Search

In this paper, we address the challenges of detecting instances from emerging classes over a non-stationary data stream during classification. In particular, instances from an entirely unknown class may appear in a data stream over time. Existing classification techniques utilize unsupervised clustering to identify the emergence of such data instances. Unfortunately, they make strong assumptions which are typically invalid in practice; (i) Most instances associated with a class are closer to each other in feature space than instances associated with different classes, (ii) Covariates of data are normalized through an oracle to overcome the effect of a few data instances having large feature values, and (iii) Labels of instances from emerging classes are readily available soon after detection. To address the challenges that occur in practice when the above assumptions are weak, we propose a practical semi-supervised emerging class detection framework. Particularly, we aim to identify similar data instances within local regions in feature space by incorporating a mutual graph clustering mechanism. Our empirical evaluation of this framework on real-world datasets demonstrates its superiority of classification performance compared to existing methods while using significantly fewer labeled instances.

Network traffic analysis has been increasingly used in various applications to either protect or threaten people, information, and systems. Website fingerprinting is a passive traffic analysis attack which threatens web navigation privacy. It is a set of techniques used to discover patterns from a sequence of network packets generated while a user accesses different websites. Internet users (such as online activists or journalists) may wish to hide their identity and online activity to protect their privacy. Typically, an anonymity network is utilized for this purpose. These anonymity networks such as Tor (The Onion Router) provide layers of data encryption which poses a challenge to the traffic analysis techniques. Although various defenses have been proposed to counteract this passive attack, they have been penetrated by new attacks that proved the ineffectiveness and/or impracticality of such defenses. In this work, we introduce a novel defense algorithm to counteract the website fingerprinting attacks. The proposed defense obfuscates original website traffic patterns through the use of double sampling and mathematical optimization techniques to deform packet sequences and destroy traffic flow dependency characteristics used by attackers to identify websites. We evaluate our defense against state-of-the-art studies and show its effectiveness with minimal overhead and zero-delay transmission to the real traffic.

In recent years, as online social networks continue to grow in size, estimating node features, such as sociodemographics, preferences and health status, in a scalable and reliable way has become a primary research direction in social network mining. Although many techniques have been developed for estimating various node features, quantifying uncertainty in such estimations has received little attention. Furthermore, most existing methods study networks parametrically, which limits insights about necessary quantity of queried data, reliable feature estimation, and estimator uncertainty. Uncertainty quantification is critical for answering key questions, such as, given a limited availability of social network data, how much data should be queried from the network?, and which node features can be learned reliably? More importantly, how can we evaluate uncertainty of our estimators? Uncertainty quantification is not equivalent to network sampling but constitutes a key complementary concept to sampling and the associated reliability analysis. To our knowledge, this paper is the first work that sheds light on uncertainty quantification and uncertainty propagation in social network feature mining. We propose a novel non-parametric bootstrap method for uncertainty analysis of node features in social network mining, derive its asymptotic properties, and demonstrate its effectiveness with extensive experiments. Furthermore, we develop a new metric based on dispersion of estimations, enabling analysts to assess how much more information is needed for increasing prediction reliability based on the estimated uncertainty. We demonstrate the effectiveness of our new uncertainty quantification methodology with extensive experiments on real life social networks, and a case study of mental health on Twitter.

Today, the Internet of Things (IoT) is increasingly flourishing with establishing ubiquitous connections between smart devices and objects, and by 2020, there will be a total of 30 billion connected things reported by IDC. The unprecedented data explosion provides immense opportunities for valuable information mining. At the same time, it also floods the infrastructure with tremendous values it necessarily handles and proposes high challenges to traditional data storing or processing techniques. On the other hand, artificial intelligence (AI) has become a key component for many applications that profoundly change our lives. Machine learning, especially deep learning (DL) technologies, vastly improves traditional computer science and networking technologies. The convergence of AI and IoT enables data to be quickly explored and turned into significant decisions. For companies and enterprises, AI enhances the speed and accuracy of data processing for instant market strategies.

