Search

Elections generally involve the simple tasks of counting votes and publishing the final tally to voters. Depending on the election’s scope, these processes require sophisticated methods embedded in the electorate’s various technological and societal factors (e.g., the voting culture). An election’s integrity is the pinnacle of the trust placed in the voting process and its final results. Previous research on cryptographic voting schemes continuously refined voting protocols to achieve private and verifiable elections. These cryptographic schemes enable novel ways to allow remote voting systems to (i) provide a remote voting alternative to on-site voting with a ballot box and (ii) offer a technical path to building an end-to-end verifiable Electronic Voting system by applying cryptographic primitives. This chapter explicitly addresses Remote Electronic Voting (REV), which enables vote casting in an uncontrolled environment and vote transmission over communication channels (e.g., over the Internet). Further, this chapter clarifies how the Distributed Ledger (DL) technology can enhance the decentralization of the electoral process, ensuring transparency and the ability to verify results while guaranteeing the confidentiality of voters. Thus, necessary cryptographic fundamentals and examples of voting schemes, their properties, and trade-offs will be investigated. The different approaches toward REV systems are detailed, followed by an overview of related work. Further, a centralized REV voting system architecture, all stakeholders involved, and critical trust assumptions are outlined. This leads to the proposal of a fully decentralized architecture, which is being evaluated in qualified discussions with respect to long-term privacy, verifiability, and voter authentication. Finally, open research aspects are complemented by overall considerations on decentralized REV.

We present the largest optical photometry compilation of gamma-ray bursts (GRBs) with redshifts (z). We include 64813 observations of 535 events (including upper limits) from 28 February 1997 to 18 August 2023. We also present a user-friendly web tool grbLC which allows users to visualize photometry, coordinates, redshift, host galaxy extinction, and spectral indices for each event in our database. Furthermore, we have added a Gamma-ray Coordinate Network (GCN) scraper that can be used to collect data by gathering magnitudes from the GCNs. The web tool also includes a package for uniformly investigating colour evolution. We compute the optical spectral indices for 138 GRBs, for which we have at least four filters at the same epoch in our sample, and craft a procedure to distinguish between GRBs with and without colour evolution. By providing a uniform format and repository for the optical catalogue, this web-based archive is the first step towards unifying several community efforts to gather the photometric information for all GRBs with known redshifts. This catalogue will enable population studies by providing light curves (LCs) with better coverage since we have gathered data from different ground-based locations. Consequently, these LCs can be used to train future LC reconstructions for an extended inference of the redshift. The data gathering also allows us to fill some of the orbital gaps from Swift in crucial points of the LCs, e.g. at the end of the plateau emission or where a jet break is identified.

Mammographic density (MD) assessment is subject to inter- and intra-observer variability. An automated method, such as Quantra software, could be a useful tool for an objective and reproducible MD assessment. Our purpose was to evaluate the performance of Quantra software in assessing MD, according to BI-RADS (R) Atlas Fifth Edition recommendations, verifying the degree of agreement with the gold standard, given by the consensus of two breast radiologists. A total of 5009 screening examinations were evaluated by two radiologists and analysed by Quantra software to assess MD. The agreement between the three assigned values was expressed as intraclass correlation coefficients (ICCs). The agreement between the software and the two readers (R1 and R2) was moderate with ICC values of 0.725 and 0.713, respectively. A better agreement was demonstrated between the software's assessment and the average score of the values assigned by the two radiologists, with an index of 0.793, which reflects a good correlation. Quantra software appears a promising tool in supporting radiologists in the MD assessment and could be part of a personalised screening protocol soon. However, some fine-tuning is needed to improve its accuracy, reduce its tendency to overestimate, and ensure it excludes high-density structures from its assessment.

We present the largest optical photometry compilation of Gamma-Ray Bursts (GRBs) with redshifts (z). We include 64813 observations of 535 events (including upper limits) from 28 February 1997 to 18 August 2023. We also present a user-friendly web tool grbLC which allows users to visualise photometry, coordinates, redshift, host galaxy extinction, and spectral indices for each event in our database. Furthermore, we have added a Gamma-ray Coordinate Network (GCN) scraper that can be used to collect data by gathering magnitudes from the GCNs. The web tool also includes a package for uniformly investigating colour evolution. We compute the optical spectral indices for 138 GRBs, for which we have at least 4 filters at the same epoch in our sample, and craft a procedure to distinguish between GRBs with and without colour evolution. By providing a uniform format and repository for the optical catalogue, this web-based archive is the first step towards unifying several community efforts to gather the photometric information for all GRBs with known redshifts. This catalogue will enable population studies by providing light curves (LCs) with better coverage since we have gathered data from different ground-based locations. Consequently, these LCs can be used to train future LC reconstructions for an extended inference of the redshift. The data gathering also allows us to fill some of the orbital gaps from Swift in crucial points of the LCs, e.g., at the end of the plateau emission or where a jet break is identified.

Item does not contain fulltext

Despite the availability of new classes of glucose-lowering drugs that improve glycaemic levels and minimise long-term complications, at least 20–25% of people with type 2 diabetes require insulin therapy. Moreover, a substantial proportion of these individuals do not achieve adequate metabolic control following insulin initiation. This is due to several factors: therapeutic inertia, fear of hypoglycaemia and/or weight gain, poor communication, complexity of insulin titration, and the number of injections needed, with the associated reduced adherence to insulin therapy. Once-weekly insulins provide a unique opportunity to simplify basal insulin therapy and to allow good glycaemic control with a low risk of hypoglycaemia. Several approaches to developing a stable and effective once-weekly insulin have been proposed, but, to date, insulin icodec and basal insulin Fc (insulin efsitora alfa) are the only two formulations for which clinical studies have been reported. The results of Phase I and II studies emphasise both efficacy (in term of glucose levels) and potential risks and adverse events. Phase III studies involving insulin icodec are reassuring regarding the risk of hypoglycaemia compared with daily basal insulin analogues. Despite some concerns raised in ongoing clinical trials, the available data suggest that weekly insulins may also be an option for individuals with type 1 diabetes, especially when adherence is suboptimal. For the first time there is an opportunity to make an important breakthrough in basal insulin therapy, particularly in people with type 2 diabetes, and to improve not only the quality of life of people with diabetes, but also the practice of diabetologists.

