Search

Forgery of a signature with the aim of deception is a serious crime. Machine learning is often employed to detect real and forged signatures. In this study, we present results which argue that robotic arms and generative models can overcome these systems and mount false-acceptance attacks. Convolutional neural networks and data augmentation strategies are tuned, producing a model of 87.12% accuracy for the verification of 2,640 human signatures. Two approaches are used to successfully attack the model with false-acceptance of forgeries. Robotic arms (Line-us and iDraw) physically copy real signatures on paper, and a conditional Generative Adversarial Network (GAN) is trained to generate signatures based on the binary class of 'genuine' and 'forged'. The 87.12% error margin is overcome by all approaches; prevalence of successful attacks is 32% for iDraw 2.0, 24% for Line-us, and 40% for the GAN. Fine-tuning with examples show that false-acceptance is preventable. We find attack success reduced by 24% for iDraw, 12% for Line-us, and 36% for the GAN. Results show exclusive behaviours between human and robotic forgers, suggesting training wholly on human forgeries can be attacked by robots, thus we argue in favour of fine-tuning systems with robotic forgeries to reduce their prevalence. • Development of a computer vision-based system for signature spoofing attack detection. • A Conditional GAN can generate "real" and "fake" signatures. • Two robots can physically replicate human signatures with pen and paper. • The GAN and both robots can fool the model and mount false-acceptance attacks. • Verification model can be defended by fine-tuning on generative and robotic forgeries. [ABSTRACT FROM AUTHOR]

• A new feature set composed of 46 features for phishing URLs detection were proposed. • An updated feature selection algorithm to obtain the most representative features. • An optimum subset composed of 9 features for phishing URLs detection was proposed. • Random Forest obtains the best Accuracy results using the feature subset proposed. • The Accuracy results obtained outperforms those reported in the literature. Phishing is a cyber-attack that exploits victims' technical ignorance or naivety and commonly involves a Uniform Resources Locator (URL). Hence, it is advantageous to detect a phishing attack by analyzing URLs before accessing them. With the raising of the Internet of Things (IoT), phishing attacks are moving to this field due to the number of IoT devices and the amount of personal information they handle. Although several approaches were proposed for phishing attacks detection, the URL-based Machine Learning approaches obtain better performance results, but all of them are dependent on the feature set used. Contradictorily, only a few works on selecting the best-suited feature set for improving the phishing detection process have been published. The present research explores how to obtain a feature set that substantially enhances the phishing detection rate in IoT environments. Hence, a feature selection algorithm was adopted and extended for getting the most representative feature set. When Random Forest is used with the proposed data representation, the phishing URL attacks discovery rate is 99.57 %. [ABSTRACT FROM AUTHOR]

Federated learning (FL) is a pivotal catalyst for enabling large-scale privacy-preserving distributed machine learning (ML). By eliminating the need for local raw dataset sharing, FL substantially reduces privacy concerns and alleviates the isolated data problem. However, in reality, the success of FL is predominantly attributed to a centralized framework called FedAvg [1] , in which workers are responsible for model training, and servers are in control of model aggregation. Nevertheless, FedAvg's centralized worker-server architecture has raised new concerns, including low scalability of the cluster, risk of data leakage, and central server failure or even defection. To overcome these challenges, we propose De centralized F ederated T rusted A veraging (DeFTA), a decentralized FL framework that serves as a plug-and-play replacement for FedAvg , bringing instant improvements to security, scalability, and fault-tolerance in the federated learning process. In essence, it primarily consists of a novel model aggregating formula with theoretical performance analysis, and a decentralized trust system (DTS) to significantly enhance system robustness. Extensive experiments conducted on six datasets and six basic models suggest that DeFTA not only exhibits comparable performance with FedAvg in a more realistic setting, but also achieves remarkable resilience even when 67% of workers are malicious. • A novel model aggregating formula is proposed that eliminates the aggregating bias in decentralized FL. • Selfish workers are introduced to the decentralized FL setting, which is simple and robust against backdoor attacks. • A general decentralized FL framework is proposed that features a drop-in replacement for the centralized FedAvg algorithm. • This replacement leads to improvements in data security and system reliability, with negligible model performance loss. [ABSTRACT FROM AUTHOR]

