Search

Reverse auction-based incentive mechanisms have been commonly proposed to stimulate mobile users to participate in crowdsensing. Recent works pointed out that bid is a private information and proposed bidding-preserving mechanisms with differential privacy against inference attack. However, all these mechanisms rely on a trusted platform, and would fail in bid protection when the platform is untrusted. In this paper, we design novel privacy-preserving incentive mechanisms to protect users' true bid information against the honest-but-curious platform while minimizing the social cost of winner selection. To this end, instead of uploading the true bid to the platform, a differentially private bid obfuscation function is designed with the exponential mechanism, which helps each user to obfuscate bids locally and submit obfuscated bids to the platform. Two solutions are proposed for the platform to solve the winner selection problem with the obfuscated information. Moreover, we further propose a novel task-bid pair protection truthful incentive mechanism to further prevent privacy leakage from the set of interested tasks, where each user encrypts his interested tasks locally and an encrypted task clustering method is proposed for winner selection with users' encrypted task-bid pairs. Both of theoretical analysis and extensive experiments demonstrate the effectiveness of proposed mechanisms.

Data plane switches in software-defined networks are increasingly recognised as potential targets for attack, with recent exploits showing their vulnerability to full compromise. The serious consequences of such a breach have prompted the design of compromise detection mechanisms, which monitor switch forwarding behaviour at runtime to ensure that it has not been altered by an attack. However, such defences cannot achieve full coverage in stateful, programmable data planes, creating an opportunity for an attacker to evade detection by carefully editing a switch's forwarding program to mishandle a small subset of packets. To exploit this opportunity and avoid detection, an attacker must analyse and edit the program's behaviour within a narrow time window, which is possible when the data plane is defined by a uBPF program compiled from P4, due to the predictable compilation process. In this work, we aim to invalidate this analysis-guided attack technique with targeted obfuscation of P4-uBPF programs that increases the analysis complexity. We find that, by inserting additional program paths and syntactic dependencies between variables, we can force an attacker to analyse a higher proportion of program instructions and carry out time-consuming SMT solving to find valid program paths, rendering the previous attack technique infeasible. Furthermore, by applying our identified program optimisations, program performance can often be maintained after obfuscation. In evaluating our work, we identify the potential to improve our solution by tailoring obfuscations to individual program paths.

A major challenge of sharing spatially explicit agricultural and agri-environmental data is to identify the trade-off between field parcel confidentiality and spatial pattern preservation. in this study, the main drawback of point-based obfuscation was identified and the polygon-based obfuscation methods were designed and developed to overcome these issues.

Advanced reverse analysis tools have significantly improved the ability of attackers to crack software via dynamic analysis techniques, such as symbol execution and taint analysis. These techniques are widely used in malicious fields such as vulnerability exploitation or theft of intellectual property. In this paper, we present an obfuscation strategy called execution trace obfuscation, wherein the program execution trace repeatedly switches between multiple threads. Our technique realizes equivalent code transformation by abstracting the obfuscation problems into pruning, cloning, and coloring problems in graph theory. Based on this, we further propose the cascade encryption of a function that depends on execution trace information with a key derived from the function address calculation process, followed by removing this key from the program. We have implemented a compiler-level system that inputs a source program and automatically generates an obfuscated file. Finally, random test proves the universality of obfuscation algorithm and verify the system's performance. Results shows that our system can effectively interfere advanced reverse analysis tools.

Unlike a traditional centralized and producer-controlled power grid, the smart grid is a more complicated distributed power system consisted of many resources and applications. In smart grid, huge amounts of data generated by edge devices are collected by different parties. To achieve high operation efficiency, it is important to enable the data sharing and cooperative computation among different parties. How to protect the security and privacy of the utility data and the identities of their owners has become a major concern. There have been some studies on this issue. However, most of these works failed to consider the privacy protection in the dual sides of the data owner and receiver. In this paper, we propose BPM4SG, a Blockchain-based dual-side Privacy-preserving Multi-party computation scheme for edge-enabled Smart Grid. In BPM4SG, the data segmentation method is adopted to ensure the security of multi-party computation (e.g., summation) in edge nodes. The consortium blockchain and smart contract are used to further increase the system security and avoid the dependency on trusted third parties. Additionally, a data obfuscation method based on the ring signatures and a new one-time address scheme are proposed to protect the privacy of both the data owner and data receiver. The analysis shows that BPM4SG can meet the security and privacy requirements of smart grid. The experimental evaluation results demonstrate that our scheme has a better performance compared with other popular schemes.

In this paper, we propose PUF-RAKE, a physically unclonable function (PUF) based lightweight, highly reliable authentication and key establishment scheme. The proposed PUF-RAKE is robust against masquerade, brute force, replay, and modeling attacks. In PUF-RAKE, we introduce an inexpensive yet secure stream authentication scheme inside the device which authenticates the server before the underlying PUF can be invoked. This prevents an adversary from brute forcing the device's PUF to acquire challenge-response pairs (CRPs) essentially locking out the device from unauthorized model generation. Additionally, we also introduce a lightweight CRP obfuscation mechanism involving XOR and shuffle operations. The security of PUF-RAKE has been formally verified. A prototype of the protocol has been implemented on two Xilinx Zynq 7000 system-on-chips. Observations, security analysis and results verify that the PUF-RAKE is secure against a probabilistic polynomial time adversary under both the unauthenticated link and authenticated link adversarial models while providing ~99% reliable authentication. In addition, PUF-RAKE provides a reduction of 60% and 72% for look-up tables (LUTs) and register count, respectively, in the programmable logic (PL) part of the Zynq 7000 as compared to a recently proposed approach while providing additional advantages.

With the development of cloud computing, the great amount of storage data requires safe and efficient data sharing. In multiparty storage data sharing, first, the confidentiality of shared data is ensured to achieve data privacy preservation. Second, the security of stored data is ensured. That is, when stored shared data are subject to frequent access operations, the server's address sequence or access mode is hidden. Therefore, determining how to ensure the untraceability of stored data or efficient hide the data access mode in sharing stored data is a challenge. By leveraging proxy re-encryption and oblivious random access memory (ORAM), a privacy-preserving and untraceable scheme is proposed to support multiple users in sharing data in cloud computing. On the one hand, group members and proxies use the key exchange phase to obtain keys and resist multiparty collusion if necessary. The ciphertext obtained according to the proxy re-encryption phase enables group members to implement access control and store data, thereby completing secure data sharing. On the other hand, this paper realizes data untraceability and a hidden data access mode through a one-way circular linked table in a binary tree (OLTB) and obfuscation operation.

