SECRYPT 2023 Abstracts

Full Papers Short Papers
Full Papers
Paper Nr: 35
Title:

MEMES: Memory Encryption-Based Memory Safety on Commodity Hardware
Authors:

David Schrammel, Salmin Sultana, Karanvir Grewal, Michael LeMay, David M. Durham, Martin Unterguggenberger, Pascal Nasahl and Stefan Mangard
Abstract: Memory encryption is an effective security building block broadly available on commodity systems from Intel® and AMD. Schemes, such as Intel® TME-MK and AMD SEV, help provide data confidentiality and integrity, enabling cryptographic isolation of workloads on shared platforms. However, due to their coarse encryption granularity (i.e., pages or entire virtual machines), these hardware-enabled primitives cannot unleash their full potential to provide protection for other security applications, such as memory safety. To this end, we present a novel approach to achieving sub-page-granular memory encryption without hardware modifications on off-the-shelf systems featuring Intel®’s TME-MK. We showcase how to utilize our fine-grained memory encryption approach for memory safety by introducing MEMES. MEMES is capable of mitigating both spatial and temporal heap memory vulnerabilities by encrypting individual memory objects with different encryption keys. Compared to other hardware-based memory safety schemes, our approach works on existing commodity hardware, which allows easier adoption. Our extensive analysis attests to the strong security benefits which are provided at a geometric mean runtime overhead of just 16–27%.
Download
Paper Nr: 40
Title:

K-Anonymous Privacy Preserving Manifold Learning
Authors:

Sonakshi Garg and Vicenç Torra
Abstract: In this modern world of digitalization, abundant amount of data is being generated. This often leads to data of high dimension, making data points far-away from each other. Such data may contain confidential information and must be protected from disclosure. Preserving privacy of this high-dimensional data is still a challenging problem. This paper aims to provide a privacy preserving model to anonymize high-dimensional data maintaining the manifold structure of the data. Manifold Learning hypothesize that real-world data lie on a low-dimensional manifold embedded in a higher-dimensional space. This paper proposes a novel approach that uses geodesic distance in manifold learning methods such as ISOMAP and LLE to preserve the manifold structure on low-dimensional embedding. Later on, anonymization of such sensitive data is achieved by M-MDAV, the manifold version of MDAV using geodesic distance. MDAV is a micro-aggregation privacy model. Finally, to evaluate the efficiency of the proposed approach machine learning classification is performed on the anonymized lower-embedding. To emphasize the importance of geodesic-manifold learning, we compared our approach with a baseline method in which we try to anonymise high-dimensional data directly without reducing it onto a lower-dimensional space. We evaluate the proposed approach over natural and synthetic data such as tabular, image and textual data sets, and then empirically evaluate the performance of the proposed approach using different evaluation metrics viz. accuracy, precision, recall and K-Stress. We show that our proposed approach is providing accuracy up to 99% and thus, provides a novel contribution of analysing the effects of K-anonymity in manifold learning.
Download
Paper Nr: 41
Title:

AIS Authentication Using Certificateless Cryptography
Authors:

Axel Rousselot, Nora Cuppens and Samra Bouakkaz
Abstract: The Automatic Identification System (AIS) is a maritime situational awareness system, designed as a collision avoidance tool to increase security at sea. Widely accepted, its data is now used for various applications, from maritime traffic predictions to the environmental effects of noise pollution. However, the AIS has been designed without security in mind and does not embed any authentication strategy. Research has shown how this lack of authentication could lead to disastrous consequences. Authentication AIS is thus an active research field, but the constraints imposed by the AIS network require subtle protocol design and careful use of new cryptographic technologies. This work proposes an authentication scheme for the AIS using the advantages of certificateless cryptography. The scheme is backward-compatible with standard AIS versions. We evaluate the performance and security of our proposed scheme through simulations and theoretical analysis. Our results show that our scheme provides strong security guarantees and efficient performance, making it a promising candidate for authenticating AIS signals in practice.
Download
Paper Nr: 50
Title:

CAPoW: Context-Aware AI-Assisted Proof of Work Based DDoS Defense
Authors:

Trisha Chakraborty, Shaswata Mitra and Sudip Mittal
Abstract: Critical servers can be secured against distributed denial of service (DDoS) attacks using proof of work (PoW) systems assisted by an Artificial Intelligence (AI) that learns contextual network request patterns. In this work, we introduce CAPOW, a context-aware anti-DDoS framework that injects latency adaptively during communication by utilizing context-aware PoW puzzles. In CAPOW, a security professional can define relevant request context attributes which can be learned by the AI system. These contextual attributes can include information about the user request, such as IP address, time, flow-level information, etc., and are utilized to generate a contextual score for incoming requests that influence the hardness of a PoW puzzle. These puzzles need to be solved by a user before the server begins to process their request. Solving puzzles slows down the volume of incoming adversarial requests. Additionally, the framework compels the adversary to incur a cost per request, hence making it expensive for an adversary to prolong a DDoS attack. We include the theoretical foundations of the CAPOW framework along with a description of its implementation and evaluation.
Download
Paper Nr: 53
Title:

Adapting P2P Mixnets to Provide Anonymity for Uplink-Intensive Applications
Authors:

Francesco Buccafurri, Vincenzo De Angelis and Sara Lazzaro
Abstract: Anonymity in Web and Internet communication is a widely investigated problem. Mixnets represent certainly the most concrete and effective approach to achieving the above goal. In general, the drawback of these approaches is that anonymity has a price in terms of traffic overhead and latency, when the global adversary model is adopted. On the Internet, to achieve scalability and not to require relevant infrastructure and networkprotocol changes, only P2P overlay protocols can be used. In recent years, we are seeing a change in Internet traffic. Due to IoT, cloud storage, WSN, M2M, etc., uplink traffic is increasingly growing. An interesting problem to address is whether this new traffic configuration may enable new strategies for improving the effectiveness of P2P mixnet-like approaches. In this paper, we investigate this problem, by considering the most representative Internet-scale P2P mixnet, called Tarzan, which is designed to obtain strong anonymity while preserving low-latency applications. We experimentally demonstrate that changing the cover traffic from bidirectional to unidirectional by making tunnels cyclic is advantageous in the case of uplink-intensive applications. The outcomes of the paper can thus give a contribution to improve mixnet-based approaches in the future Internet.
Download
Paper Nr: 58
Title:

Classical to Post-Quantum Secure ABE-IBE Proxy Re-Encryption Scheme
Authors:

Muhammad N. Khan, Asha Rao, Seyit Camtepe and Josef Pieprzyk
Abstract: Maintaining data confidentiality at the asymmetric-resource devices across emerging technologies needs varying cryptographic algorithms. Quantum computing makes preserving data confidentiality across asymmetric infrastructure more difficult. However, exploiting the architecture of classical cryptographic schemes to integrate the post-quantum constructs could be used to maintain post-quantum level confidentiality over the Internet. This paper presents a post-quantum secure classical ABE-IBE proxy re-encryption scheme (L ABE-IBE PRE) that utilizes the classical ABE-IBE proxy re-encryption capabilities at the end nodes in a system and raises the data confidentiality to post-quantum secure level over the Internet. The proposed L ABE-IBE PRE transforms a ciphertext of the classical ABE scheme to a post-quantum secure ciphertext and from a post-quantum secure ciphertext to a ciphertext of the classical IBE scheme. We compare our proposed L ABE-IBE PRE scheme with classical ABE-IBE proxy re-encryption schemes, including Encryption Switching ABE-IBE (ES.ABE-IBE) scheme (He et al., 2019). We discuss the security and efficiency of our proposed scheme.
Download
Paper Nr: 62
Title:

ZT-NIDS: Zero Trust, Network Intrusion Detection System
Authors:

Abeer Z. Alalmaie, Priyadarsi Nanda and Xiangjian He
Abstract: Zero Trust security can tackle various cyberthreats. Current trends in security monitoring must shift to a “never trust, always verify” approach, as data security is threatened when cloud-based third parties access network traces. Network Intrusion Detection System (NIDS) can be exploited to detect anomalous behaviour. Convolution Neural Network (CNN), Bi-directional Long Short Term Memory (BiLSTM) based classifiers and Auto-Encoder (AE) feature extractors have presented promising results in NIDS. AE feature extractor can compress the important information and train the unsupervised model. CNNs detect local spatial relationships, while BiLSTMs can exploit temporal interactions. Furthermore, Attention modules can capture content-based global interactions and can be applied on CNNs to attend to the significant contextual information. In this paper, we utilized the advantages of all AE, CNN and BiLSTM structures using a multi-head Self Attention mechanism to integrate CNN features for feeding into BiLSTM classifier. We use the bottleneck features of a pre-trained AE for an Attention-based CNN-BiLSTM classifier. Our experiments using 10, 6 and 2 categories NID system on UNSW-NB15 dataset showed that the proposed method outperforms state-of-the-art methods and achieved accuracy of 91.72%, 89.79% and 93.01%, respectively. Plus, we introduced a balanced data sampler for training 10 categories of NIDS.
Download
Paper Nr: 70
Title:

On the Effectiveness of Re-Identification Attacks and Local Differential Privacy-Based Solutions for Smart Meter Data
Authors:

Zeynep S. Kaya and M. Emre Gursoy
Abstract: Smart meters are increasing the ability to collect, store and share households’ energy consumption data. On the other hand, the availability of such data raises novel privacy concerns. Although the data can be de-identified or pseudonymized, a critical question remains: How unique are households’ energy consumptions, and is it possible to re-identify households based on partial or imperfect knowledge of their consumption? In this paper, we aim to answer this question, and make two main contributions. First, we develop an adversary model in which an adversary who observes a pseudonymized dataset and knows a limited number of consumption readings from a target household aims to infer which record in the dataset corresponds to the target. We characterize the adversary’s knowledge by two parameters: number of known readings and precision of readings. Using experiments conducted on three real-world datasets, we demonstrate that the adversary can indeed achieve high inference rates. Second, we propose a local differential privacy (LDP) based solution for protecting the privacy of energy consumption data. We evaluate the impact of our LDP solution on three datasets using two utility metrics, three LDP protocols, and various parameter settings. Results show that our solution can attain high accuracy and low estimation error under strong privacy guarantees.
Download
Paper Nr: 72
Title:

A First Appraisal of Cryptographic Mechanisms for the Selective Disclosure of Verifiable Credentials
Authors:

Andrea Flamini, Silvio Ranise, Giada Sciarretta, Mario Scuro, Amir Sharif and Alessandro Tomasi
Abstract: Verifiable credentials are a digital analogue of physical credentials. Their authenticity and integrity are protected by means of cryptographic techniques, and they can be presented to verifiers to prove claims about the holder of the credential itself. One way to preserve privacy during presentation consists in selectively disclosing the attributes in a credential. In this paper we present the most widespread cryptographic mechanisms used to enable selective disclosure of attributes, describing their structure and comparing them in terms of performance, size of the associated verifiable presentations, and the ability to produce predicate proofs and unlinkable presentations.
Download
Paper Nr: 85
Title:

BeeHIVE: Behavioral Biometric System Based on Object Interactions in Smart Environments
Authors:

Klaudia Krawiecka, Simon Birnbach, Simon Eberz and Ivan Martinovic
Abstract: The lack of standard input interfaces in Internet of Things (IoT) ecosystems presents a challenge in securing such infrastructures. To tackle this challenge, we introduce a novel behavioral biometric system based on naturally occurring interactions with objects in smart environments. This biometric leverages existing sensors to authenticate users without requiring any hardware modifications of existing smart home devices. The system is designed to reduce the need for phone-based authentication mechanisms, on which smart home systems currently rely. It requires the user to approve transactions on their phone only when the user cannot be authenticated with high confidence through their interactions with the smart environment. We conduct a real-world experiment that involves 13 participants in a company environment. We show that this system can provide seamless and unobtrusive authentication while still remaining highly resistant to zero-effort, video, and in-person observation-based mimicry attacks. Even when at most 1% of the strongest type of mimicry attacks are successful, our system does not require the user to take out their phone to approve legitimate transactions in more than 84% of cases for a single interaction. This increases to 93% of transactions when interactions with more objects are considered.
Download
Paper Nr: 89
Title:

Griffin: Towards Mixed Multi-Key Homomorphic Encryption
Authors:

Thomas Schneider, Hossein Yalame and Michael Yonli
Abstract: This paper presents Griffin, an extension of the mixed-scheme single-key homomorphic encryption framework Pegasus (Lu et al., IEEE S&P’21) to a Multi-Key Homomorphic Encryption (MKHE) scheme with applications to secure computation. MKHE is a generalized notion of Homomorphic Encryption (HE) that allows for operations on ciphertexts encrypted under different keys. However, an efficient approach to evaluate both polynomial and non-polynomial functions on encrypted data in MKHE has not yet been developed, hindering the deployment of HE to real-life applications. Griffin addresses this challenge by introducing a method for transforming between MKHE ciphertexts of different schemes. The practicality of Griffin is demonstrated through benchmarks with multiple applications, including the sorting of sixty four 45-bit fixed point numbers with a precision of 7 bits in 21 minutes, and evaluating arbitrary functions with a one-time setup communication of 1.4 GB per party and 2.34 MB per ciphertext. Moreover, Griffin could compute the maximum of two numbers in 3.2 seconds, a 2× improvement over existing MKHE approaches that rely on a single scheme.
Download
Paper Nr: 91
Title:

Informed Consent as Patient Driven Policy for Clinical Diagnosis and Treatment: A Smart Contract Based Approach
Authors:

Md Al Amin, Amani Altarawneh and Indrajit Ray
Abstract: Digitized healthcare systems improve services, make it easier for healthcare providers to work together, improve the accuracy of diagnoses, and get the most out of each treatment. They provide healthcare services that are better, faster, more reliable, and less expensive. With the help of information technology, computing resources, and digitized health records, medical researchers are trying to solve critical health problems like COVID-19. However, electronic healthcare systems significantly risk patients’ data privacy and security. Anyone with credentials can access patients’ healthcare data. Patients grant consent to share or access data. But they need a way to ensure informed consent is done right and on time. Due to the centralized authority in present healthcare systems, healthcare-covered entities perform all operations. As a result, many unwanted events and security incidents happen in healthcare systems. Patients must know how their data is accessed, by whom, and when. Therefore, a blockchain and smart contract-based patient-informed consent management system is proposed. Where patients provide informed consent to share or access their health records, as well as methods to ensure that informed consent is properly completed. The immutability and auto-triggering properties of blockchain and smart contracts ensure the integrity and accountability of the given informed consent.
Download
Paper Nr: 92
Title:

Using Untrusted and Unreliable Cloud Providers to Obtain Private Email
Authors:

Nicolas Chiapputo, Yvo Desmedt and Kirill Morozov
Abstract: A recent trend for organizations is to shift to cloud services which typically include email. As a result, the natural privacy concerns for users stem not only from outside attackers, but from insiders as well. Our solution does not rely on unproven assumptions and does not need a PKI. To achieve this, we partially rely on concepts from Private and Secure Message Transmission protocols, which are built on top of secret sharing. This technology allows us to distribute trust over email providers. Hence, the system remains secure as long as hackers are unable to penetrate a threshold number of providers, or this set of providers does not form a coalition to attack their users. The prototype of our proposed system has been implemented as an add-on for the Thunderbird email client, using Mozilla’s Web Crypto API and Rempe’s secret.js library. It currently supports the following secret sharing schemes: the 2-out-2 additive scheme (set as a default), the k-out-n threshold Shamir scheme, and the Rabin and Ben-Or robust scheme.
Download
Paper Nr: 93
Title:

Towards Usable Scoring of Common Weaknesses
Authors:

Olutola Adebiyi and Massimiliano Albanese
Abstract: As the number and severity of security incidents continue to increase, remediating vulnerabilities and weaknesses has become a daunting task due to the sheer number of known vulnerabilities. Different scoring systems have been developed to provide qualitative and quantitative assessments of the severity of common vulnerabilities and weaknesses, and guide the prioritization of vulnerability remediation. However, these scoring systems provide only generic rankings of common weaknesses, which do not consider the specific vulnerabilities that exist in each system. To address this limitation, and building on recent principled approaches to vulnerability scoring, we propose new common weakness scoring metrics that consider the findings of vulnerability scanners, including the number of instances of each vulnerability across a system, and enable system-specific rankings that can provide actionable intelligence to security administrators. We built a small testbed to evaluate the proposed metrics against an existing metric, and show that the results are consistent with our intuition.
Download
Paper Nr: 94
Title:

Heterogeneous Graph Storage and Leakage Prevention for Data Cooperatives
Authors:

Mark Dockendorf and Ram Dantu
Abstract: Current big data providers offer little-to-no control over how your data is used once it is collected. Data cooperatives are an alternative to these companies and give control of personal data back to the data providers (whether they be people or organizations), allowing them to determine which of their data is used and how their data is used. Data cooperatives can serve as a more ethical alternative to other big data solutions, and have already seen success in the real world. However, supporting software must be developed to ensure the privacy of data providers beyond cooperative promises. In this paper, we expand upon our previous work applying homomorphic encryption (HE) to secure the personally identifiable information (PII) of data providers in data cooperatives that use graph storage. Data cooperatives are expected to store and query over data of varying security levels, including PII, low-security (where anonymization alone is sufficient), and public domain information. To facilitate graph storage, we introduce a multidimensional graph storage technique designed specifically for data cooperatives that mix cleartext, encrypted, and anonymized heterogeneous edges over a heterogeneous set of vertices. We demonstrate a HE query watchdog, which prevents incidental data leakage at query runtime and prior to decryption when proper rules are provided. This watchdog is complementary to existing work preventing data leakage prior to query runtime. This watchdog’s operations are dominated by any reasonably-complex query.
Download
Paper Nr: 95
Title:

Generic Blockchain on Generic Human Behavior
Authors:

Clémentine Gritti, Frédéric A. Hayek and Pascal Lafourcade
Abstract: Blockchain is a type of distributed ledger. A wide range of consensus algorithms exists to reach consensus in a decentralized manner. However, most of them trade energy consumption for a degree of openness. Blockchains are primarily used for tokens and cryptocurrencies. Often the process of minting new tokens depends on actionable real world behaviors. A difficulty persists in securely translating said behavior into a decentralized blockchain. We formalize the generic concept of Proof of Behavior (PoB), and use it to create a consensus mechanism for generic permissionless blockchains.
Download
Paper Nr: 100
Title:

Smart Bulbs Can Be Hacked to Hack into Your Household
Authors:

Davide Bonaventura, Sergio Esposito and Giampaolo Bella
Abstract: The IoT is getting more and more pervasive. Even the simplest devices, such as a light bulb or an electrical plug, are made “smart” and controllable by our smartphone. This paper describes the findings obtained by applying the PETIoT kill chain to conduct a Vulnerability Assessment and Penetration Testing session on a smart bulb, the Tapo L530E by Tp-Link, currently best seller on Amazon Italy. We found that four vulnerabilities affect the bulb, two of High severity and two of Medium severity according to the CVSS v3.1 scoring system. In short, authentication is not well accounted for and confidentiality is insufficiently achieved by the implemented cryptographic measures. In consequence, an attacker who is nearby the bulb can operate at will not just the bulb but all devices of the Tapo family that the user may have on her Tapo account. Moreover, the attacker can learn the victim’s Wi-Fi password, thereby escalating his malicious potential considerably. The paper terminates with an outline of possible fixes.
Download
Paper Nr: 156
Title:

Optimizing Attribute-Based Encryption for Circuits Using Compartmented Access Structures
Authors:

Alexandru Ioniţă
Abstract: Attribute-based encryption (ABE) is an asymmetric encryption method that allows expressive access granting mechanisms, with high applicability in modern IT infrastructure, such as Cloud or IoT systems. (Ezhilarasi et al., 2021; Touati and Challal, 2016) One open problem regarding ABE is using Boolean circuits as access structures. While Boolean Formulae were supported since the first ABE scheme proposed, there is still no efficient construction that supports Boolean circuits. We propose a new ABE scheme for a new access structure type, situated between Boolean formulae and Boolean circuits in terms of expressiveness. This key point in our construction is the usage of CAS-nodes, a structure modeling compartmented groups access structures. We also show that our CAS-nodes can be used to improve the efficiency of existing ABE schemes for Boolean circuits. Our construction is secure in the Selective Set Model under the bilinear Decisional Diffie-Hellman Assumption.
Download
Paper Nr: 162
Title:

RSSI-Based Fingerprinting of Bluetooth Low Energy Devices
Authors:

Guillaume Gagnon, Sébastien Gambs and Mathieu Cunche
Abstract: To prevent tracking, the Bluetooth Low Energy protocol integrates privacy mechanisms such as address randomization. However, as highlighted by previous researches address randomization is not a silver bullet and can be circumvented by exploiting other types of information disclosed by the protocol such as counters or timing. In this work, we propose a novel attack to break address randomization in BLE exploiting side information that has not been considered before: Received Signal Strength Indication (RSSI). More precisely, we demonstrate how RSSI measurements, extracted from received BLE advertising packets, can be used to link together the traces emitted by the same device or re-identify it despite address randomization. The proposed attack leverages the distribution of RSSI to create a fingerprint of devices. An empirical evaluation of the attack on various scenarios demonstrate its effectiveness. For instance in the static context, in which devices remain at the same position, the proposed approach yields a re-identification accuracy of up to 99%, which can even be boosted by increasing the number of receivers controlled by the adversary.
Download
Paper Nr: 166
Title:

Receipt-Free Electronic Voting from zk-SNARK
Authors:

Maryam Sheikhi, Rosario Giustolisi and Carsten Schuermann
Abstract: In 2016, Locher and Haenni (Locher and Haenni, 2016) proposed an e-voting scheme that offers verifiability, everlasting vote privacy, and computational receipt-freeness, as well as an informal discussion of how the scheme achieves such properties. We advance this line of work by proposing a new cryptographic scheme that provably satisfies those properties as well as everlasting participation privacy and efficient tallying. Receipt-freeness relies on deniable vote updating and verifiable null ballot posting, generated from public knowledge stored on the bulletin board. The everlasting vote and participation privacy properties directly result from the hash-based commitment scheme and efficient zero-knowledge proofs (SNARKs). Finally, we provide mathematical proofs for all the properties, including a new game-based definition of participation privacy.
Download
Paper Nr: 178
Title:

Anomaly-Based Intrusion Detection System for DDoS Attack with Deep Learning Techniques
Authors:

Davide Agostinello, Angelo Genovese and Vincenzo Piuri
Abstract: The increasing number of connected devices is fostering a rising frequency of cyber attacks, with Distributed Denial of Service (DDoS) attacks among the most common. To counteract DDoS, companies and large organizations are increasingly deploying anomaly-based Intrusion Detection Systems (IDS), which detect attack patterns by analyzing differences in malicious network traffic against a baseline of legitimate traffic. To differentiate malicious and normal traffic, methods based on artificial intelligence and, in particular, Deep Learning (DL) are being increasingly considered, due to their ability to automatically learn feature representations for the different traffic types, without need of explicit programming or handcrafted feature extraction. In this paper, we propose a novel methodology for simulating an anomaly-based IDS based on adaptive DL by designing multiple DL models working with both binary and multi-label classification on multiple datasets with different degrees of complexity. To make the DL models adaptable to different conditions, we consider adaptive architectures obtained by automatically tuning the number of neurons for each situation. Results on publicly-available datasets confirm the validity of our proposed methodology, with DL models adapting to the different conditions by increasing the number of neurons on more complex datasets and achieving the highest accuracy in the binary classification configuration.
Download
Short Papers
Paper Nr: 12
Title:

Privacy Protection of Synthetic Smart Grid Data Simulated via Generative Adversarial Networks
Authors:

Kayode S. Adewole and Vicenç Torra
Abstract: The development in smart meter technology has made grid operations more efficient based on fine-grained electricity usage data generated at different levels of time granularity. Consequently, machine learning algorithms have benefited from these data to produce useful models for important grid operations. Although machine learning algorithms need historical data to improve predictive performance, these data are not readily available for public utilization due to privacy issues. The existing smart grid data simulation frameworks generate grid data with implicit privacy concerns since the data are simulated from a few real energy consumptions that are publicly available. This paper addresses two issues in smart grid. First, it assesses the level of privacy violation with the individual household appliances based on synthetic household aggregate loads consumption. Second, based on the findings, it proposes two privacy-preserving mechanisms to reduce this risk. Three inference attacks are simulated and the results obtained confirm the efficacy of the proposed privacy-preserving mechanisms.
Download
Paper Nr: 13
Title:

JShelter: Give Me My Browser Back
Authors:

Libor Polčák, Marek Saloň, Giorgio Maone, Radek Hranický and Michael McMahon
Abstract: The web is used daily by billions. Even so, users are not protected from many threats by default. This paper builds on previous web privacy and security research and introduces JShelter, a webextension that fights to return the browser to users. Moreover, we introduce a library helping with common webextension development tasks and fixing loopholes. JShelter focuses on fingerprinting prevention, limitations of rich web APIs, prevention of attacks connected to timing, and learning information about the device, the browser, the user, and the surrounding physical environment and location. During the research of sensor APIs, we discovered a loophole in the sensor timestamps that lets any page observe the device boot time if sensor APIs are enabled in Chromium-based browsers. JShelter provides a fingerprinting report and other feedback that can be used by future web privacy research. Thousands of users around the world use the webextension every day.
Download
Paper Nr: 16
Title:

Threshold Cryptosystems Based on 2 k-th Power Residue Symbols
Authors:

George Teşeleanu
Abstract: In this paper we introduce a novel version of the Joye-Libert cryptosystem that allows users to decrypt without knowing the factorisation of the composite modulus. Then we use our construction as a building block for a threshold decryption protocol of the homomorphic Joye-Libert encryption scheme. Finally, we present several extensions of the threshold cryptosystem.
Download
Paper Nr: 29
Title:

Improvement of Winternitz OTS with a Novel Fingerprinting Function
Authors:

Motonari Honda and Yuichi Kaji
Abstract: Winternitz one-time signature (OTS) plays a core role in practical hash-based digital signature schemes including SPHINCS+, one of PQC standardizations selected by NIST. This study focuses on the security mechanism of Winternitz OTS and improves the scheme by introducing a novel fingerprinting function. The proposed scheme has provable security of strongly existential unforgeability and reduces by about 10% of the computational costs for operations in Winternitz OTS. The improvement is combinable with other investigations such as WOTS+, and gives the contribution to the study of practical quantum secure digital signatures.
Download
Paper Nr: 30
Title:

Lessons Learned: Defending Against Property Inference Attacks
Authors:

Joshua Stock, Jens Wettlaufer, Daniel Demmler and Hannes Federrath
Abstract: This work investigates and evaluates defense strategies against property inference attacks (PIAs), a privacy attack against machine learning models. While for other privacy attacks like membership inference, a lot of research on defense mechanisms has been published, this is the first work focusing on defending against PIAs. One of the mitigation strategies we test in this paper is a novel proposal called property unlearning. Extensive experiments show that while this technique is very effective when defending against specific adversaries, it is not able to generalize, i.e., protect against a whole class of PIAs. To investigate the reasons behind this limitation, we present the results of experiments with the explainable AI tool LIME and the visualization technique t-SNE. These show how ubiquitous statistical properties of training data are in the parameters of a trained machine learning model. Hence, we develop the conjecture that post-training techniques like property unlearning might not suffice to provide the desirable generic protection against PIAs. We conclude with a discussion of different defense approaches, a summary of the lessons learned and directions for future work.
Download
Paper Nr: 31
Title:

When the Few Outweigh the Many: Illicit Content Recognition with Few-Shot Learning
Authors:

G. Cascavilla, G. Catolino, M. Conti, D. Mellios and D. A. Tamburri
Abstract: The anonymity and untraceability benefits of the Dark web account for the exponentially-increased potential of its popularity while creating a suitable womb for many illicit activities, to date. Hence, in collaboration with cybersecurity and law enforcement agencies, research has provided approaches for recognizing and classifying illicit activities with most exploiting textual dark web markets’ content recognition; few such approaches use images that originated from dark web content. This paper investigates this alternative technique for recognizing illegal activities from images. In particular, we investigate label-agnostic learning techniques like One-Shot and Few-Shot learning featuring the use Siamese neural networks, a state-of-the-art approach in the field. Our solution manages to handle small-scale datasets with promising accuracy. In particular, Siamese neural networks reach 90.9% on 20-Shot experiments over a 10-class dataset; this leads us to conclude that such models are a promising and cheaper alternative to the definition of automated law-enforcing machinery over the dark web.
Download
Paper Nr: 43
Title:

Context-Aware Behavioral Fingerprinting of IoT Devices via Network Traffic Analysis
Authors:

Arjun Prasad, Kevin K. Biju, Soumya Somani and Barsha Mitra
Abstract: The large scale proliferation of IoT devices has necessitated the requirement of securing these devices from a massive spectrum of cyber security threats. IoT device fingerprinting is a defense strategy that can help to detect unauthorized device subversion and the consequent anomalous activities by identifying device behavior and characteristics. Device fingerprinting can be done by analyzing the network traffic features of the IoT devices present in a network, thereby creating a blueprint of normal device behavior and clearly distinguishing it from any kind of abnormal behavior. Since IoT devices operate under varying dynamic conditions, it is implicit that a single device exhibits different behavioral patterns under different contexts and operating modes. In this paper, we propose a context-aware behavioral fingerprinting of IoT devices that takes into account the circumstances or contexts under which the devices are operating. Each context results in a fingerprint and the complete behavioral fingerprint of an IoT device is the combination of all such fingerprints. We perform packet level feature engineering for finding the best possible set of features for performing device fingerprinting. Our fingerprinting strategy uses supervised learning for classifying the IoT devices. We have created an IoT test bed setup consisting of a gateway and several IoT devices. We have collected network traffic data of these IoT devices and have tested the efficacy of our proposed approach on these real data. Experimental results show that our fingerprinting technique is quite effective and is capable of identifying IoT devices with more than 94% accuracy.
Download
Paper Nr: 45
Title:

One to Bind Them: Binding Verifiable Credentials to User Attributes
Authors:

Alexander Mühle, Katja Assaf and Christoph Meinel
Abstract: The Self-Sovereign Identity ecosystem is defined by its flexibility and heterogeneity. While this can be an advantage for users, as they can freely choose their identifiers and attribute providers, it also bears risks. When credentials are being issued, issuers often rely on other previously issued attributes to base their issuance decision on, either personal identifiable information or attestations of requirements. In this paper, we propose two approaches for binding such user attributes in a privacy-preserving way to credentials to prevent fraudulent usage by unauthorised users and enable further auditability of credential requirements and ownership. We propose a selective disclosure-based approach relying on BBS+ signatures. However, as the usage of BBS+ signatures is not yet widespread, we also propose an approach that does not rely on selective disclosure and instead utilises cryptographic accumulators to bind user attributes to the issued credentials.
Download
Paper Nr: 46
Title:

A Note on a CBC-Type Mode of Operation
Authors:

George Teşeleanu
Abstract: In this paper we formally introduce a novel mode of operation based on the cipher block chaining mode. The main idea of this mode is to use a stateful block cipher instead of a stateless one. Afterwards, we show how to implement our proposal and present a performance analysis of our mode. Next, we provide a concrete security analysis by computing a tight bound on the success of adversaries based on their resources. The results of our performance and security analyses are that this novel mode is more secure than the cipher block chaining mode for large files, but the encryption/decryption time doubles/triples. Therefore, our novel mode is suitable for encrypting large files, when higher security is required, but speed is not paramount. Note that the changes required to transform the software implementations of the cipher block chaining mode into this new mode are minimal, and therefore transitioning to this new mode is straightforward.
Download
Paper Nr: 54
Title:

On the Security of the Novel Authentication Scheme for UAV-Ground Station and UAV-UAV Communication
Authors:

Mustapha Benssalah and Karim Drouiche
Abstract: With the unexpected increase in the number of commercialized and marketed UAVs in the last few years, both in the civilian and military fields, the security and privacy remain the exceedingly urgent problem of national security for many countries over the world. In fact, it is imperative that drone security and privacy issues have to be properly and utterly addressed by drone manufacturers as well as commercial operators, via implementing efficient authentication mechanisms executed between the system entities before any exchange of sensitive information. In this paper, we examine in depth the security of the PUF-based authentication scheme published most recently by Alladi et al. in one of the renowned international scientific journals ”IEEE Transactions on Vehicular Technology”. Our results indicate that the claimed security performance of this scheme has been overestimated. We show that Alladi et al.’s scheme is prone to the secret session key disclosure attack. We demonstrate that the attacker can easily reveal the shared secret and decrypt all the exchanged messages for both UAV-Ground Station (GS) and UAV-UAV authentication phases. To mitigate the revealed issues, some possible improvements are suggested for this scheme. Further, via formal security analysis, using Random Oracle, we show that Alladi et al.’s improved IoD scheme could deliver all the merits of the original scheme and can prevent the aforementioned vulnerabilities.
Download
Paper Nr: 56
Title:

SEBDA: A Secure and Efficient Blockchain Based Data Aggregation Scheme
Authors:

Sehrish Shafeeq and Mathias Fischer
Abstract: Data aggregation plays a vital role in collecting and summarizing data in the Internet of Things (IoT). Data aggregation results are used to make a critical decision; therefore, the end-to-end integrity of the data aggregation result is of utmost importance. Recently, blockchain-based data aggregation approaches have been proposed that mainly focus on data confidentiality. However, existing approaches ignore two important requirements 1) the end-to-end integrity of data aggregation result and 2) the system’s scalability. This paper proposes a blockchain-based data aggregation scheme to detect end-to-end integrity of aggregation results and identify malicious aggregators. Furthermore, we improve the efficiency and scalability of the system by leveraging a sidechain. Our simulation results indicate that the proposed system improves efficiency and scalability compared to conventional blockchain-based data aggregation.
Download
Paper Nr: 61
Title:

Risk-Based Illegal Information Flow Detection in the IIoT
Authors:

Argiro Anagnostopoulou, Ioannis Mavridis and Dimitris Gritzalis
Abstract: Industrial IoT (IIoT) consists of a great number of low-cost interconnected devices, including sensors, actuators, and PLCs. Such environments deal with vast amounts of data originating from a wide range of devices, applications, and services. These data should be adequately protected from unauthorized users and services. As IIoT environments are scalable and decentralized, the conventional security schemes have difficulties in protecting systems. Information flow control, along with delegation of accurate access control rules is crucial. In this work, we propose an approach to assess the existing information flows and detect the illegal ones in IIoT environments, which utilizes a risk-based method for critical infrastructure dependency modeling. We define formulas to indicate the nodes with a high-risk level. We create a graph based on business processes, operations, and current access control rules of an infrastructure. In the graph, the edges represent the information flows. For each information flow we calculate the risk level. This aids to reconstruct current access control rules on the high-risk nodes of the infrastructure.
Download
Paper Nr: 69
Title:

A Method for Robust and Explainable Image-Based Network Traffic Classification with Deep Learning
Authors:

Amine Hattak, Giacomo Iadarola, Fabio Martinelli, Francesco Mercaldo and Antonella Santone
Abstract: In light of the growing reliance on digital technology, the security of digital devices and networks has become a critical concern in the information technology industry. Network analysis can be helpful for identifying and mitigating network-based attacks, as it enables the monitoring of network behavior and the detection of anomalous activity. Through the use of network analysis, organizations can better defend against potential security threats and protect their interconnected digital systems. In this paper, we investigate the use of deep learning techniques for network traffic classification. A robust and explainable deep learning-based approach for traffic classification is proposed starting from raw traffic data represented in PCAP format. This latter will be transformed into visualized images, which are then used as input for deep-learning models in order to discriminate malicious activities. We evaluate the effectiveness of the proposed method, by evaluating two datasets composed of 34389 network traces belonging to 35 categories: 25 related to different malware families and the remaining 10 categories belonging to trusted applications, reaching an accuracy equal to 96.8%. Moreover, we provide reasoning about model evaluation and the correctness of the models by taking into account a prediction explainability based on the visualization of the images generated from the network trace, of the areas symptomatic of a certain prediction.
Download
Paper Nr: 77
Title:

Towards a Geometric Deep Learning-Based Cyber Security: Network System Intrusion Detection Using Graph Neural Networks
Authors:

Rocco Zaccagnino, Antonio Cirillo, Alfonso Guarino, Nicola Lettieri, Delfina Malandrino and Gianluca Zaccagnino
Abstract: Networks play a key role in modern society and are therefore the target of many threats aimed at performing malicious activities. In recent years, the so-called behavioral anomaly detection is becoming a de facto standard paradigm for different cyber security scenarios, such as network system intrusion detection. This paradigm relies on the idea to detect behavioral patterns that do not match the normal activity. To build more effective behavioral models, researchers are putting efforts on the use of behavioral events’ data in advanced machine learning methods, such as Convolutional and Recurrent Neural Networks. Recently, the fledging Geometric Deep Learning research area has proposed Graph Neural Networks (GNNs), which are particularly suitable to model the data connections and interactions as entities and relationships of a graph. To exploit the benefits of using such models in network system intrusion detection, we propose a novel graph-based behavioral modeling approach using GNNs. Preliminary experiments have been carried out to measure the effectiveness of our approach on the UNSW-NB15 dataset. The results obtained show that our proposal reaches performances comparable, and in some cases, better than some state-of-the-art approach.
Download
Paper Nr: 78
Title:

