Legitimate Services Research Articles

Knowledge, Attitude and Skills of Physiotherapists Towards Tele-Rehabilitation

Background: With the rapid integration of information and communication technology in healthcare, telerehabilitation has emerged as a vital tool in physiotherapy, offering an alternative to traditional care methods. This evolution necessitates an understanding of physiotherapists' readiness and capability to employ such technologies in clinical practice. Objective: The study aimed to evaluate the knowledge, attitudes, and skills of physiotherapists regarding telerehabilitation, to ascertain their proficiency and perceptions of its application in clinical settings. Methods: A cross-sectional study was conducted over four months, post-approval of the research synopsis. Data were collected using the Telemedicine - Awareness, Knowledge, Attitude & Skills (AKAS) Questionnaire via an online Google Form from a non-probability convenience sample of 350 clinical and academic physiotherapists in Lahore. Participants had a minimum of six months of clinical experience and were aged 24 years or older. The data were analyzed using SPSS version 21.0 to interpret the survey responses statistically. Results: Among the participants, 89.7% displayed a positive attitude toward the use of telecommunications in telerehabilitation. A significant majority (79.1%) recognized telerehabilitation as a legitimate service, with 80.6% agreeing on its efficacy in patient follow-up. Computer literacy varied, with 27.4% possessing advanced knowledge, 47.1% mediocre, and 25.4% beginner levels. Statistically significant correlations were observed between levels of computer knowledge and attendance at training programs (p < 0.05 for advanced and mediocre knowledge). Conclusion: The study concluded that physiotherapists generally hold a positive view of telerehabilitation, recognizing its importance in the continuum of care. Nonetheless, the variability in ICT skills highlights the need for comprehensive training to fully exploit the capabilities of telerehabilitation in enhancing patient care.

Machine learning-based DDoS detection for IoT networks

DDoS attacks are one of the most dangerous threats to IoT networks, and they involve using attacker-controlled botnets to flood the network with malicious traffic that denies legitimate services. The global DDoS landscape is rapidly evolving, and it has become increasingly important for devices to quickly identify the types of DDoS attacks they face so that they can choose and implement effective countermeasures against known attacks. Machine learning has emerged as a popular approach for detecting DDoS traffic in IoT networks. This paper implements four machine learning models, namely Support Vector Machine (SVM), Decision Tree, Long Short-Term Memory (LSTM), and Random Forest, to perform multiclass classification for DDoS attack detection. The study uses the CICDDoS2019 dataset for evaluation. The results show that all four models can detect most types of DDoS traffic effectively. The Random Forest model achieves the highest overall accuracy of 99.32%, followed by the Decision Tree model with an accuracy of 99.10%. The LSTM and SVM models have slightly lower accuracies at 98.20% and 93.00%, respectively. The study also evaluates the models' performance in terms of precision, recall, and F1 score. Decision Tree outperforms the other models in precision, while Random Forest has the highest recall score. Moreover, the Random Forest model performs the best in terms of the F1 score. In conclusion, this paper demonstrates the effectiveness of machine learning-based approaches for DDoS detection in IoT networks using four popular models. The results illustrate the potential for these models to provide reliable and accurate detection of DDoS traffic, thus enabling effective countermeasures to be taken against this type of attack.

Detect malicious websites by building a neural network to capture global and local features of websites

With the development of the digital age, the Internet has become an integral part of our daily lives. However, it has also brought about a series of security challenges, among which malicious websites are particularly prominent. These websites often lure ignorant users by disguising themselves as legitimate services or through various fraudulent means to commit identity theft, distribute malware, or launch other forms of cyberattacks. Therefore the detection of malicious websites is very necessary. Traditionally, many malicious website detection methods rely on machine learning techniques, some of which require manual extraction of features, which may result in a time-consuming prediction process. Despite the existence of machine learning models that can automatically extract features, including unsupervised ones, capturing the subtleties of malicious website features is still a challenge. In recent years, deep learning has been gaining attention as a method for automated feature learning. It is capable of capturing and understanding the content of a website in greater depth, thus making classification and detection more accurate and efficient. Although deep learning shows its potential in capturing advanced features, its performance depends on the input data and the chosen model architecture. Both efficiently constructing feature representations of input data and building efficient model architectures to capture features are currently major challenges. For this reason, we propose a new approach for malicious website detection. This method uses wordpiece-level features to represent the information of malicious websites. Combination of multi-filter text convolutional neural network and multi-head self-attention mechanism is used for model construction. This enables the model to capture both global and local features of the input data. Compared to common deep learning methods, our approach captures the features of malicious websites better.

