Biblio

The concepts of information flow security and refinement are known to have had a troubled relationship ever since the seminal work of McLean. In this work we study refinements that support changes in data representation and semantics, including the addition of state variables that may induce new observational power or side channels. We propose a new epistemic approach to ignorance-preserving refinement where an abstract model is used as a specification of a system's permitted information flows, that may include the declassification of secret information. The core idea is to require that refinement steps must not induce observer knowledge that is not already available in the abstract model. Our study is set in the context of a class of shared variable multiagent models similar to interpreted systems in epistemic logic. We demonstrate the expressiveness of our framework through a series of small examples and compare our approach to existing, stricter notions of information-flow secure refinement based on bisimulations and noninterference preservation. Interestingly, noninterference preservation is not supported “out of the box” in our setting, because refinement steps may introduce new secrets that are independent of secrets already present at abstract level. To support verification, we first introduce a “cube-shaped” unwinding condition related to conditions recently studied in the context of value-dependent noninterference, kernel verification, and secure compilation. A fundamental problem with ignorance-preserving refinement, caused by the support for general data and observation refinement, is that sequential composability is lost. We propose a solution based on relational pre-and postconditions and illustrate its use together with unwinding on the oblivious RAM construction of Chung and Pass.

Information flow type systems enforce the security property of noninterference by detecting unauthorized data flows at compile-time. However, they require precise type annotations, making them difficult to use in practice as much of the legacy infrastructure is written in untyped or dynamically-typed languages. Gradual typing seamlessly integrates static and dynamic typing, providing the best of both approaches, and has been applied to information flow control, where information flow monitors are derived from gradual security types. Prior work on gradual information flow typing uncovered tensions between noninterference and the dynamic gradual guarantee- the property that less precise security type annotations in a program should not cause more runtime errors.This paper re-examines the connection between gradual information flow types and information flow monitors to identify the root cause of the tension between the gradual guarantees and noninterference. We develop runtime semantics for a simple imperative language with gradual information flow types that provides both noninterference and gradual guarantees. We leverage a proof technique developed for FlowML and reduce noninterference proofs to preservation proofs.

Kotlin is a relatively new programming language from JetBrains: its development started in 2010 with release 1.0 done in early 2016. The Kotlin compiler, while slowly and steadily becoming more and more mature, still crashes from time to time on the more tricky input programs, not least because of the complexity of its features and their interactions. This makes it a great target for fuzzing, even the basic forms of which can find a significant number of Kotlin compiler crashes. There is a problem with fuzzing, however, closely related to the cause of the crashes: generating a random, non-trivial and semantically valid Kotlin program is hard. In this paper, we talk about type-centriccompilerfuzzing in the form of type-centricenumeration, an approach inspired by skeletal program enumeration [1] and based on a combination of generative and mutation-based fuzzing, which solves this problem by focusing on program types. After creating the skeleton program, we fill the typed holes with fragments of suitable type, created via generation and enhanced by semantic-aware mutation. We implemented this approach in our Kotlin compiler fuzzing framework called Backend Bug Finder (BBF) and did an extensive evaluation, not only testing the real-world feasibility of our approach, but also comparing it to other compiler fuzzing techniques. The results show our approach to be significantly better compared to other fuzzing approaches at generating semantically valid Kotlin programs, while creating more interesting crash-inducing inputs at the same time. We managed to find more than 50 previously unknown compiler crashes, of which 18 were considered important after their triage by the compiler team.

Compressive Covariance Sampling (CCS) is a strategy used to recover the covariance matrix (CM) directly from compressive measurements. Several works have proven the advantages of CSS in Compressive Spectral Imaging (CSI) but most of these algorithms require multiple random projections of the scene to obtain good reconstructions. However, several low-resolution copies of the scene can be captured in a single snapshot through a lenslet array. For this reason, this paper proposes a sensing protocol and a single snapshot CCS optical architecture using a lenslet array based on the Dual Dispersive Aperture Spectral Imager(DD-CASSI) that allows the recovery of the covariance matrix with a single snapshot. In this architecture uses the lenslet array allows to obtain different projections of the image in a shot due to the special coded aperture. In order to validate the proposed approach, simulations evaluated the quality of the recovered CM and the performance recovering the spectral signatures against traditional methods. Results show that the image reconstructions using CM have PSNR values about 30 dB, and reconstructed spectrum has a spectral angle mapper (SAM) error less than 15° compared to the original spectral signatures.