BACKGROUND: The precision and accuracy of mass spectrometry (MS) made it a fundamental tool in anti-doping analysis. High-resolution (HR) mass spectrometers significantly improved compound identification. This study systematically analyzes data from an athlete (Subject 1) who tested positive for meldonium and compares it with data from a healthy volunteer (Subject 2) to examine the correctness of the doping verdict. CASE PRESENTATION: The documentation related to Subject 1 was thoroughly processed and analyzed. A study involving a volunteer (Subject 2) replicated Subject 1 regimen and urine sample collection for data alignment with anti-doping results, with Subject 2 reporting not using meldonium. The anti-doping agency’s analysis of Subject 1 showed the presence of meldonium at a concentration close to the established cut-off level. However, a closer examination revealed that one specific ion, crucial for meldonium identification, was absent from the mass spectra. Analyzing Subject 2 data, using the same methodology, the absence of the specific ion was confirmed, even though the volunteer did not consume meldonium. The European directive and the method that was validated and cited by the anti-doping agency identified meldonium on at least four specific ions, whereas the anti-doping analysis used only three ions. This discrepancy compromises the specificity of meldonium identification. CONCLUSIONS: To enhance the analytical methodology, two strategic interventions are suggested: adjusting the meldonium cut-off value and expanding the analysis to include meldonium metabolites. By addressing these avenues, the precision of meldonium detection and doping verdicts can be improved. In conclusion, this study challenges the anti-doping agency’s verdict and prompts a reevaluation of meldonium detection methodologies in anti-doping measures.

Three-dimensional (3D) bioprinting allows the production of artificial 3D cellular microenvironments thanks to the controlled spatial deposition of bioinks. Proper bioink characterization is required to achieve the essential characteristics of printability and biocompatibility for 3D bioprinting. In this work, a protocol to standardize the experimental characterization of a new bioink is proposed. A functionalized hydrogel based on gelatin and chitosan was used. The protocol was divided into three steps: pre-printing, 3D bioprinting, and post-printing. For the pre-printing step, the hydrogel formulation and its repeatability were evaluated. For the 3D-bioprinting step, the hydrogel-printability performance was assessed through qualitative and quantitative tests. Finally, for the post-printing step, the hydrogel biocompatibility was investigated using UMR-106 cells. The hydrogel was suitable for printing grids with good resolution from 4 h after the cross-linker addition. To guarantee a constant printing pressure, it was necessary to set the extruder to 37 °C. Furthermore, the hydrogel was shown to be a valid biomaterial for the UMR-106 cells’ growth. However, fragmentation of the constructs appeared after 14 days, probably due to the negative osteosarcoma-cell interference. The protocol that we describe here denotes a strong approach to bioink characterization to improve standardization for future biomaterial screening and development.

The relative contribution of small (sEVs) and large extracellular vesicles (lEVs) to the total plasma procoagulant potential is not yet well defined. Thus, we compared total and TFpos-sEVs and -lEVs isolated from healthy subjects and COVID-19 patients during the acute phase of the infection and after symptom remission in terms of (1) vesicle enumeration using nanoparticle tracking assay, imaging flow cytometry, and TF immunofluorescence localization in a single-vesicle analysis using microarrays; (2) cellular origin; and (3) TF-dependent Xa generation capacity, as well as assessing the contribution of the TF inhibitor, TFPI. In healthy subjects, the plasma concentration of CD9/CD63/CD81pos sEVs was 30 times greater than that of calceinpos lEVs, and both were mainly released by platelets. Compared to lEVs, the levels of TFpos-sEVs were 2-fold higher. The TF-dependent Xa generation capacity of lEVs was three times greater than that of sEVs, with the latter being hindered by TFPI. Compared to HSs, the amounts of total and TFpos-sEVs and -lEVs were significantly greater in acute COVID-19 patients, which reverted to the physiological values at the 6-month follow-up. Interestingly, the FXa generation of lEVs only significantly increased during acute infection, with that of sEV being similar to that of HSs. Thus, in both healthy subjects and COVID-19 patients, the TF-dependent procoagulant potential is mostly sustained by large vesicles.

Object GRB 221009A is the brightest gamma-ray burst (GRB) detected in more than 50 yr of study. In this paper, we present observations in the X-ray and optical domains obtained by the GRANDMA Collaboration and the Insight Collaboration. We study the optical afterglow with empirical fitting using the GRANDMA+HXMT-LE data sets augmented with data from the literature up to 60 days. We then model numerically using a Bayesian approach, and we find that the GRB afterglow, extinguished by a large dust column, is most likely behind a combination of a large Milky Way dust column and moderate low-metallicity dust in the host galaxy. Using the GRANDMA+HXMT-LE+XRT data set, we find that the simplest model, where the observed afterglow is produced by synchrotron radiation at the forward external shock during the deceleration of a top-hat relativistic jet by a uniform medium, fits the multiwavelength observations only moderately well, with a tension between the observed temporal and spectral evolution. This tension is confirmed when using the augmented data set. We find that the consideration of a jet structure (Gaussian or power law), the inclusion of synchrotron self-Compton emission, or the presence of an underlying supernova do not improve the predictions. Placed in the global context of GRB optical afterglows, we find that the afterglow of GRB 221009A is luminous but not extraordinarily so, highlighting that some aspects of this GRB do not deviate from the global known sample despite its extreme energetics and the peculiar afterglow evolution.

