Malicious Operations Research Articles

Investigation of Low-Moral Actions by Malicious Anonymous Operators of Avatar Robots

Avatar robots allow a teleoperator to interact with the people and environment of a remote place. Malicious operators can use this technology to perpetrate malicious or low-moral actions. In this study, we used hazard identification workshops to identify low-moral actions that are possible through the locomotor movement, cameras, and microphones of an avatar robot. We conducted three workshops, each with four potential future users of avatars, to brainstorm possible low-moral actions. As avatars are not yet widespread, we gave participants experience with this technology by having them control both a simulated avatar and a real avatar as a malicious anonymous operator in a variety of situations. They also experienced sharing space with an avatar controlled by a malicious anonymous operator. We categorized the ideas generated from the workshops using affinity diagram analysis and identified four major categories: violate privacy and security, inhibit, annoy, and destroy or hurt. We also identified subcategories for each. In the second half of this study, we discuss all low-moral action subcategories in terms of their detection, mitigation, and prevention by studying literature from autonomous, social, teleoperated, and telepresence robots as well as other fields where relevant.

Fake Instagram Account Detection using ML Algorithms

Abstract—Nowadays, the majority of people utilise social networking sites on a daily basis. Numerous people create profiles on social networking websites every day and connect with others there, regardless of their location or time. False identities are used in additional malicious operations in addition to playing a significant part in advanced persistent threats. Users of social networking sites can benefit from them, but they also have to worry about the security of their personal information. We must first determine the user's social network accounts before we can determine who is endorsing threats in these platforms. Social media usage has dramatically increased in recent years, according to statistics. Social networking sites have made things easier as they allow us to connect to people effortlessly and converse with them without the requirement for physical meetups. One of the major issues with Online Social Networks (OSNs) is fake interaction, which is used to artificially boost an account's popularity. Because phoney involvement causes businesses to lose money, inaccurate audience targeting in advertising, inaccurate product prediction systems, and an undesirable social network atmosphere, its detection is essential. Based on the classification, it is required to distinguish between real and phoney profiles on social media.Several categorization techniques have traditionally been used to identify phoney social media accounts. However, there are ways to improve social media's ability to detect phoney profiles. The suggested effort uses technology and machine learning to boost the percentage of predicted phoney profiles. Chi-square technique is used in feature selection models to find the best data. The several machine learning methods, including the Logistic Regression and Random Forest algorithms, are used in the classification approach. The classification outcome based on recall, sensitivity, specificity, f1-score, accuracy, and precision. Keywords—Machine learning, online social networks, Instagram, Social media, Natural language process.

A Lightweight Anonymous Authentication and Key Negotiation Scheme in Smart Home Environments

With the rapid development of Internet of Things (IoT) technology, smart home users can access and control smart devices remotely to enjoy convenient and efficient services. However, sensitive data collected by smart devices is vulnerable to attacks such as eavesdropping and simulation when transmitted through public channels. At the same time, the security of resource-constrained smart devices is low, and attackers may use the controlled devices to carry out malicious operations further. To address the aforementioned existing security issues, this paper proposes a lightweight user anonymous authentication scheme for resource-constrained smart home environments. At the same time, the security analysis is carried out to further prove the proposed scheme's security. Finally, the performance analysis between the proposed scheme and the existing similar schemes proves that the proposed scheme has advantages in calculation cost and safety characteristics.

GUARDIAN: A Hardware-Assisted Distributed Framework to Enhance Deep Learning Security

The ubiquity of artificial intelligence (AI) has led to its extensive research and application in various fields, such as computer vision, natural language processing, and medical image analysis. However, responsible AI faces severe security challenges, including the leakage of pretrained models and valuable training data. The existing solutions adopt new algorithm designs (such as federated learning) or cryptography (such as homomorphic encryption) to prevent possible security vulnerabilities. We observe that hardware-assisted trusted execution environments (TEEs) can further improve machine learning responsibility. Intel Software Guard Extension (SGX) is a popular, trusted execution hardware that enables users’ programs to run in an untrusted execution environment, such as a malicious operating system, but ensures the confidentiality and integrity of data. Therefore, we have designed, a hardware-assisted secure machine learning training framework that protects data security during the training process. We have analyzed the typical characteristics of machine learning applications and characterized through extensive experiments. Our findings demonstrate that introducing security guarantees causes performance degradation, which provides a feasible optimization direction in the near future.