To measure machinery vibration, a sensor system consisting of a 3-axis accelerometer, ADXL345, attached to a self-contained system-on-a-chip with integrated Wi-Fi capabilities, ESP8266, is a low-cost solution. In this work, we first show that in such a system, the widely used direct-read-and-send method which samples and sends individually acquired vibration data points to the server is not effective, especially using Wi-Fi connection. We show that the micro delays in each individual data transmission will limit the sensor sampling rate and will also affect the time of the acquired data points not evenly spaced. Then, we propose that vibration should be sampled in batches before sending the acquired data out from the sensor node. The vibration for each batch should be acquired continuously without any form of interruption in between the sampling process to ensure the data points are evenly spaced. To fill the data gaps between the batches, we propose the use of compressive sampling technique. Our experimental results show that the maximum sampling rate of the direct-read-and-send method is 350Hz with a standard uncertainty of 12.4, and the method loses more information compared to our proposed solution that can measure the vibration wirelessly and continuously up to 633Hz. The gaps filled using compressive sampling can achieve an accuracy in terms of mean absolute error (MAE) of up to 0.06 with a standard uncertainty of 0.002, making the low-cost vibration sensor node a cost-effective solution.

In the Swarm Intelligence domain, the firefly algorithm(s) is the most significant algorithm applied in most all optimization areas. FA and variants are easily understood and implemented. FA is capable of solving different domain problems. For solving diverse range of engineering problems requires modified FA or Hybrid FA algorithms, but it is possible additional scope of improvement. In recent times swarm intelligence based intelligent optimization algorithms have been used for Research purposes. FA is one of most important intelligence Swarm algorithm that can be applied for the problems of Global optimization. FA algorithm is capable of achieving best results for complicated issues. In this research study we have discussed and different characteristics of FA and presented brief Review of FA. Along with other metahauristic algorithm we have discussed FA algorithm’s different variant like multi objective, and hybrid. The applications of firefly algorithm are bestowed. The aim of the paper is to give future direction for research in FA.

Earlier around in year 1880’s, Industry 2.0 marked as change to the society caused by the invention of electricity. In today’s era, artificial intelligence plays a crucial role in defining the period of Industry 4.0. In this research study, we have presented Computational Intelligence based Machine Condition Monitoring system architecture for determination of developing faults in industrial machines. The goal is to increase efficiency of machines and reduce the cost. The architecture is fusion of machine sensitive sensors, cloud computing, artificial intelligence and databases, to develop an autonomous fault diagnostic system. To explain CI-MCMs, we have used neural networks on sensor data obtained from hydraulic system. The results obtained by neural network were compared with those obtained from traditional methods.

To develop the next generation of Internet of Things, Edge devices and systems which leverage progress in enabling technologies such as 5G, distributed computing and artificial intelligence (AI), several requirements need to be developed and put in place to make the devices smarter. A major requirement for all the above applications is the long-term security and trust computing infrastructure. Trusted Computing requires the introduction inside of the platform of a Trusted Platform Module (TPM). Traditionally, a TPM was a discrete and dedicated module plugged into the platform to give TPM capabilities. Recently, processors manufacturers started integrating trusted computing features into their processors. A significant drawback of this approach is the need for a permanent modification of the processor microarchitecture. In this context, we suggest an analysis and a design of a software-only TPM for RISC-V processors based on seL4 microkernel and OP-TEE.

Recently, Mobile Edge Cloud computing (MEC) has attracted attention both from academia and industry. The idea of moving a part of cloud resources closer to users and data sources can bring many advantages in terms of speed, data traffic, security and context-aware services. The MEC infrastructure does not only host and serves applications next to the end-users, but services can be dynamically migrated and reallocated as mobile users move in order to guarantee latency and performance constraints. This specific requirement calls for the involvement and collaboration of multiple MEC providers, which raises a major issue related to trustworthiness. Two main challenges need to be addressed: i) trustworthiness needs to be handled in a manner that does not affect latency or performance, ii) trustworthiness is considered in different dimensions - not only security metrics but also performance and quality metrics in general. In this paper, we propose a trust layer for public MEC infrastructure that handles establishing and updating trust relations among all MEC entities, making the interaction withing a MEC network transparent. First, we define trust attributes affecting the trusted quality of the entire infrastructure and then a methodology with a computation model that combines these trust attribute values. Our experiments showed that the trust model allows us to reduce latency by removing the burden from a single MEC node, while at the same time increase the network trustworthiness.

Mobile security remains a concern for multiple stakeholders. Safe user behavior is crucial key to avoid and mitigate mobile threats. The research used a survey design to capture key constructs of mobile user threat avoidance behavior. Analysis revealed that there is no significant difference between the two key drivers of secure behavior, threat appraisal and coping appraisal, for Android and iOS users. However, statistically significant differences in avoidance motivation and avoidance behavior of users of the two operating systems were displayed. This indicates that existing threat avoidance models may be insufficient to comprehensively deal with factors that affect mobile user behavior. A newly introduced variable, perceived security, shows a difference in the perceptions of their level of protection among the users of the two operating systems, providing a new direction for research into mobile security.