In the context of Information-Centric Networking, Interest Flooding Attacks (IFAs) represent a new and dangerous sort of distributed denial of service. Since existing proposals targeting IFAs mainly focus on local information, in this paper we propose GNN4IFA as the first mechanism exploiting complex non-local knowledge for IFA detection by leveraging Graph Neural Networks (GNNs) handling the overall network topology.In order to test GNN4IFA, we collect SPOTIFAI, a novel dataset filling the current lack of available IFA datasets by covering a variety of IFA setups, including ~40 heterogeneous scenarios over three network topologies. We show that GNN4IFA performs well on all tested topologies and setups, reaching over 99% detection rate along with a negligible false positive rate and small computational costs. Overall, GNN4IFA overcomes state-of-the-art detection mechanisms both in terms of raw detection and flexibility, and - unlike all previous solutions in the literature - also enables the transfer of its detection on network topologies different from the one used in its design phase., Green Open Access added to TU Delft Institutional Repository ‘You share, we take care!’ – Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

The literature and the news regularly report cases of exploiting Universal Serial Bus (USB) devices as attack tools for malware injections and private data exfiltration. To protect against such attacks, security researchers proposed different solutions to verify the identity of a USB device via side-channel information (e.g., timing or electromagnetic emission). However, such solutions often make strong assumptions on the measurement (e.g., electromagnetic interference-free area around the device), on a device’s state (e.g., only at the boot or during specific actions), or are limited to one particular type of USB device (e.g., flash drive or input devices).In this paper, we present PowerID, a novel method to fingerprint USB peripherals based on their power consumption. PowerID analyzes the power traces from a peripheral to infer its identity and properties. We evaluate the effectiveness of our method on an extensive power trace dataset collected from 82 USB peripherals, including 35 models and 8 types. Our experimental results show that PowerID accurately recognizes a peripheral type, model, activity, and identity., Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

Social Honeypots are tools deployed in Online Social Networks (OSN) to attract malevolent activities performed by spammers and bots. To this end, their content is designed to be of maximum interest to malicious users. However, by choosing an appropriate content topic, this attractive mechanism could be extended to any OSN users, rather than only luring malicious actors. As a result, honeypots can be used to attract individuals interested in a wide range of topics, from sports and hobbies to more sensitive subjects like political views and conspiracies. With all these individuals gathered in one place, honeypot owners can conduct many analyses, from social to marketing studies. In this work, we introduce a novel concept of social honeypot for attracting OSN users interested in a generic target topic. We propose a framework based on fully-automated content generation strategies and engagement plans to mimic legit Instagram pages. To validate our framework, we created 21 self-managed social honeypots (i.e., pages) on Instagram, covering three topics, four content generation strategies, and three engaging plans. In nine weeks, our honeypots gathered a total of 753 followers, 5387 comments, and 15739 likes. These results demonstrate the validity of our approach, and through statistical analysis, we examine the characteristics of effective social honeypots., Green Open Access added to TU Delft Institutional Repository ‘You share, we take care!’ – Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

Fifth-generation (5G) cellular communication networks are being deployed on applications beyond mobile devices, including vehicular networks and industry automation. Despite their increasing popularity, 5G networks, as defined by the Third Generation Partnership Project (3GPP), have been shown to be vulnerable against fake base station (FBS) attacks. An adversary carrying out an FBS attack emulates a legitimate base station by setting up a rogue base station. This enables the adversary to control the connection of any user equipment that (inadvertently) connects with the rogue base station. Such an adversary can gather sensitive information belonging to the user. While there is a large body of work focused on the development of tools to detect FBSs, the user equipment will continue to remain vulnerable to an FBS attack. In this paper, we propose BARON, a defense methodology to enable user equipment to determine whether a target base station that it is connecting to is legitimate or rogue. BARON accomplishes this by ensuring that the user receives an authentication token from the target base station which can be computed only by a legitimate and trusted entity. As a consequence, receiving such an authentication token from a base station ensures legitimacy of the base station. We evaluate BARON through extensive experiments on the handover process between base stations in 5G networks. Our experimental results show that BARON introduces an overhead of less than 1% during handover completion, which is 10000× lower than the overhead reported by a state-of-the-art method. BARON is also effective in thwarting an FBS attack and quickly recovering connection to a legitimate base station., Cyber Security

In the past few years, Convolutional Neural Networks (CNN) have demonstrated promising performance in various real-world cybersecurity applications, such as network and multimedia security. However, the underlying fragility of CNN structures poses major security problems, making them inappropriate for use in security-oriented applications, including computer networks. Protecting these architectures from adversarial attacks necessitates using security-wise architectures that are challenging to attack. In this study, we present a novel architecture based on an ensemble classifier that combines the enhanced security of 1-Class classification (known as 1C) with the high performance of conventional 2-Class classification (known as 2C) in the absence of attacks. Our architecture is referred to as the 1.5-Class (cmb-classifier) classifier and is constructed using a final dense classifier, one 2C classifier (i.e., CNNs), and two parallel 1C classifiers (i.e., auto-encoders). In our experiments, we evaluated the robustness of our proposed architecture by considering eight possible adversarial attacks in various scenarios. We performed these attacks on the 2C and cmb-classifier architectures separately. The experimental results of our study showed that the Attack Success Rate (ASR) of the I-FGSM attack against a 2C classifier trained with the N-BaIoT dataset is 0.9900. In contrast, the ASR is 0.0000 for the cmb-classifier., Green Open Access added to TU Delft Institutional Repository ‘You share, we take care!’ – Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

This work explores stylistic triggers for backdoor attacks in the audio domain: dynamic transformations of malicious samples through guitar effects. We first formalize stylistic triggers – currently missing in the literature. Second, we explore how to develop stylistic triggers in the audio domain by proposing JingleBack. Our experiments confirm the effectiveness of the attack, achieving a 96% attack success rate. Our code is available in https://github.com/skoffas/going-in-style., Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