Trans-IDS: A Transformer-Based Intrusion Detection System
Authors:

El M. Mercha, El Mostapha Chakir and Mohammed Erradi
Abstract: The increasing number of online systems and services has led to a rise in cyber security threats and attacks, making Intrusion Detection Systems (IDS) more crucial than ever. Intrusion Detection Systems (IDS) are designed to detect unauthorized access to computer systems and networks by monitoring network traffic and system activities. Owing to the valuable values provided by IDS, several machine learning-based approaches have been developed. However, most of these approaches rely on feature selection methods to overcome the problem of high-dimensional feature space. These methods may lead to the exclusion of important features or the inclusion of irrelevant ones, which can negatively impact the accuracy of the system. In this work, we propose Trans-IDS (transformer-based intrusion detection system), a transformer-based system for intrusion detection, which does not rely on feature selection methods. Trans-IDS learns efficient contextualized representations for both categorical and numerical features to achieve high prediction performance. Extensive experiments have been conducted on two publicly available datasets, namely UNSW-NB15 and NSL-KDD, and the achieved results show the efficiency of the proposed approach.
Download
Paper Nr: 79
Title:

Regulating Cyber Incidents: A Review of Recent Reporting Requirements
Authors:

Angelica Marotta and Stuart Madnick
Abstract: In today’s digital landscape, cyber incidents have become more frequent and sophisticated, posing significant threats to organizations and individuals. To mitigate these risks, governments and regulatory bodies worldwide have developed various incident reporting regulations for organizations to follow. However, the effectiveness of these regulations in handling cyber incidents remains a point of debate. This paper focused on examining current cyber incident reporting regulations and their characteristics, with the primary objective of identifying the regulatory factors that impact the effectiveness of these regulations. Key aspects under investigation included timing requirements, the clarity in defining cyber incidents, and the provision of explicit guidelines regarding the necessity and scope of reporting incidents. Finally, it provides insights into how regulatory requirements can be improved to better handle cyber incidents in today’s rapidly evolving regulatory environment.
Download
Paper Nr: 80
Title:

BAGUETTE: Hunting for Evidence of Malicious Behavior in Dynamic Analysis Reports
Authors:

Vincent Raulin, Pierre-François Gimenez, Yufei Han and Valérie T. Tong
Abstract: Malware analysis consists of studying a sample of suspicious code to understand it and producing a representation or explanation of this code that can be used by a human expert or a clustering/classification/detection tool. The analysis can be static (only the code is studied) or dynamic (only the interaction between the code and its host during one or more executions is studied). The quality of the interpretation of a code and its later detection depends on the quality of the information contained in this representation. To date, many analyses produce voluminous reports that are difficult to handle quickly. In this article, we present BAGUETTE, a graph-based representation of the interactions of a sample and the resources offered by the host system during one execution. We explain how BAGUETTE helps automatically search for specific behaviors in a malware database and how it efficiently assists the expert in analyzing samples.
Download
Paper Nr: 83
Title:

PIUDI: Private Information Update for Distributed Infrastructure
Authors:

Shubham Raj, Snehil Joshi and Kannan Srinathan
Abstract: Encrypted data is susceptible to side-channel attacks like usage and access analysis. Techniques like Oblivious-RAM (ORAM) and privacy information retrieval and writing aim to hide clients’ access pattern while accessing encrypted data on a distrusted server. However, current techniques are constructed for a single server model making them unsuitable and inefficient for contemporary distributed architectures. In our work, we address this problem and provide a solution to private information update using packed secret sharing. Our protocol, named “Private Information Update for Distributed Infrastructure” PIUDI, aims to mitigate the attacks to which PIR-Writing protocols are more susceptible in a distributed environment. Our scheme is secure in presence of up to t + k − 1 compromised parties where k is the size of the data set. We also provide an analysis of our protocol for computational efficiency and gas cost in blockchains
Download
Paper Nr: 86
Title:

OCScraper: Automated Analysis of the Fingerprintability of the iOS API
Authors:

Gerald Palfinger
Abstract: Tracking has allowed application providers to offer the vast majority of their applications for free as it allows them to target advertising. However, tracking has proven to be an invasion of user privacy. To counter this, operating system vendors have removed access to unique identifiers in their APIs. Nevertheless, applications can still combine other non-unique data from the device to create a unique fingerprint. Until now, it has not been well understood what kind of information is available to do so on iOS. This paper addresses this gap by introducing the OCScraper framework, a tool for automatically discovering fingerprintable information sources on iOS devices. OCScraper does this by systematically crawling the API of the operating system. In the process, it creates objects on which methods are called and properties are queried. In our evaluation, we show that OCScraper can successfully invoke a large number of methods and retrieve the majority of parameters. We discover hundreds of robust information sources that provide distinct bits of information which can be used to create a cross-application fingerprint.
Download
Paper Nr: 88
Title:

XACML Extension for Graphs: Flexible Authorization Policy Specification and Datastore-Independent Enforcement
Authors:

Aya Mohamed, Dagmar Auer, Daniel Hofer and Josef Küng
Abstract: The increasing use of graph-structured data for business- and privacy-critical applications requires sophisticated, flexible and fine-grained authorization and access control. Currently, role-based access control is supported in graph databases, where access to objects is restricted via roles. This does not take special properties of graphs into account, such as vertices and edges along the path between a given subject and resource. In our previous research iterations, we started to design an authorization policy language and access control model, which considers the specification of graph paths and enforces them in the multi-model database ArangoDB. Since this approach is promising to consider graph characteristics in data protection, we improve the language in this work to provide flexible path definitions and specifying edges as protected resources. Furthermore, we introduce a method for a datastore-independent policy enforcement. Besides discussing the latest work in our XACML4G model, which is an extension to the Extensible Access Control Markup Language (XACML), we demonstrate our prototypical implementation with a real case giving an outlook on performance.
Download
Paper Nr: 90
Title:

Automated Feature Engineering for AutoML Using Genetic Algorithms
Authors:

Kevin Shi and Sherif Saad
Abstract: Automated machine learning (AutoML) is an approach to automate the creation of machine learning pipelines and models. The ability to automatically create a machine learning pipeline would allow users without machine learning knowledge to create and use machine learning systems. However, many AutoML tools have no or limited automated feature engineering support. We develop an approach that is able to augment existing AutoMl tools with automated feature generation and selection. This generation method uses feature generators guided by and genetic algorithm to generate and select features as part of the AutoMl model selection process. We show that this approach is able to improve the AutoML model performance in 77% of all tested cases with up to 78% error reduction. Our approach explores how existing AutoML tools can be augmented with more automated steps to improve the generated machine learning pipeline’s performance.
Download
Paper Nr: 96
Title:

Smoothing the Ride: Providing a Seamless Upgrade Path from Established Cross-Border eID Workflows Towards eID Wallet Systems
Authors:

Roland Czerny, Christian Kollmann, Blaž Podgorelec, Bernd Prünster and Thomas Zefferer
Abstract: The eIDAS regulation and its technical implementation successfully enabled cross-border eID use cases within the European Union. Established in 2014 as part of an EU regulation, its technological foundation is starting to show its age, particularly on smartphones. The European Commission (EC) is well aware of this fact, and large-scale pilots for the wallet-based, next-generation pan-European eID framework are on their way. This work fills the gap between both approaches and enables member states to provide wallet-based authentication to established service providers right now. Our prototypical implementation effectively demonstrates that cross-border, wallet-based eID workflows can be rolled out already, while catering towards the constraints of already operational infrastructure. We achieve this by introducing an eIDAS app, which supports both existing eIDAS-based cross-border authentication as well as interaction with wallet apps.
Download
Paper Nr: 104
Title:

Unclonable Cryptography: A Tale of Two No-Cloning Paradigms
Authors:

Ghada Almashaqbeh and Rohit Chatterjee
Abstract: Unclonable cryptography builds primitives that enjoy some form of unclonability, such as quantum money, software copy protection, and bounded execution programs. These are impossible in the classical model as classical data is inherently clonable. Quantum computing, with its no-cloning principle, offers a solution. However, it is not enough to realize bounded execution programs; these require one-time memory devices that self-destruct after a single data retrieval query. Very recently, a new no-cloning technology has been introduced [Eurocrypt’22], showing that unclonable polymers—proteins—can be used to build bounded-query memory devices and unclonable cryptographic applications. In this paper, we investigate the relation between these two technologies; whether one can replace the other, or complement each other such that combining them brings the best of both worlds. Towards this goal, we review the quantum and unclonable polymer models, and existing unclonable cryptographic primitives. Then, we discuss whether these primitives can be built using the other technology, and show alternative constructions and notions when possible. We also offer insights and remarks for the road ahead. We believe that this study will contribute in advancing the field of unclonable cryptography on two fronts: developing new primitives, and realizing existing ones using new constructions.
Download
Paper Nr: 105
Title:

Design of a New Hardware IP-HLS for Real-Time Image Chaos-Based Encryption
Authors:

Mohamed S. Azzaz, Redouane Kaibou, Hamdane Kamelia, Abdenour Kifouche and Djamel Teguig
Abstract: This paper presents a new approach for designing a lightweight and efficient prototype of encryption devoted to secure real-time embedded applications. The proposed approach is simple and it is based on two concepts, the first one is related to the design methodology in which it allows a good compromise between performances and time development, by using Vivado High Level synthesis (HLS). In counterpart, and as a second concept chaos-based theory is adopted for the design of a robust stream cipher encryption algorithm with good trade-off between low resources and speed. Simulation and experimental results of image encryption demonstrate that the proposed design presents a good performances in terms of security, low resources and speed. Indeed, the solution can be embedded in many real-time applications namely video encryption.
Download
Paper Nr: 114
Title:

Virtual Private Networks in the Quantum Era: A Security in Depth Approach
Authors:

David Schatz, Friedrich Altheide, Hedwig Koerfgen, Michael Rossberg and Guenter Schaefer
Abstract: Conventional asymmetric cryptography is threatened by the ongoing development of quantum computers. A mandatory countermeasure in the context of virtual private networks (VPNs) is to use post-quantum cryptography (PQC) as a drop-in replacement for the authenticated key exchange in the Internet Key Exchange (IKE) protocol. However, the results of the ongoing cryptanalysis of PQC cannot be predicted. Consequently, this article discusses orthogonal methods for quantum-resistant key exchanges, like quantum key distribution (QKD) and multipath key reinforcement (MKR). As each method has limitations when used on its own, we conclude that it is best to maximize security by combining all available sources of symmetric key material to protect traffic inside a VPN. As one possible realization, we propose a lightweight proxy concept that uses available symmetric keys, like QKD and MKR keys, to implement a transparent cryptographic tunnel for all IKE packets, and consequently for PQC key exchanges. In contrast to combining PQC and symmetric key material within the IKE protocol, our approach provides security in depth: If secure symmetric keys are available, attacks on IKE and hence on PQC algorithms are infeasible. But even otherwise, the security properties of IKE and thus PQC are not weakened, so the overall security of the VPN is guaranteed to increase.
Download
Paper Nr: 126
Title:

Secure E-Commerce Protocol with Complex Trading Capabilities of Intermediaries
Authors:

Cătălin V. Bîrjoveanu and Mirela Bîrjoveanu
Abstract: Up to now, there are many multi-party fair exchange protocols with applications in buying physical/digital goods, digital signature of contracts and certified e-mail, but there is no e-commerce protocol that allows multiple intermediaries to perform aggregate, chained or optional transactions. In this paper, we propose the first multi-party e-commerce complex transaction protocol that allows the customer to acquire some physical products through many intermediaries and providers. Considering complex transactions rise new challenges for assuring strong fairness, that are not appearing in two-party transactions. The objective of our proposal is to ensure strong fairness, effectiveness, timeliness, non-repudiation and confidentiality in a multi-party scenario. The formal verification of our proposal using Cl-AtSe model checker proves that all security requirements mentioned above are satisfied.
Download
Paper Nr: 129
Title:

5G Handover: When Forward Security Breaks
Authors:

Navya Sivaraman and Simin Nadjm-Tehrani
Abstract: 5G mobility management is dependent on a couple of complex protocols for managing handovers, based on the available network interfaces (such as Xn and N2). In our work, we focus on the 5G Xn handover procedure, as defined by the 3GPP standard. In Xn handovers, the source base station hands the user equipment (UE) over to a target base station through two different mechanisms: horizontal or vertical key derivation. To ascertain the security of these complex protocols, recent works have formally described the protocols and proved some security properties. In this work, we formulate a new property, forward security, which ensures the secrecy of future handovers following a session key exchange in one handover. Using a formal model and the Tamarin prover, we show that forward security breaks in the 5G Xn handover in presence of an untrusted base station. We also propose a solution to mitigate this counter-example with a small modification of the 3GPP Xn handover procedures based on the perceived source base station state.
Download
Paper Nr: 146
Title:

The Explainability-Privacy-Utility Trade-Off for Machine Learning-Based Tabular Data Analysis
Authors:

Wisam Abbasi, Paolo Mori and Andrea Saracino
Abstract: In this paper, we present a novel privacy-preserving data analysis model, based on machine learning, applied to tabular datasets, which defines a general trade-off optimization criterion among the measures of data privacy, model explainability, and data utility, aiming at finding the optimal compromise among them. Our approach regulates the privacy parameter of the privacy-preserving mechanism used for the applied analysis algorithms and explainability techniques. Then, our method explores all possible configurations for the provided privacy parameter and manages to find the optimal configuration with the maximum achievable privacy gain and explainability similarity while minimizing harm to data utility. To validate our methodology, we conducted experiments using multiple classifiers for a binary classification problem on the Adult dataset, a well-known tabular dataset with sensitive attributes. We used (ε,δ)-differential privacy as a privacy mechanism and multiple model explanation methods. The results demonstrate the effectiveness of our approach in selecting an optimal configuration, that achieves the dual objective of safeguarding data privacy and providing model explanations of comparable quality to those generated from real data. Furthermore, the proposed method was able to preserve the quality of analyzed data, leading to accurate predictions.
Download
Paper Nr: 152
Title:

VerifMSI: Practical Verification of Hardware and Software Masking Schemes Implementations
Authors:

Quentin L. Meunier and Abdul R. Taleb
Abstract: Side-Channel Attacks are powerful attacks which can recover secret information in a cryptographic device by analysing physical quantities such as power consumption. Masking is a common countermeasure to these attacks which can be applied in software and hardware, and consists in splitting the secrets in several parts. Masking schemes and their implementations are often not trivial, and require the use of automated tools to check for their correctness. In this work, we propose a new practical tool named VerifMSI which extends an existing verification tool called LeakageVerif targeting software schemes. Compared to LeakageVerif, VerifMSI includes hardware constructs, namely gates and registers, what allows to take glitch propagation into account. Moreover, it includes a new representation of the inputs, making it possible to verify three existing security properties (Non-Interference, Strong Non-Interference, Probe Isolating Non-Interference) as well as a newly defined one called Relaxed Non-Interference, compared to the unique Threshold Probing Security verified in LeakageVerif. Finally, optimisations have been integrated in VerifMSI in order to speed up the verification. We evaluate VerifMSI on a set of 9 benchmarks from the literature, focusing on the hardware descriptions, and show that it performs well both in terms of accuracy and scalability.
Download
Paper Nr: 155
Title:

A Lightweight Access Control Scheme with Attribute Policy for Blockchain-Enabled Internet of Things
Authors:

Syed S. Ullah, Vladimir Oleshchuk and Harsha G. Pussewalage
Abstract: The Internet of Things (IoT) revolution has increased the number of connected devices, leading to new security challenges. One of these challenges is the management of access control for these devices. Traditional access control methods may not be able to address these challenges effectively. This paper proposes attribute-based access control (ABAC) for the blockchain-enabled Internet of Things (BE-IoT). ABAC allows access to be granted or denied based on the attributes of the user or device requesting access rather than relying on a central authority to manage access control information. This allows for more flexible and dynamic access control policies that can adapt to changing situations and minimize the risk of unauthorized access. Blockchain technology provides a secure and transparent way to manage access control information for IoT devices. Blockchain is a decentralized and distributed ledger allowing secure and tamper-proof information storage. By storing access control information on the blockchain, it can be shared across a network of devices transparently and securely. The authors conduct a security analysis to evaluate and compare the proposed scheme to existing schemes. The analysis results indicate that the proposed scheme has the advantage of using minimal computation time and communication overhead compared to previous solutions. The authors suggest that the ABAC scheme using blockchain combined with a lightweight Hyperelliptic Curve Cryptosystem (HCC) is well suited for secure deployment in IoT.
Download
Paper Nr: 167
Title:

On Single-Server Delegation Without Precomputation
Authors:

Matluba Khodjaeva and Giovanni Di Crescenzo
Abstract: Many public-key cryptosystems use pairings as important primitive operations. To expand the applicability of these solutions to computationally weaker devices, it has been advocated that a computationally weaker client delegates such primitive operations to a computationally stronger server. Important requirements for such delegation protocols include privacy of the client’s pairing inputs and security of the client’s output, in the sense of detecting, except for very small probability, any malicious server’s attempt to convince the client of an incorrect pairing result. Except for less than a handful of results, all single-server delegation protocols in the literature are structured into an offline phase, where precomputation can be performed, and an online phase, where the client has resource constraints. Designing single-server delegation protocols without precomputation is naturally harder. In this paper, we show that the computation of a pairing with non-private inputs can be efficiently delegated to a single server, without need for precomputation. We also discuss the failure of a previously published attempt, and note the inefficiency of natural extensions of our protocol to more demanding input cases.
Download
Paper Nr: 172
Title:

WebAppAuth: An Architecture to Protect from Compromised First-Party Web Servers
Authors:

Pascal Wichmann, Sam Ansari, Hannes Federrath and Jens Lindemann
Abstract: We present the WebAppAuth architecture for protecting client-side web applications even from attackers who fully control the web server. WebAppAuth signs all files sent to the client on a secure offline device or a hardware security module never accessible by the web server. Public keys are propagated through a key registry that is maintained by two independent key registration authorities, thus protecting users even on their first visit to the web application. Our threat model covers attackers who gain full control over the targeted domain and its DNS and DNSSEC configuration.
Download
Paper Nr: 177
Title:

ERC20: Correctness via Linearizability and Interference Freedom of the Underlying Smart Contract
Authors:

Rudrapatna K. Shyamasundar
Abstract: ERC20 is a standard for the creation of a specific type of tokens called ERC20 tokens, one of the most widely adopted tokens on Ethereum. ERC20 tokens are transferred through dedicated transactions among Ethereum addresses, and managed by smart contracts. Nondeterministic behaviour has been observed on the smart contracts that manage ERC20 tokens resulting in owners losing significant amounts while using it. In this paper, we first discuss issues of nondeterministic behaviour in the ERC20 smart contract, and the standard general remedies that have been proposed in the literature to avoid nondeterministic behaviour in ERC20. Then, through the notion of linearizability, it is shown that as ERC20 permits unbounded concurrency, the linearizability of the ERC20 smart contract is undecidable - thus, demonstrating the subtle complexity of ERC20 and the strong synchronization requirements of ERC20. Finally, treating ERC20 smart contract as a set of asynchronous interacting processes executing on a blockchain, we describe an approach that is common in classical programming language specification, and show how a set of constraints on the traces of ERC20 executions based on interference freedom property for concurrent execution on the blockchain overcomes the nondeterministic behaviour; we shall further sketch how such an execution can be implemented in Solidity. Furthermore, we discuss how the two approaches of linerarization and interference freedom mutually benefit each other and assist in arriving at constraints that leads to wait-free implementation of smart contracts.
Download
Paper Nr: 180
Title:

A Rand Index-Based Analysis of Consensus Protocols
Authors:

Sangita Roy and Rudrapatna K. Shyamasundar
Abstract: Consensus is the heart of Blockchain Technology. Consensus algorithms suffer from issues of either energy inefficiency in the context of Proof of Work (PoW) or monopoly in the context of Proof of Stake (PoS). In other words, while PoW suffers from scalability and performance and PoS suffers from monopoly, both fairness issues are from various interpretations of the blockchain platform. To overcome these issues, there have been several hybrids of PoW and PoS consensus protocols. In this paper, we show how Rand Index can be used for cluster analysis hence analyzing various aspects of consensus protocols. The analysis focuses on issues like correctness, fork formation, and fairness aspects like overcoming monopoly, equal participation of nodes in block creation, decreased latency in commit transaction, a fair selection of validators, minimizing the size/requirement of permissioned networks, etc. We first demonstrate our approach to the Ripple protocol and correlate it with its’ analogies of correctness. We further show, how conditions like fork formations can be overcome through our analysis. Toward the end of the paper, we propose a cluster environment model for realizing a fair selection of validators.
Download
Paper Nr: 182
Title:

Δ SFL: (Decoupled Server Federated Learning) to Utilize DLG Attacks in Federated Learning by Decoupling the Server
Authors:

Sudipta Paul and Vicenç Torra
Abstract: Federated Learning or FL is the orchestration of centrally connected devices where a pre-trained machine learning model is sent to the devices and the devices train the machine learning model with their own data, individually. Though the data is not being stored in a central database the framework is still prone to data leakage or privacy breach. There are several different privacy attacks on FL such as, membership inference attack, gradient inversion attack, data poisoning attack, backdoor attack, deep learning from gradients attack (DLG). So far different technologies such as differential privacy, secure multi party computation, homomorphic encryption, k-anonymity etc. have been used to tackle the privacy breach. Nevertheless, there is very little exploration on the privacy by design approach and the analysis of the underlying network structure of the seemingly unrelated FL network. Here we are proposing the ΔDSFL framework, where the server is being decoupled into server and an analyst. Also, in the learning process, ΔDSFL will learn the spatio information from the community detection, and then from DLG attack. Using the knowledge from both the algorithms, ΔDSFL will improve itself. We experimented on three different datasets (geolife trajectory, cora, citeseer) with satisfactory results.
Download
Paper Nr: 17
Title:

Light Quantum Key Distribution Network Security Estimation Tool
Authors:

Sara Nikula, Pekka Koskela, Outi-Marja Latvala and Sami Lehtonen
Abstract: Quantum key distribution offers a way to create and distribute secure encryption keys based on the laws of quantum physics, which means that these protocols are secure even in the presence of an adversary with unlimited computing power. These keys can be forwarded over several hops in quantum key distribution networks (QKDN). At the moment, any established solutions to assess the security of these networks don’t exist. This paper describes a concept of light tool for security status estimation, which provides a holistic estimation of quantum key distribution network systems’ security status, especially concentrating in quantum issues that might not arise when assessing classical networks. Our approach is to make high abstraction level questions concerning the status of specific security issues. Rather than providing detailed questions, we try to reach a holistic view of QKDN security, where the questions will also guide the future security development. We present sets of questions which concern different areas of quantum key distribution network security. With the help of these questions, we offer a high-abstraction level tool for estimating the security of quantum key distribution networks.
Download
Paper Nr: 21
Title:

Evaluating Label Flipping Attack in Deep Learning-Based NIDS
Authors:

Hesamodin Mohammadian, Arash H. Lashkari and Ali A. Ghorbani
Abstract: Network intrusion detection systems are one of the key elements of any cybersecurity defensive system. Since these systems require processing a high volume of data, using deep learning models is a suitable approach for solving these problems. But, deep learning models are vulnerable to several attacks, including evasion attacks and poisoning attacks. The network security domain lacks the evaluation of poisoning attacks against NIDS. In this paper, we evaluate the label-flipping attack using two well-known datasets. We perform our experiments with different amounts of flipped labels from 10% to 70% of the samples in the datasets. Also, different ratios of malicious to benign samples are used in the experiments to explore the effect of datasets’ characteristics. The results show that the label-flipping attack decreases the model’s performance significantly. The accuracy for both datasets drops from 97% to 29% when 70% of the labels are flipped. Also, results show that using datasets with different ratios does not significantly affect the attack’s performance.
Download
Paper Nr: 22
Title:

Security for Next-Gen Analytics for Cross-Organisation Collaboration
Authors:

Laurent Gomez, Francesco Capano and Patrick Duverger
Abstract: With the global economic and energy crisis, businesses are under pressure to create more financially sustainable and environmentally-aware industries. To that extent, organizations rely on advanced analytics to optimize their business operations and mitigate risks. However, the increasing complexity of cross-organizational collaboration and ever-stricter data protection obligations pose two conflicting objectives: achieving transparency in collaborative processes - mandatory for data and process mining - while adhering to data protection obligations. In this paper, we elaborate on an approach for privacy-preserving analytics, on data shared along cross-organization collaborations. Our strategy is two-fold: (1) transparency and traceability in cross-organization collaboration, leveraging distributed ledger technologies, and (2) privacy-preserving data and process analytics, using hardware-assisted PET, Privacy Enhancing Technology. In a co-innovation with the city of Antibes, we evaluated the feasibility and performance of our approach on a public procurement use case, demonstrating a 5% decrease in late payment penalties.
Download
Paper Nr: 24
Title:

Leveraging Hardware Reverse Engineering to Improve the Cyber Security and Resilience of the Smart Grid
Authors:

Arne R. Nygård and Sokratis Katsikas
Abstract: Cyber-attacks on digital supply chains are rising, and Critical Infrastructures (CIs) such as the Smart Grid are prime targets. There is increasing evidence that vendors, service providers, and outsourced IT -providers are at equal risk of being used by malicious actors to gain a foothold in the power grid - delivering exploits that can disrupt electric power delivery and severely damage our economy. Long digital supply chains with components from different manufacturers require a new approach and methods to ensure the needed security in Critical Infrastructures. Hardware Reverse Engineering (HRE), commonly used for verifying the security of an embedded system, includes disassembling to analyse, test, and document the functionality and vulnerability of the target system. This paper proposes leveraging HRE for improving both the security and the resilience of the power infrastructure against cyber-attacks enabled through the digital supply chain, by organising HRE activities, and how this can be organized within the equipment procurement process in a Distribution System Operator (DSO).
Download
Paper Nr: 26
Title:

On the Implementation of a Lattice-Based Revocable Hierarchical Ibe
Authors:

Mikael Carmona, Doryan Lesaignoux and Antoine Loiseau
Abstract: Identity Based Encryption (IBE) is a serious alternative of Public Key Infrastructure when considering distributed systems such as wireless sensors network, multi-site enterprise, manufacturing sites, and so on. In particular, Revocable Hierarchical IBE (RHIBE) provides all functionalities required for an operational cryptography deployment. This paper proposes a parameter analysis, and a software implementation of one of the most advanced post-quantum RHIBE. The objective is to quantify the performances in software and to provide a concrete set of parameters for a given level of security. For the best of our knowledge, this was not done from previous works that only provide order of magnitudes about parameters and instances sizes. Regarding applications and from today, post-quantum RHIBE lead to very large keys and ciphertext size, letting it difficult to consider such cryptosystems for constraint devices.
Download
Paper Nr: 27
Title:

Privacy in Practice: Private COVID-19 Detection in X-Ray Images
Authors:

Lucas Lange, Maja Schneider, Peter Christen and Erhard Rahm
Abstract: Machine learning (ML) can help fight pandemics like COVID-19 by enabling rapid screening of large volumes of images. To perform data analysis while maintaining patient privacy, we create ML models that satisfy Differential Privacy (DP). Previous works exploring private COVID-19 models are in part based on small datasets, provide weaker or unclear privacy guarantees, and do not investigate practical privacy. We suggest improvements to address these open gaps. We account for inherent class imbalances and evaluate the utility-privacy trade-off more extensively and over stricter privacy budgets. Our evaluation is supported by empirically estimating practical privacy through black-box Membership Inference Attacks (MIAs). The introduced DP should help limit leakage threats posed by MIAs, and our practical analysis is the first to test this hypothesis on the COVID-19 classification task. Our results indicate that needed privacy levels might differ based on the task-dependent practical threat from MIAs. The results further suggest that with increasing DP guarantees, empirical privacy leakage only improves marginally, and DP therefore appears to have a limited impact on practical MIA defense. Our findings identify possibilities for better utility-privacy trade-offs, and we believe that empirical attack-specific privacy estimation can play a vital role in tuning for practical privacy.
Download
Paper Nr: 32
Title:

ArmorDroid: A Rule-Set Customizable Plugin for Secure Android Application Development
Authors:

Cong-Binh Le, Bao-Thi Nguyen-Le, Phuoc-Loc Truong, Minh-Triet Tran and Anh-Duy Tran
Abstract: Although Android is a popular mobile operating system, its app ecosystem could be safer. The lack of awareness and concern for security issues in apps is one of the main reasons for this. Given the current situation, developers have yet to receive sufficient security knowledge. Therefore, we have researched and proposed a tool to support security coding. Based on the idea of DevSecOps, developers are placed at the center to optimize the solution to this problem by integrating security programming into the earlier stage in the software development process. This paper presents two main research contributions: compilation and categorization of security issues in Android application development and developing ArmorDroid, a plugin for Android Studio to support secure coding. This plugin, which can be used for Java, Kotlin, and XML files, can instantly scan and detect vulnerable code and suggest quick fixes for developers during the development phase. This plugin helps developers improve their security code and trains them to write secure code by providing security coding standards in Android applications. Furthermore, developers can customize our rule set to suit their situation and share it with different developers. Our work also presents the results of a pilot study on the effectiveness of the ArmorDroid plugin.
Download
Paper Nr: 34
Title:

SQLi Detection with ML: A Data-Source Perspective
Authors:

Balázs Pejó and Nikolett Kapui
Abstract: Almost 50 years after the invention of SQL, injection attacks are still top-tier vulnerabilities of today’s ICT systems. In this work, we highlight the shortcomings of the previous Machine Learning based results and fill the identified gaps by providing a comprehensive empirical analysis. We cross-validate the trained models by using data from other distributions which was never studied in relation with SQLi. Finally, we validate our findings on a real-world industrial SQLi dataset.
Download
Paper Nr: 37
Title:

Guidelines and a Framework to Improve the Delivery of Network Intrusion Detection Datasets
Authors:

Brian Lewandowski
Abstract: Applying deep learning techniques to perform network intrusion detection has expanded significantly in recent years. One of the main factors contributing to this expansion is the availability of improved network intrusion detection datasets. Despite recent improvements to these datasets, researchers have found it difficult to effectively compare methodologies across a wide variety of datasets due to the unique features generated as part of the delivered datasets. In addition, it is often difficult to generate new features using a dataset due to the lack of source data or inadequate ground truth labeling information for a given dataset. In this work, we look at network intrusion detection dataset development with a focus on improving the delivery of datasets from a dataset researcher to other downstream researchers. Specifically, we focus on making dataset features reproducible, providing clear labeling criteria, and allowing a clear path for researchers to generate new features. We outline a set of guidelines for achieving these improvements along with providing a publicly available implementation framework that demonstrates the guidelines using an existing network intrusion detection dataset.
Download
Paper Nr: 47
Title:

Labelled Vulnerability Dataset on Android Source Code (LVDAndro) to Develop AI-Based Code Vulnerability Detection Models
Authors:

Janaka Senanayake, Harsha Kalutarage, Mhd Omar Al-Kadri, Luca Piras and Andrei Petrovski
Abstract: Ensuring the security of Android applications is a vital and intricate aspect requiring careful consideration during development. Unfortunately, many apps are published without sufficient security measures, possibly due to a lack of early vulnerability identification. One possible solution is to employ machine learning models trained on a labelled dataset, but currently, available datasets are suboptimal. This study creates a sequence of datasets of Android source code vulnerabilities, named LVDAndro, labelled based on Common Weakness Enumeration (CWE). Three datasets were generated through app scanning by altering the number of apps and their sources. The LVDAndro, includes over 2,000,000 unique code samples, obtained by scanning over 15,000 apps. The AutoML technique was then applied to each dataset, as a proof of concept to evaluate the applicability of LVDAndro, in detecting vulnerable source code using machine learning. The AutoML model, trained on the dataset, achieved accuracy of 94% and F1-Score of 0.94 in binary classification, and accuracy of 94% and F1-Score of 0.93 in CWE-based multi-class classification. The LVDAndro dataset is publicly available, and continues to expand as more apps are scanned and added to the dataset regularly. The LVDAndro GitHub Repository also includes the source code for dataset generation, and model training.
Download
Paper Nr: 49
Title:

A Comprehensive Risk Assessment Framework for IoT-Enabled Healthcare Environment
Authors:

Mofareh Waqdan, Habib Louafi and Malek Mouhoub
Abstract: The significance of risk assessment in medical sectors, particularly in emergency rooms, is crucial due to the criticality of the service. We present a comprehensive risk assessment framework for analyzing the risks associated with deploying and using Internet of Things (IoT) technologies in a healthcare environment. In this context, we improve upon the existing methodologies by dynamically calculating the risk score for different devices profiles, considering their number along with other parameters, such as network protocols, device heterogeneity, device security updates, device physical security status, device history status, layer history status, and device criticality. The framework helps healthcare organizations identify, assess, and manage the risks of IoT, which can range from data privacy and confidentiality to system integrity, availability, and performance.
Download
Paper Nr: 55
Title:

Robust Three-Factor Lightweight Authentication Based on Extended Chaotic Maps for Portable Resource-Constrained Devices
Authors:

Arijit Karati, Yu-Sheng Chang and Ting-Yu Chen
Abstract: Public-key based authentication and key agreement (AKA) protocols have attracted considerable interest in providing secure access for various application scenarios. Although three-factor AKA (3FAKA) offers higher security than one- or two-factor ones, most existing 3FAKA are vulnerable, or their safety is reduced to the security of one- or two-factor authentication. Thus, finding a balance between security and usability and countering cloning risks with robust three-factor authentication is an ongoing problem. To mitigates such issues, we propose a lightweight 3FAKA for mobile devices. The suggested 3FAKA employs the physical unclonable function to withstand device cloning attacks and extended chaotic maps to preserve lightweight processes while ensuring essential cryptographic traits, such as unpredictability, unrepeatability, and uncertainty. It is secure under the intractability of extended chaotic maps computational Diffie-Hellman problem. Performance analysis exhibits that our protocol provides a comprehensive set of security and functional aspects accounting for adequate computation, storage, and communication costs compared to state-of-the-art alternatives.
Download
Paper Nr: 57
Title:

Data Protection and Security Issues with Network Error Logging
Authors:

Libor Polčák and Kamil Jeřábek
Abstract: Network Error Logging helps web server operators detect operational problems in real-time to provide fast and reliable services. This paper analyses Network Error Logging from two angles. Firstly, this paper overviews Network Error Logging from the data protection view. The ePrivacy Directive requires consent for nonessential access to the end devices. Nevertheless, the Network Error Logging design does not allow limiting the tracking to consenting users. Other issues lay in GDPR requirements for transparency and the obligations in the contract between controllers and processors of personal data. Secondly, this paper explains Network Error Logging exploitations to deploy long-time trackers to the victim devices. Even though users should be able to disable Network Error Logging, it is not clear how to do so. Web server operators can mitigate the attack by configuring servers to preventively remove policies that adversaries might have added.
Download
Paper Nr: 60
Title:

Defeating MageCart Attacks in a NAISS Way
Authors:

Cătălin Rus, Dipti K. Sarmah and Mohammed El-Hajj
Abstract: MageCart attacks pose a security threat to E-commerce platforms by using e-skimmers to steal payment details. Image steganography is used by attackers to conceal e-skimmers, making detection challenging. Existing solutions have limitations, such as incompatibility or insufficient functionality. This research proposes NAISS, a server-side middlebox solution that leverages digital signatures to filter unauthorized images without requiring client-side modifications. The proof-of-concept implementation demonstrates the efficacy of NAISS, filtering 100% of state of the art stegoimages, while indicating areas for further improvement.
Download
Paper Nr: 67
Title:

Fidelis: Verifiable Keyword Search with No Trust Assumption
Authors:

Laltu Sardar and Subhra Mazumdar
Abstract: A searchable encryption (SE) scheme allows a client to outsource its data to a cloud service provider (CSP) without the fear of leaking sensitive information. The latter can search over the outsourced data based on the client’s query. Such a scheme prevents a malicious CSP from sending incorrect results. However, a malicious client can deny receipt of the correct result and wrongly blame the CSP. Existing SE schemes fail when the client acts maliciously. In this paper, we have studied searchable encryption schemes where none of the parties trust each other. We propose Fidelis, a novel blockchain-based SE scheme, with keyword-search functionality, that is verifiable by both parties. None of the parties can cheat, and an honest CSP gets payment upon providing the result. We implement and evaluate an instance of the protocol on real-life data using Ethereum as the blockchain platform, deploying it in the Ropsten test network. Upon comparing with existing schemes, we observe that our protocol is efficient and scalable.
Download
Paper Nr: 74
Title:

Lightweight FHE-based Protocols Achieving Results Consistency for Data Encrypted Under Different Keys
Authors:

Marina Checri, Jean-Paul Bultel, Renaud Sirdey and Aymen Boudguiga
Abstract: Over the last few years, the improved performances of FHE has paved the way for new multi-user approaches which go beyond performing encrypted-domain calculation for a single user. In this context, this paper proposes several simplified multi-user setups resulting in new FHE-based building blocks and protocols. By simplified multi-user setting we mean that, in order to process a user request, the FHE server is able to select only data encrypted under the proper key in an oblivious way. In doing so, information like the distribution of data per user remains private without losing the consistency of the obtained homomorphic results. We conclude the paper with experiments illustrating that these simplified setups, although not universally applicable, can lead to practical performances for moderate-size databases.
Download
Paper Nr: 76
Title:

Approximate Homomorphic Pre-Processing for CNNs
Authors:

Shabnam Khanna and Ciara Rafferty
Abstract: Homomorphic encryption (HE) allows computations on encrypted data, making it desirable for use in privacy-preserving data analytics. However, HE function evaluation is computationally intensive. Approximate computing (AC) allows a trade-off between accuracy, memory/energy usage and running time. Polynomial approximation of the Rectified Linear Unit (ReLU) function, a key CNN activation function, is explored and AC techniques of task-skipping and depth reduction are applied. The most accurate ReLU approximations are implemented in nGraph-HE’s Cryptonets CNN using a SEAL backend, resulting in a minimal decrease in training accuracy of 0.0011, no change in plaintext classification accuracy, and a speed-up of 47%.
Download
Paper Nr: 99
Title:

A 10-Layer Model for Service Availability Risk Management
Authors:

Jan M. Evang
Abstract: Effective management of service availability risk is a critical aspect of Network Operations Centers (NOCs) as network uptime is a key performance indicator. However, commonly used risk classification systems such as ISO27001:2013, NIST CSF, and NIST 800-53 often do not prioritize network availability, resulting in the potential oversight of certain risks and ambiguous classifications. This paper presents a comprehensive examination of network availability risk and proposes a 10-layer model that aligns closely with the operational framework of NOCs. The 10-layer model encompasses hardware risk, risks across various network layers, as well as external risks such as cloud, human errors, and political governance. By adopting this model, critical risks are less likely to be overlooked, and the NOC’s risk management process is streamlined. The paper outlines each layer of the model, provides illustrative examples of related risks and outages, and presents the successful evaluation of the model on two real-life networks, where all risks were identified and appropriately classified.
Download
Paper Nr: 103
Title:

Lattice-Based Threshold Signature Implementation for Constrained Devices
Authors:

Patrik Dobias, Sara Ricci, Petr Dzurenda, Lukas Malina and Nikita Snetkov
Abstract: Threshold signatures have gained increased attention especially due to their recent applications in blockchain technologies. In fact, current cryptocurrencies such as Bitcoin, and Cardano started to support multi-signature transactions. Even if the Schnorr-based threshold signatures improve the blockchain’s privacy and scalability, these schemes do not provide post-quantum security. In this paper, we propose the optimization of the DS2 lattice-based (n,n)-threshold signature scheme and present its practical implementation. Moreover, we evaluate our optimized implementation of the DS2 scheme on different platforms. The results demonstrate that our implementation is easily portable and executable on constrained devices based on ARM Cortex-A53, ARM Cortex-M3, and ESP32 architectures.
Download
Paper Nr: 107
Title:

How to Plausibly Deny Steganographic Secrets
Authors:

Shahzad Ahmad and Stefan Rass
Abstract: We introduce the notion of oblivious secret sharing as an enhancement of (conventional) secret sharing with the added possibility of (plausibly) denying that some shares even exist. Secret sharing is a cryptographic technique that allows a distributed secure storage of information across multiple parties, such that no party or pre-defined coalition of parties can reconstruct the stored secret. Confidentiality, in this regard, does only apply to the secret, but not the the shares themselves. Oblivious secret sharing extends the secrecy also to the shares, thereby adding the additional possibility of denying the existence of shares in first place, or to reconstruct a different, harmless, secret upon force. We investigate a combination of steganography and secret sharing to enhance both primitives at the same time: secret sharing adds deniability to steganography and steganography adds extended confidentiality to secret sharing. Our construction is generic in its use of steganography, but concrete in the used secret sharing scheme. The latter is a form of multi-secret sharing, letting us secretly hide a set of messages in a larger collection of images, such that the secrets are, in a steganographic way, hidden, but disclosure upon force can be made with plausible deniability. This deniability even extends to the number of secrets embedded in the picture collection. This number is as well deniable. We corroborate our construction by providing an implementation.
Download
Paper Nr: 109
Title:

Proctoring Online Exam Using Eye Tracking
Authors:

Waheeb Yaqub, Manoranjan Mohanty and Basem Suleiman
Abstract: Online proctoring is required for online teaching. Typically, third-party video-based crowd-sourced online proctoring solutions are being used for monitoring exam-takers (e.g., students). This approach, however, has privacy concerns as an exam-taker’s face is shown to the third-party provider. In this paper, we propose to address this concern using face hiding, and then monitoring the face hidden exam takers via eye (gaze) tracking. The eye tracking is used to detect if the exam-taker is reading from computer screen, e.g., from ChatGPT. The face is hidden by exposing the eyes such that eye tracking is possible.
Download
Paper Nr: 110
Title:

Blockchain Data Replication
Authors:

Roberto De Prisco, Sergiy Shevchenko and Pompeo Faruolo
Abstract: We consider applications that write data over a blockchain. Such applications are based on the implicit assumption that the blockchain will work forever. Although blockchains are very fault-tolerant by construction, the event that a blockchain becomes totally unusable or disappears is not impossible. We consider the problem of making the applications fault tolerant against total blockchain failures by replicating the needed data over several blockchains. As specific use cases, we consider the implementation of Self-Sovereign identities and the implementation of a Key Event Receipt Infrastructure using data replicated over several blockchains.
Download
Paper Nr: 111
Title:

Toward a Compliant Token-Based e-Voting System with SSI-Granted Eligibility
Authors:

Dario Castellano, Roberto De Prisco and Pompeo Faruolo
Abstract: In this paper we present a preliminary design for an e-voting system based on self-sovereign identities and built on the Algorand blockchain. The design keeps into consideration the basic properties of an e-voting system and also the EU recommendations. We use the Dizme framework for the management of the identities of the voters, which allows to keep secret the identity while certifying the right to vote, and we store the encrypted votes on the Algorand blockchain. Votes are decrypted only in the tally phase.
Download
Paper Nr: 112
Title:

Self-Sovereign Identity (SSI) Attribute-Based Web Authentication
Authors:

Biagio Boi, Marco De Santis and Christian Esposito
Abstract: Web authentication is primarily based on password usage, representing the weakest link in the entire security chain. The number of services offered over the web is continuously increasing, and with them also the number of required passwords that users need to create and securely store. Despite various standards for password-less or multi-factor authentication, another issue is that most web authentication means use an identity provider (or a federation of providers) advocated to create, manage and check digital identity claims; able to profile user habits related to web navigation and violate rights in terms of privacy. Recently, we are witnessing a radical change of perspective, where identity checks and enforcement are moved away from the providers and more focused on users. Within such user-centric approaches, Self-Sovereign Identity (SSI) has faced progressive popularity, and some authentication mechanisms based on SSI have been proposed. This paper aims to describe a solution based on Hyperledger Aries which is capable to achieve zero-knowledge proof to make an attribute-based authentication and authorization for the web able to cope with the recent legal obligations in terms of privacy.
Download
Paper Nr: 121
Title:

International Mutual Recognition: A Description of Trust Services in US, UK, EU and JP and the Testbed “Hakoniwa”
Authors:

Satoshi Kai, Takao Kondo, Naghmeh Karimi, Konstantinos Mersinas, Marc Sel, Roberto Yus and Satoru Tezuka
Abstract: With the proliferation of digital transactions, trust is becoming increasingly important, as exemplified by the World Economic Forum’s Data Free Flow with Trust. Digital signatures are utilized to establish trust to prevent spoofing and unauthorized modification of transmitted digital data. However, the extent of trust is limited by jurisdictions, trusted lists and bridge certificate authorities, and does not have international coverage. For this reason, mutual recognition is needed, i.e. trust relationships established across countries. Establishing mutual recognition is complex and time-demanding due to the legislations, systems, and technologies involved. In parallel, electronic signatures consist of complex systems and structures and, thus, focusing on the technical requirements and solutions can enhance mutual recognition processes. The purpose of our approach is to develop a testbed that can verify technical aspects of mutual recognition. This paper describes the concept of the testbed “Hakoniwa” which includes analyzing the requirements, simulating and testing mutual recognition trust services across US, UK, EU and JP.
Download
Paper Nr: 122
Title:

Improving Intrusion Detection Systems with Multi-Agent Deep Reinforcement Learning: Enhanced Centralized and Decentralized Approaches
Authors:

Amani Bacha, Farah B. Ktata and Faten Louati
Abstract: Intrusion detection is a crucial task in the field of computer security as it helps protect these systems against malicious attacks. New techniques have been developed to cope with the increasing complexity of computer systems and the constantly evolving threats. Multi-agent reinforcement learning (MARL), is an extension of Reinforcement Learning (RL) in which agents can learn to detect and respond to intrusions while considering the actions and decisions of the other agents. In this study, we evaluate MARL’s performance in detecting network intrusions using the NSL-KDD dataset. We propose two approaches, centralized and decentralized, namely COCA-MADQN and MADQN-GTN. Our approaches show good results in terms of Accuracy, Precision, Recall, and F1-score.
Download
Paper Nr: 127
Title:

Combining Generators of Adversarial Malware Examples to Increase Evasion Rate
Authors:

Matouš Kozák and Martin Jureček
Abstract: Antivirus developers are increasingly embracing machine learning as a key component of malware defense. While machine learning achieves cutting-edge outcomes in many fields, it also has weaknesses that are exploited by several adversarial attack techniques. Many authors have presented both white-box and black-box generators of adversarial malware examples capable of bypassing malware detectors with varying success. We propose to combine contemporary generators in order to increase their potential. Combining different generators can create more sophisticated adversarial examples that are more likely to evade anti-malware tools. We demonstrated this technique on five well-known generators and recorded promising results. The best-performing combination of AMG-random and MAB-Malware generators achieved an average evasion rate of 15.9% against top-tier antivirus products. This represents an average improvement of more than 36% and 627% over using only the AMG-random and MAB-Malware generators, respectively. The generator that benefited the most from having another generator follow its procedure was the FGSM injection attack, which improved the evasion rate on average between 91.97% and 1,304.73%, depending on the second generator used. These results demonstrate that combining different generators can significantly improve their effectiveness against leading antivirus programs.
Download
Paper Nr: 128
Title:

Detecting BrakTooth Attacks
Authors:

Achyuth Nandikotkur, Issa Traore and Mohammad Mamun
Abstract: More than 5.1 billion Bluetooth-enabled devices were shipped in the year 2022 and this trend is expected to exceed 7.1 billion by the year 2026. A large proportion of these devices are used in smart homes designed for older adults, to help them age in place. Monitoring vitals, climate control, illumination control, fall detection, incontinence detection, pill dispensing, and several other functions are successfully addressed by many of these Bluetooth-enabled devices. Therefore it becomes crucial to protect them from malicious attacks and ensure the safety and well-being of their users. Some of these devices have only Bluetooth connectivity which makes patching them challenging for older adults, as a result, most remain unpatched. The family of vulnerabilities recently found in the Bluetooth Classic (BT Classic) stack called BrakTooth, poses a genuine threat to such devices. In this study, we develop an experimental procedure to capture traffic at the Link Manager Protocol (LMP) layer of the BT Classic stack and use machine learning algorithms to detect BrakTooth-based attacks.
Download
Paper Nr: 131
Title:

SoK: Towards CCA Secure Fully Homomorphic Encryption
Authors:

Hiroki Okada and Kazuhide Fukushima
Abstract: Fully homomorphic encryption (FHE) was realized by Gentry in 2009. Since then, the current FHE construction has an inherent theoretical problem: FHE schemes are not secure against adaptive chosen-ciphertext attacks (CCA2), since FHE is malleable by definition. We conduct a survey on the existing works to circumvent this problem toward achieving better security of FHE.
Download
Paper Nr: 132
Title:

IMAGINE Dataset: Digital Camera Identification Image Benchmarking Dataset
Authors:

Jarosław Bernacki and Rafał Scherer
Abstract: We present the IMAGINE dataset. The proposed dataset may be used for benchmarking digital camera identification algorithms, which is an important issue in the field of digital forensics. So far, the most common image dataset seems to be the Dresden Image Database, but this dataset contains images from relatively old devices which include charge-coupled device (CCD) imaging sensors. Our dataset contains a number of images coming from modern devices which include mobile devices, compact cameras, and digital single-lens reflex/mirrorless (DSLR/DSLM) with Complementary Metal-Oxide-Semiconductor (CMOS) imaging sensors. Extensive experimental evaluation performed on a set of modern camera identification methods and algorithms confirmed the reliability of the IMAGINE dataset.
Download
Paper Nr: 133
Title:

Remote Security Assessment for Cyber-Physical Systems: Adapting Design Patterns for Enhanced Diagnosis
Authors:

Kazutaka Matsuzaki, Kenji Sawada and Shinich Honiden
Abstract: This paper presents a novel approach to remote security diagnosis for critical infrastructure systems, focusing on integrating Cyber-Physical Systems (CPS) and cloud-based diagnosis. The proposed method adapts two existing design patterns to address the challenges associated with remote security diagnosis: (1) adapting the "Ambassador Pattern" of the cloud design pattern for virtual extension of the CPS input interface to the cloud computing environment, and (2) adapting the "Data Aggregation Pattern" of the edge computing design pattern for virtual extension of the CPS output to the cloud computing environment. We discuss implementing and evaluating our proposed method in a simulated environment, demonstrating its potential for improving the accuracy and efficiency of remote security assessment. This research contributes to developing secure and reliable CPS by providing insights into effectively adapting existing design patterns for remote security diagnosis.
Download
Paper Nr: 135
Title:

Uncovering Flaws in Anti-Phishing Blacklists for Phishing Websites Using Novel Cloaking Techniques
Authors:

Wenhao Li, Yongqing He, Zhimin Wang, Saleh M. Alqahtani and Priyadarsi Nanda
Abstract: The proliferation of phishing attacks pose substantial threats to global prosperity amidst the Fourth Industrial Revolution. Given the burgeoning number of Internet users and devices, cyber criminals are harnessing phishing toolkits and Phishing-as-a-Service (PhaaS) platforms to spawn numerous fraudulent websites. In retaliation, assorted detection mechanisms, with anti-phishing blacklists acting as a primary line of defense against phishing sites, have been proposed. Yet, adversaries have contrived cloaking techniques to dodge this detection method. This study endeavors to unearth the shortcomings of prevailing blacklists and thereby bolster the efficacy of detection strategies for Anti-Phishing Entities (APEs). This paper presents an exhaustive analysis of innovative and practicable attacks on current anti-phishing blacklists, unmasking potential weaknesses in these protection mechanisms hitherto unexplored in prior research. Additionally, we divulge potential loopholes exploitable by attackers and appraise their effectiveness against popular browser blacklists.
Download
Paper Nr: 139
Title:

CNN-HMM Model for Real Time DGA Categorization
Authors:

Aimen Mahmood, Haider Abbas and Faisal Amjad
Abstract: To remotely control the target machine, hackers manage to establish a connection between victim and their Command and Control server(C2). In order to hide their C2 they generate domain names algorithmically. Such algorithms are called Domain Generation algorithms(DGA). These algorithmically generated domain names are either gibberish as the characters are generated and concatenated randomly, or pure dictionary words or the combination of the two. This paper presents an algorithm that classifies the DGA running on a compromised system either as gibberish, dictionary oriented or the mixed one, in real time. The proposed algorithm consists of two distinct modules i) Network forensics to detect the DGA ii) Classification of the DGA using the combination of Hidden Markov Model and Convolution Neural Network in real time. The algorithm is trained and tested against more than 0.21 million samples taken from more than 50 different DGAs. The algorithm gives as good as 99% accuracy for all types of DGAs. In addition it can detect zero day DGA as well as multiple DGAs running on a system.
Download
Paper Nr: 144
Title:

Anomaly Detection in Smart Grid Networks Using Power Consumption Data
Authors:

Hasina Rahman, Priyadarsi Nanda, Manoranjan Mohanty and Nazim U. Sheikh
Abstract: Smart meters, intelligent devices used for managing energy consumption of consumers, are one of the integral components of the smart grid infrastructure. The smart metering infrastructure can facilitate a two-way communications through the Internet to leverage home energy management and remote meter reading by the service providers. As a consequence, the smart meters are extremely susceptible to various potential security threats, such as data tampering, distributed denial of services (DDoS) attack and spoofing attacks. In this paper, we put forward a scheme to detect anomalies in energy consumption data using real-world datasets. Thereby, addressing data tampering attacks. We have adapted an unsupervised machine learning method to distinguish the anomalous behaviour from the normal behaviour in energy consumption patterns of consumers. In addition, we have proposed a robust threshold mechanism for detecting abnormalities against noise, which has not been used in smart grids before. Our proposed model shows an accuracy of 94.53% in detecting anomalous patterns in energy consumption data. This accuracy surpasses the existing benchmark in anomaly detection in energy consumption data using machine learning models (Huang and Xu, 2021).
Download
Paper Nr: 145
Title:

Security for Distributed Machine Learning
Authors:

Laurent Gomez, Tianchi Yu and Patrick Duverger
Abstract: With the adoption of IoT-like technologies, industrials aim to enhance the business value of their physical assets and improve their operational efficiency. However, IoT devices alone tend to strain enterprise systems with a sheer volume of unstructured and unfiltered data. To overcome this challenge, endowing (smart) devices with AI-based capabilities can significantly enhance enterprise system capabilities. However, deploying AI-based capabilities on potentially insecure edge hardware and platforms introduces new security risks, including AI model theft, poisoning, and data leaks. This paradigm shift necessitates the protection of distributed AI applications and data. In this paper, we propose a solution for safeguarding the Intellectual Property and data privacy of ML-based software. We utilize hardware-assisted Privacy Enhancing Technologies, specifically Trusted Execution Environments. We evaluate the effectiveness of our approach in the context of ML-based motion detection in CCTV cameras. This work is part of a co-innovation project with the Smart City of Antibes, France.
Download
Paper Nr: 150
Title:

A Secure Emergency Framework in an IoT Based Patient Monitoring System
Authors:

Neila Mekki, Mohamed Hamdi, Taoufik Aguili and Tai-hoon Kim
Abstract: Today, the Internet of Things (IoT) in healthcare has become more productive to reduce the gap between doctors and patients. If any problem has occurred to the patient, then the doctor approaches the patient and gives the appropriate treatment. In this context, the main research question is how to identify the methodological choice (paradigm, approach, and method) in coherent with theoretical foundation of the Internet of things. Our objective is to involve better management of public IoT healthcare application by following a prevention methodology. To address this need, we adopt the design science research (DSR) methodology to implement a smart healthcare application. The ultimate goal is to enable the dynamic prediction and/or detection of the patient health deterioration, which taking into consideration the patient health evolution. So the prototyping process suggests some important factors to monitor and assist living diabetic patient at any time. The doctor have the ability to easily monitor and manage the patient health and can save precious minutes every day. Without having to manually visit each patient, the doctor can give a remote diagnosis and track the medical assets. To this purpose, we provides a theoretical contribution which the DSR assists in identifying an intelligent healthcare application based on IoT technology.
Download
Paper Nr: 153
Title:

A Two-Party Hierarchical Deterministic Wallets in Practice
Authors:

ChihYun Chuang, Ihung Hsu and TingFang Lee
Abstract: The applications of Hierarchical Deterministic Wallet are rapidly growing in various areas such as cryptocurrency exchanges and hardware wallets. Improving privacy and security is more important than ever. In this study, we proposed a protocol that fully support a two-party computation of BIP32. Our protocol, similar to the distributed key generation, can generate each party’s secret share, the common chain-code, and the public key without revealing a seed and any descendant private keys. We also provided a simulation-based proof of our protocol assuming a rushing, static, and malicious adversary in the hybrid model. Our master key generation protocol produces up to total of two bit leakages from a honest party given the feature that the seeds will be re-selected after each execution. The proposed hardened child key derivation protocol leads up to a one bit leakage in the worst situation of simulation from a honest party and will be accumulated with each execution. Fortunately, in reality, this issue can be largely mitigated by adding some validation criteria of boolean circuits and masking the input shares before each execution. We then implemented the proposed protocol and ran in a single thread on a laptop which turned out with practically acceptable execution time. Lastly, the outputs of our protocol can be easily integrated with many threshold sign protocols.
Download
Paper Nr: 154
Title:

Migrating Applications to Post-Quantum Cryptography: Beyond Algorithm Replacement
Authors:

Alexandre Augusto Giron
Abstract: Post-Quantum Cryptography (PQC) defines cryptographic algorithms designed to resist the advent of the quantum computer. Most public-key cryptosystems today are vulnerable to quantum attackers, so a global-scale transition to PQC is expected. As a result, several entities foment efforts in PQC standardization, research, development, creation of Work Groups (WGs), and issuing adoption recommendations. However, there is a long road to broad PQC adoption in practice. This position paper describes why migrating to PQC is necessary and gathers evidence that the “hybrid mode” can help the migration process. Finally, it stresses that there are risks yet to be considered by the literature. Quantum-safe protocols are being evaluated, but more attention (and awareness) is needed for the software and protocols at the application layer. Lastly, this position paper gives further recommendations for a smother PQC migration.
Download
Paper Nr: 157
Title:

Analyzing Image Based Strategies for Android Malware Detection and Classification: An Empirical Exploration
Authors:

Chirag Jaju, Dhairya Agrawal, Rishi Poddar, Shubh Badjate, Sidharth Anand, Barsha Mitra and Soumyadeep Dey
Abstract: In recent years, the popularity of Android as a mobile operating system has grown exponentially and so it has been widely used in a huge array of mobile phones. This large scale proliferation of Android has resulted in it being extensively targeted by malware. Numerous families of malware have been developed with the sole purpose of infecting mobile phones and perpetrating different types of attacks on these devices and their users. Naturally, in the past few years, researchers have focused on developing strategies for detecting and classifying malware families. A large number of such strategies are based on converting the malware APK files to grayscale or color images. In this paper, we survey six APK to image conversion techniques and perform a comparative empirical analysis of these methods with respect to malware detection and classification. We implement the six approaches to convert the benign as well as malware binaries into images and then use three CNN-based models to distinguish between benign and malware files and also to classify the various malware families. We use two very popular open-source Android malware datasets, CICAndMal2017 and the Drebin dataset for comparing the performance of the different image conversion techniques for the detection and classification tasks in terms of accuracy and F1-score. The results of the study provide insights into the relative performance of these approaches and help to determine the combination of the image conversion approach and the classification model that provides the best detection and classification performance.
Download
Paper Nr: 165
Title:

Multi-Environment Training Against Reward Poisoning Attacks on Deep Reinforcement Learning
Authors:

Myria Bouhaddi and Kamel Adi
Abstract: Our research tackles the critical challenge of defending against poisoning attacks in deep reinforcement learning, which have significant cybersecurity implications. These attacks involve subtle manipulation of rewards, leading the attacker’s policy to appear optimal under the poisoned rewards, thus compromising the integrity and reliability of such systems. Our goal is to develop robust agents resistant to manipulations. We propose an optimization framework with a multi-environment setting, which enhances resilience and generalization. By exposing agents to diverse environments, we mitigate the impact of poisoning attacks. Additionally, we employ a variance-based method to detect reward manipulation effectively. Leveraging this information, our optimization framework derives a defense policy that fortifies agents against attacks, bolstering their resistance to reward manipulation.
Download
Paper Nr: 168
Title:

Privacy-Preserving Algorithms for Data Cooperatives with Directed Graphs
Authors:

Mark Dockendorf and Ram Dantu
Abstract: A handful of companies currently hold large collections of data about most people. In addition to the questionable ethics of collecting personal data with few-to-no options to limit what these companies collect, there exist exceptionally few ways to regulate how your data is stored and used once it is collected. Furthermore, these data collections cannot be easily cross-referenced to gain insight. Data cooperatives provide an alternative to these separated collections of data. As a participant-driven organization, similar to a credit union, data cooperatives have a vested interest in preserving the privacy of individuals while offering insight similar to other big data analytics. Another bonus of the data cooperative model is the voluntary (and ethical) sourcing of data. The downside of giving participants the freedom to choose which data they contribute is incomplete data sets. To help address this, we adapt label propagation, a semi-supervised learning algorithm for community detection based on partially labeled data, to work over homomorphically encrypted (HE) graphs. We also adapt triangle counting and a vertex scoring scheme to work over directed heterogeneous-vertex, heterogeneous-edge HE graph data.
Download