An Efficient and Provably Secure Identity Authentication Scheme for VANET

In recent years, many researchers have applied aggregated signature techniques to resource-constrained vehicular Ad Hoc networks (VANET) authentication scenarios. We reviewed two recent VANET authentication schemes based on certificateless aggregated signatures (CLAS) while demonstrating that neither of them is resistant to public key replacement attacks under their security models. An eavesdropper can successfully forge a legitimate signature to perform malicious operation. To further address the above security flaws, we propose an improved CLAS scheme for VANET. Considering that some researchers have briefly or even incorrectly used forking lemmas in their security proofs to prove an insecure CLAS scheme, we further improve and refine the security model and security proof method for CLAS, which make the proof process transparent by using general forking lemma. Based on these improvements, our scheme can resist attacks from two types of adversaries in the CLAS security model. In the final performance analysis, the improved CLAS scheme outperforms the secure related scheme of recent years in terms of both computational and communication efficiency. Therefore, our proposal is more suitable for resource-constrained VANET environments.

Securing TEEs With Verifiable Execution Contracts

Recent works have demonstrated that trusted execution environments, such as Intel Software Guard Extensions, are vulnerable to various attacks from the privileged software, including side-channel attacks. Existing solutions, such as T-SGX, Déjà Vu, Cloak and Varys, detect side-channel attacks at runtime. But they are limited by design, because false detection is unavoidable in these detection methods and therefore any security policy developed atop these mechanisms has to tolerate some malicious operations to achieve practical false positive detection rates. In this paper, we propose the concept of verifiable execution contracts, which request the privileged software to provide a benign execution environment for enclaves within which launching attacks becomes very difficult, if not impossible. Since the privileged software is untrusted, we design methods for verifying that the execution contracts are observed. With the proposed verifiable execution contracts, we analyzed how existing attacks could be mitigated.

SE-VFC: A Secure Framework for Computation Outsourcing in Vehicular Fog Computing Environments

Abstract: SE-VFC is a proposed computing scheme that addresses the challenge of providing secure and efficient outsourcing computing in vehicular fog computing. Vehicular fog computing is a paradigm that involves the utilization of computing resources in vehicles to provide various computing services to end- users. However, since fog vehicles may be untrusted, there is a potential for malicious operations that can cause serious accidents. To address this challenge, SE-VFC proposes the use of a secure and efficient outsourcing computing scheme that involves fog vehicles with computing resources. The scheme utilizes lightweight Boneh-Lynn-Shacham (BLS) signature and group signature for batch anonymous authentication of fog vehicles while preserving their privacy in multiple outsourcing tasks. This means that fog vehicles are authenticated and verified without revealing their identities, which helps to protect their privacy. Additionally, SE-VFC ensures the correctness of the computing results by verifying them. This helps to ensure that the results produced are accurate and reliable. Compared to existing schemes, SE-VFC has relatively low communication and computation overhead, making it efficient for batch authentication in multiple computing tasks. The effectiveness and practicality of the proposed scheme have been verified through extensive simulation results. Overall, SE-VFC is an important contribution to the field of vehicular fog computing, as it addresses the challenge of providing secure and efficient outsourcing computing while also ensuring the privacy and correctness of the computing results.

The cloud forensics frameworks and tools: A brief review

A Cloud is a platform that allows for quick application deployment and dynamic scaling. The cloud differs from on-premise software and data storage in terms of cost, security, scalability, recovery, and mobility which makes more businesses are switching from on-premise to cloud solutions every year. Although cloud computing models have several benefits over on-site models, they are nonetheless vulnerable to both internal and external threats. Even malicious operations can be carried out on the cloud with ease because of the flexible environment. Forensic investigations require the extraction of evidence, and analysis of a cloud system after an intrusion or break-in. It enables investigators to find and retrieve data from a variety of sources in the cloud environment. It is very challenging to find proof of a crime since the distributed nature of the cloud prevents evidence from being retained on a specific physical machine and instead disperses the data over various regions. This paper focuses on current forensic investigation tools used in the Cloud environment and highlights the need for the development of efficient cloud forensic tools.

