Recent Attacks Research Articles

Emotions and Their Correctness Conditions: A Defense of Attitudinalism

In this paper, we contrast the different ways in which the representationalist and the attitudinalist in the theory of emotions account for the fact that emotions have evaluative correctness conditions. We argue that the attitudinalist has the resources to defend her view against recent attacks from the representationalist. To this end, we elaborate on the idea that emotional attitudes have a rich profile and explain how it supports the claim that these attitudes generate the wished-for evaluative correctness conditions. Our argument rests on the idea that emotional attitudes manifest a sensitivity to evaluative evidence and that this sensitivity secures the kind of normativity we expect of the emotions. We bring our discussion to a close by assessing whether the psychological underpinnings of this sensitivity to evaluative evidence are such as to threaten the foundation of attitudinalism: the idea that emotions do not represent values. Given the available models of how we might access values prior to emotional experience, we conclude that the attitudinalist is still in the game.

A distributed intrusion detection system to detect DDoS attacks in blockchain-enabled IoT network

The Internet of Things (IoT) is emerging as a new technology for the development of various critical applications. However, these applications are still working on centralized storage architecture and have various key challenges like privacy, security, and single point of failure. Recently, the blockchain technology has emerged as a backbone for the IoT-based application development. The blockchain can be leveraged to solve privacy, security, and single point of failure (third-part dependency) issues of IoT applications. The integration of blockchain with IoT can benefit both individual and society. However, 2017 Distributed Denial of Service (DDoS) attack on mining pool exposed the critical fault-lines among blockchain-enabled IoT network. Moreover, this application generates huge amount of data. Machine Learning (ML) gives complete autonomy in big data analysis, capabilities of decision making and therefore is used as an analytical tool. Thus, in order to address above challenges, this paper proposes a novel distributed Intrusion Detection System (IDS) using fog computing to detect DDoS attacks against mining pool in blockchain-enabled IoT Network. The performance is evaluated by training Random Forest (RF) and an optimized gradient tree boosting system (XGBoost) on distributed fog nodes. The proposed model effectiveness is assessed using an actual IoT-based dataset i.e., BoT-IoT, which includes most recent attacks found in blockchain-enabled IoT network. The results indicate, for binary attack-detection XGBoost outperforms whereas for multi-attack detection Random Forest outperforms. Overall on distributed fog nodes RF takes less time for training and testing compared to XGBoost.

Penetration of Energized Metal Fragments to Porcine Thoracic Tissues.

Energized fragments from explosive devices have been the most common mechanism of injury to both military personnel and civilians in recent conflicts and terrorist attacks. Fragments that penetrate into the thoracic cavity are strongly associated with death due to the inherent vulnerability of the underlying structures. The aim of this study was to investigate the impact of fragment-simulating projectiles (FSPs) to tissues of the thorax in order to identify the thresholds of impact velocity for perforation through these tissues and the resultant residual velocity of the FSPs. A gas-gun system was used to launch 0.78-g cylindrical and 1.13-g spherical FSPs at intact porcine thoracic tissues from different impact locations. The sternum and rib bones were the most resistant to perforation, followed by the scapula and intercostal muscle. For both FSPs, residual velocity following perforation was linearly proportional to impact velocity. These findings can be used in the development of numerical tools for predicting the medical outcome of explosive events, which in turn can inform the design of public infrastructure, of personal protection, and of medical emergency response.