Machine Learning Detection of Cloud Services Abuse as C&C Infrastructure

The proliferation of cloud and public legitimate services (CLS) on a global scale has resulted in increasingly sophisticated malware attacks that abuse these services as command-and-control (C&C) communication channels. Conventional security solutions are inadequate for detecting malicious C&C traffic because it blends with legitimate traffic. This motivates the development of advanced detection techniques. We make the following contributions: First, we introduce a novel labeled dataset. This dataset serves as a valuable resource for training and evaluating detection techniques aimed at identifying malicious bots that abuse CLS as C&C channels. Second, we tailor our feature engineering to behaviors indicative of CLS abuse, such as connections to known CLS domains and potential C&C API calls. Third, to identify the most relevant features, we introduced a custom feature elimination (CFE) method designed to determine the exact number of features needed for filter selection approaches. Fourth, our approach focuses on both static and derivative features of Portable Executable (PE) files. After evaluating various machine learning (ML) classifiers, the random forest emerges as the most effective classifier, achieving a 98.26% detection rate. Fifth, we introduce the “Replace Misclassified Parameter (RMCP)” adversarial attack. This white-box strategy is designed to evaluate our system’s detection robustness. The RMCP attack modifies feature values in malicious samples to make them appear as benign samples, thereby bypassing the ML model’s classification while maintaining the malware’s malicious capabilities. The results of the robustness evaluation demonstrate that our proposed method successfully maintains a high accuracy level of 84%. In sum, our comprehensive approach offers a robust solution to the growing threat of malware abusing CLS as C&C infrastructure.

Abuse of Cloud-Based and Public Legitimate Services as Command-and-Control (C&C) Infrastructure: A Systematic Literature Review

The widespread adoption of cloud-based and public legitimate services (CPLS) has inadvertently opened up new avenues for cyber attackers to establish covert and resilient command-and-control (C&C) communication channels. This abuse poses a significant cybersecurity threat, as it allows malicious traffic to blend seamlessly with legitimate network activities. Traditional detection systems are proving inadequate in accurately identifying such abuses, emphasizing the urgent need for more advanced detection techniques. In our study, we conducted an extensive systematic literature review (SLR) encompassing the academic and industrial literature from 2008 to July 2023. Our review provides a comprehensive categorization of the attack techniques employed in CPLS abuses and offers a detailed overview of the currently developed detection strategies. Our findings indicate a substantial increase in cloud-based abuses, facilitated by various attack techniques. Despite this alarming trend, the focus on developing detection strategies remains limited, with only 7 out of 91 studies addressing this concern. Our research serves as a comprehensive review of CPLS abuse for the C&C infrastructure. By examining the emerging techniques used in these attacks, we aim to make a significant contribution to the development of effective botnet defense strategies.

Police and procedural justice: perceptions of young people with mental illness

ABSTRACT Young people with mental illness are significantly more likely to encounter the police than their counterparts who do not identify as having a mental illness. Yet little is known regarding how this cohort perceives the police and whether they believe the police to be a fair, trustworthy, and legitimate service. Research suggests that young people and other vulnerable groups (such as adults with mental illness) value procedural justice policing as a technique for nurturing fair and trustworthy policing, which in turn, increases satisfaction with police interactions and willingness to cooperate with police. This study uses procedural justice as a lens for analysing the perceptions of young people with mental illnesses regarding the police. Drawing upon survey data from a sample of 3147 Australian participants aged between 14 and 25 years old – a third of which identified as having a mental health condition – results demonstrate that young people with a mental illness offered significantly lower perceptions of the police in relation to procedural justice. Young people identifying as not heterosexual or as trans* or gender diverse, and those who report that they are not seen as Australian, also offered significantly lower perceptions of police procedural justice. A theoretical explanation is offered for why these marginalised young groups perceive the police to be procedurally unjust. Tactics for how the police may nurture more trusting and supporting relationships with young people in general are also discussed.