A Data-Driven Cyber–Physical System Using Deep-Learning Convolutional Neural Networks: Study on False-Data Injection Attacks in an Unmanned Ground Vehicle Under Fault-Tolerant Conditions

Leveraging the benefits of deep-learning convolutional neural networks, we introduce a new data-driven cyber–physical system specifically designed to address the vulnerability of middleware software, namely, Robot Operating System (ROS), widely implemented in robotics in both civilian and military domains. As for our research platform, we employ the GVR-BOT unmanned ground vehicle, which is a replicate of the U.S. Army ground robot. We focus our study on the ability of the ground robot to operate under fault-tolerant conditions, making it challenging from the standpoint of cybersecurity to differentiate between legitimate and malicious operations. The GVR-BOT ground vehicle belongs to a class of differential drive ground robots and employs ROS in its onboard computer to interact with users. To facilitate deep learning, we develop a large database of images based on the network-traffic data of ROS, describing the dynamics of the GVR-BOT ground robot under legitimate and malicious operations. We use our image database to train and validate the performance of our deep-learning CNN system. Given a set of RGB/grayscale images describing the normalized time-series data representing the dynamics of the GVR-BOT ground robot, the objective of our proposed cybersecurity algorithm is to safeguard the legitimate operation of the ground robot under fault-tolerant conditions, such that any attempts to compromise its performance (e.g., malicious attacks) can be prevented within the minimum detection time. Our research indicates a promising result as our system is capable of detecting malicious attacks with high accuracy while recognizing its legitimate operations with reasonably small false-positive rates.

A Systematic and Comprehensive Survey of Recent Advances in Intrusion Detection Systems Using Machine Learning: Deep Learning, Datasets, and Attack Taxonomy

Recently, intrusion detection systems (IDS) have become an essential part of most organisations’ security architecture due to the rise in frequency and severity of network attacks. To identify a security breach, the target machine or network must be watched and analysed for signs of an intrusion. It is defined as efforts to compromise the confidentiality, integrity, or availability of a computer or network or to circumvent its security mechanisms. Several IDS have been proposed in the literature to efficiently detect such attempts exploiting different characteristics of cyberattacks. These systems can provide with timely sensing the network intrusions and, subsequently, notifying the manager or the responsible person in an organisation. Important actions are then carried out to reduce the degree of damage caused by the intrusion. Organisations use such techniques to defend their systems from the network disconnectivity and increase reliance on the information systems by employing intrusion detection. This paper presents a detailed summary of recent advances in IDS from the literature. Nevertheless, a review of future research directions for detecting malicious operations and launching different attacks on systems is discussed and highlighted. Furthermore, this study presents detailed description of well‐known publicly available datasets and a variety of strategies developed for dealing with intrusions.

Recent advances of Captcha security analysis: a short literature review

CAPTCHA has long been used to keep bots from misusing web services. Various CAPTCHA schemes have been proposed over the years, principally to increase usability and security against emerging bots and hackers performing malicious operations. However, automated attacks have effectively cracked all common conventional schemes, and the majority of present CAPTCHA methods are also vulnerable to human-assisted relay attacks. Invisible reCAPTCHA and some approaches have not yet been cracked. However, with the introduction of fourth generation bots accurately mimicking human behavior, a secure CAPTCHA would be hardly designed without additional special devices. In this paper, we presented a short literature review of the current CAPTCHA schemes, as well as highlighting new trends and open issues, the challenges, and the opportunities as a solid starting point for designing the future secure and usable CAPTCHA schemes.

Kernel-Based Container File Access Control Architecture to Protect Important Application Information

Container platforms ease the deployment of applications and respond to failures. The advantages of container platforms have promoted their use in information services. However, the use of container platforms is accompanied by associated security risks. For instance, malware uploaded by users can leak important information, and malicious operators can cause unauthorized modifications to important files to create service errors. These security threats degrade the quality of information services and reduce their reliability. To overcome these issues, important container files should be protected by file-access control functions. However, legacy file-access control techniques, such as umask and SecureOS, do not support container platforms. To address this problem, we propose a novel kernel-based architecture in this study to control access to container files. The proposed container file-access control architecture comprises three components. The functionality and performance of the proposed architecture were assessed by implementing it on a Linux platform. Our analysis confirmed that the proposed architecture adequately controls users’ access to container files and performs on par with legacy file-access control techniques.

Are Neural Ranking Models Robust?