On the complexity of fair coin flipping

A two-party coin-flipping protocol is ε-fair if no efficient adversary can bias the output of the honest party (who always outputs a bit, even if the other party aborts) by more than ε. Cleve [STOC '86] showed that r-round o(1/r)-fair coin-flipping protocols do not exist. Awerbuch, Blum, Chor, Goldwasser, and Micali [Manuscript '85] constructed a Θ(1/r)-fair coin-flipping protocol, assuming the existence of one-way functions. Moran, Naor, and Segev [Journal of Cryptology '16] constructed an r-round coin-flipping protocol that is Θ(1/r)-fair (thus matching the aforementioned lower bound of Cleve [STOC '86]), assuming the existence of oblivious transfer.The above gives rise to the intriguing question of whether oblivious transfer, or more generally “public-key primitives,” is required for an o(1/r)-fair coin-flipping protocol. Towards answering this intriguing question, Maji and Wang [Crypto '18] have recently showed that in the random oracle model (ROM), any coin-flipping protocol can be biased by Ω(1/r). This implies that o(1/r)-fair coin-flipping protocol cannot be constructed from one-way function, or from a family of collision-resistant hash functions, in a black-box way. This result does not rule out, however, non black-box constructions, and black-box constructions based on primitives that cannot be realized in the ROM.We make a different progress towards answering above question by showing that, for any constant r∈N, the existence of an 1/(c⋅r)-fair, r-round coin-flipping protocol implies the existence of an infinitely-often key-agreement protocol, where c denotes some universal constant (independent of r). Our reduction is non black-box and makes a novel use of the recent dichotomy for two-party protocols of Haitner, Nissim, Omri, Shaltiel, and Silbak [SICOMP '20] to facilitate a two-party variant of the recent attack of Beimel, Haitner, Makriyannis, and Omri [FOCS '18] on multi-party coin-flipping protocols.

The reputational contagion effects of ransomware attacks

Little research examines investor attention outcomes spreading between firms through partial ownership, without additional business or industry linkages, including the spread of investor attention reactions to firms that are competitors to those firms having ownership stakes in impacted firms. We take advantage of the recent Colonial Pipeline ransomware attack, evidencing reputational contagion from firms impacted directly by reputation events to firms that are competitors of the firms that have significant ownership with the impacted firm, but otherwise no other industrial overlaps. Our results suggest investor attention events have greater breadth of impact than previously realized.

Machine-Learning-Based Darknet Traffic Detection System for IoT Applications

The massive modern technical revolution in electronics, cognitive computing, and sensing has provided critical infrastructure for the development of today’s Internet of Things (IoT) for a wide range of applications. However, because endpoint devices’ computing, storage, and communication capabilities are limited, IoT infrastructures are exposed to a wide range of cyber-attacks. As such, Darknet or blackholes (sinkholes) attacks are significant, and recent attack vectors that are launched against several IoT communication services. Since Darknet address space evolved as a reserved internet address space that is not contemplated to be used by legitimate hosts globally, any communication traffic is speculated to be unsolicited and distinctively deemed a probe, backscatter, or misconfiguration. Thus, in this paper, we develop, investigate, and evaluate the performance of machine-learning-based Darknet traffic detection systems (DTDS) in IoT networks. Mainly, we make use of six supervised machine-learning techniques, including bagging decision tree ensembles (BAG-DT), AdaBoost decision tree ensembles (ADA-DT), RUSBoosted decision tree ensembles (RUS-DT), optimizable decision tree (O-DT), optimizable k-nearest neighbor (O-KNN), and optimizable discriminant (O-DSC). We evaluate the implemented DTDS models on a recent and comprehensive dataset, known as the CIC-Darknet-2020 dataset, composed of contemporary actual IoT communication traffic involving four different classes that combine VPN and Tor traffic in a single dataset covering a wide range of captured cyber-attacks and hidden services provided by the Darknet. Our empirical performance analysis demonstrates that bagging ensemble techniques (BAG-DT) offer better accuracy and lower error rates than other implemented supervised learning techniques, scoring a 99.50% of classification accuracy with a low inferencing overhead of 9.09 µ second. Finally, we also contrast our BAG-DT-DTDS with other existing DTDS models and demonstrate that our best results are improved by (1.9~27%) over the former state-of-the-art models.