This paper presents an implementation of a novel approach, utilizing hybrid data partitioning, to secure sensitive data and improve query performance. In this novel approach, vertical and horizontal data partitioning are combined together in an approach that called hybrid partitioning and the new approach is implemented using Microsoft SQL server to generate divided/partitioned relations. A group of proposed rules is applied to the query request process using query binning (QB) and Metadata of partitioning. The proposed approach is validated using experiments involving a collection of data evaluated by outcomes of advanced stored procedures. The suggested approach results are satisfactory in achieving the properties of defining the data security: non-linkability and indistinguishability. The results of the proposed approach were satisfactory. The proposed novel approach outperforms a well-known approach called PANDA.

This work demonstrates an ultra-compact low power oscillating micromechanical active pixel array based on a 0.35 μm back-end of line (BEOL)-embedded CMOS-MEMS technology. Each pixel consists of a 3-MHz clamped-clamped beam (CCB) MEMS resonator and a power scalable transimpedance amplifier (TIA) that occupies a small area of 70 × 60 μm2 and draws only 85 μW/pixel. The MEMS resonator is placed next to the TIA with less than 10 μm spacing thanks to the well-defined etch stops in the titanium nitride composite (TiN-C) CMOS-MEMS platform. A multiplexing phase-locked loop (PLL)-driven oscillator is employed to demonstrate the chip functionality. In particular, a nonlinear operation of the resonator tank is used to optimize the phase noise (PN) performance and Allan deviation (ADEV) behavior. The ADEV of 420 ppb averaged over best 3-pixels is exhibited based on such a nonlinear vibration operation.

Experimental implementation of phase-locked loop (PLL) with bandpass filter is proposed. Such PLL is noteworthy for neuron-like dynamics. It generates both regular and chaotic spikes and bursts. Previously proposed hardware implementation of this system has significant disadvantage – absence of excitable (non-oscillating) mode that is vital for brain neurons. The proposed electronic neuron-like generator is modified and could be used for hardware implementation of spiking neural networks.

Object-oriented program (OOP) is very popular in these years for its advantages, but the testing method for OOP is still not mature enough. To deal with the problem that it is impossible to generate the probability density function by simply numeralizing a point in the test case caused by the complex structure of the object-oriented test case, we propose the Adaptive Random Testing through Test Profile for Object-Oriented software (ARTTP-OO). It generates a test case at the edge of the input field and calculates the distance between object-oriented test cases using Object and Method Invocation Sequence Similarity (OMISS) metric formula. And the probability density function is generated by the distance to select the test cases, thereby realizing the application of ARTTP algorithm in OOP. The experimental results indicate the proposed ARTTP-OO consumes less time cost without reducing the detection effectiveness.

In the last decade the use of artificial neural networks (ANNs) in many fields like image processing or speech recognition has become a common practice because of their effectiveness to solve complex tasks. However, in such a rush, very little attention has been paid to security aspects. In this work we explore the possibility to embed a watermark into the ANN parameters. We exploit model redundancy and adaptation capacity to lock a subset of its parameters to carry the watermark sequence. The watermark can be extracted in a simple way to claim copyright on models but can be very easily attacked with model fine-tuning. To tackle this culprit we devise a novel watermark aware training strategy. We aim at delving into the loss landscape to find an optimal configuration of the parameters such that we are robust to fine-tuning attacks towards the watermarked parameters. Our experimental results on classical ANN models trained on well-known MNIST and CIFAR-10 datasets show that the proposed approach makes the embedded watermark robust to fine-tuning and compression attacks.

With the development in IC technology, testing the designs is becoming more and more complex. In the design, process testing consumes 60-80% of the time. The basic testing principle is providing the circuit under test (CUT) with input patterns, observing output responses, and comparing against the desired response called the golden response. As the density of the device are rising leads to difficulty in examining the sub-circuit of the chip. So, testing of design is becoming a time-consuming and costly process. Attaching additional logic to the circuit resolves the issue by testing itself. BIST is a relatively a design for testability technique to facilitate thorough testing of ICs and it comprises the test pattern generator, circuit under test, and output response analyzer. Quick diagnosis and very high fault coverage can be ensured by BIST. As complexity in the circuit is increasing, testing urges TPGs (Test Pattern Generators) to generate the test patterns for the CUT to sensitize the faults. TPGs are vulnerable to malicious activities such as scan-based side-channel attacks. Secret data saved on the chip can be extracted by an attacker by scanning out the test outcomes. These threats lead to the emergence of securing TPGs. This work demonstrates providing a secured test pattern generator for BIST circuits by locking the logic of TPG with a password or key generated by the key generation circuit. Only when the key is provided test patterns are generated. This provides versatile protection to TPG from malicious attacks such as scan-based side-channel attacks, Intellectual Property (IP) privacy, and IC overproduction.