The security of computers is at risk because of information leaking through their power consumption. Attackers can use advanced signal measurement and analysis to recover sensitive data from this side channel. To address this problem, this paper presents Maya, a simple and effective defense against power side channels. The idea is to use formal control to re-shape the power dissipated by a computer in an application-transparent manner---preventing attackers from learning any information about the applications that are running. With formal control, a controller can reliably keep power close to a desired target function even when runtime conditions change unpredictably. By selecting the target function intelligently, the controller can make power to follow any desired shape, appearing to carry activity information which, in reality, is unrelated to the application. Maya can be implemented in privileged software, firmware, or simple hardware. In this paper, we implement Maya on three machines using privileged threads only, and show its effectiveness and ease of deployment. Maya has already thwarted a newly-developed remote power attack.

We propose the hybrid malware detection scheme, HyMalD, with bidirectional long short-term memory (Bi-LSTM) and the spatial pyramid pooling network (SPP-Net). Its purpose is to protect IoT devices and minimize the damage caused by infection through obfuscated malware. HyMalD performs the static and dynamic analyses logically simultaneously detects obfuscated malware, which is impossible to do using static analysis alone. First, it extracts static features of the opcode sequence using a reconstructed dataset according to the obfuscation, and extracts the application programming interface (API) call sequence dynamically. The extracted features are trained through the Bi-LSTM and SPP-Net models, which HyMalD uses to detect and classify IoT malware. The performance of HyMalD was evaluated, and its detection accuracy was 92.5%. False-negative rate (FNR) of HyMalD was 7.67%. Thus, HyMalD detects IoT malware more accurately and with a lower FNR than static analysis, which had a 92.09% detection accuracy and a 9.97% FNR.

Obfuscation is a prevalent security technique which transforms syntactic representation of a program to a complicated form, but still keeps program semantics unchanged. So far, developers heavily rely on obfuscation to harden their products and reduce the risk of adversarial reverse engineering. However, despite its spectacular progress, one crucial hurdle is that each of existing obfuscation method is designed specifically for obfuscating one program feature (e.g., identifier name, control flow), so an effective obfuscation scheme usually composes a considerable amount of different obfuscation methods. Therefore, one primary challenge lies in identifying effective combinations of obfuscation methods. In this research, we propose a principled technique for generating an optimal program obfuscation scheme by adopting a reinforcement learning approach. Given a program and a set of obfuscation transformations, a reinforcement learning model is progressively trained to select a sequence of obfuscation transformations, such that applying each transformation in order towards the program yields the optimal obfuscation result, making programs dissimilar while retaining reasonable instrumentation overhead. Our implementation can directly work on raw binary executables without source code, and our evaluation demonstrates that the trained models can effectively obfuscate executable files with low cost.

Decompilers are indispensable tools in Android malware analysis and app security auditing. Numerous academic works also employ an Android decompiler as the first step in a program analysis pipeline. In such settings, decompilation is frequently regarded as a "solved" problem, in that it is simply expected that source code can be accurately recovered from an app. On the other hand, it is known that, e.g, obfuscation can negatively impact a decompilers effectiveness. Therefore, in order to better understand potential failure modes of, e.g., automated analysis pipelines involving decompilation, it is important to characterize the performance of decompilers on both benign and malicious apps. To this end, we have performed what is, to the best of our knowledge, the first large-scale study of Android decompilation failure rates, using three sets of apps; namely, 3,018 open-source apps, 13,601 apps crawled from Google Play, and an existing collection of 24,553 malware samples. In addition to the state-of-the-art Dalvik bytecode decompiler Jadx, we also studied the performance of three popular Java decompilers. Furthermore, this paper also presents the findings from a follow-up study on 54,945 malware apps, where we additionally performed an analysis of the reasons for decompilation failures. Our study revealed that decompilers generally have very low failure rates, and that few failures on benign apps appear to be related to obfuscation. On malware, however, obfuscation appears to be a more prominent cause of failures, although the vast majority of malicious apps could still be fully decompiled by an ensemble of decompilers. Funding Agencies|Swedish Graduate School in Computer Science (CUGS); Excellence Center at Linkoeping - Lund in Information Technology (ELLIIT)

The security of hardware intellectual properties (IPs) has become a significant concern, as the opportunity for piracy, reverse engineering, and malicious modification is increasing. Hardware obfuscation has been studied as a potent method to protect against all these attack vectors. However, most of the existing obfuscation techniques have been successfully compromised, where many inherent functional or structural vulnerabilities in these techniques are utilized to reveal the obfuscation key or retrieve the original design. In this paper, we introduce LeGO, a learning-guided obfuscation framework that overcomes known vulnerabilities in a scalable and systematic manner, leading to a robust and lightweight locking mechanism. The proposed framework is guided by our security evaluation process that performs a thorough assessment of an obfuscated IP against various attacks and identifies the vulnerabilities. It then judiciously selects and applies a set of design modification steps or rules that can eliminate these vulnerabilities. Such a rule-based obfuscation process has the distinctive capability to address all existing as well as emerging attacks through the learning of appropriate design transformation steps that prevent these attacks. We present an efficient strategy to apply these rules on a design, while resolving any conflict. Our evaluation of the LeGO framework on a set of ISCAS85 and open-source IP benchmarks has shown promising results in terms of robustness against diverse attacks with an average of area, power and delay overhead of 39%, 45%, and 15%, respectively.

Cryptography chips are often used in some applications, such as smart grids and Internet of Things (IoT) to ensure their security. Cryptographic chips must be strictly tested to guarantee the correctness of the encryption and decryption. Scan-based design-for-testability (DFT) provides high test quality. However, it can also be misused to steal the cipher key of cryptographic chips by hackers. In this article, we present a new scan design methodology that can resist scan-based side-channel attacks by the dynamical obfuscation of scan input data and scan output data. The scan test is managed by a test password, which consists of load password and scan password. When the chip enters into the test mode, it is required to apply the test password via some external input ports. Once the correct load password is delivered, the scan password can be loaded into a special shift register. If the scan password is also correct, the chip testing can proceed normally. In case the load password or the scan password is wrong, the data in scan chains cannot be propagated correctly. Specifically, some elusory bits are sneaked into scan chains dynamically. The advantage of the proposed method is that it has no negative impact on design performance and test flow when powerfully protecting cryptographic chips. The area penalty is also acceptably low compared with other schemes.

The outsourcing of data is becoming increasingly commonplace as data is constantly been synchronized between user systems (e.g., personal computers and sensor devices) and cloud computing servers. However, for the consideration of data privacy, it is necessary to encrypt sensitive data prior to outsourcing. Limitations such as measurement, network delays, and data obfuscation may, however, result in uncertain data. Compared with searching over encrypted certain data, processing queries for encrypted uncertain data is more challenging. In this paper, we propose a secure and efficient range query scheme over outsourced encrypted uncertain data, for example from Internet of Things (IoT) systems. Specifically, we use pivot mapping to map data to a low-dimensional space to facilitate calculation and processing while preserving some of the original relevance among the data. Additionally, we encode data and then map codes into multiple Bloom filters which are organized by a binary tree-based index. Our scheme achieves data privacy, hides the relevance among data, and also supports efficient queries. We analyze the security and evaluate the performance of our approach using experiments on Microsoft Azure. The analysis and experimental results evidence that our proposed approach is secure and efficient.

