Search

Alzheimer's disease is the most prevalent form of dementia, which is a gradual condition that begins with mild memory loss and progresses to difficulties communicating and responding to the environment. Recent advancements in neuroimaging techniques have resulted in large-scale multimodal neuroimaging data, leading to an increased interest in using deep learning for the early diagnosis and automated classification of Alzheimer's disease. This study uses machine learning (ML) methods to determine the severity level of Alzheimer's disease using MRI images, where the dataset consists of four levels of severity. A hybrid of 12 feature extraction methods is used to diagnose Alzheimer's disease severity, and six traditional machine learning methods are applied, including decision tree, K-nearest neighbor, linear discrimination analysis, Naïve Bayes, support vector machine, and ensemble learning methods. During training, optimization is performed to obtain the best solution for each classifier. Additionally, a CNN model is trained using a machine learning system algorithm to identify specific patterns. The accuracy of the Naïve Bayes, Support Vector Machines, K-nearest neighbor, Linear discrimination classifier, Decision tree, Ensembled learning, and presented CNN architecture are 67.5%, 72.3%, 74.5%, 65.6%, 62.4%, 73.8% and, 95.3%, respectively. Based on the results, the presented CNN approach outperforms other traditional machine learning methods to find Alzheimer severity.

Dynamic searchable symmetric encryption (DSSE) enables searches over encrypted data as well as data dynamics such as flexible data addition and deletion operations. A major security concern in DSSE is how to preserve forward and backward privacy, which are typically achieved by removing the linkability between the newly added data and previous queries, and between the deleted data and future queries, respectively. After information leakage types were formally defined for different levels of backward privacy (i.e., Type-I, II, III), many backward private DSSE schemes have been constructed under the definitions. However, we observed that the backward privacy can be violated by leveraging additional secondary leakage, which is typically leaked in specific constructions of schemes in spite of their theoretical guarantees. In this paper, in order to understand the security gap between the theoretical definitions and practical constructions, we conduct an in-depth analysis of the root cause for the secondary leakage, and demonstrate how it can be abused to violate Type-II backward privacy (e.g., the exposure of the deletion history) of DSSE constructions in practice. We then propose a novel Type-II backward private DSSE scheme based on Intel SGX, which is resilient to the secondary leakage abuse attack. According to the comparative analysis of our scheme with the state-of-the-art SGX-based DSSE schemes, Bunker-B (EuroSec’19) and SGX-SE1 (ACNS’20), our scheme shows higher efficiency in terms of the search latency with a negligible utility loss under the same security level (cf. Bunker-B) while showing similar efficiency with a higher security level (cf. SGX-SE1). Finally, we formally prove that our scheme guarantees Type-II backward privacy.

Dynamic searchable symmetric encryption (DSSE) enables users to outsource their data while retaining the capability to search and update on the encrypted database. Although various DSSE schemes have been proposed to achieve higher efficiency and stronger security, many of them incurred information leakages due to the linkability between ciphertexts and queries as side information. The notions of forward and backward privacy are defined to capture such information leakage in DSSE formally. In particular, backward privacy guarantees that queries do not reveal their relationship with the deleted database, which is further classified into four types (Type-I, $\textrm {I}^{-}$ , II, and III) based on the types of information leakage. In this study, we provide a backward privacy attack that exploits the information leakages and apply it to Type- $\textrm {I}^{-}$ backward private schemes to lower their security level to Type-III. We then propose a new DSSE framework, which is robust against the proposed attack. We apply our framework to the previous DSSE scheme (Zuo et al., ESORICS 2019) to build the first forward and backward Type-I private DSSE scheme under the backward privacy attack, and demonstrate its efficacy.

Traitor tracing via blind watermarking is a promising solution to protect copyright. Recently, it was demonstrated that deep learning-based blind watermarking methods could outperform traditional watermarking methods in terms of robustness against distortions. However, we found they could sacrifice the imperceptibility as a trade-off. To handle this challenge, we propose a novel method consisting of a deep blind model and watermarking strategy. For the purpose, we first investigate the fundamental components of the basic deep blind watermarking model, and empirically show how the performance changes when each component is modified with respect to the robustness. Based on it, we construct a deep blind watermarking encoder, CFC+CONCAT, which can encode watermarks in a robust way against distortions without imperceptibility degradation. We then propose a watermarking strategy to make deep blind watermarking robust by increasing watermarking capacity (by splitting a large image into small patches), and using the effect of distortion types on the robustness we found. According to the experiments, our method achieved 5.46 higher PSNR on average than the baseline methods with comparable robustness under various distortions when watermarking in the $3\times 256\times 256$ image. Also, the training time and VRAM usage are reduced by less than 1/4, demonstrating our method can mitigate the trade-off between robustness and imperceptibility, and achieve lightweight training.