Backdoor attack aims to compromise clean models without arousing suspicion, in which poisoned models behave normally for clean inputs yet return adversary-desired results when triggers appear. Due to the great insidiousness and hazard of backdoor attacks, backdoor defences have been attracting a lot of attention in the machine learning security community. Apart from most backdoor mitigation defences, our defence aims to determine whether the prediction of the classifier is trustworthy. More specifically, we scrutinize whether the prediction result is determined by the adversary-defined trigger or the semantic information of an input. To accomplish this goal, we devise a novel algorithm named feature aggregation, which requires only benign inputs and aims to separate the feature representation distributions of poisoned inputs from those of benign ones. The feature aggregation minimizes the distance between intra-benign feature representations and maximizes the distance between benign and poisoned feature representations. Then, we employ flow-based probability density estimation to model the distribution of benign feature representations. Since the likelihood of poisoned inputs over the estimated distribution is significantly smaller than those of benign ones, they can be identified based on an adaptive threshold. Experimental results show that our method outperforms state-of-the-art defences. [ABSTRACT FROM AUTHOR]

Natural language processing (NLP) backdoor attacks have become a hidden threat to modern NLP applications. Most of the existing defense methods defend against specific types of backdoor attacks, and they generally fail to defend against invisible backdoors with syntactically correct triggers. This paper proposes NLPSweep, a comprehensive defense scheme that can defend against five common types of backdoor attacks, namely, character, word, sentence, homograph, and learnable textual attacks. Specifically, we propose a framework that can discover an effective defense solution without prior knowledge of the attacks. The defense solution is optimized from the framework and can defend against various attacks while ensuring high accuracy. Finally, we verify the effectiveness of NLPSweep on two pretrained models (BERT and XLNET) on three classic datasets (SST-2, IMDB, and OLID) and compare it with five state-of-the-art defense methods, namely, ONION, Pred, RAP, Fine-pruning, and STRIP. The experimental results demonstrate that NLPSweep has an average model accuracy (ACC) greater than 0.922 and that the average attack success rate (ASR) is only 0.202, outperforming the compared methods. Furthermore, NLPSweep is tested on the real-world Yelp dataset and it can effectively defend against backdoor attacks with the ASR less than 0.07 and the ACC greater than 0.973.1 • Existing defense methods only defend against specific backdoor attacks. • Our defense framework can discover an effective defense solution without prior knowledge of the attacks. • Our defense solution can defend against various attacks while ensuring high accuracy. • Tests on three classic datasets show that our defense scheme outperforms recent work. • Our scheme demonstrates operational success on the real-world Yelp dataset, effectively defending against backdoor attacks. [ABSTRACT FROM AUTHOR]

• This work presented a novel homomorphic encryption framework over non-abelian rings (matrix-ring). It is one-way secure based on the Conjugacy Search Problem. • The scheme supports real numbers encryption and achieves fast ciphertexts homomorphic comparison without decrypting any ciphetexts operations's intermediate result. • We use the scheme to realize privacy preservation for machine learning training and classification in data ciphertexts environment. The analysis shows that our proposed schemes are efficient for encryption/decryption and homomorphic operations. In recent years, more and more machine learning algorithms depend on the cloud computing. When a machine learning system is trained or classified in the cloud environment, the cloud server obtains data from the user side. Then, the privacy of the data depends on the service provider, it is easy to induce the malicious acquisition and utilization of data. On the other hand, the attackers can detect the statistical characteristics of machine learning data and infer the parameters of machine learning model through reverse attacks. Therefore, it is urgent to design an effective encryption scheme to protect the data's privacy without breaking the performance of machine learning. In this paper, we propose a novel homomorphic encryption framework over non-abelian rings, and define the homomorphism operations in ciphertexts space. The scheme can achieve one-way security based on the Conjugacy Search Problem. After that, a homomorphic encryption was proposed over a matrix-ring. It supports real numbers encryption based on the homomorphism of 2-order displacement matrix coding function and achieves fast ciphertexts homomorphic comparison without decrypting any ciphetexts operations' intermediate result. Furthermore, we use the scheme to realize privacy preservation for machine learning training and classification in data ciphertexts environment. The analysis shows that our proposed schemes are efficient for encryption/decryption and homomorphic operations. [ABSTRACT FROM AUTHOR]

