Search

Keywords Reinforcement learning; Android malware detection; Feature selection; RNN; Sequence processing Highlights * This paper applied reinforcement learning algorithms to the feature selection phase of Android malware detection, reducing the burden of feature selection tasks. * This paper adopts Natural Language Processing methods to tackle the feature selection methods. * This paper presented a modifiable framework that can be easily ported to other feature selection tasks for malware detection. Abstract Due to the completely open-source nature of Android, the exploitable vulnerability of malware attacks is increasing. Machine learning, leading to a great evolution in Android malware detection in recent years, is typically applied in the classification phase. Since the correlation between features is ignored in some traditional ranking-based feature selection algorithms, applying wrapper-based feature selection models is a topic worth investigating. Though considering the correlation between features, wrapper-based approaches are time-consuming for exploring all possible valid feature subsets when processing a large number of Android features. To reduce the computational expense of wrapper-based feature selection, a framework named DroidRL is proposed. The framework deploys DDQN algorithm to obtain a subset of features which can be used for effective malware classification. To select a valid subset of features over a larger range, the exploration-exploitation policy is applied in the model training phase. The recurrent neural network (RNN) is used as the decision network of DDQN to give the framework the ability to sequentially select features. Word embedding is applied for feature representation to enhance the framework's ability to find the semantic relevance of features. The framework's feature selection exhibits high performance without any human intervention and can be ported to other feature selection tasks with minor changes. The experiment results show a significant effect when using the Random Forest as DroidRL's classifier, which reaches 95.6% accuracy with only 24 features selected. Author Affiliation: (a) College of Software Engineering, Sichuan University, Chengdu, China (b) School of Cyber Science and Engineering, Sichuan University, Chengdu, China (c) College of Computer Science, Sichuan University, Chengdu, China (d) School of Business, Sichuan University, Chengdu, China * Corresponding author. Article History: Received 21 September 2022; Revised 21 December 2022; Accepted 26 January 2023 Byline: Yinwei Wu (a), Meijin Li (a), Qi Zeng (c), Tao Yang (c), Junfeng Wang (c), Zhiyang Fang [fangzhiyang@scu.edu.cn] (*,b), Luyu Cheng (d)

Keywords Cyberspace security; Intrusion detection; Adversarial training; Machine learning; Generative adversarial networks Abstract Network Intrusion Detection Systems (IDS) have achieved high accuracy by widely applying Machine Learning (ML) models. However, most current ML-based IDSs can not cope with targeted attacks from adversaries because they are commonly trained and tested using fixed data sets. In this paper, we propose an Adversarial Intrusion Detection Training Framework (AIDTF) to improve the robustness of IDSs, which consists of an attacker model a-model, a defender model d-model, and a black-box trainer t-module. Both the a-model and d-model are multilayer perceptrons, and the t-module is the module used to train IDSs. AIDTF improves the accuracy of IDS by using an adversarial training method, which is different from traditional training methods. Taking the distribution of normal samples in the dataset as the distribution that the a-model and d-model need to learn, the goal of the a-model is to generate samples that deceive the d-model, while the goal of the d-model is to determine whether the input samples are real samples, so there is an adversarial relationship between a-model and d-model. Different types of IDSs can be trained by the t-module using the samples generated from the confrontation between the a-model and the d-model, and we call this kind of IDS the Adversarial Training Intrusion Detection System (ATIDS). The main contribution of this paper is to propose a training method that is used to obtain an IDS with high accuracy not only for known test sets but also to identify unknown disguised attack samples. We tested different types of ATIDSs using the current mainstream attack methods, which include the Fast Gradient Method, Fast Gradient Sign Method, Projected Gradient Descent, and Jacobs Saliency Map Algorithm. The experimental results prove that AIDTF outperforms other adversarial training methods with not only higher accuracy for the test set but also up to a 99% recognition rate for the attack samples. Author Affiliation: (a) School of Computer Science and Technology, Dongguan University Of Technology, GuangDong, China (b) School of Cyberspace Security, Dongguan University Of Technology, GuangDong, China * Corresponding author. Article History: Received 11 October 2022; Revised 2 February 2023; Accepted 13 February 2023 Byline: Wen Ding Xiong [xiongwending@hotmail.com] (a), Kai Lun Luo [luokl@dgut.edu.cn] (b), Rui Li [ruili@dgut.edu.cn] (*,b)

Keywords Cybercrime; Situational crime prevention; SCP; Criminology; Cyber-focused crime; Cyber-enabled crime Highlights * Evolution and developments of cybercrimes into cyber-focused and cyber-enabled crimes. * Survey of research articles on the application of Situational Crime Prevention (SCP) techniques in preventing cybercrimes. * Research gaps and future areas of research on SCP in cybercrimes. Abstract Situational Crime Prevention (SCP) is a criminological approach that is shown to reduce crime opportunities drawing from five different strategies comprising 25 techniques. With the global increase in cybercrime, practitioners and researchers are increasingly investigating opportunities for applying SCP strategies and techniques to prevent cyber-focused and cyber-enabled crimes. Recent research proposes ways that SCP can be applied to cybercrime. Yet most of this research utilizes only a few of the SCP techniques and the linkages between the SCP techniques and opportunities for reducing cybercrimes are rarely made explicit. In this paper we evaluate the relevance of the full spectrum of SCP techniques to cybercrime and explicate how computer scientists, cybercrime and cybersecurity researchers and practitioners apply SCP principles to prevent and control cyber-enabled crime. Through a focused systematic review of 352 articles across computer science, criminal justice and criminology literature using the PRISMA method, this paper clarifies terminologies, explores the rise of cybercrimes, and explains the value of SCP for responding to cybercrimes. We provide a review of the current research undertaken to apply SCP to cybercrimes and conclude with a discussion on research gaps and potential future areas of research. Author Affiliation: (a) Faculty of Engineering, Cyber Security, School of Information Technology and Electrical Engineering, Architecture and Information Technology, The University of Queensland, Brisbane, QLD 4072, Australia (b) Faculty of Humanities and Social Sciences, School of Social Science, The University of Queensland, Brisbane, QLD 4072, Australia * Corresponding author. Article History: Received 8 April 2021; Revised 5 December 2021; Accepted 10 January 2022 Byline: Heemeng Ho [heemeng.ho@uq.net.au] (a,*), Ryan Ko [ryan.ko@uq.edu.au] (a), Lorraine Mazerolle [l.mazerolle@uq.edu.au] (b)