Range query on encrypted data has been widely studied to achieve fast query processing while keeping data and queries secret. Prior work hides even the ordering information of the data, but sacrifices accuracy (e.g., false positives) and efficiency (e.g., exponential complexity in the domain size) as a trade-off. Moreover, hiding the order alone is not sufficient to prevent the recent database reconstruction attacks on range query abusing access pattern and volume leakage. Several countermeasures prevent such information leakage but incur practically unacceptable storage or computational overhead due to fake records embedded in the database and database re-encryption procedures. In this paper, we first propose a range query scheme $\mathsf{RevealRE}$ , which is highly efficient, but reveals ordering information. We then extend $\mathsf{RevealRE}$ to construct $\mathsf{HideRE}$ , a range query scheme that does not leak data ordering information while accurate (i.e., no false positives/negatives) and efficient (i.e., logarithmic search time). $\mathsf{HideRE}$ can mitigate the database reconstruction attacks by introducing deceptive queries, which are indistinguishable from regular queries while obfuscating the queried ranges. We experimentally confirm efficiency of our construction under various data distribution models, demonstrating the practicality. Resilience to database reconstruction attacks of our order-hiding range query scheme is formally proved.

Bitcoin is the most widely used cryptocurrency for illegal trade in current darknet markets. Owing to the anonymity of its addresses, even though transaction flows are globally visible, Bitcoin clustering remains one of the most challenging and open problems in illegal Bitcoin transaction analysis. In this article, to resolve this problem, we propose a novel multi-layer heuristic algorithm for Bitcoin clustering, which leverages on-chain transactions as well as off-chain application data in the real world. For this purpose, we first explored the unique characteristics of darknet market ecosystems including their trading systems. By conducting an in-depth analysis of the data manually collected for 11 months, we found that some darknet market review data disclosed transactions containing Bitcoin value and item delivery information. We then identified unique Bitcoin addresses associated with the disclosed information, owned by the same darknet providers. Based on address ownership, more accurate market clusters could be created, which have not previously been identified by other clustering algorithms. According to our experimental results, approximately 31.68% of the darknet market review data matched real Bitcoin transactions, and 122 hidden clusters associated with Silk Road 4 were found. This indicates that the proposed algorithm can complement existing clustering methods and significantly reduce the false negative rate by up to 91.7%.

Public key encryption with keyword search (PEKS) enables users to search over encrypted data outsourced to an untrusted server. Unfortunately, updates to the outsourced data may incur information leakage by exploiting the previously submitted queries. Prior works addressed this issue by means of forward privacy, but most of them suffer from significant performance degradation. In this paper, we present a novel forward private PEKS scheme leveraging Software Guard Extension (SGX), a trusted execution environment provided by Intel. The proposed scheme presents substantial performance improvements over prior work. Specifically, we reduce the query processing cost from O(n) to O(1), where n is the number of encrypted data. According to our performance analysis, the overall computation time is reduced by 80% on average. Lastly, we provide a formal security definition of SGX-based forward private PEKS, as well as a rigorous security proof of the proposed scheme.

With the rapid growth in the development of smart devices equipped with biometric sensors, client identification system using biometric traits are widely adopted across various applications. Among many biometric traits, fingerprint-based identification systems have been extensively studied and deployed. However, to adopt biometric identification systems in practical applications, two main obstacles in terms of efficiency and client privacy must be resolved simultaneously. That is, identification should be performed at an acceptable time, and only a client should have access to his/her biometric traits, which are not revocable if leaked. Until now, multiple studies have demonstrated successful protection of client biometric data; however, such systems lack efficiency that leads to excessive time utilization for identification. The most recently researched scheme shows efficiency improvements but reveals client biometric traits to other entities such as biometric database server. This violates client privacy. In this paper, we propose an efficient and privacy-preserving fingerprint identification scheme by using cloud systems. The proposed scheme extensively exploits the computation power of a cloud so that most of the laborious computations are performed by the cloud service provider. According to our experimental results on an Amazon EC2 cloud, the proposed scheme is faster than the existing schemes and guarantees client privacy by exploiting symmetric homomorphic encryption. Our security analysis shows that during identification, the client fingerprint data is not disclosed to the cloud service provider or fingerprint database server.