Rapid development of wireless technologies has driven the evolution of smart grid application. In smart grid, authentication plays an important role for secure communication between smart meter and service provider. Hence, the design of secure authenticated key agreement schemes has received significant attention from researchers. In these schemes, a trusted third party directly participates in key agreement process. Although, this third party is assumed as trusted, however we cannot reject the possibility that being a third party, it can also be malicious. In the existing works, either the established session key is revealed to the agents of a trusted third party, or a trusted third party agent can impersonate the smart meter and establish a valid session key with the service provider, which is likely to cause security vulnerabilities. Therefore, there is a need to design a secure authentication scheme so that only the deserving entities involved in the communication can establish and know the session key. This paper proposes a new secure authenticated key agreement scheme for smart grid considering the fact that the third party can also be malicious. The security of the proposed scheme has been thoroughly evaluated using an adversary model. Correctness of the scheme has been analyzed using the broadly accepted Burrows-Abadi-Needham (BAN) Logic. In addition, the formal security verification of the proposed scheme has been performed using the widely accepted Automated Validation of Internet Security Protocols and Applications (AVISPA) simulation tool. Results of this simulation confirm that the proposed scheme is safe. Detailed security analysis shows the robustness of the scheme against various known attacks. Moreover, the comparative performance study of the proposed scheme with other relevant schemes is presented to demonstrate its practicality.

Many information systems have been around for several decades, and most of them have their underlying databases. The data accumulated in those databases over the years could be a very valuable asset, which must be protected. The first role of database auditing is to ensure and confirm that security measures are set correctly. However, tracing user behavior and collecting a rich audit trail enables us to use that trail in a more proactive ways. As an example, audit trail could be analyzed ad hoc and used to prevent intrusion, or analyzed afterwards, to detect user behavior patterns, forecast workloads, etc. In this paper, we present a simple, secure, configurable, role-separated, and effective in-database auditing subsystem, which can be used as a base for access control, intrusion detection, fraud detection and other security-related analyses and procedures. It consists of a management relations, code and data object generators and several administrative tools. This auditing subsystem, implemented in several information systems, is capable of keeping the entire audit trail (data history) of a database, as well as all the executed SQL statements, which enables different security applications, from ad hoc intrusion prevention to complex a posteriori security analyses.

The advancement of technology in the creation of new tools to solve problems such as information storage generates proportionally developing methods that search for security flaws or breaches that compromise said information. The need to periodically generate security reports on database managers is given by the complexity and number of attacks that can be carried out today. This project seeks to carry out an evaluation of the security of NoSQL database managers. The work methodology is developed according to the order of the objectives, it begins by synthesizing the types of vulnerabilities, attacks and protection schemes limited to MongoDB, Redis and Apache Cassandra. Once established, a prototype of a web system that stores information with a non-relational database will be designed on which a series of attacks defined by a test plan will be applied seeking to add, consult, modify or eliminate information. Finally, a report will be presented that sets out the attacks carried out, the way in which they were applied, the results, possible countermeasures, security advantages and disadvantages for each manager and the conclusions obtained. Thus, it is possible to select which tool is more convenient to use for a person or organization in a particular case. The results showed that MongoDB is more vulnerable to NoSQL injection attacks, Redis is more vulnerable to attacks registered in the CVE and that Cassandra is more complex to use but is less vulnerable.

In the last few years, cluster ensembles have emerged as powerful techniques that integrate multiple clustering methods into recommender systems. Such integration leads to improving the performance, quality and the accuracy of the generated recommendations. This paper proposes a novel recommender system based on a cluster ensemble technique for big data. The proposed system incorporates the collaborative filtering recommendation technique and the cluster ensemble to improve the system performance. Besides, it integrates the Expectation-Maximization method and the HyperGraph Partitioning Algorithm to generate new recommendations and enhance the overall accuracy. We use two real-world datasets to evaluate our system: TED Talks and MovieLens. The experimental results show that the proposed system outperforms the traditional methods that utilize single clustering techniques in terms of recommendation quality and predictive accuracy. Most importantly, the results indicate that the proposed system provides the highest precision, recall, accuracy, F1, and the lowest Root Mean Square Error regardless of the used similarity strategy.