Keywords Microscopic printing; Source printer identification; Printer forensics; Documentauthentication; Support vector machine Abstract Identifying a forged printed document with scanned evidence can be a challenge. Microscopic printing is showing random shape which depends on the printing source as well as printing material. This paper presents a statistical analysis of the printing patterns under a microscopic scale, analyses the effect of printing direction, printing substrate (uncoated and coated paper), and printing technology (conventional offset, waterless offset, and electrophotography). The analysis shows a negligible effect of printing direction, yet, using the shape descriptor indexes, the printing materials and technologies are distinguishable under a microscopic scale. As a result, the algorithms based on Support Vectors Machine and Random Forest are developed, with shape descriptor indexes as features, for printing source identification. Both proposed algorithms, equally, achieve a high classification accuracy rate, over 92% accuracy with complex geometric-shape patterns. Thanks to the lightweight and efficiency of the Support Vectors Machine, the study shows promising applications for real-world and potential implementation in the Internet of Things devices. Author Affiliation: (a) Université de Lille, ENSAIT, GEMTEX, F-59000 Lille, France (b) School of Computer Science & Engineering, International University, and Vietnam National University, Ho Chi Minh City, Vietnam (c) University Grenoble Alpes, CNRS, Grenoble INP (Institute of Engineering, Univ. Grenoble Alpes), LGP2, F-38000 Grenoble, France * Corresponding author. Article History: Received 9 January 2021; Revised 2 April 2021; Accepted 4 May 2021 Byline: Quoc-Thông Nguyen [nguyenquocthong1111@gmail.com] (*,a), An Mai (b), Lionel Chagas (c), Nadège Reverdy-Bruas (c)

Keywords Ransomware detection; Evolutionary computation; Symbolic regression; Genetic programming; Malice score; Cooperative coevolution Abstract Malice scoring is a technique that is present throughout the literature to quantify a software malignance through the assignment of a malice score. However, the majority of existing malice scoring models are synthesised using manually selected features and weights, where a domain specialist is needed. Hence, this paper aim at utilising Genetic Programming and cooperative coevolution to automatically evolve an ensemble of symbolic regression functions to assign a malice score to an instance of software data. Using a publicly available dataset, the effectiveness of the proposed method is assessed and compared to that of the state-of-the-art malice scoring method. The experimental results show that the proposed method has significantly outperformed the benchmark method and exhibits the best-performing model that produces an overall balanced accuracy of 95.80%, correctly classifying 94.21% and 97.39% of unseen malicious and benign instances, respectively. Furthermore, various aspects of the proposed method and experimental results have been analysed in-depth to provide insight into the evolutionary process and some of the automatically evolved models. Author Affiliation: (a) School of Engineering and Computer Science, Victoria University of Wellington, Wellington, New Zealand (b) Department of Computer Science, University of Agriculture Faisalabad, Punjab, Pakistan (c) Cybersecurity Lab, Massey University, Auckland, New Zealand * Corresponding author. Article History: Received 23 October 2022; Revised 24 February 2023; Accepted 27 March 2023 Byline: Taran Cyriac John [johntara@myvuw.ac.nz] (a), Muhammad Shabbir Abbasi [Shabbir.Abbasi@ecs.vuw.ac.nz] (a,b), Harith Al-Sahaf [Harith.Al-Sahaf@ecs.vuw.ac.nz] (*,a), Ian Welch [Ian.Welch@ecs.vuw.ac.nz] (a), Julian Jang-Jaccard [J.Jang-jaccard@massey.ac.nz] (c)

Keywords Cloud storage; Cloud security; Public auditing; Privacy-preserving; Data security Abstract Public auditing enables a verifier, say a third party auditor (TPA), to verify whether the cloud correctly stores the user's cloud data. To date, a lot of public auditing schemes have been proposed. However, none of them consider the problem of auditing frequency. In practice, to reduce the cost of auditing service and avoid waste of resources, the users prefer to frequently verify the integrity of high-value data and check the integrity of low-value data with low frequency. In this paper, we propose a privacy-preserving certificateless public auditing scheme supporting different auditing frequencies. In this scheme, a novel auditing strategy is provided, in which the TPA is allowed to complete auditing tasks on high-value and low-value files with different auditing frequencies. The user's privacy can be achieved by utilizing permutation technology to confuse the real file index. Hence, the TPA cannot distinguish the files with high value. We also use the random masking technology to mask the auditing proof, which guarantees the privacy of user data. The proposed scheme avoids the complicated certificate management and key escrow since it is designed in the certificateless cryptography. We prove that the proposed scheme is secure. The experimental results are shown to validate the efficiency of the proposed scheme. Author Affiliation: (a) College of Computer Science and Technology, Qingdao University, Qingdao 266071, China (b) School of Mathematicsy, Shandong University, Jinan 250100, China (c) School of Artificial Intelligence and Big Data, Henan University of Technology, Zhengzhou 450001, China * Corresponding author. Article History: Received 1 November 2022; Revised 18 January 2023; Accepted 10 March 2023 Byline: Yinghui Huang (a), Wenting Shen [shenwentingmath@163.com] (*,a), Jing Qin (b), Huiying Hou (c)