Shark attacks in New Caledonia from 1958 to 2020: a review of cases

RésuméContexte et objectifsNous présentons une série de cas d’attaques de requins survenues en Nouvelle-Calédonie, afin de proposer aux usagers du milieu marin concernés et aux autorités en charge de la sécurité du public un état des lieux de cette problématique.MéthodesUn recueil de cas réalisé par les auteurs a fait l’objet d’une base de données, dont les résultats sont analysés et présentés ici sous forme synthétique.RésultatsNous avons répertorié 67 cas d’attaques de requins en Nouvelle-Calédonie de 1958 à 2020, dont 13 fatales. Le nombre des attaques a augmenté au fil des années. Les attaques ont concerné majoritairement des chasseurs sous-marins et des apnéistes récoltant des invertébrés (58,5 % du total des attaques). La proportion d’attaques de baigneurs, nageurs et adeptes du snorkeling (18,5 % du total des attaques) et celle des pratiquants des sports de glisse (14 %) pourraient avoir augmenté ces dernières décennies. Une attaque de plongeur en scaphandre autonome a été répertoriée. La létalité des attaques est de près d’une sur cinq, supérieure à la moyenne mondiale. Les principales espèces en cause sont le requin tigre Galeocerdo cuvier (20 attaques, dont 8 mortelles) et le requin bouledogue Carcharhinus leucas (14 attaques, dont 2 mortelles). Deux attaques ont été attribuées au grand requin blanc Carcharodon carcharías, dont une mortelle.ConclusionsLa stimulation alimentaire apparaît comme le principal facteur favorisant les attaques. L’information du public mériterait d’être optimisée dans une perspective de prévention des accidents.

Does the Self-training in Ménière's Disease Fit the Disease Characteristics and Help Alleviate the Balance Problems?

Background: To examine whether the self-initiated exercise in Ménière’s disease fits the characteristics of the balance problems.Methods: This retrospective study included 539 people with Ménière’s disease belonging to the Finnish Ménière Federation. The mean age was 61.9 years with a mean history of Ménière’s disease of 15.6 years. The data were collected with an online questionnaire.Results: In total, 30% of the patients did not do any training, 23% did training once a week, 22% did 2-3 times a week, and 26% did the training daily. The most common training exercises were different self-training exercises (26%) followed by walking (16%), guided training (15%), viewing plus balance training (10%), and viewing training (4%). Non-defined balance problems (18%) were associated with recent vertigo attacks. Swaying type of balance problems were present in 23% and they used all types of training programs. Rocking type of balance disorder was present in 8% and they preferred guided training exercises. Tripping off type of balance disorder was present in 25% and they preferred viewing plus balance training.Conclusions: The type of self-training used was related to the type of balance problems reported. When choosing the vestibular rehabilitation in Ménière’s disease , the type of balance disorder should be characterized and the rehabilitation program should be individually tailored.

Good, Actually: Aristotelian Metaphysics and the ‘Guise of the Good’

AbstractIn this paper I argue that both defence and criticism of the claim that humans act ‘under the guise of the good’ neglects the metaphysical roots of the theory. I begin with an overview of the theory and its modern commentators, with critics noting the apparent possibility of acting against the good, and supporters claiming that such actions are instances of error.These debates reduce the ‘guise of the good’ to a claim about intention and moral action, and in so doing have become divorced from the theory's roots in classical and medieval philosophy. Aristotle and Aquinas’ ‘guise of the good’ is primarily a metaphysical claim resting on the equivalence between actuality and goodness, from which conclusions about moral action are derived. I show the reasoning behind their theory and how it forms the basis for the claims about intention and action at the centre of the modern debate. Finally, I argue that the absence of its original foundation is apparent in recent attacks on the ‘guise of the good’. It is unsurprising that modern action theory and ethics have not always been able to comfortably accommodate the ‘guise of the good’; they are only telling half of the story.