Hybrid H-DOC: A bait for analyzing cyber attacker behavior

Cyber security is a vital concern for companies with internet-based cloud networks. These networks are constantly vulnerable to attack, whether from inside or outside organization. Due to the ever-changing nature of the cyber world, security solutions must be updated regularly in order to keep infrastructure secure. With the use of attack detection approaches, security systems such as antivirus, firewalls, or intrusion detection systems have become more effective. However, conventional systems are unable to detect zero-day attacks or behavioral changes. These drawbacks can be overcome by setting up a honeypot. In this paper, a hybrid Honeynet model deployed in Docker (H-DOC) bait has been proposed that comprises both low interaction and high interaction honeypot to attract the malicious attacker and to analyze the behavioral patterns. This is a form of bait, designed to detect or block attacks, or to divert an attacker's attention away from the legitimate services. It focuses only on the SSH protocol, as it is widely used for remote system access and is a popular target of attacks. The proposed Hybrid H-DOC method identify ransomware activity, attack trends, and timely decision-making through the use of an effective rule and tunes the firewall. The attack detection accuracy of the proposed Hybrid H-DOC method when compared with IDH, Decepti-SCADA, AS-IDS and HDCM is 13.97%, 11.82%, 8.60% and 5.07% respectively.

Identity – Africa – Biometrics

There is currently a digital revolution ongoing across the globe that cannot be missed. It appears that it is bringing the newest solutions and answers to all latest requirements and expectations that seemed to be out of the reach for many decades. However, it is not only technology that is needed these days, but also societies are seeking credible tools and acceptable option implemented in order to provide an individual a state approved identity with access to legitimate services. Although each of us is subjected to rights and duties based on identity given from the very beginning of our lives, some may not have a chance to present a proof of this identity due to geographic, cultural or social issues. Various organizations both commercial and international, including state ones and NGOs, are concerned of a significant high rate of loss of opportunities by some due to lack of basic identification document, whether it is an old fashioned one or a digital ID. This paper brings some current activities and events for discussion in regards to response to deficiency in terms of equipping citizens of African countries with the latest type of identification document, which contains of access to multiple services. Moreover, while reading the study, it may be noticed the level of devotion and engagement by actors, which includes seeking and employing the best know-how practice and digital biometric traits. Thanks to such approach, some African countries may be already ahead of so-called “western developed economies”. However, digital biometrization of individuals could be a response to modern challenges on one side, and to crisis management and natural disasters on the other. The paper briefly describes the problem of identification with use of digital biometric features in Africa, and it rather invites others to carry out an independent research, as well encourage to discussion on advantages and disadvantages for using biometrics in the process of identification.

H-DOCTOR: Honeypot based firewall tuning for attack prevention

A honeypot is a well-known entrapment technique used by network and Internet of Things (IoT) security professionals to lure intruders. Unlike traditional security measures, they can capture information in real time from the attacker about how they are attacking. A network firewall protects Internet servers from unwanted and malicious traffic. Detecting ransomware with existing security systems such as IDPS (Intrusion Detection and Protection System) and AV (Antivirus) is difficult and time-consuming. In this paper, a novel hybrid Honeynet deployed in Docker for detecting attacker behavior with Tuning Of fiRewall (H-DOCTOR) has been proposed. The proposed H-DOCTOR technique comprises both low interaction and high interaction honeypot to attract the malicious attacker and to analyze the behavioral patterns. This is a form of bait, designed to detect or block attacks, or to divert an attacker's attention away from the legitimate services and tune the firewall. The proposed H-DOCTOR method identify ransomware activity, attack trends, and timely decision-making through the use of an effective rule and tunes the firewall. The proposed H-DOCTOR framework is compared with existing methods such as HyInt,IDS and honeypot-based IDS. The proposed system achieves higher accuracy of 86% and the existing system such as HyInt,IDS and honeypot-based IDS achieves 73.25%, 76.75% and 81.25%.

