repository and will be experimented using Encog Workbench tool. The main expected outcome from this study is the preliminary ANN classifier which classifies the target class of the phishing websites data set accurately, either phishy, suspicious or legitimate ones. The results indicate that ANN (9-5-1) model outperforms other models by achieving the highest accuracy and the least MSE value which is 0.04745.

Implications of Compulsory Car Accident Insurance Comparative Study

Compulsory civil liability insurance on car accidents is one of the most important topics, which aims to achieve traffic safety and reduce car accidents. Today, car accidents constitute a great danger to human life as they cause different types of physical and moral damages. This study, however, attempts to highlight the effectiveness of compulsory insurance in providing legal protection for damages resulting from car accidents. Such protection can be achieved through the process of creating legal mechanism to enable injured people to refer to insurance companies. It is quite apparent that nobody can deny the importance of insurance and its influence on people’s lives. Insurance companies nowadays have become an essential cornerstone in the economy of any country. An insurance contract has legal consequences on the parties, which leads to corresponding obligations. These parties are committed to comply with these obligations otherwise, any violation will be treated as per the prescribed legal sanctions. In conclusion, any research or study on the compulsory insurance system whether in the Emirati law or in Islamic Sharia is highly recommended as part of the attempts to solve and rectify any legal and legitimate problems in this system. An essential objective of the Islamic Sharia is to achieve all fair interests of people. Arab and international legislation consider car insurance compulsory with some exceptions in order to compensate all those affected by a car accident. Arab and other foreign laws as well as the legitimate ones have differed in their choices of car insurance basis. Many legislations in the field of compulsory insurance have limited the right of compensation to body damage. Some other legislations have covered damages of property. Most legislations have not specified the amount of compensation that the insurer is obliged to pay in case of injury, death, or property damages. companies.

Doing Gender, Class, and Nation in Northern India: Student Aspirations and the New Middle Class

ABSTRACT India’s new middle class is important in establishing a hegemonic culture and structure that legitimizes what it means to be a successful, modern Indian man or woman. This study examines the extent to which, and how, the aspirations of educated, non-cosmopolitan young people in the Garhwali hills of northern India reflect and embody these hegemonic ideals. These questions are important because these ideal constructs, largely based in the realities of elite, transnational middle-class lives, are held up to be the legitimate ones that reflect a vision of India as a modern nation. My findings draw from 38 in-depth interviews conducted with students at five colleges in the Garhwali area of Uttarakhand. The aspirations and expectations of college students in this area largely reflect, and thus reinforce and legitimize, dominant constructs of gender, class, and nation. This is the case even though the chances of obtaining a position in the transnational middle class are relatively low for young people in this area. Moreover, the particular constraints faced by female students make it especially unlikely that they will ever reach new-middle-class status. The implications of these findings are discussed.

Phishing Mitigation Techniques: A Literature Survey

Email is a channel of communication which isconsideredto be a confidential medium of communication for exchange of information among individuals and organisations. The confidentiality consideration about email is no longer the case as attackers send malicious emails to users to deceive them into disclosing their private personal information such as username, password, and bank card details, etc. In search of a solution to combat phishing cybercrime attacks, different approaches have been developed. However, the traditional exiting solutions have beenlimited in assisting email users to identify phishing emails from legitimate ones. This paper reveals the different email and website phishing solutions in phishing attack detection. It first provides a literature analysis of different existing phishing mitigation approaches. It then provides a discussion on the limitations of the techniques, before concluding with anexplorationintohow phishing detection can be improved.

Detecting Colluding Sybil Attackers in Robotic Networks Using Backscatters

Due to the openness of wireless medium, robotic networks that consist of many miniaturized robots are susceptible to Sybil attackers, who can fabricate myriads of fictitious robots. Such detrimental attacks can overturn the fundamental trust assumption in robotic collaboration and thus impede widespread deployments of robotic networks in many collaborative tasks. Existing solutions rely on bulky multi-antenna systems to passively obtain fine-grained physical layer signatures, making them unaffordable to miniaturized robots. To overcome this limitation, we present ScatterID, a lightweight system that attaches featherlight and batteryless backscatter tags to single-antenna robots for Sybil attack mitigation. Instead of passively “observing” signatures, ScatterID actively “manipulates” multipath propagation by exploiting backscatter tags to intentionally create rich multipath signatures obtainable to single-antenna robots. Particularly, these signatures are used to carefully construct similarity vectors to thwart advanced Sybil attackers, who further trigger power-scaling and colluding attacks to generate dissimilar signatures. Then, a customized random forest model is developed to accurately infer the identity legitimacy of each robot. We implement ScatterID on the iRobot Create platform and evaluate it under various Sybil attacks in real-world environments. The experimental results show that ScatterID achieves a high AUROC of 0.987 and obtains an overall accuracy of 95.4% under basic and advanced Sybil attacks. Specifically, it can successfully detect 96.1% of fake robots while mistakenly rejecting just 5.7% of legitimate ones.