There are numerous areas relied on random numbers. As one knows, in Cryptography, randomness plays a vital role from key generation to encrypting the systems. If randomness is not created effectively, the whole system is vulnerable to security threats where an outsider can easily predict the algorithm used to generate the random numbers in the system. Another main application where one would not touch is the role of random numbers in different devices mainly storage-related like Solid State Drives, Universal Serial Bus (USB), Secure Digital (SD) cards random performance testing. This paper focuses on various novel algorithms to generate random numbers for efficient performance evaluation of different drives. The main metrics for performance testing is random read and write performance. Here, the biggest challenge to test the random performance of the drive is not only the extent to which randomness is created but also the testing should cover the entire device (say complete NAND, NOR, etc.). So, the random number generator should generate in such a way that the random numbers should not be able to be predicted and must generate the numbers covering the entire range. This paper proposes different methods for such generators and towards the end, discusses the implementation in Field Programmable Gate Array (FPGA).

The Multivariate Polynomial Public Key (MPPK) algorithm, over a prime Galois field, takes a multiplier multivariate polynomial and two multiplicand univariate solvable polynomials to create two product multivariate polynomials. One of variables is for secret message and all others are for noises. The public key consists of all coefficients of the product multivariate polynomials, except the two constant terms for the message variable. The private key is made of both multiplicands. Encryption takes a list of random numbers, over the prime Galois field. The first number is the secret to exchange. The other random numbers generate noise automatically cancelled by decryption. The secret is easily extracted from the evaluation of a solvable equation. The level of security provided by MPPK is adaptable. The algorithm can be used in several different ways. In this paper, we review the performance achieved by MPPK for several combinations of polynomial configurations and Galois field sizes. For every combination, we calculated key generation time, encryption time and decryption time. We also compare the effectiveness of MPPK with the performance of all four NIST PQC finalists. For MPPK, the data has been collected from the execution of an implementation in Java. In comparison to the NIST PQC finalists, MPPK key generation, encryption and decryption performance is excellent.

In recent years, many modifications have been done to combat the weaknesses of the Vigenère Cipher Algorithm. Several studies have been carried out to rectify the flaw of the algorithm’s repeating key nature by increasing the key length equal to that of the plain text. However, some characters cannot be encrypted due to the limited set of characters in the key. This paper modified the algorithm’s key generation process using a Pseudo-Random Number Generator to improve the algorithm’s security and expanded the table of characters to up to 190 characters. The results show that based on Monobit examination and frequency analysis, the repeating nature of the key is non-existent, and the generated key can be used to encrypt a larger set of characters. The ciphertext has a low IC value of 0.030, which is similar to a random string and polyalphabetic cipher with an IC value of 0.038 but not equal to a monoalphabetic cipher with an IC value of 0.065. Results show that the modified version of the algorithm performs better than some of the recent studies conducted on it

Ransomware is a major malware attack experienced by large corporations and healthcare services. Ransomware employs the idea of cryptovirology, which uses cryptography to design malware. The goal of ransomware is to extort ransom by threatening the victim with the destruction of their data. Ransomware typically involves a 3-step process: analyzing the victim’s network traffic, identifying a vulnerability, and then exploiting it. Thus, the detection of ransomware has become an important undertaking that involves various sophisticated solutions for improving security. To further enhance ransomware detection capabilities, this paper focuses on an Application Programming Interface (API)-based ransomware detection approach in combination with machine learning (ML) techniques. The focus of this research is (i) understanding the life cycle of ransomware on the Windows platform, (ii) dynamic analysis of ransomware samples to extract various features of malicious code patterns, and (iii) developing and validating machine learning-based ransomware detection models on different ransomware and benign samples. Data were collected from publicly available repositories and subjected to sandbox analysis for sampling. The sampled datasets were applied to build machine learning models. The grid search hyperparameter optimization algorithm was employed to obtain the best fit model; the results were cross-validated with the testing datasets. This analysis yielded a high ransomware detection accuracy of 99.18% for Windows-based platforms and shows the potential for achieving high-accuracy ransomware detection capabilities when using a combination of API calls and an ML model. This approach can be further utilized with existing multilayer security solutions to protect critical data from ransomware attacks.

Recent advancements in quantum information theory and quantum computation intend the possibilities of breaking the existing classical cryptographic systems. To mitigate these kinds of threats with quantum computers we need some advanced quantum-based cryptographic systems. The research orientation towards this is tremendous in recent years, and many excellent approaches have been reported. In this article, we discuss the probable approaches of the quantum cryptographic systems from implementation point of views to handle the post-quantum cryptographic attacks.