It is a challenging task to deploy lightweight security protocols in resource-constrained IoT applications. A hardware-oriented lightweight authentication protocol based on device signature generated during voltage over-scaling (VOS) was recently proposed to address this issue. VOS-based authentication employs the computation unit such as adders to generate the process variation dependent error which is combined with secret keys to create a two-factor authentication protocol. In this paper, machine learning (ML)-based modeling attacks to break such authentication is presented. We also propose a \underline{c}hallenge \underline{s}elf-\underline{o}bfuscation \underline{s}tructure (CSoS) which employs previous challenges combined with keys or random numbers to obfuscate the current challenge for the VOS-based authentication to resist ML attacks. Experimental results show that ANN, RNN and CMA-ES can clone the challenge-response behavior of VOS-based authentication with up to 99.65% prediction accuracy, while the prediction accuracy is less than 51.2% after deploying our proposed ML resilient technique. In addition, our proposed CSoS also shows good obfuscation ability for strong PUFs. Experimental results show that the modeling accuracies are below 54% when $10^6$ challenge-response pairs (CRPs) are collected to model the CSoS-based Arbiter PUF with ML attacks such as LR, SVM, ANN, RNN and CMA-ES.

Information security is critical for the safe and secure operation of distribution systems. Distributed averaging has been frequently utilized to coordinate multiple inverter-interfaced distributed generators (DGs) within the distribution grid. Unfortunately, state-of-the-art dynamic consensus-based average observers lead to loss of privacy due to neighboring information exchange, i.e., the local states of each DG that contain private information could be inferred by the neighboring DGs. In this paper, to avoid privacy disclosure and guarantee the effectiveness of distributed averaging, a privacy-preserving distributed average observer is proposed. The proposed observer adopts an algorithm-based approach in privacy preservation. Compared to the existing distributed privacy-preserving algorithms in the literature, the proposed observer achieves accurate averaging and does not introduce additional restrictions on the communication network topology. Two-fold obfuscation is implemented to mask the true values of one agent’s local states from its neighbors during the average seeking. Particularly, the true values are randomly deviated at each agent locally before publishing, and the true values of the deviations are further masked using dynamic weights that vary randomly. Additionally, the proposed observer supports “plug-and-play” functionality and is robust against communication delays. The proposed observer is implemented on hardware controllers, and its observation and privacy-preserving performance are validated in a controller hardware-in-the-loop (HIL) testbed.

Recent advances in 3D reconstruction technology allow people to capture and share their experiences in 3D. However, little is known about people's sharing preferences and privacy concerns for these reconstructed experiences. To fill this gap, we first present ReliveReality, an experience-sharing method utilizing deep learning-based computer vision techniques to reconstruct clothed humans and 3D environments and estimate 3D pose with only a RGB camera. ReliveReality can be integrated into social virtual environments, allowing others to socially relive a shared experience by moving around the experience from different perspectives, on desktop or in VR. We conducted a 44-participant within-subject study to compare ReliveReality to viewing recorded videos, and to a ReliveReality version with blurring obfuscation. Our results shed light on how people identify with reconstructed avatars, how obfuscation affects reliving experiences, and sharing preferences and privacy concerns for reconstructed experiences. We propose design implications for addressing these issues.

This article develops and tests an identity-based account of malfeasance in consumer markets. We hypothesize that multi-brand organizational structures help predatory firms short-circuit reputational discipline by rendering their underlying identities opaque to consumer audiences. The analysis utilizes comprehensive administrative data on all U.S. for-profit colleges, an industry characterized by widespread fraud and poor (although variable) educational outcomes. Consistent with the hypothesis that brand multiplicity facilitates malfeasance by reducing ex ante reputational risks, colleges that are part of multi-brand companies invest less in instruction, have worse student outcomes, and are more likely to face legal and regulatory sanctions (relative to single-brand firms). Maintaining multiple outward-facing brand identities also mitigates reputational penalties in the wake of law enforcement actions, as measured by news coverage of legal actions, and by subsequent enrollment growth. The results suggest identity multiplicity plays a key role in allowing firms to furnish substandard products, even amid frequent scandals and media scrutiny. Predatory practices are facilitated not only by the inherent informational asymmetries in a given product, but also by firms’ efforts to make themselves less legible to audiences. The analysis contributes to research on higher education, organizational theory, and the sociology of markets.

Functional encryption (FE), which provides fine-grained access control on encrypted data, is becoming a new hot spot in the field of cryptography. Recent applications, such as outsourcing computation, searchable encryption and so on, suggest that FE has unlimited possibilities. It especially shows great feasibility to construct indistinguishability obfuscation and reuseable garbled circuits. Furthermore, bounded collusion functional encryption is an extension of FE which is against more than one key query and protects the security of messages under more than one function keys. In this paper, we proposed a bounded collusion FE for cubic polynomials, which follows from Agrawal and Rosen's work on TCC 2017. Our construction only invokes the Regev public key encryption and a linear FE scheme which avoids complex encodings defined recursively. What's more, we proposes an FE scheme for all circuit with FULL-SIM security. Finally, we also implement these schemes and do some analyses on parameters' size, time and space performance.

The privacy risk has become an emerging challenge in both information theory and computer science due to the massive (centralized) collection of user data. In this paper, we overview privacy-preserving mechanisms and metrics from the lenses of information theory, and unify different privacy metrics, including f-divergences, R\'enyi divergences, and differential privacy, by the probability likelihood ratio (and the logarithm of it). We introduce recent progresses on designing privacy-preserving mechanisms according to the privacy metrics in (i) computer science, where differential privacy is the standard privacy notion that controls the output shift given small input perturbation, and (ii) information theory, where the privacy is guaranteed by minimizing information leakage. In particular, for differential privacy, we include its important variants (e.g., R\'enyi differential privacy, Pufferfish privacy) and properties, discuss its connections with information-theoretic quantities, and provide the operational interpretations of its additive noise mechanisms. For information-theoretic privacy, we cover notable frameworks from privacy funnel, originated from rate-distortion theory and information bottleneck, to privacy guarantee against statistical inference/guessing, and information obfuscation on samples and features. Finally, we discuss the implementations of these privacy-preserving mechanisms in current data-driven machine learning scenarios, including deep learning, information obfuscation, federated learning, and dataset sharing.

With the improvement of software copyright protection awareness, code obfuscation technology plays a crucial role in protecting key code segments. As the obfuscation technology becomes more and more complex and diverse, it has spawned a large number of malware variants, which make it easy to evade the detection of anti-virus software. Malicious code detection mainly depends on binary code similarity analysis. However, the existing software analysis technologies are difficult to deal with the growing complex obfuscation technologies. To solve this problem, this paper proposes a new obfuscation-resilient program analysis method, which is based on the data flow transformation relationship of the intermediate representation and the graph network model. In our approach, we first construct the data transformation graph based on LLVM IR. Then, we design a novel intermediate language representation model based on graph networks, named DFSGraph, to learn the data flow semantics from DTG. DFSGraph can detect the similarity of obfuscated code by extracting the semantic information of program data flow without deobfuscation. Extensive experiments prove that our approach is more accurate than existing deobfuscation tools when searching for similar functions from obfuscated code.