Characterizing Cryptocurrency-themed Malicious Browser Extensions

Due to the surging popularity of various cryptocurrencies in recent years, a large number of browser extensions have been developed as portals to access relevant services, such as cryptocurrency exchanges and wallets. This has stimulated a wild growth of cryptocurrency themed malicious extensions that cause heavy financial losses to the users and legitimate service providers. They have shown their capability of evading the stringent vetting processes of the extension stores, highlighting a lack of understanding of this emerging type of malware in our community. In this work, we conduct the first systematic study to identify and characterize cryptocurrency-themed malicious extensions. We monitor seven official and third-party extension distribution venues for 18 months (December 2020 to June 2022) and have collected around 3600 unique cryptocurrency-themed extensions. Leveraging a hybrid analysis, we have identified 186 malicious extensions that belong to five categories. We then characterize those extensions from various perspectives including their distribution channels, life cycles, developers, illicit behaviors, and illegal gains. Our work unveils the status quo of the cryptocurrency-themed malicious extensions and reveals their disguises and programmatic features on which detection techniques can be based. Our work serves as a warning to extension users, and an appeal to extension store operators to enact dedicated countermeasures. To facilitate future research in this area, we release our dataset of the identified malicious extensions and open-source our analyzer.

Secure and Efficient Blockchain-Assisted Authentication for Edge-Integrated Internet-of-Vehicles

Edge-Integrated Internet-of-Vehicles (IoV) sinks service to edge nodes, which responses quickly to vehicles' requests and alleviates the burden of cloud servers. In such scenario, the entities of IoV need to be mutually authenticated since potential attacks can impersonate edge nodes to send false instructions to vehicles, or impersonate legitimate service subscribers to get free-ride IoV services. Furthermore, due to the high mobility characteristics of vehicles, frequent authentication is required between vehicles and edge nodes. We hope that the authentication process can be conducted efficiently to ensure the continuous service. Existing works cannot balance the security and efficiency well. This is still an issue worthy of discussion. In this article, we propose SEA, a secure and efficient blockchain-assisted authentication scheme for IoV. SEA achieves mutual authentication among vehicles, edge nodes and cloud servers. Specifically, the cloud server is only involved when vehicles are initially authenticated. And edge nodes realize the authentication of vehicles by querying the authentication result recorded by cloud on the blockchain, which significantly reduces the cryptographic computation overhead and eliminates network communication delay. Besides, session keys between any two entities involved are negotiated, which can secure sensitive data of vehicles. Extensive experiments have been conducted to show the security and efficiency of SEA.

Understanding the Practices of Global Censorship through Accurate, End-to-End Measurements

It is challenging to conduct a large scale Internet censorship measurement, as it involves triggering censors through artificial requests and identifying abnormalities from corresponding responses. Due to the lack of ground truth on the expected responses from legitimate services, previous studies typically require a heavy, unscalable manual inspection to identify false positives while still leaving false negatives undetected. In this paper, we propose Disguiser, a novel framework that enables end-to-end measurement to accurately detect the censorship activities and reveal the censor deployment without manual efforts. The core of Disguiser is a control server that replies with a static payload to provide the ground truth of server responses. As such, we send requests from various types of vantage points across the world to our control server, and the censorship activities can be recognized if a vantage point receives a different response. In particular, we design and conduct a cache test to pre-exclude the vantage points that could be interfered by cache proxies along the network path. Then we perform application traceroute towards our control server to explore censors' behaviors and their deployment. With Disguiser, we conduct 58 million measurements from vantage points in 177 countries. We observe 292 thousand censorship activities that block DNS, HTTP, or HTTPS requests inside 122 countries, achieving a 106 false positive rate and zero false negative rate. Furthermore, Disguiser reveals the censor deployment in 13 countries.

Where service recovery meets its paradox: implications for avoiding overcompensation

PurposeThe service recovery paradox (SRP) is the phenomenon that happens when customer satisfaction level post-service failure and recovery surpasses the customer satisfaction level achieved at error-free service. The aim of this study was to identify how large the size of compensation has to be at recovery for customer satisfaction to surpass that of error-free service (i.e. to identify a threshold value for SRP). The purpose of this is to inform managers how to restore customer satisfaction yet avoid overcompensation.Design/methodology/approachThe paper covers two studies. Study 1 used the novel approach of asking participants who had experienced a service failure in the hotel industry what amount of money (recovery) would make them more satisfied than in the case of error-free service. Study 2 then tested the compensation levels expressed by Study 1 participants to be sufficient for the service recovery paradox to occur.FindingsStudy 1 indicated that the threshold for the SRP was (on average) around 1,204 SEK, or just over 80% of the original room reservation price of 1,500 SEK (approx. $180). Study 2 found that (on average) the customer satisfaction of participants who received 1,204 SEK in compensation for service failure marked the point where it surpassed that of error-free service. Participants who received 633 SEK were less satisfied; participants who received 1,774 SEK were more satisfied.Research limitations/implicationsThe findings are context-specific. Future research should test the findings' generalizability.Practical implicationsThe approach used in this paper could provide managers with a tool to guide their service recovery efforts. The findings could help hotel managers to make strategic decisions to restore customer satisfaction yet avoid overcompensation, given a legitimate service failure in which the organization is at fault.Originality/valueNumerous previous studies have investigated the occurrence or absence of the SRP at predetermined compensation levels. This paper used a novel approach to find a quantitative threshold at which the magnitude of the recovery effort makes customer satisfaction surpass that of error-free service.