In the era of the Internet of Communication Technologies (ICT), the Internet is becoming more popular and widely used across the world. Radio Frequency IDentification (RFID) has become a prominent technology in healthcare systems for identifying tagged objects. The RFID tags are attached to the billions of different healthcare devices or things in several associated applications. However, RFID tags’ security and privacy are regarded as the two biggest concerns. An adversary might eavesdrop, tamper, or even intercept the transmitted messages in RFID systems. Also, the privacy of the users (patients, doctors, and nurses) may breach. In past years, numerous ultralightweight RFID authentication schemes have been proposed in the healthcare sector. However, all these schemes were pointed out as insecure under several known security attacks namely, replay, impersonation, full-disclosure, and de-synchronization attacks. Keeping in view such security flaws, we present an efficient and reliable ultralightweight RFID authentication scheme (ER2AS) for healthcare systems to enhance patients’ medication safety. The scheme employs bitwise XOR, circular left–right rotations, and our proposed ultralighweight reformation operation to achieve higher-level security. The security and privacy evaluations demonstrate that ER2AS scheme resists several known security attacks. The performance analysis also demonstrates that it incurs lower computation and storage overhead on the RFID tags, thus making it practical to be implemented in real-time healthcare environments., Green Open Access added to TU Delft Institutional Repository ‘You share, we take care!’ – Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

Many regions are in urgent need of facial masks for slowing down the spread of COVID-19. To fight the pandemic, people are contributing masks through donation systems. Most existing systems are built on a centralized architecture which is prone to the single point of failure and lack of transparency. Blockchain-based solutions neglect fundamental privacy concerns (donation privacy) and security attacks (collusion attack, stealing attack). Moreover, current auditing solutions are not designed to achieve donation privacy, thus not appropriate in our context. In this work, we design a decentralized, anonymous, and secure auditing framework Astraea based on private smart contracts for donation systems. Specifically, we integrate a Distribute Smart Contract (DiSC) with an SGX Enclave to distribute donations, prove the integrity of donation number (intention) and donation sum while preserving donation privacy. With DiSC, we design a Donation Smart Contract to refund deposits and defend against the stealing attack the collusion attack from malicious collector and transponder. We formally define and prove the privacy and security of Astraea by using security reduction. We build a prototype of Astraea to conduct extensive performance analysis. Experimental results demonstrate that Astraea is practically efficient in terms of both computation and communication., Green Open Access added to TU Delft Institutional Repository ‘You share, we take care!’ – Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Intelligent Systems, Cyber Security

Authentication and de-authentication phases should occur at the beginning and end of secure user sessions, respectively. A secure session requires the user to pass the former, but the latter is often underestimated or ignored. Unattended or dangling sessions expose users to well-known Lunchtime Attacks. To mitigate this threat, researchers focused on automated de-authentication systems, either as a stand-alone mechanism or as a result of continuous authentication failures. Unfortunately, no single approach offers security, privacy, and usability. Face-recognition methods, for example, may be suitable for security and usability, but they violate user privacy by continuously recording their actions and surroundings. In this work, we propose BLUFADER, a novel continuous authentication system that takes advantage of blurred face detection and recognition to fast, secure, and transparent de-authenticate users, preserving their privacy. We obfuscate a webcam with a physical blur layer and use deep learning algorithms to perform face detection and recognition continuously. To evaluate BLUFADER's practicality, we collected two datasets formed by 30 recruited subjects (users) and thousands of physically blurred celebrity photos. The de-authentication system was trained and evaluated using the former, while the latter was used to appraise the privacy and increase variance at training time. To guarantee the privacy-preserving effectiveness of the selected physical blurring filter, we show that state-of-the-art deblurring models are not able to revert our physical blur. Further, we demonstrate that our approach outperforms state-of-the-art methods in detecting blurred faces, achieving up to 95% accuracy. Moreover, BLUFADER effectively de-authenticates users up to 100% accuracy in under 3 seconds, while satisfying security, privacy, and usability requirements. Last, our continuous authentication face recognition module based on Siamese Neural Network preventively protect user, Cyber Security

Cheap commercial off-the-shelf (COTS) First-Person View (FPV) drones have become widely available for consumers in recent years. Unfortunately, they also provide low-cost attack opportunities to malicious users. Thus, effective methods to detect the presence of unknown and non-cooperating drones within a restricted area are highly demanded. Approaches based on detection of drones based on emitted video stream have been proposed, but were not yet shown to work against other similar benign traffic, such as that generated by wireless security cameras. Most importantly, these approaches were not studied in the context of detecting new unprofiled drone types. In this work, we propose a novel drone detection framework, which leverages specific patterns in video traffic transmitted by drones. The patterns consist of repetitive synchronization packets (we call pivots), which we use as features for a machine learning classifier. We show that our framework can achieve up to 99% in detection accuracy over an encrypted WiFi channel using only 170 packets originated from the drone within 820ms time period. Our framework is able to identify drone 2 transmissions even among very similar WiFi transmissions (such as video streams originated from security cameras) as well as in noisy scenarios with background traffic. Furthermore, the design of our pivot features enables the classifier to detect unprofiled drones in which the classifier has never trained on and is refined using a novel feature selection strategy that selects the features that have the discriminative power of detecting new unprofiled drones., Cyber Security

Vehicular Digital Forensics (VDF) is essential to enable liability cognizance of accidents and fight against crimes. Ensuring the authority to timely gather, analyze, and trace data promotes vehicular investigations. However, adversaries crave the identity of the data provider/user, damage the evidence, violate evidence jurisdiction, and leak evidence. Therefore, protecting privacy and evidence accountability while guaranteeing access control and traceability in VDF is no easy task. To address the above-mentioned issues, we propose Eunomia: an anonymous and secure VDF scheme based on blockchain. It preserves privacy with decentralized anonymous credentials without trusted third parties. Vehicular data and evidence are uploaded by data providers to the blockchain and stored in distributed data storage. Each investigation is modeled as a finite state machine with state transitions being executed by smart contracts. Eunomia achieves fine-grained evidence access control via ciphertext-policy attribute-based encryption and Bulletproofs. A user must hold specific attributes and a temporary-and unexpired token/warrant to retrieve data from the blockchain. Finally, a secret key is embedded into data to trace the traitor if any evidence breach happens. We use a formal analysis to demonstrate the strong privacy and security properties of Eunomia. Moreover, we build a prototype in a WiFi-based Ethereum test network to evaluate its performance., Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