Mail user agent (MUA) programs provide an integrated interface for email services. Many MUAs support email encryption functionality to ensure the confidentiality of emails. In practice, they encrypt the content of an email using email encryption standards such as OpenPGP or S/MIME, mostly implemented using GnuPG. Despite their widespread deployment, there has been insufficient research on their software structure and the security dependencies among the software components of MUA programs. In order to understand the security implications of the structures and analyze any possible vulnerabilities of MUA programs, we investigated a number of MUAs that support email encryption. As a result, we found severe vulnerabilities in a number of MUAs that allow cache side-channel attacks in virtualized desktop environments. Our analysis reveals that the root cause originates from the lack of verification and control over the third-party cryptographic libraries that they adopt. In order to demonstrate this, we implemented a cache side-channel attack on RSA in GnuPG and then conducted an evaluation of the vulnerability of 13 MUAs that support email encryption in Ubuntu 14.04, 16.04 and 18.04. Based on our experiment, we found that 10 of these MUA programs (representing approximately 77% of existing MUA programs) allow the installation of a vulnerable version of GnuPG, even when the latest version of GnuPG, which is secure against most cache side-channel attacks, is in use. In order to substantiate the importance of the vulnerability we discovered, we conducted a FLUSH+RELOAD attack on these MUA programs and demonstrated that the attack restored 92% of the bits of the 2048-bit RSA private key when the recipients read a single encrypted email.

With the successful proliferation of data outsourcing services, security and privacy issues have drawn significant attention. Data authentication in particular plays an essential role in the storage of outsourced digital content and keeping it safe from modifications by inside or outside adversaries. In this paper, we focus on online data authentication using a Merkle (hash) tree to guarantee data integrity. By conducting in-depth diagnostics of the side channels of the Merkle tree-based approach, we explore novel solutions to improve the security and reliability of the maintenance of outsourced data. Based on a thorough review of previous solutions, we present a new method of inserting auxiliary random sources into the integrity verification proof on the prover side. This prevents the exposure of partial information within the tree structure and consequently releases restrictions on the number of verification execution, while maintaining desirable security and reliability of authentication for the long run. Based on a rigorous proof, we show that the proposed scheme maintains consistent reliability without being affected by continuous information leakage caused by repetitions of the authentication process. In addition, experimental results comparing with the proposed scheme with other state-of-the-art studies demonstrate its efficiency and practicality.

The smart grid is a promising electrical grid paradigm for enhancing flexibility and reliability in power transmission through two-way communications among grid entities. In the smart grid system, the privacy of usage information measured by individual smart meters has gained significant attention, owing to the possibility of personal information inference. Moreover, efficient and reliable power provisioning can be seriously impeded through illicit manipulations of aggregated data under the influence of malicious adversaries. Due to such potential risks, it becomes an important requirement for the smart grid to preserve privacy of metering data by secure aggregation and to authenticate the aggregated result in an efficient manner within large scale environments. From this perspective, this paper investigates the current status of security and privacy in smart grid systems and representative state-of-the-art studies in secure aggregation and authentication of metering data for future directions of a smart grid.

Long-term electrocardiogram (ECG) monitoring, as a representative application of cyber-physical systems, facilitates the early detection of arrhythmia. A considerable number of previous studies has explored monitoring techniques and the automated analysis of sensing data. However, ensuring patient privacy or confidentiality has not been a primary concern in ECG monitoring. First, we propose an intelligent heart monitoring system, which involves a patient-worn ECG sensor (e.g., a smartphone) and a remote monitoring station, as well as a decision support server that interconnects these components. The decision support server analyzes the heart activity, using the Pan–Tompkins algorithm to detect heartbeats and a decision tree to classify them. Our system protects sensing data and user privacy, which is an essential attribute of dependability, by adopting signal scrambling and anonymous identity schemes. We also employ a public key cryptosystem to enable secure communication between the entities. Simulations using data from the MIT-BIH arrhythmia database demonstrate that our system achieves a 95.74% success rate in heartbeat detection and almost a 96.63% accuracy in heartbeat classification, while successfully preserving privacy and securing communications among the involved entities.