Random Forest Detector and Classifier of Multiple IoT-based DDoS Attacks

In this paper two new models for Random Forest (RF) classifiers are presented. The first one discriminates Distributed Denial of Service (DDoS) network attacks from normal IP (Internet Protocol) traffic and the second one classifies 10 types of attacks. General optimization procedures are proposed based on the parameters of the RF classifiers. The observed DDoS attacks are typical for botnets, comprised of IoT (Internet of Things) devices. Bot-master plays central role into coordinating the bots. The explicit aim is either resource exhaustion of the targeted machine or bandwidth saturation of the supporting channels to it. Both activities render the legitimate services unavailable. The detection process has an accuracy of 0.9999. The classification process deviates between 0.9992 and 0.9999. Processing times allow the proposed approach to be used in real-world applications.

Moving target defense of routing randomization with deep reinforcement learning against eavesdropping attack

Eavesdropping attacks have become one of the most common attacks on networks because of their easy implementation. Eavesdropping attacks not only lead to transmission data leakage but also develop into other more harmful attacks. Routing randomization is a relevant research direction for moving target defense, which has been proven to be an effective method to resist eavesdropping attacks. To counter eavesdropping attacks, in this study, we analyzed the existing routing randomization methods and found that their security and usability need to be further improved. According to the characteristics of eavesdropping attacks, which are “latent and transferable”, a routing randomization defense method based on deep reinforcement learning is proposed. The proposed method realizes routing randomization on packet-level granularity using programmable switches. To improve the security and quality of service of legitimate services in networks, we use the deep deterministic policy gradient to generate random routing schemes with support from powerful network state awareness. In-band network telemetry provides real-time, accurate, and comprehensive network state awareness for the proposed method. Various experiments show that compared with other typical routing randomization defense methods, the proposed method has obvious advantages in security and usability against eavesdropping attacks.

Remote Delivery of Service: A Survey of Occupational Therapists' Perceptions.

Background:Telehealth has been declared an accepted method of occupational therapy (OT) service delivery and has been shown to be effective. However, studies done before the outbreak of coronavirus disease (COVID-19) show that most occupational therapists didn’t use it.Aim:The aim of this exploratory study was to examine the perceptions of occupational therapists regarding remote delivery of service following the COVID-19 outbreak.Material and methods:An online survey, including 11-item five-point Likert scale, and 2 open-ended questions were distributed to occupational therapists.Results:Responses were received from 245 Israeli occupational therapists. The majority of the participants (60%) strongly agreed that remote delivery allows an ecological and effective intervention, while 76% strongly agreed that an ideal treatment is one that would combine telehealth with in-person intervention. Qualitative findings indicated that the most significant advantage was providing care in the natural environment and improving accessibility to the service. The most salient barriers were limitations of the therapeutic relationship and threats on clinical reasoning.Conclusion:The study results highlight the complexity of telehealth. Findings indicate that overall occupational therapists perceive remote care as an effective and legitimate service delivery method that cannot be used as an alternative to in-person treatment. These findings can help in developing intervention programs for remote treatment, and their implementation.