Keywords Cybersecurity; Privacy; Intrusion detection; Industry 4.0; Decentralized federated learning; Differential privacy; IoT/IIoT security; Post-Quantum cryptography Abstract Advanced technologies, such as the Internet of Things (IoT) and Artificial Intelligence (AI), underpin many of the innovations in Industry 4.0. However, the interconnectivity and open nature of such systems in smart industrial facilities can also be targeted and abused by malicious actors, which reinforces the importance of cyber security. In this paper, we present a secure, decentralized, and Differentially Private (DP) Federated Learning (FL)-based IDS (2DF-IDS), for securing smart industrial facilities. The proposed 2DF-IDS comprises three building blocks, namely: a key exchange protocol (for securing the communicated weights among all peers in the system), a differentially private gradient exchange scheme (achieve improved privacy of the FL approach), and a decentralized FL approach (that mitigates the single point of failure/attack risk associated with the aggregation server in the conventional FL approach). We evaluate our proposed system through detailed experiments using a real-world IoT/IIoT dataset, and the results show that the proposed 2DF-IDS system can identify different types of cyber attacks in an Industrial IoT system with high performance. For instance, the proposed system achieves comparable performance (94.37%) with the centralized learning approach (94.37%) and outperforms the FL-based approach (93.91%) in terms of accuracy. The proposed system is also shown to improve the overall performance by 12%, 13%, and 9% in terms of F1-score, recall, and precision, respectively, under strict privacy settings when compared to other competing FL-based IDS solutions. Author Affiliation: (a) Networks and Systems Laboratory (LRS), Badji Mokhtar-Annaba University, B.P.12, Annaba 23000, Algeria (b) Artificial Intelligence & Digital Science Research Center, Technology Innovation Institute, United Arab Emirates (c) UMR CNRS 6027 IRDL, University of Brest, Brest, France (d) Laboratory of Automation and Manufacturing Engineering, University of Batna 2, Batna, Algeria (e) School of Electrical Engineering and Computer Science, University of Ottawa, Ottawa, ON, Canada (f) Department of Information Systems and Cyber Security, University of Texas at San Antonio, San Antonio, TX 78249, USA * Corresponding author. Article History: Received 1 September 2022; Revised 30 November 2022; Accepted 9 January 2023 Byline: Othmane Friha [othmane.friha@univ-annaba.org] (*,a), Mohamed Amine Ferrag [mohamed.ferrag@tii.ae] (b), Mohamed Benbouzid [Mohamed.Benbouzid@univ-brest.fr] (c), Tarek Berghout [t.berghout@univ-batna2.dz] (d), Burak Kantarci [Burak.Kantarci@uottawa.ca] (e), Kim-Kwang Raymond Choo [raymond.choo@fulbrightmail.org] (f)

Keywords Global positioning system (GPS); machine learning (ML); software-defined radio (SDR); spoofing detection; unmanned aerial vehicles (UAVs) Abstract In this paper, machine learning (ML) modeling is proposed for the detection and classification of global positioning system (GPS) spoofing in unmanned aerial vehicles (UAVs). Three testing scenarios are implemented in an outdoor yet controlled setup to investigate static and dynamic attacks. In these scenarios, authentic sets of GPS signal features are collected, followed by other sets obtained while the UAV is under spoofing attacks launched with a software-defined radio (SDR) transceiver module. All sets are standardized, analyzed for correlation, and reduced according to feature importance prior to their exploitation in training, validating, and testing different multiclass ML classifiers. The resulting performance evaluation of these classifiers shows a detection rate (DR), misdetection rate (MDR), and false alarm rate (FAR) better than 92%, 13%, and 4%, respectively, together with a sub-millisecond detection time. Hence, the proposed modeling facilitates accurate real-time GPS spoofing detection and classification for UAV applications. Author Affiliation: (1) Department of Electrical and Computer Engineering, Purdue University Northwest, Hammond, IN 46375, USA (2) Department of Electrical and Computer Engineering, The University of Maine, Orono, ME 04469, USA (3) School of Electrical Engineering and Computer Science, The University of North Dakota, Grand Forks, ND 58202, USA * Corresponding author Article History: Received 8 September 2022; Revised 15 December 2022; Accepted 27 December 2022 Byline: Mohammad Nayfeh (1), Yuchen Li (1), Khair Al Shamaileh [kalshama@pnw.edu] (1,*), Vijay Devabhaktuni (2), Naima Kaabouch (3)