In recent years, the use of Software Defined Networking (SDN) has increased due to various network management requirements. Using SDN in computer network applications has brought several benefits to users, including lower operational costs, better hardware management, flexibility, and centralized network deployment. On the other hand, the Internet of Things (IoT) is another rapidly growing technology. Distributed and dynamic infrastructures are two critical characteristics of IoT. These characteristics lead to some challenges while using SDN in IoT in terms of security and privacy. In this paper, we address security and privacy issues and solutions for SDN-based IoT systems. We analyze the techniques used for defense in previous works to achieve an acceptable level of security and privacy protection in SDN-based IoT systems. In the data plane, SDN-based IoT papers have considered hashing and encryption techniques, in the control plane, certificate authority and access control have been analyzed, and in the application plane, attack detection, and authentication have been discussed. We also provide a statistical analysis of the existing work. This analysis shows that researchers have focused on certain areas more than others in recent years. The final analysis also highlights issues that previous researchers have ignored., Cyber Security

GRB 221009A is the brightest Gamma-Ray Burst (GRB) detected in more than 50 years of study. In this paper, we present observations in the X-ray and optical domains after the GRB obtained by the GRANDMA Collaboration (which includes observations from more than 30 professional and amateur telescopes) and the Insight-HXMT Collaboration. We study the optical afterglow with empirical fitting from GRANDMA+HXMT data, augmented with data from the literature up to 60 days. We then model numerically, using a Bayesian approach, the GRANDMA and HXMT-LE afterglow observations, that we augment with Swift-XRT and additional optical/NIR observations reported in the literature. We find that the GRB afterglow, extinguished by a large dust column, is most likely behind a combination of a large Milky-Way dust column combined with moderate low-metallicity dust in the host galaxy. Using the GRANDMA+HXMT-LE+XRT dataset, we find that the simplest model, where the observed afterglow is produced by synchrotron radiation at the forward external shock during the deceleration of a top-hat relativistic jet by a uniform medium, fits the multi-wavelength observations only moderately well, with a tension between the observed temporal and spectral evolution. This tension is confirmed when using the extended dataset. We find that the consideration of a jet structure (Gaussian or power-law), the inclusion of synchrotron self-Compton emission, or the presence of an underlying supernova do not improve the predictions, showing that the modelling of GRB22109A will require going beyond the most standard GRB afterglow model. Placed in the global context of GRB optical afterglows, we find the afterglow of GRB 221009A is luminous but not extraordinarily so, highlighting that some aspects of this GRB do not deviate from the global known sample despite its extreme energetics and the peculiar afterglow evolution., Comment: Accepted to ApJL for the special issue, 37 pages, 23 pages main text, 6 tables, 13 figures

IEEE 802.1CB provides a standard for reliable packet delivery within Time-Sensitive Networking (TSN). As this standard is envisioned to be used in mission-critical networks in the near future, it has to be protected against security threats. The integrity of the network communication should be the biggest focus as guaranteed delivery is essential. However, IEEE 802.1CB does not come with security guarantees. Indeed, as we show in this paper, an attacker may be able to exploit different threat vectors to impair the correctness of communication, impacting on the safety of users. Due to TSN strict delay and reliability requirements, classical security solutions can not be easily applied without significant efforts. Therefore, researchers proposed multiple solutions to guarantee secure communication. However, the current state-of-the-art is not able to guarantee both security and timing guarantees. In this paper, we provide a detailed analysis of the security of IEEE 802.1CB exploiting the STRIDE methodology. Compared to the existing state-of-the art on the subject, we provide a deeper analysis of the possible threats and their effect. We then analyze available solutions for security in IEEE 802.1CB, and compare their performance in terms of time, reliability, and security guarantees. Based on our analysis, we show that, although there exist promising solutions trying to provide security to 802.1CB, there is still a gap to be filled both in terms of security and latency guarantees., Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

Networks of Unmanned Aerial Vehicles (UAVs) are emerging in many application domains, e.g., military surveillance. To perform collaborative tasks, the involved UAVs exchange several types of information, e.g., sensor data and commands. The major question here is how to schedule the tasks under dynamic traffic flows to provide network services. Existing solutions use the Round-Robin Strategy (RRS), where the tasks are scheduled statistically by dividing the time into fixed-length rounds. However, the RRS wastes significant network and device resources due to task scheduling in each round. This paper proposes DROVE-a novel clustering approach that allows the UAVs for dynamic task scheduling. However, determining the task scheduling is crucial, as it significantly affects several network parameters, e.g., throughput. Therefore, we devise the problem of distributed task scheduling under dynamic traffic flow scenarios to optimize the throughput. We propose a clustering task scheduling algorithm to serve dynamic traffic flows. Particularly, we integrate the dynamic traffic flows into the Lyapunov drift analysis framework, and determine the throughput optimality of our proposed scheduling algorithm. We perform extensive simulations to validate the effectiveness of DROVE. The results show that DROVE outperforms the state-of-The-Art solutions in terms of energy consumption, clustering overhead, throughput, end-To-end delay, flow success rate and packet drop rate., Cyber Security

With the rapid technological advancement in the Internet of Things (IoT) and Internet of Vehicles (IoV), we witness exponential growth of Connected and Autonomous Vehicles (CAVs). However, these integrations of IoV with other technologies make the IoV network and its interaction between different network components highly complex. Therefore, ensuring the correct functioning of the firmware and software running on these next-generation vehicles becomes an essential requirement. A feasible method to address the aforementioned security issues is Remote Attestation (RA). However, the advancement in the attackers' approaches and the increased complexity, large network size, and vehicle mobility allow the attacks to bypass these security solutions, making RA less effective. In this paper, we propose LHASIoV, an attestation and healing protocol for IoV. LHASIoV has many features such as competent-wise (treats different entities of the system differently), geographical location-aware (traces forensics of security breaches and eases healing compromised vehicles), gradual healing (via slicing the healing software) of compromised vehicles, and resistance to single-point-of-failure. We provide proof-of-concept implementation and formal operational and security analysis for LHASIoV. To show its practical feasibility and effectiveness, we provide performance analysis by implementing it on the Omnetpp simulator. The simulation results show that for an IoV system that has 100 vehicles moving with a speed range of 15-25 mph, LHASIoV needed only 5.27 seconds to complete the vehicle's attestation. For this number of vehicles and compared to the existing protocols, LHASIoV reduced the communication and storage costs on average by 54.46% and 43.92%, respectively., Green Open Access added to TU Delft Institutional Repository ‘You share, we take care!’ – Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