Abstract WP179: Impact Of Different Cardiac Rhythm Monitoring Strategies On Secondary Stroke Prevention: A Systematic Review And Network Meta-analysis Of Randomized Controlled Clinical Trials

Background and Purpose: Prolonged cardiac rhythm monitoring can reveal a substantial proportion of ischemic stroke (IS) patients with atrial fibrillation (AF). We sought to evaluate the potential utility of available prolonged cardiac rhythm monitoring strategies with respect to secondary stroke prevention. Methods: We searched Medline and Scopus databases to identify randomized controlled clinical trials (RCTs) comparing AF detection, anticoagulation initiation and stroke recurrence rates in patients with history of recent IS or transient ischemic attack (TIA) receiving cardiac rhythm monitoring with implantable loop recorders (ILRs), 30-days external loop recorders or Holter monitors. We performed a network meta-analysis to combine direct and indirect evidence for any given pair of monitoring devices that were evaluated within a trial and reported effect estimates with risk ratios (RRs) and corresponding 95% confidence intervals (95%CIs). Results: We identified 5 RCTs including a total of 2202 patients (mean age 68 years, 40% women). In indirect analyses the likelihood of AF detection and anticoagulation initiation was higher for both ILR (RR=8.48, 95%CI: 3.41, 21.06; RR=3.29, 95%CI: 1.70-6.39) and external loop recorders (RR=3.06, 95%CI: 1.66, 5.61; RR=1.63, 95%CI: 1.03-2.58) compared to Holter devices. The probability of AF detection and anticoagulation initiation was lower for Holter and external loop recorders compared to ILR devices (RR=0.36, 95%CI: 0.15, 0.85 and RR=0.50, 95%CI: 0.25-0.98, respectively). No difference in the risk of stroke recurrence was found in the indirect comparisons of different cardiac rhythm monitoring strategies. Conclusion: The likelihood of AF detection and anticoagulation initiation after an ischemic stroke or TIA is higher with ILRs compared to both external loop recorders and Holter devices.

Verifying liquidity of recursive Bitcoin contracts

Smart contracts - computer protocols that regulate the exchange of crypto-assets in trustless environments - have become popular with the spread of blockchain technologies. A landmark security property of smart contracts is liquidity: in a non-liquid contract, it may happen that some assets remain frozen, i.e. not redeemable by anyone. The relevance of this issue is witnessed by recent liquidity attacks to Ethereum, which have frozen hundreds of USD millions. We address the problem of verifying liquidity on BitML, a DSL for smart contracts with a secure compiler to Bitcoin, featuring primitives for currency transfers, contract renegotiation and consensual recursion. Our main result is a verification technique for liquidity. We first transform the infinite-state semantics of BitML into a finite-state one, which focusses on the behaviour of a chosen set of contracts, abstracting from the moves of the context. With respect to the chosen contracts, this abstraction is sound, i.e. if the abstracted contract is liquid, then also the concrete one is such. We then verify liquidity by model-checking the finite-state abstraction. We implement a toolchain that automatically verifies liquidity of BitML contracts and compiles them to Bitcoin, and we assess it through a benchmark of representative contracts.

Review: From Back Alley to the Border: Criminal Abortion in California, 1920–1969, by Alicia Gutierrez-Romine

Review: <i>From Back Alley to the Border: Criminal Abortion in California, 1920–1969</i>, by Alicia Gutierrez-Romine

Gut microbiome alterations in hereditary angioedema

BackgroundHereditary angioedema (HAE) is a rare disease with wide intra- and interindividual clinical variation. There are no reliable indicators available in clinical practice to predict the onset and severity of HAE. Uncovering the changes in the gut microbiota in HAE patients may offer insight into a missing piece of the pathogenesis and help explain the clinical heterogeneity. ObjectiveExplore whether dysbiosis exists in patients with HAE and whether there are biomarkers to indicate the episodes. MethodsFecal samples and clinical data were collected from patients with C1-inhibitor–related HAE and their healthy family members. Patients were grouped on the basis of the most recent conditions of HAE episodes and major clinical manifestations. The gut microbiota was evaluated by sequencing the 16S ribosomal RNA gene and analyzed for diversity. ResultsMicrobial richness and diversity were significantly reduced among patients who had recent HAE attacks, especially for those presenting with abdominal symptoms (P = .003 and P = .048 compared with healthy controls and patients with no recent episodes, respectively). Decreased Firmicutes and increased Proteobacteria were found among the individuals with a recent episode, along with a marked increase of pathogenic bacteria on the basis of the predictive functional profiling. Dysbiosis was restored after regular use of danazol or tranexamic acid. A combined biomarker composed of Bifidobacterium, Lachnospira, Paraprevotella, Desulfovibrio, and Staphylococcus was proposed to detect the recent edema episodes. ConclusionWe reported alterations of the gut microbiome in patients with HAE and explored the possible role of bacteria in the etiology of edema episodes, which may provide new clues for the prediction of disease course, clinical treatment, and therapeutic evaluation.