Analysis of Perceptual Hashing Algorithms in Image Manipulation Detection

Perceptual image hashing is a family of algorithms that generate content-based image hashes. Unlike cryptographic hashes, perceptual hashes are designed to not change much when an image undergoes minor modifications such as compression, color-correction, and brightness. Therefore, these algorithms have been found useful in detecting redundant images, perform reverse image search, and flagging/filtering inappropriate imagery by comparing image hashes with a dataset of known perceptual hashes. While these applications have been served well, there is a new threat to visual information in the form of misinformation through content changing image manipulation using techniques such as object addition/removal and copy-move. While perceptual hashing algorithms can very accurately identify copies of similar images and their legitimately modified versions, their effectiveness in detecting content changing manipulations is not studied well. Existing research and advanced image libraries propose various image hashing algorithms, and several datasets of manipulated images are available in the public domain. In this work, a review and performance analysis of several perceptual hashing algorithms against two such datasets is presented. Results show less than ideal performance in distinguishing maliciously manipulated images from legitimate ones. Based on the results, limitations of perceptual hashing algorithms are identified, and future research directions are proposed.

Exploring the mechanisms of phishing

Social engineering can be defined as a form of attack involving human interactions. 1,2 It is used to force users or victims to make psychological mistakes so that they end up making a security mistake, giving up crucial information. Social engineering is about tricking users with the help of fake websites that look the same as legitimate ones or impersonating someone trustworthy, and it includes activities such as exploiting normal human behaviours like kindness and greed. Human behaviour is such that people tend to fall easily for anything they think is free, or anything they see as trustworthy.

PoPL: Proof-of-Presence and Locality, or How to Secure Financial Transactions on Your Smartphone

The security of financial apps on smartphones is threatened by a class of advanced and persistent malware that can bypass all existing security measures. Strong cryptography and trusted on-chip hardware modules are powerless against sophisticated attacks that supplant device owners through device input record/replay functionality, effectively hijacking their credentials, privileges, and actions. In this paper, we introduce Proof-of-Presence and Locality (PoPL), a new security measure that tackles this threat by leveraging sensors to prove the physical presence of device owners and therefore discriminate between malware-initiated transaction requests and legitimate ones. Moreover, PoPL neither imposes the expense of additional hardware nor compromises app usability. In order to demonstrate PoPL’s practicality, we developed PoPLar, a challenge puzzle implementation of the PoPL concept that ensures usability even on limited screen sizes by the use of a dendrogram. We have made it available as an open-source library ready to be integrated with minimal effort with existing apps. We demonstrate PoPLar’s effectiveness and ease of integration through case studies involving apps from the three top cryptocurrency exchanges and an open-source crypto wallet.

SnapCatch: Automatic Detection of Covert Timing Channels Using Image Processing and Machine Learning

With the rapid growth of data exfiltration carried out by cyber attacks, Covert Timing Channels (CTC) have become an imminent network security risk that continues to grow in both sophistication and utilization. These types of channels utilize inter-arrival times to steal sensitive data from the targeted networks. CTC detection relies increasingly on machine learning techniques, which utilize statistical-based metrics to separate malicious (covert) traffic flows from the legitimate (overt) ones. However, given the efforts of cyber attacks to evade detection and the growing column of CTC, covert channels detection needs to improve in both performance and precision to detect and prevent CTCs and mitigate the reduction of the quality of service caused by the detection process. In this article, we present an innovative image-based solution for fully automated CTC detection and localization. Our approach is based on the observation that the covert channels generate traffic that can be converted to colored images. Leveraging this observation, our solution is designed to automatically detect and locate the malicious part (i.e., set of packets) within a traffic flow. By locating the covert parts within traffic flows, our approach reduces the drop of the quality of service caused by blocking the entire traffic flows in which covert channels are detected. We first convert traffic flows into colored images, and then we extract image-based features for detection covert traffic. We train a classifier using these features on a large data set of covert and overt traffic. This approach demonstrates a remarkable performance achieving a detection accuracy of 95.83% for cautious CTCs and a covert traffic accuracy of 97.83% for 8 bit covert messages, which is way beyond what the popular statistical-based solutions can achieve.