The anonymity and untraceability benefits of the Dark web account for the exponentially-increased potential of its popularity while creating a suitable womb for many illicit activities, to date. Hence, in collaboration with cybersecurity and law enforcement agencies, research has provided approaches for recognizing and classifying illicit activities with most exploiting textual dark web markets' content recognition; few such approaches use images that originated from dark web content. This paper investigates this alternative technique for recognizing illegal activities from images. In particular, we investigate label-agnostic learning techniques like One-Shot and Few-Shot learning featuring the use Siamese neural networks, a state-of-the-art approach in the field. Our solution manages to handle small-scale datasets with promising accuracy. In particular, Siamese neural networks reach 90.9% on 20-Shot experiments over a 10-class dataset; this leads us to conclude that such models are a promising and cheaper alternative to the definition of automated law-enforcing machinery over the dark web.

Rationale and objectives: Our multicentric study analysed clinical, radiologic and pathologic features in patients with atypical ductal hyperplasia (ADH) diagnosed with vacuum-assisted biopsy (VAB), to identify factors associated with the risk of upgrade, to develop a scoring system to support decision making. Materials and methods: Patients with ADH on VAB under stereotactic/tomosynthesis guidance (2012–2022) were eligible. Inclusion criteria were availability of surgical histopathological examination of the entire lesion or radiologic follow-up (FUP) ≥ 24 months. VAB results were compared with surgical pathological results or with imaging FUP evolution to assess upgrade. A backward stepwise linear regression was used to identify predictors of upgrade. The discriminatory power of the model was calculated through the area under the receiver operating curve (ROC–AUC); the Hosmer–Lemeshow test was used to assess model calibration. The points system was developed based on the selected risk factors, and the probability of upgrade associated with each point total was determined. Results: 112 ADH lesions were included: 91 (91/112, 81.3%) underwent surgical excision with 20 diagnosis of malignancy, while 21 (21/112, 18.7%) underwent imaging FUP with one interval change (mean FUP time 48 months). Overall upgrade rate was 18.7% (21/112). Age, menopausal status, concurrent breast cancer, BIRADS classification and number of foci of ADH were identified as risk factors for upgrade. Our model showed an AUC = 0.85 (95% CI 0.76–0.94). The points system showed that the risk of upgrade is < 2% when the total score is ≤ 1. Conclusion: Our scoring system seemed a promising easy-to-use decision support tool for management of ADH, decreasing unnecessary surgeries, reducing patients’ overtreatment and healthcare costs.

Introduction: The selection of surgery post-neoadjuvant chemotherapy (NACT) is difficult and based on surgeons’ expertise. The aim of this study was to create a post-NEoadjuvant Score System (pNESSy) to choose surgery, optimizing oncological and aesthetical outcomes. Methods: Patients (stage I–III) underwent surgery post-NACT (breast-conserving surgery (BCS), oncoplastic surgery (OPS), and conservative mastectomy (CMR) were included. Data selected were BRCA mutation, ptosis, breast volume, radiological response, MRI, and mammography pre- and post-NACT prediction of excised breast area. pNESSy was created using the association between these data and surgery. Area under the curve (AUC) was assessed. Patients were divided into groups according to correspondence (G1) or discrepancy (G2) between score and surgery; oncological and aesthetic outcomes were analyzed. Results: A total of 255 patients were included (118 BCS, 49 OPS, 88 CMR). pNESSy between 6.896–8.724 was predictive for BCS, 8.725–9.375 for OPS, and 9.376–14.245 for CMR; AUC was, respectively, 0.835, 0.766, and 0.825. G1 presented a lower incidence of involved margins (5–14.7%; p = 0.010), a better locoregional disease-free survival (98.8–88.9%; p < 0.001) and a better overall survival (96.1–86.5%; p = 0.017), and a better satisfaction with breasts (39.8–27.5%; p = 0.017) and physical wellbeing (93.5–73.6%; p = 0.001). Conclusion: A score system based on clinical and radiological features was created to select the optimal surgery post-NACT and improve oncological and aesthetic outcomes.

Background: food production represents one of the highest impacting activities on our planet, significantly contributing to climate change. Agriculture is one of the most important drivers of these changes since farming, forestry, and livestock, emit approximately one third of the global total CO2. Moreover, the modern agriculture systems mainly focus on starchy vegetables leading to energy dense and nutrient poor dietary patterns related to chronic diseases, such as NCDs. Elderly are the most vulnerable population portion that experiences even more than others the impact of unhealthy dietary patterns. Therefore, a transition to healthier and more sustainable solutions must be adopted to reach the SDGs promoted by the Agenda 2030, positively impacting the environment and human health. The role of pulses in this context is discussed. Scope and approach: authors focus on the role of Leguminosae considering their potential impact both on health in the ageing population as well as on agri-food chains sustainability. Key findings and conclusions: there is an increasing awareness on how legumes represent an important source of bioactive compounds (i.e., phenolics, saponins and peptides) with a wide range of healthy activities, all of which share antioxidant properties, essential to prevent or delay oxidative stress and disease in elderly population. With an ever-ageing population at the global level, healthy ageing is an emerging public health priority for securing citizens’ quality of life and minimizing healthcare associated costs.