Keywords Greybox fuzzing; Internet of things; On-device; Binary-level; Daemon analysis Abstract In recent years, coverage-guided greybox fuzzing has demonstrated its efficiency in detecting security vulnerabilities on traditional devices. Instrumentation information plays a significant role in sophisticated greybox fuzzer such as American Fuzzing Lop to directionally improve coverage and distill seeds. While open-source programs leverage wrapped assemblers to glean instrumentation information, closed-source programs can utilize the emulation-based instrumentation for coverage-guided fuzzing. The pervasiveness of the closed source puts a strong demand for emulation instrumentation. However, the required access to peripherals brings great difficulty in fuzzing on the emulator, especially for those various IoT devices. This paper presents AflIot, the first generic on-device fuzzing framework for Linux-based IoT binary programs. By leveraging offset-free binary-level instrumentation, binary programs can avoid unnecessarily rewriting, inherit compatibility of peripherals, and be executed directly on IoT devices by AflIot. We evaluate AflIot on multiple benchmarks with real-world IoT programs. AflIot identified 437 unique crashes in 13 binary programs, including 95 newly confirmed unique crashes. Those crashes demonstrate that AflIot is efficient and effective in detecting potential software bugs in binary programs on Linux-based IoT devices. Author Affiliation: (a) College of Computer Science and Technology, Zhejiang University, Hangzhou 310027, China (b) Department of Electrical Engineering and Computer Science, Northwestern University, Evanston, IL 60208, USA (c) Department of Computer Science, University of California, Davis, CA 95616, USA (d) Key Laboratory of Blockchain and Cyberspace Governance of Zhejiang Province, Hangzhou, China, 310027 * Corresponding author. Article History: Received 1 September 2020; Revised 8 June 2022; Accepted 18 August 2022 (footnote)1 Member, IEEE (footnote)2 Fellow, IEEE Byline: Xuechao Du [xcdu@zju.edu.cn] (a), Andong Chen [chenandong@zju.edu.cn] (a), Boyuan He [bhe@northwestern.edu] (b), Hao Chen [chen@ucdavis.edu] (c,1), Fan Zhang [fanzhang@zju.edu.cn] (a,d,1,*), Yan Chen [ychen@northwestern.edu] (b,2)

Keywords Cybersecurity; Policy; Cyberspace; Infrastructure; Protection; Security; Threats Highlights * This study investigates cybersecurity attributes used in seven nations including the USA, the EU, Canada, Australia, China, India, and malaysia. * Fourteen common cybersecurity attributes were identified among these nations including Telecommunication, Network, cloud Computing, E-Commerce, online Banking, smart Grid, consumer Rights, Cybercrime, Encryption, Privacy, identity Theft, digital Signature, data Security, and spam. * Some nations scored higher at managing some cybersecurity attributes than others. For example, the USA has the highest score of E-banking policy, but canada has the highest score of E-commerce and spam policies. Abstract Cyber threats have risen as a result of the growing usage of the Internet. Organizations must have effective cybersecurity policies in place to respond to escalating cyber threats. Individual users and corporations are not the only ones who are affected by cyber-attacks; national security is also a serious concern. Different nations' cybersecurity rules make it simpler for cybercriminals to carry out damaging actions while making it tougher for governments to track them down. Hence, a comprehensive cybersecurity policy is needed to enable governments to take a proactive approach to all types of cyber threats. This study investigates cybersecurity regulations and attributes used in seven nations in an attempt to fill this research gap. This paper identified fourteen common cybersecurity attributes such as telecommunication, network, Cloud computing, online banking, E-commerce, identity theft, privacy, and smart grid. Some nations seemed to focus, based on the study of key available policies, on certain cybersecurity attributes more than others. For example, the USA has scored the highest in terms of online banking policy, but Canada has scored the highest in terms of E-commerce and spam policies. Identifying the common policies across several nations may assist academics and policymakers in developing cybersecurity policies. A survey of other nations' cybersecurity policies might be included in the future research. Author Affiliation: (a) Informatics and Digitalization, Molde University College--Specialized University in Logistics, 6410 Molde, Norway (b) Department of Software Engineering, Atilim University, Ankara 06830, Turkey (c) Management Information Systems Department, College of Business, American University of the Middle East, Egaila 15453, Kuwait (d) School of Computer Science, The University of Technology Sydney, 15 Broadway, Ultimo, NSW 2007, Australia * Corresponding author. Article History: Received 28 April 2022; Revised 24 June 2022; Accepted 28 June 2022 Byline: Alok Mishra [alok.mishra@himolde.no] (a,b,*), Yehia Ibrahim Alzoubi [yehia.alzoubi@aum.edu.kw] (c), Memoona Javeria Anwar (d), Asif Qumer Gill (d)

Keywords Secure multi-party computation; Privacy-preserving machine learning; Oblivious transfer; Secret sharing; Garbled circuits Abstract Recently, privacy-preserving machine learning (PPML) has received a lot of research attention, due to the increasing demand for multiple data owners in training machine learning models. Thus, many works have been proposed for privacy-preserving machine learning, in which many breakthroughs have been made. However, However, there is still much room for improvement in terms of efficiency and accuracy. In this paper, we design a toolkit called LEGO that efficiently combines garbled circuits, secret sharing, oblivious transfer, and homomorphic encryption to reduce time and improve accuracy. Our work focuses on the two-server model where the two servers train the models on the different owners' private data. For fully connected layers and convolutional layers, we utilize the associated multiplication triplets to reduce the communication. For the offline phase, we design a novel protocol based on oblivious transfer and improved the previous protocol based on homomorphic encryption. We use the MPC-friendly activation function to improve the performance. Besides, we accelerate the local computation by adding GPU support. Our work is implemented in C++, and it can securely train machine learning models, including linear regression, logistic regression, neural networks, and convolutional neural networks. The experimental results show that our work is significantly faster than the state-of-the-art works. Author Affiliation: (a) College of Computer Science and Technology, Jilin University, Changchun 130012, China (b) Department of Electrical and Computer Engineering, George Washington University,Washington, DC, 20052, USA * Corresponding author. Article History: Received 4 November 2021; Revised 21 April 2022; Accepted 1 June 2022 Byline: Zhipeng Zhou (a), Qiang Fu (b), Qianjun Wei (a), Qiang Li [li_qiang@jlu.edu.cn] (*,a)