Recently, we have witnessed the bloom of neural ranking models in the information retrieval (IR) field. So far, much effort has been devoted to developing effective neural ranking models that can generalize well on new data. There has been less attention paid to the robustness perspective. Unlike the effectiveness, which is about the average performance of a system under normal purpose, robustness cares more about the system performance in the worst case or under malicious operations instead. When a new technique enters into the real-world application, it is critical to know not only how it works in average, but also how would it behave in abnormal situations. So, we raise the question in this work: Are neural ranking models robust? To answer this question, first, we need to clarify what we refer to when we talk about the robustness of ranking models in IR. We show that robustness is actually a multi-dimensional concept and there are three ways to define it in IR: (1) the performance variance under the independent and identically distributed (I.I.D.) setting; (2) the out-of-distribution (OOD) generalizability ; and (3) the defensive ability against adversarial operations. The latter two definitions can be further specified into two different perspectives, respectively, leading to five robustness tasks in total. Based on this taxonomy, we build corresponding benchmark datasets, design empirical experiments, and systematically analyze the robustness of several representative neural ranking models against traditional probabilistic ranking models and learning-to-rank (LTR) models. The empirical results show that there is no simple answer to our question. While neural ranking models are less robust against other IR models in most cases, some of them can still win two out of five tasks. This is the first comprehensive study on the robustness of neural ranking models. We believe the way we study the robustness as well as our findings would be beneficial to the IR community. We will also release all the data and codes to facilitate the future research in this direction.

Human-artificial intelligence approaches for secure analysis in CAPTCHA codes

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) has long been used to keep automated bots from misusing web services by leveraging human-artificial intelligence (HAI) interactions to distinguish whether the user is a human or a computer program. Various CAPTCHA schemes have been proposed over the years, principally to increase usability and security against emerging bots and hackers performing malicious operations. However, automated attacks have effectively cracked all common conventional schemes, and the majority of present CAPTCHA methods are also vulnerable to human-assisted relay attacks. Invisible reCAPTCHA and some approaches have not yet been cracked. However, with the introduction of fourth-generation bots accurately mimicking human behavior, a secure CAPTCHA would be hardly designed without additional special devices. Almost all cognitive-based CAPTCHAs with sensor support have not yet been compromised by automated attacks. However, they are still compromised to human-assisted relay attacks due to having a limited number of challenges and can be only solved using trusted devices. Obviously, cognitive-based CAPTCHA schemes have an advantage over other schemes in the race against security attacks. In this study, as a strong starting point for creating future secure and usable CAPTCHA schemes, we have offered an overview analysis of HAI between computer users and computers under the security aspects of open problems, difficulties, and opportunities of current CAPTCHA schemes.

Detecting Sybil Attacks in Vehicular Fog Networks Using RSSI and Blockchain

Vehicular Fog Computing (VFC) is a paradigm of vehicular networks that has a set of advantages such as agility, efficiency, and reduced latency. The VFC is vulnerable to a variety of attacks, and existing security measures in traditional networks are not necessarily applicable to VFC. Among these attacks, we can find the Sybil attack that allows a vehicle to create multiple identities to perform malicious operations. In this paper, we propose a blockchain-based mechanism to detect Sybil attacks in VFC networks. The detection process consists of two levels; the first one is targeted toward the verification of the vehicle’s position by the FN using the Received Signal Strength Indicator (RSSI) technique. The FN delivers a position proof, if its position is valid, and stores it in the blockchain. At this point, the set of the obtained position proofs constitutes a trajectory. The second level is projected toward a comparison between the trajectories of the vehicles reporting an event. Two trajectories that pass through the same FNs at the same time, will be considered as Sybil trajectories. The objective of these two-level detections is to identify the Sybil attack in several attack scenarios performed by a powerful adversary. Our analysis shows that existing proposals cannot deal with such an adversary. Moreover, simulation results show the efficiency of our proposal in terms of communication, computation, and detection rate. Indeed, our system can reach a detection rate of 98% when the malicious vehicle generates several aliases simultaneously and sends position requests to the FN for each generated pseudonym.

Features Engineering for Malware Family Classification Based API Call

Malware is used to carry out malicious operations on networks and computer systems. Consequently, malware classification is crucial for preventing malicious attacks. Application programming interfaces (APIs) are ideal candidates for characterizing malware behavior. However, the primary challenge is to produce API call features for classification algorithms to achieve high classification accuracy. To achieve this aim, this work employed the Jaccard similarity and visualization analysis to find the hidden patterns created by various malware API calls. Traditional machine learning classifiers, i.e., random forest (RF), support vector machine (SVM), and k-nearest neighborhood (KNN), were used in this research as alternatives to existing neural networks, which use millions of length API call sequences. The benchmark dataset used in this study contains 7107 samples of API call sequences (labeled to eight different malware families). The results showed that RF with the proposed API call features outperformed the LSTM (long short-term memory) and gated recurrent unit (GRU)-based methods against overall evaluation metrics.