Reinforced Transformer Learning for VSI-DDoS Detection in Edge Clouds

Edge-driven software applications often deployed as online services in the cloud-to-edge continuum lack significant protection for services and infrastructures against emerging cyberattacks. Very-Short Intermittent Distributed Denial of Service (VSI-DDoS) attack is one of the biggest factor for diminishing the Quality of Services (QoS) and Quality of Experiences (QoE) for users on edge. Unlike conventional DDoS attacks, these attacks live for a very short time (on the order of a few milliseconds) in the traffic to deceive users with a legitimate service experience. To provide protection, we propose a novel and efficient approach for detecting VSI-DDoS attacks using reinforced transformer learning that mitigates the tail latency and service availability problems in edge clouds. In the presence of attacks, the users’ demand for availing ultra-low latency and high throughput services deployed on the edge, can never be met. Moreover, these attacks send very-short intermittent requests towards the target services that enforce longer delays in users’ responses. The assimilation of transformer with deep reinforcement learning accelerates detection performance under adverse conditions by adapting the dynamic and the most discernible patterns of attacks (e.g., multiplicative temporal dependency, attack dynamism). The extensive experiments with testbed and benchmark datasets demonstrate that the proposed approach is suitable, effective, and efficient for detecting VSI-DDoS attacks in edge clouds. The results outperform state-of-the-art methods with 0.9%-3.2% higher accuracy in both datasets.

Understanding the Practices of Global Censorship through Accurate, End-to-End Measurements

It is challenging to conduct a large scale Internet censorship measurement, as it involves triggering censors through artificial requests and identifying abnormalities from corresponding responses. Due to the lack of ground truth on the expected responses from legitimate services, previous studies typically require a heavy, unscalable manual inspection to identify false positives while still leaving false negatives undetected. In this paper, we propose Disguiser, a novel framework that enables end-to-end measurement to accurately detect the censorship activities and reveal the censor deployment without manual efforts. The core of Disguiser is a control server that replies with a static payload to provide the ground truth of server responses. As such, we send requests from various types of vantage points across the world to our control server, and the censorship activities can be recognized if a vantage point receives a different response. In particular, we design and conduct a cache test to pre-exclude the vantage points that could be interfered by cache proxies along the network path. Then we perform application traceroute towards our control server to explore censors' behaviors and their deployment. With Disguiser, we conduct 58 million measurements from vantage points in 177 countries. We observe 292 thousand censorship activities that block DNS, HTTP, or HTTPS requests inside 122 countries, achieving a 10^-6 false positive rate and zero false negative rate. Furthermore, Disguiser reveals the censor deployment in 13 countries.

Crook-sourced intrusion detection as a service

Most conventional cyber defenses strive to reject detected attacks as quickly and decisively as possible; however, this instinctive approach has the disadvantage of depriving intrusion detection systems (IDSes) of learning experiences and threat data that might otherwise be gleaned from deeper interactions with adversaries. For IDS technology to improve, a next-generation cyber defense is proposed in which cyber attacks are unconventionally reimagined as free sources of live IDS training data. Rather than aborting attacks against legitimate services, adversarial interactions are selectively prolonged to maximize the defender’s harvest of useful threat intelligence. Enhancing web services with deceptive attack-responses in this way is shown to be a powerful and practical strategy for improved detection, addressing several perennial challenges for machine learning-based IDS in the literature, including scarcity of training data, the high labeling burden for (semi-)supervised learning, encryption opacity, and concept differences between honeypot attacks and those against genuine services. By reconceptualizing software security patches as feature extraction engines, the approach conscripts attackers as free penetration testers, and coordinates multiple levels of the software stack to achieve fast, automatic, and accurate labeling of live web streams.Prototype implementations are showcased for two feature set models to extract security-relevant network- and system-level features from cloud services hosting enterprise-grade web applications. The evaluation demonstrates that the extracted data can be fed back into a network-level IDS for exceptionally accurate, yet lightweight attack detection.

Risk assessment model of compromising personal data on mobile devices

Development of the information space to an avalanche-like increase in the volume of mobile data on the Internet. The generated digital portraits of users are becoming one of the main products for sale. The high quality of user digital portraits and their number is achieved through the use of intelligent data processing methods and the presence of large data sets. The volume of data processed by mobile devices and the number of modern services that collect various types of information make the issue of ensuring the confidentiality of user information the most important. Existing security mechanisms for mobile operating systems, as a rule, are aimed at neutralizing harmful effects and do not ensure the safety of personal data from legitimate services. The article proposes a model for assessing the risks of compromising personal data on mobile devices based on the correlation analysis of public information about service developers in order to detect the possibility of aggregating data from various sources.