Keywords Intention-concealed; Privacy preserving; Browsing trajectories; Online social networks; Interest profile Abstract With the flourishment of Artificial Intelligence (AI), the quality of services on online social networks (OSNs) has improved tremendously. Through the introduction of AI into OSNs, providers enhance the users experience. However, the risk of data misuse has also been magnified. And there has been a trend towards users' mistrust when it comes to sharing their true intention on OSN platforms, primarily because of privacy concerns. In this paper, we propose an effective intention-concealing visitation framework named Aviv, which acts as a credible and private third-party where it generates artificial intention-concealed browsing (AICB trajectories) for users to conceal their true intentions. The browsing trajectory is a sequence composed of blogs, bloggers, news, or a mixture containing visitable content. Specifically, Aviv first extracts accessible graphs composed of visitable contents from applied OSN platforms. Then an elaborate and personalized divert scoring process is conducted to measure optional decoy visits' effectiveness. Finally, using the divert scoring values, elaborate and personalized decoy visits are picked out, Aviv composes AICB trajectories with true intentions and picked decoy visits. Aviv is implemented as a credible private third-party and tested on a real OSN, the performance evaluation results show that Aviv is effective and efficient. Author Affiliation: (a) National Key Laboratory of Integrated Networks Services, Xidian University, Xi'an, China (b) School of Computer Science, University of Guelph, Ontario, Canada (c) Faculty of Computer Science, University of New Brunswick, New Brunswick, Canada * Corresponding author. Article History: Received 20 August 2021; Revised 17 April 2022; Accepted 26 May 2022 Byline: Helin Li (a), Hui Zhu [zhuhui@xidian.edu.cn] (*,a), Xiaodong Lin (b), Rongxing Lu (c), Zhipeng Yu (a), Wei Lan (a)

Keywords Secure multiparty computation; Convolutional neural network; Polynomial approximation; Parametric polynomial; Secret sharing Abstract In recent years, deep learning has become an increasingly popular approach to modelling data due to its ability to detect abstract underlying patterns in data. Its practical applications have been limited, however, by data privacy concerns, restricting its use in major sectors such as healthcare and banking. Secure multiparty computation (MPC) is a scheme which allows multiple parties to perform joint computations over private data, while keeping the content of their data secret. MPC can enable privacy-preserving machine learning, however current implementations are rarely applied in practice due to the prohibitively high cost of performing thousands of computations and transmitting data between parties. In this paper we propose a framework incorporating various optimisation approaches from the wider field of privacy-preserving deep learning, including privacy-preserving batch normalisation and polynomial approximation of activation functions, and evaluate their performance when applied to a privacy-preserving convolutional neural network (CNN), discussing the trade-off each offers in terms of their accuracy and efficiency. We experiment with parametric polynomial (PPoly) activations by deriving polynomial approximations to activation functions and allowing the network to tune the coefficients as learning weights. We will show that, in shallow CNNs, the application of batch normalisation in combination with a PPoly activation layer can result in faster convergence, with testing accuracy exceeding that achieved with an unencrypted network, at the cost of longer running times. Author Affiliation: Centre of Software Reliability / Institute for Cyber Security, School of Mathematics, Computer Science and Engineering, City University of London, United Kingdom * Corresponding author. Article History: Received 15 April 2021; Revised 27 January 2022; Accepted 2 March 2022 Byline: Cate Berry [catherine.statham@city.ac.uk], Nikos Komninos [nikos.komninos.1@city.ac.uk] (*)

Keywords Non-repudiation; IoT; Cloud computing; Blockchain; Trust Abstract The IoT cloud computing paradigm is emerging for IoT applications. In such a paradigm, how to guarantee non-repudiation service provisioning has attracted research efforts recently. While existing solutions could work for distributed IoT cloud applications, storage, computation, and economic cost is still a practical challenging concern. In this paper, we propose a new, cost-lower non-repudiation scheme for IoT cloud applications. The proposed scheme guarantees that neither the IoT client nor the cloud could repudiate a service enjoyment and provisioning. Specifically, the proposed scheme employs a blockchain to achieve non-repudiation. First, when the cloud provides a service, it encrypts the service, stores a cryptographic hash digest of the encrypted service on the blockchain, and then sends the encrypted service to the IoT client. Second, the IoT client needs to acknowledge the hash digest on the blockchain to obtain the service. Third, the cloud sends the decryption key to the blockchain under the IoT client's public key to finish a service provisioning. We show that the proposed scheme achieves non-repudiation fairly. We prototyped, evaluated, and open-sourced the proposed scheme. Experimental results confirmed the efficiency of the proposed scheme and the speedup compared with the state-of-the-art solution. Author Affiliation: (a) College of Computer Science and Engineering, Shenzhen University, China (b) College of Computer Science and Electronic Engineering, Hunan University, Changsha, China (c) College of Computer Science, Chongqing University, Chongqing, China * Corresponding author. Article History: Received 13 October 2021; Revised 23 January 2022; Accepted 16 February 2022 Byline: Fei Chen [fchen@szu.edu.cn] (a), Jiahao Wang [1910273023@email.szu.edu.cn] (a), Jianqiang Li [lijq@szu.edu.cn] (a), Yang Xu [xuyangcs@hnu.edu.cn] (b), Cheng Zhang (b), Tao Xiang [txiang@cqu.edu.cn] (c,*)