Dissecting traffic fingerprinting CNNs with filter activations

HTTPS encrypted traffic flows leak information on underlying contents through various statistical properties such as packet lengths and timing, enabling traffic fingerprinting attacks. Recent traffic fingerprinting attacks leveraged Convolutional Neural Networks (CNNs) to record very high accuracies undermining state-of-the-art defenses. In this paper, we analyze such CNNs to understand their inner workings which helps in building efficient traffic classifiers and effective defenses. First, we experiment on three datasets and show that website fingerprinting CNNs focus majorly on transitions between uploads and downloads in trace fronts while video fingerprinting CNNs focus more on finer shapes of periodic bursts. Next, we show that traffic fingerprinting CNNs exhibit transfer-learning capabilities allowing identification of new websites with fewer data. We also demonstrate how traffic fingerprinting CNNs outperform Recurrent Neural Networks (RNNs) due to their resilience to random shifts in data, which is common in network traces. We further generalize these observations on other publicly available network traffic datasets. Leveraging our observations, we propose two new defenses against traffic fingerprinting. Our first defense FRONT-U, defends website visits by obfuscating transitions between uploads and downloads in trace fronts and provides similar privacy as the state-of-the-art defense FRONT, with half the data overhead. Our second defense STOMA, defends streaming traffic by obfuscating the finer sub-bursts within major bursts of a trace using only the next few seconds as opposed to using the entire trace as in the state-of-the-art.

Risk of serious COVID-19 outcomes among adults with asthma in Scotland: a national incident cohort study

SummaryBackgroundThere is considerable uncertainty over whether adults with asthma should be offered booster vaccines against SARS-CoV-2 and, if so, who should be prioritised for booster vaccination. We were asked by the UK's Joint Commission on Vaccination and Immunisation to undertake an urgent analysis to identify which adults with asthma were at an increased risk of serious COVID-19 outcomes to inform deliberations on booster COVID-19 vaccines.MethodsThis national incident cohort study was done in all adults in Scotland aged 18 years and older who were included in the linked dataset of Early Pandemic Evaluation and Enhanced Surveillance of COVID-19 (EAVE II). We used data from EAVE II to investigate the risk of COVID-19 hospitalisation and the composite outcome of intensive care unit (ICU) admission or death from COVID-19 among adults with asthma. A Cox proportional hazard model was used to derive adjusted hazard ratios (HRs) and 95% CIs for the association between asthma and COVID-19 hospital admission and ICU admission or death, stratified by markers of history of an asthma attack defined by either oral corticosteroid prescription (prednisolone, prednisone, and dexamethasone) in the 2 years before March 1, 2020, or hospitalisation for asthma before March 1, 2020. Analyses were adjusted for age, sex, socioeconomic status, comorbidity, previous hospitalisation, and vaccine status.FindingsBetween March 1, 2020, and July 27, 2021, 561 279 (12·7%) of 4 421 663 adults in Scotland had clinician-diagnosed-and-recorded-asthma. Among adults with asthma, 39 253 (7·0%) had confirmed SARS-CoV-2 infections, of whom 4828 (12·3%) were admitted to hospital for COVID-19 (among them, an estimated 600 [12·4%] might have been due to nosocomial infections). Adults with asthma were found to be at an increased risk of COVID-19 hospital admission (adjusted HR 1·27, 95% CI 1·23–1·32) compared with those without asthma. When using oral corticosteroid prescribing in the preceding 2 years as a marker for history of an asthma attack, the adjusted HR was 1·54 (95% CI 1·46–1·61) for those with three or more prescribed courses of oral corticosteroids, 1·37 (1·26–1·48) for those with two prescribed courses, 1·30 (1·23–1·37) for those with one prescribed course, and 1·15 (1·11–1·21) for those without any courses, compared with those aged 18 years or older without asthma. Adults with asthma were found to be at an increased risk of COVID-19 ICU admission or death compared with those without asthma (adjusted HR 1·13, 95 % CI 1·05–1·22). The adjusted HR was 1·44 (95% CI 1·31–1·58) for those with three or more prescribed courses of oral corticosteroids, 1·27 (1·09–1·48) for those with two prescribed courses, 1·04 (0·93–1·16) for those with one prescribed course, and 1·06 (0·97–1·17) for those without any course, compared with adults without asthma.InterpretationAdults with asthma who have required two or more courses of oral corticosteroids in the previous 2 years or a hospital admission for asthma before March 1, 2020, are at increased risk of both COVID-19 hospitalisation and ICU admission or death. Patients with a recent asthma attack should be considered a priority group for booster COVID-19 vaccines.FundingUK Research and Innovation (Medical Research Council), Research and Innovation Industrial Strategy Challenge Fund, Health Data Research UK, and Scottish Government.