Over the past decade, public non-profit universities have dramatically increased their online offerings. The COVID-19 pandemic has also triggered additional investment in online education. It has become commonplace for public universities to contract out some portion of their online services to online program managers, or OPMs. OPMs are private, for-profit companies that provide a broad range of services, from instructional design, to marketing, student recruitment, curricular provision, operational services, technological platforms and more. They have proliferated in the last decade. Only a couple of companies existed before 2008, but now there are numerous providers including: Pearson, Wiley, Blackboard, Emerge Education, 2U, Unicon, Comcourse, Kaplan, Keypath, Collegis, Orbis Education, Helix Education, Extension Engine, Coursera, Apollidon, Noodle Partners, iDesing, Synergis Education, Meteor Learning, All Campus, Hot Chalk, Academic Partnerships, CapEd, Learning House, AnswerNet, Everspring, Bisk, and Grand Canyon Education, among others. Yet, public-private-partnerships (or P3s) between public universities and OPMs remain little recognized and understudied. In these analyses we draw on a dataset of 239 OPM-public university contracts compiled with the generous support of The Century Foundation. We code structural features of the contracts that have been identified as potentially predatory including: paying the for-profit provider a commission as a share of all tuition revenue; giving the for-profit provider control over student recruitment; utilizing course or program content developed by the for-profit provider; assigning instruction to the for-profit provider rather than the college’s faculty; and including lengthy and/or complex contract terms that benefit for-profit providers. We also examine how many schools amend a contract over time to expand engagement with an OPM and assess the (in)visibility of for-profit providers to consumers through investigation of the university’s online program websites. Content analysis of the contracts, associated documents, and university webpages will be utilized to illustrate and address the study’s research questions.

Successful software authorship de-anonymization has both software forensics applications and privacy implications. However, the process requires an efficient extraction of authorship attributes. The extraction of such attributes is very challenging, due to various software code formats from executable binaries with different toolchain provenance to source code with different programming languages. Moreover, the quality of attributes is bounded by the availability of software samples to a certain number of samples per author and a specific size for software samples. To this end, this work proposes a deep Learning-based approach for software authorship attribution, that facilitates large-scale, format-independent, language-oblivious, and obfuscation-resilient software authorship identification. This proposed approach incorporates the process of learning deep authorship attribution using a recurrent neural network, and ensemble random forest classifier for scalability to de-anonymize programmers. Comprehensive experiments are conducted to evaluate the proposed approach over the entire Google Code Jam (GCJ) dataset across all years (from 2008 to 2016) and over real-world code samples from 1,987 public repositories on GitHub. The results of our work show high accuracy despite requiring a smaller number of samples per author. Experimenting with source-code, our approach allows us to identify 8,903 GCJ authors, the largest-scale dataset used by far, with an accuracy of 92.3%. Using the real-world dataset, we achieved an identification accuracy of 94.38% for 745 C programmers on GitHub. Moreover, the proposed approach is resilient to language-specifics, and thus it can identify authors of four programming languages (e.g., C, C++, Java, and Python), and authors writing in mixed languages (e.g., Java/C++, Python/C++). Finally, our system is resistant to sophisticated obfuscation (e.g., using C Tigress) with an accuracy of 93.42% for a set of 120 authors. Experimenting with executable binaries, our approach achieves 95.74% for identifying 1,500 programmers of software binaries. Similar results were obtained when software binaries are generated with different compilation options, optimization levels, and removing of symbol information. Moreover, our approach achieves 93.86% for identifying 1,500 programmers of obfuscated binaries using all features adopted in Obfuscator-LLVM tool.

Community detection for Location-based Social Networks (LBSNs) has been received great attention mainly in the field of large-scale Wireless Communication Networks. In this paper, we present a Differential Privacy Latent Trajectory cOmmunity Discovering (DP-LTOD) scheme, which obfuscates original trajectory sequences into differential privacy-guaranteed trajectory sequences for trajectory privacy-preserving, and discovers latent trajectory communities through clustering the uploaded trajectory sequences. Different with traditional trajectory privacy-preserving methods, we first partition original trajectory sequence into different segments. Then, the suitable locations and segments are selected to constitute obfuscated trajectory sequence. Specifically, we formulate the trajectory obfuscation problem to select an optimal trajectory sequence which has the smallest difference with original trajectory sequence. In order to prevent privacy leakage, we add Laplace noise and exponential noise to the outputs during the stages of location obfuscation matrix generation and trajectory sequence function generation, respectively. Through formal privacy analysis, we prove that DP-LTOD scheme can guarantee $\epsilon$ e -differential private. Moreover, we develop a trajectory clustering algorithm to classify the trajectories into different kinds of clusters according to semantic distance and geographical distance. Extensive experiments on two real-world datasets illustrate that our DP-LTOD scheme can not only discover latent trajectory communities, but also protect user privacy from leaking.

Mobile devices are no less than ticking time bombs if examined from security perspective, as their exertion is intense and relative security measures are quite a few. Attackers at present scenario are switching over to techniques that easily obfuscate the existing state-of-art tools and victims to get their work done. Evasion is one such tactic to confuse security system or obfuscate the information flow so as to go unnoticed from them. Whereas, covert channels are channels that hide the existence of communication itself, thereby making it unidentifiable for users as well as state-of-art tools. The paper presents a novel attack namely IEII(Implicit Evasive Information Invasion) presenting an algorithm developed to attack privacy and security of mobile devices. As a solution to the insecurity posed by the attack, a novel detection mechanism is also proposed. Concisely, the paper shows a novel approach showing an attack IEII with a level of obfuscation to bypass existing state-of-art mechanisms such as SuSi, FlowDroid etc. Also, its detection mechanism using AspectJ is developed. Hence, the paper opens up a new area depicting unforeseen threats and implementing its security in mobile devices with reference to the novel attack and detection proposed.

Many enterprises are under threat of targeted attacks aiming at data exfiltration. To launch such attacks, in recent years, attackers with their malware have exploited a covert channel that abuses the domain name system (DNS) named DNS tunneling. Although several research efforts have been made to detect DNS tunneling, the existing methods rely on features that advanced tunneling techniques can easily obfuscate by mimicking legitimate DNS clients. Such obfuscation would result in data leakage. To tackle this problem, we focused on a “trace” left by DNS tunneling that cannot be easily hidden. In the context of data exfiltration by DNS tunneling, the malware connects directly to the DNS cache server and the generated DNS tunneling queries produce cache misses with absolute certainty. In this study, we propose a DNS tunneling detection method based on the cache-property-aware features. Our experiments show that one of the proposed features can efficiently characterize the DNS tunneling traffic. Furthermore, we introduce a rule-based filter and a long short-term memory (LSTM)-based filter using this proposed feature. The rule-based filter achieves a higher rate of DNS tunneling attack detection than the LSTM one, which instead detects the attack more quickly, while both maintain a low misdetection rate.