Cyber code analysis is fundamental to malware detection and vulnerability discovery for defending cyber attacks. Traditional approaches resorting to manually defined rules are gradually replaced by automated approaches empowered by machine learning. This revolution is accelerated by big code from open source projects which support machine learning models with outstanding performance. In the context of a data-driven paradigm, this paper reviews recent analytic research on cyber code of malicious and common software by using a set of common concepts of similarity, correlation and collective indication. Sharing security goals in recognizing anomalous code that may be malicious or vulnerable. The ability to do so is not determined in isolation, rather drawn for code correlation and context awareness. This paper demonstrates a new research methodology of data driven cyber security (DDCS) and its application in cyber code analysis. The framework of the DDCS methodology consists of three components, i.e., cyber security data processing, cyber security feature engineering, and cyber security modeling. Some challenging issues are suggested to direct the future research. [ABSTRACT FROM AUTHOR]

At the core of every artificial neural network, lie neurons which are approximate models of their biological counterparts. However, networks that are made of artificial neurons can become unreliable in the face of adversarial machine learning attacks. We traced this issue back to its roots and created a reliable artificial neuron (called binomial neuron) that can resist adversarial attacks such as DeepFool, Fast Gradient Sign Method (FGSM), Pixel, Square and Carlini and Wagner's (C&W) better. We propose to replace the input value of an artificial neuron with the expectation of a Bernoulli random variable. This random variable is made up of the spikes fired by the previous-layer binomial neuron upon crossing a randomly generated threshold. Depending on how long the neuron waits to aggregate the spikes and find the expectation, different model variants can be created. We conducted extensive experiments to evaluate the reliability of this new neuron. The results confirm the increase in the robustness/accuracy under adversarial attacks, or equivalently, the substantial increase in the amount of distortion attackers need to add to images in order to create successful adversarial samples. These distortions pass the perceptibility range to the extent that approach total image destruction. • Creating a novel artificial neuron. • Increasing robustness of the proposed neuron against adversarial attacks. • Using an expectation of a Bernoulli random variable as the input of the proposed neuron. • Achieving high performances in terms of accuracy and robustness under adversarial attacks. [ABSTRACT FROM AUTHOR]

Privacy-preserving traffic flow classification has attracted a significant amount of research interest because of its increasing importance to both network management and privacy protection. In this paper, we propose novel methods for effectively protecting network flow identifiers and attributes against privacy inference attacks in port-based and payload-based classifications respectively, and analyze their performance guarantee on data utility for flow classification and privacy (security). For protection of flow identifiers, we propose a partial identifier protection approach applying randomization and anonymization respectively on desired bit positions to conceal sensitive information, and show their expected-case performance guarantee. For protection of flow attributes, we propose a perturbation-based scheme that first selects the representative attributes by deploying an entropy-based attribute selection method to filter out redundant and insignificant attributes and reduce the problem space, then partitions the attribute domains into either equal-depth or equal-width intervals and perturbs attribute values in these intervals by swapping them with those in adjacent intervals and intervals with same value distribution respectively. We analyze the performance guarantee of the proposed methods and show the experiment results of classification accuracy obtained by implementing popular machine-learning based benchmark classifiers on our selected attributes against that on raw attributes, and on our perturbed attribute values against that on raw values, respectively. The experiment results show that our proposed methods for attribute selection and perturbation retain a high degree of data utility under the desired privacy guarantee for network traffic classification. [ABSTRACT FROM AUTHOR]