Keywords Hyperledger fabric; Blockchain; Endorsing peer; Endorsement policy; ZK-SNARK; Linkable threshold ring signature; RSA Accumulators; Proof of exponentiation Abstract Hyperledger Fabric is a permissioned flavor of blockchain which offers various privacy features to its users. It stands out from other permissioned framework by allowing only a subset of peers called endorsing peers to execute the chaincode. This subset is given in the form of logical expression called endorsement policy. During the validation phase, every peer checks the transaction for desired endorser signatures against the endorsement policy. There are various attacks and privacy risks involved in disclosing the endorser signature and endorsement policy. In this paper we provide a framework for a secure endorsement system in Hyperledger Fabric. An efficient linkable threshold ring signature scheme is constructed, with a ZK-SNARK set membership proof, to secure the endorsements made by the endorsers. The endorsement policy is obfuscated by employing a recent construction of universal RSA accumulators and the individual membership proofs are batched through a non-interactive proof of exponentiation technique for efficient validation. We provide formal security definitions and proofs for the proposed framework. Author Affiliation: (a) Department of Computer Science and Engineering, Thiagarajar College of Engineering, Madurai, India (b) Department of Computer Science and Engineering, National Institute of Technology, Trichy, India * Corresponding author. Article History: Received 2 February 2021; Revised 31 March 2021; Accepted 1 February 2022 (footnote)1 (Senior Member IEEE) Byline: Dharani J [jdharani791@gmail.com] (*,a), Sundarakantham K [kskcse@tce.edu] (a), Kunwar Singh [kunwar@nitt.edu] (b), Mercy Shalinie S [shalinie@tce.edu] (1,a)

Keywords Differential privacy; Attribute linkage attack; Set-valued dataset; Topology theory; APLKiller Abstract Differential Privacy (DP) is well-known for its strong privacy guarantee. Briefly speaking, DP algorithms guarantee that the statistical information of the data is roughly preserved, and at the same time, individual privacy is protected with guarantees. However, when there are correlations among the attribute in the dataset, only relying on DP is not sufficient to defend against the attribute linkage attack, which is a well-known privacy attack aiming at deducing individuals' private information. In the attribute linkage attack, the adversary can leverage prior knowledge about the victim, combined with accessing the published dataset, to infer sensitive information about a victim. In this paper, we study the attribute linkage attack in DP settings, and argue that enhancing DP can give users a higher level of privacy guarantees. Our contributions are â we show that the attribute linkage attack can be initiated with high probability under the protection of DP, â we propose a variant of DP called APL-Free-DP to provide a higher level of privacy guarantees, â we design an algorithm APLKiller which satisfies the APL-Free -DP. Finally, experiments show that our algorithm not only eliminates the attribute linkage attack, and at the same time, it has a better ability to extract useful information from the data. Author Affiliation: (a) Department of Computer Science and Engineering, The Chinese University of Hong Kong,Hong Kong, China (b) Baidu Security, Beijing, China * Corresponding authors. Article History: Received 15 May 2021; Revised 4 November 2021; Accepted 15 November 2021 Byline: Jincheng Wang [jcwang@cse.cuhk.edu.hk] (*,a), Zhuohua Li [zhli@cse.cuhk.edu.hk] (a), John C.S. Lui [cslui@cse.cuhk.edu.hk] (a,*), Mingshen Sun [sunmingshen@baidu.com] (b)

Keywords Process anomalies; Anomaly detection; Industrial control systems; Design and data-centric approach; Water treatment plant Abstract There exist several process-based anomaly detectors for Industrial Control Systems (ICS). Often such detectors are built using Machine learning (ML) algorithms that do not take explicit advantage of the design knowledge of the plant under control. Such detectors are considered as physics unaware. In this paper, we present the outcome of a series of experiments designed to explore the significance of design knowledge in improving the detection effectiveness of ML-based anomaly detectors. The experiments were conducted on an operational Secure Water Treatment (SWaT) plant by launching several coordinated attacks. Based on the observations we argue that detectors that use physics-informed ML algorithms can detect, and explain to plant operators, a wider range of anomalies when compared against their physics-unaware counterparts. Author Affiliation: (a) iTrust, Centre for Cyber Security Research, Singapore University of Technology and Design, Singapore (b) Department of Computer Science, Purdue University, USA * Corresponding authors. Article History: Received 5 May 2021; Revised 3 October 2021; Accepted 31 October 2021 Byline: Dillon Cheong Lien Sung [cheonglsdillon@gmail.com] (a), Gauthama Raman M.R. [gauthama_mani@sutd.edu.sg] (a,*), Aditya P Mathur [aditya_mathur@sutd.edu.sg] (a,b)

Keywords Malware detection; Semantic information; Sensitive subgraph; Machine learning; Feature engineering Abstract As the most popular mobile platform, Android has become the major attack target of malware, and thus there is an urgent need to effectively thwart them. Recently, the machine learning-based technique has been a promising solution for malware detection, which highly depends on distinguishing features to separate the malware from the benign apps. Although hundreds of features are available for machine learning-based malware detectors, adversaries can also utilize feature-related knowledge to develop variants of malware to evade detection. Therefore, a key role of the Android security community is to continuously propose new features that can characterize malicious behaviors. In this paper, we propose a novel static sensitive subgraph-based feature for Android malware detection, named S.sup.3Featrue. First, to represent Android applications with high-level characteristics, we develop a sensitive function call graph (SFCG) by extending a function call graph (FCG) through tagging sensitive nodes on it. A malicious score is evaluated to identify sensitive nodes. Second, a large number of sensitive subgraphs (SSGs) and their neighbor subgraphs (NSGs) are mined from a SFCG to characterize suspicious behaviors of applications. Finally, after removing repetitive or isomorphic subgraphs, the remaining SSGs and NSGs are encoded into a feature vector to represent each application. For malware detection, S.sup.3Featrue achieves 97.04% F1-score, which performs better than other well-studied features. And a combination of S.sup.3Featrue and other features achieves 97.71% F1-score, which shows that S.sup.3Feature is a good potential feature in improving the performance of malware detection approaches or tools. Author Affiliation: School of Computer Science and Engineering, Nanjing University of Science and Technology, Nanjing 210094,China * Corresponding author. Article History: Received 6 July 2021; Revised 4 September 2021; Accepted 8 October 2021 Byline: Fan Ou, Jian Xu [dolphin.xu@njust.edu.cn] (*)