Embedded systems are widely deployed in life-critical systems, but system constraints often limit the depth of security used in these devices, potentially leaving them open to numerous threats. Side channel attacks (SCAs) are a popular attack to extract sensitive information from embedded systems using only side channel leakage. Existing research has focused on obfuscating the sensitive data and operations with the assumption that attackers can readily and automatically identify the location of the sensitive operations in each trace, which is needed to align traces for a successful SCA. However, this is not always the true as the target sensitive data may be randomly located within side channel leakage trace, which necessitates the use of automatic preprocessing to identifying those locations. Limited research has focused on the evaluation of identifying these locations and the difficulty for attacker to identify the location of sensitive information within side channel leakage traces. This paper presents a methodology for evaluating power obfuscation approaches that seek to obfuscate the location of sensitive operation within the power trace, thereby significantly increasing the complexity of automated trace alignment. This paper presents a new adversary model and proposes a new metric, mean trials to success (MTTS), to evaluate different power obfuscation methods in the context of automated trace alignment. We evaluate two common obfuscation methods, namely, instruction shuffling and random instruction insertion, and we present a new obfuscation method using power shaping to intentionally mislead the attacker.

The emergence of Internet of Things malware, which leverages exploited IoT devices to perform large-scale cyber attacks (e.g., Mirai botnet), is considered as a major threat to the Internet ecosystem. To mitigate such threat, there is an utmost need for effective IoT malware classification and family attribution, which provide essential steps towards initiating attack mitigation/prevention countermeasures. In this paper, motivated by the lack of sophisticated malware obfuscation in the implementation of IoT malware, we utilize features extracted from strings- and image-based representations of the executable binaries to propose a novel multi-dimensional classification approach using Deep Learning (DL) architectures. To this end, we analyze more than 70,000 recently detected IoT malware samples. Our in-depth experiments with four prominent IoT malware families highlight the significant accuracy of the approach (99.78%), which outperforms conventional single-level classifiers. Additionally, we utilize our IoT-tailored approach for labeling newly detected “unknown” malware samples, which were mainly attributed to a few predominant families. Finally, this work contributes to the security of future networks (e.g., 5G) through the implementation of effective tools/techniques for timely IoT malware classification, and attack mitigation.

In India, most healthcare expenses are patients' out-of-pocket payments to private sector providers. Catastrophic health expenditures drive millions of families deeper into poverty. To save poorer households, hundreds of government-funded health insurance schemes have been introduced since the 2000s. These "demand side" schemes suggest that treatments in the private sector will be fully reimbursed. Fieldwork in one of India's largest hospitals shows that GFHIs overpromise. GFHIs are designed to turn patients into co-creators of healthcare value, but instead they deepen individuals' lack of market transparency. Poor patients pay the price for the state's lack of trust in them.

With the increasing availability of internet access, the number of malware is growing dramatically. So, defence against malware is an important issue in the security of computers and networks. Hence, malware detection systems are important. The most common method for malware detection is a signature-based technique. Nowadays, malware attempt to deceive all kinds of anti-malware, using obfuscation mechanisms and polymorphic behaviours, thus this method is not able to detect such malware and is not very effective. One way to deal with these types of malware is through dynamic malware analysis that requires executing the malware and monitoring its behaviour. In this paper, a novel dynamic malware detection method is presented which utilizes hardware events during file execution such as hardware port status, CPU internal status, main memory status, etc., as features of the classification model. Then, two Deep Neural Network (DNN) based algorithms, Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM), are used to construct the machine learning model. Finally, the voting network is used between the outputs of CNNs and the LSTM network, and the label of the suspicious sample is determined. The results show that the combination of hardware events as feature inputs, with LSTM and voting network can be effective in detecting new malware.

While spatial crowdsourcing has become a popular paradigm for spatio-temporal data collection, location privacy has raised increasing concerns among the participants of spatial crowdsourcing projects in recent years. The question of how to implement a spatial crowdsourcing project at minimal cost while preserving location privacy, is the major issue that most existing works have investigated. In this paper, we propose a novel privacy-preserving method for spatial crowdsourcing that combines location obfuscation and path optimization in order to provide enhanced privacy preservation at a minimal cost. We apply geo-indistinguishability and exponential mechanism to achieve an enhanced privacy guarantee. Moreover, because a higher privacy level consistently leads to extra distance cost, we therefore present a path optimization algorithm that reduces the total distance of a spatial crowdsourcing project. The experimental results demonstrate that the proposed method outperforms the traditional methods in terms of privacy level and performance costs.

Qu’est-ce qui fait que les logiques machiniques résistent à l’utilisateur ? Il semble que l’on prête aux machines un potentiel utopique d’unification de toutes les formes de logiques vers un seul et unique modèle binaire. Pourtant, la transparence, postulée par cette utopie unificatrice, s’oppose à la situation technique effective des machines, révélant la tension existante entre l’opacité de la matérialité du hardware et l’idéal utopique du software. En réduisant l’information au strict minimum, les machines se doteraient d’un pouvoir computationnel infini. Héritière de la machine universelle théorique de Turing, cette machine utopique serait capable de tout et de rien. Si tout est traitable par la computation, alors la machine devient véritablement universelle en rendant possible un langage unifié dans des circuits de logiques électroniques. Le design des programmes se situe à l’intermédiaire entre la logique machinique et la production de programmes fonctionnels. Ce texte explore les modalités techniques de la traduction de la logique au sein des machines dans le cadre du design de programmes. Nous émettons l’hypothèse que la stratification des couches successives de logiciels, entre le designer et l’électronique, impliquent de multiples traductions. Cet empilement permet à la machine d’exécuter le programme tout en rendant la compréhension des logiques machiniques difficile pour l’utilisateur, une traduction bruitée vers un langage inintelligible. Les logiques de substitution d’une chaîne de caractères par une autre chaîne de caractères partagent des traits communs avec l’analyse du cryptage de l’information, avec la cryptanalyse. Si les modèles analytiques sont proches, les objectifs linguistiques diffèrent : du point de vue de la machine, la traduction, automatisée, s’attache à la syntaxe, et du point de vue de l’humain, elle s’attache particulièrement à la sémantique. Cette distinction fondamentale contribue au sentiment d’opacification des logiques et à la résistance des machines face à l’entendement. Or, ces procédés imposent une non-réversibilité de la traduction : interdépendance entre les strates, compilation, obfuscation, enjeux économiques, constituent autant d’instances qui semblent ériger la dissimulation des logiques en dogme technique, au profit d’une idéologie fonctionnelle restreignant paradoxalement l’intelligibilité des machines computationnelles. What makes machine logic so difficult to understand for users ? It seems as if we attribute to machines the utopian potential of unifying all forms of logic into one single binary model. Yet, the transparency proposed by this utopian unification contradicts the actual technical situation of machines, revealing an existing tension between the material opacity of hardware and the utopian ideal of software. By reducing information to its bare minimum, machines would acquire infinite computational power. Heir to Turing’s theoretical universal machine, this utopian machine would be capable of everything and nothing. If computation can process everything, then the machine becomes truly universal by enabling a unified language embedded in electronic logic circuits. Program design is at the interface between machine logic and the production of functional programs. This essay explores the technical modalities of logic translations inherent to machines within the context of program design. We hypothesize that the successive layers of software, between a designer and the electronics, implies successive translations. This layering allows the machine to execute the program while simultaneously making it difficult for the end user to understand the machine-based logic, which would be equivalent to a noisy translation resulting in an unintelligible language. The logic of substituting one string (sequence of characters) for another string shares common traits with information encryption analysis, ergo cryptanalysis. While the analytical models are similar, the linguistic goals are quite different : from the machine standpoint, automated translation focuses on syntax, and from a human standpoint, it focuses particularly on semantics. This fundamental distinction contributes to a perception of machine logic opacity and makes it all the more difficult for the machine’s functioning to be understood. These processes reinforce the non-reversibility of translation : interdependence between layers, compilation, obfuscation, economic stakes, are all instances that seem to provide the basis of concealment of logic as technical dogma, favoring a functional ideology that paradoxically restricts the intelligibility of computational machines.