Blockchain-Enabled Conditional Decentralized Vehicular Crowdsensing System

The rapid growth of connected and autonomous vehicles (CAVs) shows an urgent demand for driving and transportation-related data, which gives rise to vehicular crowdsensing systems (VCSs). Nevertheless, the existing centralized VCS framework mainly faces the system reliability problem while the decentralized one cannot satisfy the management flexibility. In addition, when the privacy preservation scheme that prevents information leakage encounters the user selection scheme that desires detailed information of participants, how to balance this seemingly irreconcilable contradiction is inevitable for VCS. To remedy that, we take the first research attempt and explore the balance point between the system management, privacy preservation, and quality of experience (QoE) of participants. By fully exploiting the characters of participating entities, a blockchain-enabled conditional decentralized VCS is proposed in this paper. Firstly, we propose a privacy-preserving scheme where the zk-SNARK proof combines with the mixed-task smart contract to guarantee the interaction process will not reveal any private information of participants. Secondly, we propose an efficient reputation management mechanism that renders certain the participants can get a satisfactory QoE even under the condition that the private information of users is secured. And also, the malicious operations in the system will be effectively supervised. Theoretical analysis and extensive simulations demonstrate the security and efficiency properties of privacy preservation and indicate the effectiveness of reputation management.

A Cross-Domain Authentication Scheme Based on Cooperative Blockchains Functioning With Revocation for Medical Consortiums

Regional medical consortium systems facilitates medical information sharing. However, many security issues exposed by the dominant centralized architectures, such as single points of failure, unauthorized operations and illegal access, are increasingly apparent constraints on the security and efficiency of data sharing across domains. Even more, any malicious operation detected, effective measures should be executed promptly for identity tracing. In this paper, we propose a secure and efficient cross-domain authentication scheme based on two cooperative blockchains (BCs) for medical consortium systems. Specifically, an intra-domain BC records any legal users’ registration and authentication information while an inter-domain BC is responsible for writing users’ cross-domain authentication information. In each domain, the general hospital acts as a trusted third service provider to achieve cross-chain interactions. For the entire cross-domain authentication procedure, anonymity mechanism is utilized to enhance security, and to trace malicious users, the improved chameleon hash is used in the intra-domain BC to redact the state of the user, and blacklist merkle tree is extended in the inter-domain BC to protect different domains’ services from illegal accessing. In addition, security analysis and performance evaluation are completely given to prove the superior security features and performance compared with other schemes.

Attack and Anomaly Detection in IoT Sites Using Machine Learning Techniques

Abstract: A growing problem in the IoT space is the attack and anomaly detection in the infrastructure of the Internet of Things (IoT). Every domain is using IoT infrastructure more and more, and with that use comes a surge in risks and attacks against those infrastructures. Such attacks and anomalies that can lead to an IoT system failure include Denial of Service, Data Type Probing, Malicious Control, Malicious Operation, Scan, Spying, and Wrong Setup. Logistic Regression (LR), Decision Tree (DT) and Random Forest (RF) are the machine learning (ML) methods that have been employed in this. Accuracy, precision, recall, f1 score, and area under the receiver operating characteristic curve are the evaluation measures used in performance comparison. For Decision Tree and Random Forest, the system received test accuracy results of 99.4 %. Despite the same accuracy of these algorithms, other criteria show that Random Forest performs significantly better.

Command Authentication Using Multiagent System for Attacks on the Economic Dispatch Problem

Over the past decade, cyberattack events on the electricity grid are rising and have severely impacted grid operation. These attacks are becoming more intelligent as they can falsify critical data and bypass existing protection protocols. This could result in the system to operate in a nonoptimal condition and suffer substantial economic losses over a prolonged period. Hence, it is crucial to develop tools to defend the system against such attacks to minimize the cost of malicious operations. This article aims to develop a novel command authentication strategy to detect and mitigate false data injection attacks (FDIAs) targeting the system centralized economic dispatch (ED) control signals. First, we describe the ED problem based on Singapore’s deregulated market context. We then perform a risk assessment and formulate a stealthy FDIA vector targeting the ED control signals. Subsequently, we propose a novel authentication technique leveraging on the multiagent system, which includes detection and mitigation algorithms to verify the ED control commands. Last, we evaluate the efficiency and latency of the proposed technique on the 5-bus, 3-generating unit, and 15-generating unit test system. Simulation and experiment results using a real-time hardware-in-the-loop system proves that the authentication technique can detect and mitigate the stealthy FDIA vector with high accuracy.