Keywords Network-based intrusion detection system; Cost-sensitive algorithms; Deep learning; Bagging; Boosting; Cybersecurity Abstract In recent times, Network-based Intrusion Detection Systems (NIDSs) have become very popular for detecting intrusions in computer networks. Existing NIDSs can easily identify those intrusions that have been frequently witnessed in the network (majority attacks), but they cannot identify new and infrequent intrusions (minority attacks) accurately. Moreover, such systems solely focus on maximizing the overall Attack Detection Rate while overlooking the number of false alarms. To address these issues, this paper proposes CSE-IDS, a three-layer NIDS, based on Cost-Sensitive Deep Learning and Ensemble algorithms. Layer 1 of the proposed CSE-IDS uses Cost-Sensitive Deep Neural Network to separate normal traffic from suspicious network traffic. These suspicious samples are then sent to Layer 2, which uses the eXtreme Gradient Boosting algorithm to classify them into normal class, different majority attack classes, and a single class representing all minority attack classes. At last, Random Forest is used at Layer 3 to classify the minority attacks identified at Layer 2 into their respective classes. The performance of the proposed CSE-IDS was evaluated on the NSL-KDD, CIDDS-001, and CICIDS2017 datasets with respect to Accuracy, Recall, Precision, F1-score, ROC curve, AUC values, and computational times. The proposed system outperforms its counterparts by achieving a high Attack Detection Rate for both majority attacks and minority attacks present in the network. Further, it minimizes the number of false alarms by correctly segregating normal traffic from attack traffic. The obtained results confirm that the proposed CSE-IDS can be deployed in the real world for performing network-based intrusion detection. Author Affiliation: (a) Department of Computer Science, University of Delhi, India (b) Keshav Mahavidyalaya, University of Delhi, India * Corresponding author. Article History: Received 30 June 2021; Revised 4 September 2021; Accepted 3 October 2021 Byline: Neha Gupta [neha.phd.2018@gmail.com] (a), Vinita Jindal [vjindal@keshav.du.ac.in] (b,*), Punam Bedi [pbedi@cs.du.ac.in] (a)

Keywords IoT; Healthcare; IoHT; Security; IoHT device identification; IoHT device authentication; Vulnerabilities; Attacks; Threats Abstract The Internet of Things (IoT) paradigm serves as an enabler technology in several domains. Healthcare is one of the domains in which the IoT plays a vital role in increasing quality of life. On the one hand, the Internet of Healthcare Things (IoHT) creates smart environments and increases the efficiency and intelligence of the provided services. On the other hand, unfortunately, it suffers from security vulnerabilities inside and outside. There are various techniques used to identify, access, and securely manage IoT devices. Additionally, sensors, monitoring, key confidentiality management, integrity, and sensitive data accessibility are required. This study focuses on the IoT perception layer and offers a comprehensive review of the IoHT or the Internet of Medical Things (IoMT). The paper covers the current trends and open challenges in IoHT device authentication mechanisms, such as the physically unclonable function (PUF) and blockchain-based techniques. In addition, IoT simulators and verification tools are included. Finally, a future vision regarding the evolution of IoHT device authentication in terms of the utilization of different technologies, such as artificial intelligence, cloud computing, and 5G, is provided at end of this review. Author Affiliation: (a) Electronics and Communications Department, Faculty of Engineering, Minia University, Minia, Egypt (b) Department of Computer Science, Electrical and Space Engineering, Luleå University of Technology, Luleå 97187, Sweden (c) College of Information Technology, United Arab Emirates University, Al Ain P.O. Box 17551, United Arab Emirates (d) Faculty of Engineering, Al-Azhar University, Qena P.O. Box 83513, Egypt (e) Centre for Security, Communications and Network Research, University of Plymouth, Plymouth PL4 8AA, U.K (f) Department of Telecommunications Engineering, Egyptian Russian University, Cairo, Egypt * Corresponding author. Article History: Received 22 March 2021; Revised 1 September 2021; Accepted 21 September 2021 Byline: Moustafa Mamdouh (a), Ali Ismail Awad [ali.awad@ltu.se] (*,b,c,d,e), Ashraf A.M. Khalaf (a), Hesham F.A. Hamed (a,f)

Keywords Trajector; VANET; Semantic; Reinforcement learning; Differential privacy Abstract The protection of vehicle trajectory in Vehicular ad hoc network is facing many challenges. Among these challenges, one of the most critical issues is to keep the balance between geographical location protection and semantic location protection. Traditional trajectory protection schemes either only focus on geographical location protection or only semantic location protection. Moreover, when trajectory privacy protection is carried out, each location is often given the same protection. This may lead to sensitive locations under insufficient protection and unimportant locations under overprotection. In this paper, based on differential privacy, we propose an optimized privacy differential privacy scheme with reinforcement learning in vehicular ad hoc network. The proposed scheme can dynamically optimize the privacy budget allocation for each location on the vehicle trajectory to reach a better balance between geolocation obfuscation and semantic security. Experiments results demonstrate that the proposed scheme can reduce the risk of geographical and semantic location leakage, and therefore ensure the balance between the utility and privacy. Author Affiliation: (a) Faculty of Mathematics and Computer Science, Wuhan Polytechnic University, Wuhan, 430023, China (b) School of Computer Science, University of Technology Sydney, Sydney, 2007, Australia (c) School of Information and Security Engineering, Zhongnan University of Economics and Law, Wuhan, 430073, China * Corresponding author. Article History: Received 9 September 2020; Revised 12 June 2021; Accepted 11 August 2021 Byline: Xin Chen (a), Tao Zhang (b), Sheng Shen (b), Tianqing Zhu [tianqing.zhu@uts.edu.au] (*,b), Ping Xiong (c)