In this retrospective study we share our single-center experience using a magnetic seed for the preoperative localization of non-palpable breast lesions. Patients who underwent a preoperative localization with Magseed® (Endomagnetics, Cambridge, UK) placement between 2020 and 2022 were enrolled. Indications to Magseed placement have been established during multidisciplinary meetings prior to surgery and all patients underwent breast-conserving surgery (BCS). 45 patients were included. Magnetic seeds have been introduced under ultrasound guidance in 40 patients (88.9%) and under stereotactic guidance in 5 patients (11.1%). We registered a highly successful placement rate (97.8%), with only one case of migration (2.2%). After BCS, all the magnetic seeds were recovered (100% retrieval rate). The re-excision rate for positive margins was 0%. Our experience, with a highly successful placement and retrieval rate and a re-excision rate equal to 0%, is consistent with the encouraging literature published on Magseed so far, suggesting this technique to be extremely effective. Moreover, our single case of seed migration supports the existing data stating that Magseed migration is rare. In conclusion, despite acknowledging Magseed limitations, we highly value the advantages linked to this technique, and we, therefore, uphold its use.

User authentication remains a challenging issue, despite the existence of a large number of proposed solutions, such as traditional text-based, graphical-based, biometrics-based, Web-based, and hardware-based schemes. For example, some of these schemes are not suitable for deployment in an Internet of Things (IoT) setting, partly due to the hardware and/or software constraints of IoT devices. The increasing popularity and pervasiveness of IoT equipment in a broad range of settings reinforces the importance of ensuring the security and privacy of IoT devices. Therefore, in this article, we conduct a comprehensive literature review and an empirical study to gain an in-depth understanding of the different authentication schemes as well as their vulnerabilities and deficits against various types of cyberattacks when applied in IoT-based systems. Based on the identified limitations, we recommend several mitigation strategies and discuss the practical implications of our findings., Green Open Access added to TU Delft Institutional Repository ‘You share, we take care!’ – Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

Due to its critical role in cybersecurity, digital forensics has received significant attention from researchers and practitioners alike. The ever increasing sophistication of modern cyberattacks is directly related to the complexity of evidence acquisition, which often requires the use of several technologies. To date, researchers have presented many surveys and reviews on the field. However, such articles focused on the advances of each particular domain of digital forensics individually. Therefore, while each of these surveys facilitates researchers and practitioners to keep up with the latest advances in a particular domain of digital forensics, the global perspective is missing. Aiming to fill this gap, we performed a qualitative review of all the relevant reviews in the field of digital forensics, determined the main topics on digital forensics topics and identified their main challenges. Despite the diversity of topics and methods, there are several common problems that are faced by almost all of them, with most of them residing in evidence acquisition and pre-processing due to counter analysis methods and difficulties of collecting data from devices, the cloud etc. Beyond pure technical issues, our study highlights procedural issues in terms of readiness, reporting and presentation, as well as ethics, highlighting the European perspective which is traditionally stricter in terms of privacy. Our extensive analysis paves the way for closer collaboration among researcher and practitioners among different topics of digital forensics., Cyber Security

This work explores backdoor attacks for automatic speech recognition systems where we inject inaudible triggers. By doing so, we make the backdoor attack challenging to detect for legitimate users and, consequently, potentially more dangerous. We conduct experiments on two versions of a speech dataset and three neural networks and explore the performance of our attack concerning the duration, position, and type of the trigger. Our results indicate that less than 1% of poisoned data is sufficient to deploy a backdoor attack and reach a 100% attack success rate. We observed that short, non-continuous triggers result in highly successful attacks. Still, since our trigger is inaudible, it can be as long as possible without raising any suspicions making the attack more effective. Finally, we conduct our attack on actual hardware and saw that an adversary could manipulate inference in an Android application by playing the inaudible trigger over the air., Cyber Security

The 6TiSCH standard provides minimum latency and reliability in mission-critical IoT applications. To optimize resource allocation during 6TiSCH network formation, IETF released the 6TiSCH minimal configuration (6TiSCH-MC) standard. 6TiSCH-MC considered IETF's IPv6 Routing Protocol for Low power and Lossy network (RPL) as a routing protocol for both upward and downward routing. In RPL, new joining nodes or joined nodes transmit DODAG Information Solicitation (DIS) requests to get routing information from the network. However, we observe that malicious node(s) can severely affect 6TiSCH networks by sending multiple DIS requests. In this letter, we show and experimentally evaluate on real devices the impact of the DIS attack during 6TiSCH networks formation. We show that the attacker does not need expensive resources or access to the network's sensitive information to execute the DIS attack. Our testbed experiments show that the DIS attack significantly degrades the nodes' joining time and energy consumption, increasing them by 34% and 16%, respectively, compared to normal functioning during 6TiSCH network formation., Green Open Access added to TU Delft Institutional Repository ‘You share, we take care!’ – Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

WiseML '22, Contains fulltext : 288621.pdf (Publisher’s version ) (Open Access)

AISec '22, Item does not contain fulltext

AICAS 2022, Contains fulltext : 288623.pdf (Publisher’s version ) (Closed access)

WiseML '22, Contains fulltext : 288621.pdf (Publisher’s version ) (Open Access)

AISec '22, Contains fulltext : 288630.pdf (Publisher’s version ) (Closed access)

AICAS 2022, Contains fulltext : 288623.pdf (Publisher’s version ) (Closed access)

Traffic monitoring services collect traffic reports and respond to users' traffic queries. However, the reports and queries may reveal the user's identity and location. Although different anonymization techniques have been applied to protect user privacy, a new security threat arises, namely, n-by-1 jamming attack, in which an anonymous contributing driver impersonates n drivers and uploads n normal reports by using n reporting devices. Such an attack will mislead the traffic monitoring service provider and further degrade the service quality. Existing traffic monitoring services do not support customized queries, and private information retrieval techniques cannot be applied directly in traffic monitoring. We formally define the new attack and propose a traffic monitoring scheme TraJ to defend the attack and achieve user-defined location privacy. Specifically, we bridge anonymous contributing drivers without disclosing their speed set by using private set intersection. Each RSU collects time traffic reports and structures a weighted proximity graph to filter out malicious colluding drivers. We design a user-defined privacy-preserving query method by encoding complex road network. We leverage the uploading phase from private aggregation to collect traffic conditions and allow requesting drivers to dynamically and privately query traffic conditions. We provide a formal analysis of TraJ to prove its privacy and security properties. We also construct a prototype based on a real-world dataset and Android smartphones to demonstrate its feasibility and efficiency. A formal analysis demonstrates the privacy and security properties. Extensive experiments illustrate the performance and defense efficacy., Green Open Access added to TU Delft Institutional Repository ‘You share, we take care!’ – Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