Obfuscated data exfiltration perpetrated by malicious actors presents a significant threat to organizations looking to protect sensitive data. Socket layer protocol customization presents the potential to enhance obfuscated data exfiltration by providing a protocol-agnostic means of embedding targeted data within application payloads of established socket connections. Fully evaluating and characterizing this technique will serve as an important step in the development of suitable mitigations. This thesis evaluated the performance of this method of data exfiltration through experimentation to determine its viability and identify its limitations. The evaluation assessed the effectiveness of exfiltration via socket layer customization with various application protocols and characterized its use to determine the most suitable protocols. Basic host-based and network-based security controls were introduced to test the exfiltration method’s ability to bypass typical security controls implemented to prevent data exfiltration. The experimentation results indicate that this exfiltration method is both viable and applicable across multiple application protocols. It proved flexible enough in its design and configuration to bypass basic host-based access controls and general network intrusion prevention system packet inspection. Deep packet inspection was identified as a potential solution; however, the required inspection and filtering granularity might make implementation infeasible. Office of Naval Research, Arlington, VA 22203-1995 Outstanding Thesis Petty Officer First Class, United States Navy Approved for public release. Distribution is unlimited.

In order to enhance the security of logic obfuscation schemes, delay locking has been proposed in combination with traditional functional logic locking approaches. A circuit obfuscated using this approach preserves the original functionality only when both correct functional and delay keys are provided. In this article, we develop a novel SAT formulation-based attack approach called TimingSAT to deobfuscate the functionalities of such delay-locked designs. The proposed technique models the timing characteristics of various types of gates present in a design as Boolean functions to build a timing profile embedded SAT formulation in terms of targeted key inputs. TimingSAT attack works in two stages. In the first stage, the functional key is found using the conventional SAT attack approach, and in the second stage, the delay key is determined using the aforementioned timing profile embedded SAT formulation of the circuit. In both stages of the attack, wrong keys are iteratively eliminated till a key belonging to the correct equivalence class is obtained. We perform experiments to demonstrate the effectiveness of our proposed TimingSAT attack to break delay-locked benchmarks within a few hours. Subsequently, we propose a countermeasure called stripped-functionality delay locking (SFDL) which not only thwarts TimingSAT attack but also resists all known attacks against logic obfuscation. SFDL combines the concept of delay locking with a stripped-functionality-based logic locking approach to realize an effective IP security solution for hardware designs. Unlike existing logic locking schemes, SFDL simultaneously achieves strong SAT attack resiliency as well as significantly high output corruptibility.

Obfuscation is used to protect programs from analysis and reverse engineering. There are theoretically effective and resistant obfuscation methods, but most of them are not implemented in practice yet. The main reasons are large overhead for the execution of obfuscated code and the limitation of application only to a specific class of programs. On the other hand, a large number of obfuscation methods have been developed that are applied in practice. The existing approaches to the assessment of such obfuscation methods are based mainly on the static characteristics of programs. Therefore, the comprehensive (taking into account the dynamic characteristics of programs) justification of their effectiveness and resistance is a relevant task. It seems that such a justification can be made using machine learning methods, based on feature vectors that describe both static and dynamic characteristics of programs. In this paper, it is proposed to build such a vector on the basis of characteristics of two compared programs: the original and obfuscated, original and deobfuscated, obfuscated and deobfuscated. In order to obtain the dynamic characteristics of the program, a scheme based on a symbolic execution is constructed and presented in this paper. The choice of the symbolic execution is justified by the fact that such characteristics can describe the difficulty of comprehension of the program in dynamic analysis. The paper proposes two implementations of the scheme: extended and simplified. The extended scheme is closer to the process of analyzing a program by an analyst, since it includes the steps of disassembly and translation into intermediate code, while in the simplified scheme these steps are excluded. In order to identify the characteristics of symbolic execution that are suitable for assessing the effectiveness and resistance of obfuscation based on machine learning methods, experiments with the developed schemes were carried out. Based on the obtained results, a set of suitable characteristics is determined.

With the advent of the era of big data, data privacy protection has become a valuable topic in the field of data publication. Unfortunately, traditional methods of privacy protection, k-anonymity, and its extensions are not absolutely secure as an adversary with background knowledge can determine the owner of a record. The emergence of differential privacy provides a reasonable alternative for privacy security, but the existing solutions ignore the correlation between sensitive attributes and other attributes. In this paper, we propose a new differential privacy scheme based on quasi-identifier classification for big data publication (DP-QIC). It is a new data publishing scheme based on the obfuscation of attribute correlation. We innovatively present quasi-identifier classification based on sensitive attributes and the privacy ratio for evaluating the data set vulnerability. DP-QIC achieves data privacy-protecting through four steps: data collection, grouping and shuffling, generalization, merging, and noise adding, which retains the overall statistical characteristics of the data set. Moreover, the exponential mechanism and the Laplace mechanism are integrated to ensure higher flexibility and a stronger level of privacy protection, so DP-QIC can be used for privacy processing of different data groups in future development. Finally, we have compared the performance of our scheme with the other two famous schemes in the industry. Experimental results demonstrate that DP-QIC has obvious advantages in data utility, privacy protection, and processing efficiency.