Keywords Security; Assurance; Trustworthy data security level agreement (TDSLA); Service level agreement; Cloud services; Government pocurement; Indonesia Abstract After the post-Snowden upheavals, there is a growing concern about preserving the confidentiality of sensitive data across government agencies when using global cloud service providers, such as Amazon Web Services and Microsoft Azure. The use of certification schemes is becoming more critical to assure the security of services offered. This situation is problematic because many certification schemes aim to demonstrate compliance with a security standard rather than achieve a specified security level. Despite the benefits of security certification schemes like Common Criteria (CC), an assurance-based certification process does not scale well to service provision. To this end, this paper aims to investigate the concept of system assurance and trustworthiness in service provisioning, especially when government agencies procure cloud-based services. By using work on the Indonesian Government's data confidentiality requirements, this work develops principles as foundations for a trustworthy data security level agreement (TDSLA) capability framework as a new assurance mechanism for service provisioning based on discrete levels of security assurance incorporated into the formulation of a service level agreement (SLA). The principles which have emerged from the empirical qualitative data collection were evaluated and validated using four approaches: 1) reflection against related work; 2) testimonial validity through participants' feedback; 3) use cases, and 4) application of transferability using cases from the UK Government Cloud (G-Cloud) and the US Federal Risk and Authorization Management Program (FedRAMP). The TDSLA capability framework can form the basis for constructing a legal language in contracts or SLAs. Author Affiliation: (a) Jakarta Smart City, Department of Communications, Informatics, and Statistics, Jakarta, Indonesia (b) School of Computing - Telkom University, Bandung, Indonesia (c) Department of Computer Science, University of Oxford, Oxford, United Kingdom * Corresponding author. Article History: Received 14 June 2020; Revised 23 December 2020; Accepted 1 March 2021 Byline: Yudhistira Nugraha [yudhistiranugraha@telkomuniversity.ac.id] (a,b,*), Andrew Martin (c)

Keywords Spam review detection; Machine learning; Convolutional neural networks; Self-organizing maps; Word2Vec; GloVe; Fake review detection Abstract Online public reviews have significant influenced customers who purchase products or seek services. Fake reviews are posted online to promote or demote targeted products or reputation of the organizations and businesses. Spam review detection has been the focus of many researchers in recent years. As the online services have been growing rapidly, the importance of the issue is ever increasing and needs to be addressed properly. In this regard, there is a variety of approaches that have been introduced to distinguish truthful reviews from the fake ones. The main features engineered in the past studies typically involve two types of linguistic-based and behavioral-based characteristics of the reviews. Unsupervised, supervised and semi-supervised machine learning methods have been widely utilized to perform such a classification. This paper introduces a novel approach to detect fake reviews from the genuine ones using linguistic features. Unsupervised learning via self-organizing maps (SOM) in conjunction with a convolutional neural networks (CNN) are employed to perform classification of the reviews. We transform the reviews into images by arranging semantically-similar words around a pixel of the image or equivalently a SOM grid cell. The resulting review images are consequently fed to the CNN for supervised training and then classification. Comprehensive tests on two gold-standard datasets show the effectiveness of the proposed method on single and multi-domain contexts with accuracy of 88% and 87%, respectively. Author Affiliation: School of Computer Science, University of Windsor, 401 Sunset Ave, Windsor, ON N9B 3P4, Canada * Corresponding author. Article History: Received 14 October 2020; Revised 16 February 2021; Accepted 16 March 2021 Byline: Ashraf Neisari [neisari@uwindsor.ca], Luis Rueda [lrueda@uwindsor.ca] (*), Sherif Saad [shsaad@uwindsor.ca]

Keywords DNA cryptography; DNA sequence; Encryption; Decryption; Mealy machine Abstract Nowadays, the amount of data produced and stored in computing devices is increasing at an alarming rate. Tremendous amounts of critical and sensitive data are transmitted between all these devices. Thus, it is very imperative to guarantee the security of all these indispensable data. Cryptography is a commonly used technique to ensure data security. The fundamental objective of cryptography is to transmit data from the sender to the receiver in the most secure way, so that an attacker is unable to extract the original data content. This paper proposes a novel cryptosystem based on Deoxyribonucleic Acid (DNA) cryptography and finite automata theory. The system is made of three entities, namely a key pair generator, a sender and a receiver. The sender generates a 256-bit DNA based secret key based on the attributes of the receiver, and this key is used for data encryption. Then, a randomly generated Mealy machine is used for coding the DNA sequence, which makes the ciphertext more secure. The proposed scheme can protect the system against numerous security attacks, such as brute force attack, known plaintext attack, differential cryptanalysis attack, cipher text only attack, man-in-the-middle attack and phishing attack. The results and discussions show that the proposed scheme is efficient and secure than the existing schemes. Author Affiliation: (a) Division of Computer Engineering, School of Engineering, Cochin University of Science and Technology, Kochi, India (b) Department of Computer Science and Engineering, National Institute of Technology Patna, Bihar, India (c) University of Haute-Alsace, Colmar, France * Corresponding author. Article History: Received 17 September 2020; Revised 20 December 2020; Accepted 21 December 2020 Byline: Pramod Pavithran (a), Sheena Mathew (a), Suyel Namasudra [suyelnamasudra@gmail.com] (b,*), Pascal Lorenz (c)