Ride-Hailing Service (RHS) has drawn plenty of attention as it provides transportation convenience for riders and financial incentives for drivers. Despite these benefits, riders risk the exposure of sensitive location data during ride requesting to an untrusted Ride-Hailing Service Provider (RHSP). Our motivation arises from repetitive matching, i.e., the same driver is repetitively assigned to the same rider. Meanwhile, we introduce a driver exclusion function to protect riders' location privacy. Existing work on privacy-preserving RHS overlooks this function. While Secure k Nearest Neighbor (SkNN) facilitates efficient matching, the state-of-the-art neglects a collusion attack. To solve this problem, we formally define repetitive matching and strong location privacy, and propose Mnemosyne: privacy-preserving ride matching with collusion-resistant driver exclusion. We extend the simple integration of equality checking and item exclusion to a dynamic integration. We concatenate each prefix of an acceptable identity range to each location code when generating a ride request, i.e., secure mix index. We process each prefix of the driver identity to generate a ride response, i.e., a mix token. We build an indistinguishable Bloom-filter as an index to query the token. When matching riders with drivers, the colluding parties cannot distinguish identity prefixes from location codes. We build a prototype of Mnemosyne based on servers, smartphones, and a real-world dataset. Experimental results demonstrate that Mnemosyne outperforms existing work regarding strong location privacy and computational costs., Green Open Access added to TU Delft Institutional Repository ‘You share, we take care!’ – Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

Nowadays, online services, like e-commerce or streaming services, provide a personalized user experience through recommender systems. Recommender systems are built upon a vast amount of data about users/items acquired by the services. Such knowledge represents an invaluable resource. However, commonly, part of this knowledge is public and can be easily accessed via the Internet. Unfortunately, that same knowledge can be leveraged by competitors or malicious users. The literature offers a large number of works concerning attacks on recommender systems, but most of them assume that the attacker can easily access the full rating matrix. In practice, this is never the case. The only way to access the rating matrix is by gathering the ratings (e.g., reviews) by crawling the service's website. Crawling a website has a cost in terms of time and resources. What is more, the targeted website can employ defensive measures to detect automatic scraping. In this paper, we assess the impact of a series of attacks on recommender systems. Our analysis aims to set up the most realistic scenarios considering both the possibilities and the potential attacker's limitations. In particular, we assess the impact of different crawling approaches when attacking a recommendation service. From the collected information, we mount various profile injection attacks. We measure the value of the collected knowledge through the identification of the most similar user/item. Our empirical results show that while crawling can indeed bring knowledge to the attacker (up to 65% of neighborhood reconstruction on a mid-size dataset and up to 90% on a small-size dataset), this will not be enough to mount a successful shilling attack in practice., Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

Shortest distance queries over large-scale graphs bring great benefits to various applications, i.e., save planning time and travelling expenses. To protect the sensitive nodes and edges in the graph, a user outsources an encrypted graph to an untrusted server without losing the query ability. However, no prior work has considered the user requirement of the shortest path with k unsorted nodes. In particular, we are concerned with how to securely find the shortest path by passing k nodes that do not have a fixed traverse order. To solve the problems, we propose Gespun (stands for Graph encryption for shortest path queries with k unordered nodes). It includes an oracle encryption scheme that is provably secure against the semi-honest server. Specifically, we compute the shortest paths and distances for all nodes locally to obtain path-distance oracles. We transform the shortest paths to a sequence of secure codes by using a pseudo-random permutation to protect the structure privacy. We encrypt the shortest distance by using additively homomorphic encryption. Second, we pack the oracles in link-list nodes and store them in an array-based dictionary after another permutation. Next, we construct a search graph to compute the shortest path while guaranteeing that the path passes the required k nodes. We formally prove that Gespun is adaptively semantically-secure in the random oracle. We implement a prototype of Gespun and evaluate its performance. Experiments results demonstrate that Gespun is efficient, e.g., a query over 6301 nodes, 20777 edges, and 5 unsorted nodes only needs 483 ms to get queried results. We believe that our research problem span new research that soon promotes a new line of graph encryption schemes., Green Open Access added to TU Delft Institutional Repository ‘You share, we take care!’ – Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

Enhancing Network Intrusion Detection Systems (NIDS) with supervised Machine Learning (ML) is tough. ML-NIDS must be trained and evaluated, operations requiring data where benign and malicious samples are clearly labeled. Such labels demand costly expert knowledge, resulting in a lack of real deployments, as well as on papers always relying on the same outdated data. The situation improved recently, as some efforts disclosed their labeled datasets. However, most past works used such datasets just as a 'yet another' testbed, overlooking the added potential provided by such availability. In contrast, we promote using such existing labeled data to cross-evaluate ML-NIDS. Such approach received only limited attention and, due to its complexity, requires a dedicated treatment. We hence propose the first cross-evaluation model. Our model highlights the broader range of realistic use-cases that can be assessed via cross-evaluations, allowing the discovery of still unknown qualities of state-of-the-art ML-NIDS. For instance, their detection surface can be extended - at no additional labeling cost. However, conducting such cross-evaluations is challenging. Hence, we propose the first framework, XeNIDS, for reliable cross-evaluations based on Network Flows. By using XeNIDS on six well-known datasets, we demonstrate the concealed potential, but also the risks, of cross-evaluations of ML-NIDS., Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security