In mobile crowdsourcing, organizers usually need participants’ precise locations for optimal task allocation, e.g., minimizing selected workers’ travel distance to task locations. However, the exposure of users’ locations raises privacy concerns. In this paper, we propose a location privacy-preserving task allocation framework with geo-obfuscation to protect users’ locations during task assignments. More specifically, we make participants obfuscate their reported locations under the guarantee of two rigorous privacy-preserving schemes, differential and distortion privacy, without the need to involve any third-party trusted entity. In order to achieve optimal task allocation with the differential-and-distortion geo-obfuscation, we formulate a mixed-integer non-linear programming problem to minimize the expected travel distance of the selected workers under the constraints of differential and distortion privacy. Moreover, a worker may be willing to accept multiple tasks, and a task organizer may be concerned with multiple utility objectives such as task acceptance ratio in addition to travel distance. Against this background, we also extend our solution to the multi-task allocation and multi-objective optimization cases. Evaluation results on both simulation and real-world user mobility traces verify the effectiveness of our framework. Particularly, our framework outperforms Laplace obfuscation, a state-of-the-art geo-obfuscation mechanism, by achieving up to 47 percent shorter average travel distance on real-world data under the same level of privacy protection.

The presence of connected devices in homes introduces numerous threats to privacy via the analysis of the encrypted traffic these devices generate. Prior works have shown that traffic attributes such as packet size combined with machine learning techniques enable the inference of private information from Internet of Things users. One of the commonly used techniques to mitigate those privacy threats is traffic obfuscation, such as packet padding. Most padding mechanisms that were previously proposed statically select the number of bytes inserted in the packets, which incurs high overhead and ineffective privacy improvement. These static mechanisms are particularly unsuitable for networks whose traffic patterns are significantly dynamic, such as smart homes. This article proposes an adaptive packet padding approach based on software-defined networking (SDN) that adjusts the number of bytes inserted into packets in response to variations in the home network utilization. The proposed technique monitors the network to instruct a padding mechanism through a representational state transfer (REST) interface proposed in this article. This mechanism ensures that the length of packets generated by connected devices is modified. The evaluation includes four supervised learning mechanisms, random forest (RF), support vector machine (SVM), decision tree, and $k$ -nearest neighbors (KNNs), to measure privacy improvement through the metrics accuracy, recall, and $F1$ -score. Goodput, jitter, and packet loss induced by the proposal are also evaluated. Our proposal is shown to overcome the state-of-the-art solutions in privacy preservation with a significantly lower overhead. For instance, the accuracy of RF on identifying devices decreases from 96% to 4.96%.

Most firms covary more positively with downmarkets than upmarkets—a phenomenon I refer to as “risk asymmetry.” I predict and find that risk asymmetry is caused, at least in part, by a firm's ability to selectively obfuscate poor performance. Risk asymmetry decreases significantly when firms are required to adhere to the more stringent auditing standards mandated under Section 404 of the Sarbanes‐Oxley Act, however this decrease is more muted for firms with weak internal controls. Consistent with my predictions, these patterns are stronger for more market‐sensitive firms and weaker for firms that include relative performance evaluation in their CEOs' pay packages. Taken together with prior literature (which documents that risk asymmetry is priced), my results suggest that a firm can lower its cost of capital by credibly reducing its ability to obfuscate value‐relevant information.

To better understand temporary price reductions or “sales,” this paper presents a generalized “clearinghouse” framework of advertised sales and explores some applications. By viewing the firms as competing in utility and amending the conventional tiebreak rule, we allow for multiple dimensions of firm heterogeneity in complex market environments. Moreover, we (i) provide original insights into the number and types of firms that use sales, (ii) offer new results on how firm heterogeneity affects market outcomes, (iii) extend a common empirical “cleaning” procedure, and (iv) analyze a family of activities in sales markets, including persuasive advertising and obfuscation. (JEL D21, D43, L13, L25, M37)

Malware analysis is an essential task to understand infection campaigns, the behavior of malicious codes, and possible ways to mitigate threats. Malware analysis also allows better assessment of attackers’ capabilities, techniques, and processes. Although a substantial amount of previous work provided a comprehensive analysis of the international malware ecosystem, research on regionalized, country-, and population-specific malware campaigns have been scarce. Moving towards addressing this gap, we conducted a longitudinal (2012-2020) and comprehensive (encompassing an entire population of online banking users) study of MS Windows desktop malware that actually infected Brazilian banks’ users. We found that the Brazilian financial desktop malware has been evolving quickly: it started to make use of a variety of file formats instead of typical PE binaries, relied on native system resources, and abused obfuscation techniques to bypass detection mechanisms. Our study on the threats targeting a significant population on the ecosystem of the largest and most populous country in Latin America can provide invaluable insights that may be applied to other countries’ user populations, especially those in the developing world that might face cultural peculiarities similar to Brazil’s. With this evaluation, we expect to motivate the security community/industry to seriously consider a deeper level of customization during the development of next-generation anti-malware solutions, as well as to raise awareness towards regionalized and targeted Internet threats.

Strong physical unclonable function (PUF) is a promising solution for device authentication in resourceconstrained applications but vulnerable to machine learning attacks. In order to resist such attack, many defenses have been proposed in recent years. However, these defenses incur high hardware overhead, degenerate reliability and are inefficient against advanced machine learning attacks such as approximation attacks. In order to address these issues, we propose a Random Set-based Obfuscation (RSO) for Strong PUFs to resist machine learning attacks. The basic idea is that several stable responses are derived from the PUF itself and pre-stored as the set for obfuscation in the testing phase, and then a true random number generator is used to select any two keys to obfuscate challenges and responses with XOR operations. When the number of challenge-response pairs (CRPs) collected by the attacker exceeds the given threshold, the set will be updated immediately. In this way, machine learning attacks can be prevented with extremely low hardware overhead. Experimental results show that for a 64x64 Arbiter PUF, when the size of set is 32 and even if 1 million CRPs are collected by attackers, the prediction accuracies of Logistic regression, support vector machines, artificial neural network, convolutional neural network and covariance matrix adaptive evolutionary strategy are about 50% which is equivalent to the random guessing., 12 pages, 8 figures

Recent work, motivated by anonymous messaging platforms, has introduced adaptive diffusion protocols which can obfuscate the source of a rumor: a "snapshot adversary" with access to the subgraph of "infected" nodes can do no better than randomly guessing the entity of the source node. What happens if the adversary has access to multiple independent snapshots? We study this question when the underlying graph is the infinite $d$-regular tree. We show that (1) a weak form of source obfuscation is still possible in the case of two independent snapshots, but (2) already with three observations there is a simple algorithm that finds the rumor source with constant probability, regardless of the adaptive diffusion protocol. We also characterize the tradeoff between local spreading and source obfuscation for adaptive diffusion protocols (under a single snapshot). These results raise questions about the robustness of anonymity guarantees when spreading information in social networks., Comment: 30 pages, 3 figures

Researchers develop bioassays following rigorous experimentation in the lab that involves considerable fiscal and highly-skilled-person-hour investment. Previous work shows that a bioassay implementation can be reverse-engineered by using images or video and control signals of the biochip. Hence, techniques must be devised to protect the intellectual property (IP) rights of the bioassay developer. This study is the first step in this direction and it makes the following contributions: (1) it introduces the use of a dummy valve as a security primitive to obfuscate bioassay implementations; (2) it shows how dummy valves can be used to obscure biochip building blocks such as multiplexers and mixers; (3) it presents design rules and security metrics to design and measure obfuscation. In our preliminary work, we presented the concept through the use of sieve-valve as a dummy-valve. However, sieve-valves are difficult to fabricate. To overcome fabrication complexities, we propose a novel multi-height-valve as an obfuscation primitive. Moreover, we showcase the suitability of multi-height-valve for obfuscation through COMSOL simulations. We demonstrate the practicality of the proposal by fabricating an obfuscated biochip using multi-height valves. We assess the cost-security trade-offs associated with this solution and study the practical implications of dummy-valve based obfuscation on real-life biochips.