Visualizing Realistic Benchmarked IDS Dataset: CIRA-CIC-DoHBrw-2020

Intrusion Detection System (IDS) dataset is crucial to detect lateral movement of cyber-attacks. IDS dataset will help to train the IDS classifier model to achieve earliest detection. A good near-realism public dataset is essential to assist the development of advanced IDS classifier models. However, the available public IDS dataset has long been under scrutiny for its practicality to reflect real low-footprint cyber threats, render real-time network scenario, reflect recent malware attack over newly developed DoH protocol, disregard layer 3 information and finally publish contradictory results of classification and analysis between various studies which makes it non-reproducible and without shareable results. This problem can be resolved by sophisticatedly visualizing a new realistic, real-time, low footprint and up-to-date benchmarked dataset. Visualization helps to detect data deformation before designing the optimized and highly accurate classifier model. Therefore, this study aims to review a new realistic benchmarked IDS dataset and apply sophisticated technique to visualize them. The review starts by carefully examining production network features. These are then compared with various well-established public IDS datasets. Many of them are static, unrealistic meta-features and disregard source and destination Internet Protocol (IP) information except CIRA-CIC-DoHBrw-2020 dataset. The study then applies Eigen Centrality (EC) technique from the graph theory to visualize this layer 3 (L3) information. Finally, using various visualization techniques such as Principal Component Analysis (PCA) and Gaussian Mixture Model (GMM), the study further analyzes and subsequently visualizes the data. Results show that the CIRA-CIC-DoHBrw-2020 simulated recent malware attack and has a very imbalanced dataset which reflects the realistic low-footprint cyber-attacks. The centrality graph clearly visualizes IPs that are compromised by recent DoH attack in real-time, and the study concludes decisively that smaller packet length of size 1000 to 2000 bytes is to fit an attack trait.

Back in Black: A Comparative Evaluation of Recent State-Of-The-Art Black-Box Attacks

The field of adversarial machine learning has experienced a near exponential growth in the amount of papers being produced since 2018. This massive information output has yet to be properly processed and categorized. In this paper, we seek to help alleviate this problem by systematizing the recent advances in adversarial machine learning black-box attacks since 2019. Our survey summarizes and categorizes 20 recent black-box attacks. We also present a new analysis for understanding the attack success rate with respect to the adversarial model used in each paper. Overall, our paper surveys a wide body of literature to highlight recent attack developments and organizes them into four attack categories: score based attacks, decision based attacks, transfer attacks and non-traditional attacks. Further, we provide a new mathematical framework to show exactly how attack results can fairly be compared.