The Web Search Engine (WSE) is a software system used to retrieve data from the web successfully. WSE uses the user’s search queries to build the user’s profile and provide personalized results. Users’ search queries hold identifiable information that could compromise the privacy of the respective user. This work proposes a multi-group distributed privacy-preserving protocol (MG-OSLo) and tries to investigate the state-of-the-art distributed privacy-preserving protocols for computing web search privacy. The MG-OSLo comprises multiple groups in which each group has a fixed number of users. The MG-OSLo measures the impact of the multi-group on the user’s privacy. The primary objective of this work is to assess local privacy and profile privacy. It aims at evaluating the impact of group size and group count on a user’s privacy. Two grouping approaches are used to group the users in MG-OSLo, i.e. a non-overlapping group design and overlapping group design. The local privacy results reveal that the probability of linking a query to the user depends on the group size and group count. The higher the group size or group count, the lower the likelihood of relating the query to the user. The profile privacy computes the profile obfuscation level using a privacy metric Profile Exposure Level (PEL). Different experiments have been performed to compute the profile privacy of the subset of an AOL query log for two situations: i) self-query submissions allowed and ii) self-query submissions not allowed. The privacy achieved by MG-OSLo is compared with the modern privacy-preserving protocol UUP(e), OSLo, and Co-utile protocols. The results show that the MG-OSLo provided better results as compared to OSLo, UUP, and Co-utile. Similarly, the multi-group has a positive impact on local privacy and user profile privacy.

As most malware is infectious, anti-analysis and packing techniques supported by commercial protectors are conventionally applied to hinder analysis. When analyzing to detect and block such protected malware, it is necessary to do so in a virtual environment to prevent infection. In terms of packing, it is necessary to analyze using dynamic binary instrumentation (DBI), a dynamic analysis tool, which is advantageous for unpacking because DBI inserts code at run time and analyzes it dynamically. However, malware terminates on its own when it detects a virtual environment or DBI due to anti-analysis techniques. Therefore, it is necessary to also bypass anti-VM and anti-DBI techniques in order to successfully analyze malware in a virtual environment using DBI. It is very difficult for analysts to bypass anti-VM and anti-DBI techniques that are used in commercial protectors because analysts generally have little information on what methods are used or how to even bypass these techniques. In this paper, we suggest guidelines to aid in easy analysis of malware protected by anti-VM and anti-DBI techniques supported by commercial protectors. We analyzed the techniques used by five of the most common commercial protectors, and herein present how to bypass anti-VM and anti-DBI techniques supported by commercial protectors via a detailed algorithm analysis. We performed a bypass experiment after applying each commercial protector to 1573 executable files containing vulnerabilities provided by the National Institute of Standards and Technology (NIST). To our knowledge, this is the first empirical study to suggest detailed bypassing algorithms for anti-VM and anti-DBI techniques used in commercial protectors.

Trajectory data set is the indispensable foundation for constructing reliable Internet of Vehicles (IoV) service and location-based service (LBS), while it is likely to be abused by malicious attackers to infer user’s privacy. In this paper, we propose a trajectory protection method based on stop points obfuscation, which can confront various privacy attacks and preserve the semantic information to achieve adequate utility. Two strategies for stop point selection are designed, including category-distance priority method and Markov matrix method. Our new method was analyzed and evaluated on a real-world trajectory data set. The experiment result shows that our method can improve the utility of the data set and provide multi-level privacy protection.

Recent technological developments in computer systems transfer human life from real to virtual environments. Covid-19 disease has accelerated this process. Cyber criminals’ interest has shifted in a real to virtual life as well. This is because it is easier to commit a crime in cyberspace rather than regular life. Malicious software (malware) is unwanted software which is frequently used by cyber criminals to launch cyber-attacks. Malware variants are continuing to evolve by using advanced obfuscation and packing techniques. These concealing techniques make malware detection and classification significantly challenging. Novel methods which are quite different from traditional methods must be used to effectively combat with new malware variants. Traditional artificial intelligence (AI) specifically machine learning (ML) algorithms are no longer effective in detecting all new and complex malware variants. Deep learning (DL) approach which is quite different from traditional ML algorithms can be a promising solution to the problem of detecting all variants of malware. In this study, a novel deep-learning-based architecture is proposed which can classify malware variants based on a hybrid model. The main contribution of the study is to propose a new hybrid architecture which integrates two wide-ranging pre-trained network models in an optimized manner. This architecture consists of four main stages, namely: data acquisition, the design of deep neural network architecture, training of the proposed deep neural network architecture, and evaluation of the trained deep neural network. The proposed method tested on Malimg, Microsoft BIG 2015, and Malevis datasets. The experimental results show that the suggested method can effectively classify malware with high accuracy which outperforms the state of the art methods in the literature. When proposed method tested on Malimg dataset, 97.78% accuracy is obtained which is outperformed most of the ML-based malware detection method.

The purpose of this paper is to assess the effect of financial performance on textual features of the CEO’s statement. Specifically, given the incentives of poorly performed companies engage in impression management, the study investigates whether companies’ reporting strategy hinges on its financial performance. The research questions are tested through analysis of a variety of textual features in the CEO’s statement of 30 good and 30 poor performed companies listed on NASDAQ OMX Stockholm. We apply a range of textual characteristics drawn mostly from prior studies in given realm to the specific research of impression management in the CEO’s report. Overall our findings do not corroborate impression management claim, as six out of seven our results run counter to assertions made by impression management research. We found although evidence that poorly performed companies more focused on future compared with good performed companies. Finally, we conclude by discussing our results and outlining some avenues for further research.

This study investigates the shifting meanings invested in the ragtime song “A Hot Time in the Old Time, Tonight” at the turn of the twentieth century. Complicating the tune's place in the canon of military, political, and national anthems was its associations with “vice,” black culture, and white supremacy. By mapping the ritual and representational uses of the song, this investigation demonstrates how “A Hot Time” served paradoxical functions that simultaneously affirmed and unsettled American exceptionalism. In doing so, this article traces the processes of obfuscation whereby black musical traditions and white supremacy defined America's distinctive national identity.