МОЖЛИВОСТІ ТА ПРОБЛЕМНІ ПИТАННЯ УДОСКОНАЛЕННЯ ЗАХИСТУ ОБʼЄКТІВ КРИТИЧНОЇ ІНФРАСТРУКТУРИ У СУЧАСНИХ УМОВАХ

The aggressive war against Ukraine makes it clear that the hopes of mankind that future wars will take place in the form of low-intensity conflicts, but rather in the economic, informational spheres without the use of military force, turned out to be in vain. Russia has demonstrated that such seemingly wild actions for the modern civilized world as the seizure of territories, the destruction of cities, attempts to destroy the statehood and self-consciousness of nations will remain relevant as long as autocratic regimes exist and there are no effective international mechanisms that would make any armed aggression impossible. Consequently, the issue of protecting territories and infrastructure in the face of large-scale aggression using the entire list of available types of means of armed struggle will, unfortunately, be relevant in the near future. The article analyzes the recent massive attacks on infrastructure facilities and modern technologies of air defense weapons. As a result of the analysis, possible directions for improving the protection of critical infrastructure facilities were proposed, the main of which is the use of a wide range of systems and complexes of very short-range weapons. In addition, a number of problematic issues and tasks were identified that need to be considered in order to improve the protection of critical infrastructure facilities, the main of which are: safety providing of using the proposed systems directly in populated areas or near them; ensuring the rational use of the resource of weapons, ammunition and other equipment and materiel associated with the functioning of the protection systems of objects; determination of the military formation which will be responsible for infrastructure facilities protecting.

Multiclass Classification-Based Side-Channel Hybrid Attacks on Strong PUFs

Physical unclonable functions (PUFs) are promising solutions for low-cost device authentication; hence, ignoring the security of PUFs is becoming increasingly difficult. Generally, strong PUFs are vulnerable to classical machine learning (ML) attacks; however, classical ML attacks do not perform well on strong PUFs with complex structures. Side-channel analysis (SCA) hybrid attacks provide efficient approaches to modeling XOR APUF. However, owing to the inadequate exploitation of all available data, recent SCA hybrid attacks may fail on novel PUF designs, such as MPUF and iPUF. Thus, herein, we introduce a method that combines challenge-response pairs with side-channel information to construct challenge-synthetic-feature pairs (CSPs) via feature cross, thereby making it possible to model strong PUFs through multiclass classification. We propose multiclass classification-based SCA hybrid attacks to model strong PUFs with complex structures. When provided with CSPs, the proposed hybrid attacks use a feed-forward neural network with a softmax activation function to build combined models of PUFs. The combined models predict class labels for given challenges and then reveal responses through simple mappings from these labels. Experimental results show that the proposed attacks could model 16-XOR APUF, (128,5)-MPUF, (8,8)-iPUF, and (2,16)-iPUF with accuracies exceeding 94%. Compared with state-of-the-art modeling techniques, the proposed attack has advantages in terms of modeling accuracy, time cost, and the size of required training data.

Order-Hiding Range Query Over Encrypted Cloud Data

Range query on encrypted data has been widely studied to achieve fast query processing while keeping data and queries secret. Prior work hides even the ordering information of the data, but sacrifices accuracy (e.g., false positives) and efficiency (e.g., exponential complexity in the domain size) as a trade-off. Moreover, hiding the order alone is not sufficient to prevent the recent database reconstruction attacks on range query abusing access pattern and volume leakage. Several countermeasures prevent such information leakage but incur practically unacceptable storage or computational overhead due to fake records embedded in the database and database re-encryption procedures. In this paper, we first propose a range query scheme RevealRE, which is highly efficient, but reveals ordering information. We then extend RevealRE to construct HideRE, a range query scheme that does not leak data ordering information while accurate (i.e., no false positives/negatives) and efficient (i.e., logarithmic search time). HideRE can mitigate the database reconstruction attacks by introducing deceptive queries, which are indistinguishable from regular queries while obfuscating the queried ranges. We experimentally confirm efficiency of our construction under various data distribution models, demonstrating the practicality. Resilience to database reconstruction attacks of our order-hiding range query scheme is formally proved.