Autonomous Vehicles (AVs), also known as self-driving cars, are becoming more prevalent in our daily lives. AVs rely on sensor information to evaluate their environment and make crucial decisions in real-time, however, new attacks can create false sensor and actuation commands. As technological advancements expand the usage of AVs to perform more complex tasks, it is imperative to secure the integrity of these devices against malicious external tampering. In this paper, we propose a security framework we call Shared Reality, which consists of verifying that sensors perceive the same physical reality. We implement our design on a custom hardware platform that uses the popular Robot Operating System (ROS) software. Our experiments show that AVs utilizing our proposed security framework ensure security with low overhead while performing several autonomous tasks.

Time series forecasting with additional spatial information has attracted a tremendous amount of attention in recent research, due to its importance in various real-world applications on social studies, such as conflict prediction and pandemic forecasting. Conventional machine learning methods either consider temporal dependencies only, or treat spatial and temporal relations as two separate autoregressive models, namely, space-time autoregressive models. Such methods suffer when it comes to long-term forecasting or predictions for large-scale areas, due to the high nonlinearity and complexity of spatio-temporal data. In this paper, we propose to address these challenges using spatio-temporal graph neural networks. Empirical results on Violence Early Warning System (ViEWS) dataset and U.S. Covid-19 dataset indicate that our method significantly improved performance over the baseline approaches.

In contrast to offline working fashions, two research paradigms are devised for online learning: (1) Online Meta Learning (OML) learns good priors over model parameters (or learning to learn) in a sequential setting where tasks are revealed one after another. Although it provides a sub-linear regret bound, such techniques completely ignore the importance of learning with fairness which is a significant hallmark of human intelligence. (2) Online Fairness-Aware Learning. This setting captures many classification problems for which fairness is a concern. But it aims to attain zero-shot generalization without any task-specific adaptation. This therefore limits the capability of a model to adapt onto newly arrived data. To overcome such issues and bridge the gap, in this paper for the first time we proposed a novel online meta-learning algorithm, namely FFML, which is under the setting of unfairness prevention. The key part of FFML is to learn good priors of an online fair classification model's primal and dual parameters that are associated with the model's accuracy and fairness, respectively. The problem is formulated in the form of a bi-level convex-concave optimization. Theoretic analysis provides sub-linear upper bounds for loss regret and for violation of cumulative fairness constraints. Our experiments demonstrate the versatility of FFML by applying it to classification on three real-world datasets and show substantial improvements over the best prior work on the tradeoff between fairness and classification accuracy, KDD '21: Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining

A social media user's geographical location is vital to many applications like local search and event detection. The scarcity of publicly available location information motivates researchers to predict user geolocation based on information such as tweet text and social interaction data. In this paper, we investigate and improve on the task of predicting a Twitter user's city-level location based on the content of the user's historical tweets. In order to train a reliable location classifier, previous studies on this topic have typically assumed that there are sufficient amount of users living in each cities. However, they simply ignore the fact that different demographic groups may participate in social media platforms, which results in a highly imbalanced data distribution. Being aware of this population imbalance issue, we propose an episodic learning based framework to extract a single representative for each class (location), so that classifiers can later be trained on a balanced class distribution. To examine the effectiveness of our method, we design experiments which involve two kinds of baselines, the state-of-the-art geolocation detection methods and the well-known approaches handling imbalanced data in classification. The results of experiments on the data collected from Twitter demonstrated the superiority of our method when compared with baselines.

Deep neural networks (DNNs) are vulnerable to adversarial attacks. Existing adversarial defense approaches mostly use a large number of labels during the training step to improve the model's robustness. However, the labeling typically requires a lot of resources and is time-consuming, especially when the annotation is hard to generate (e.g., an emergency scene in autopilot). In this paper, we propose an instance-level unsupervised perturbation to replace the supervised class-level adversarial sample in the robust training. The unsupervised perturbation is generated on various transformed views of single input, which aims to make the model confuse the instance-level discrimination of this specific input. We further introduce the contrastive learning based adversarial learning(UPAT), which maximizes the agreement between the transformed instance with its corresponding unsupervised perturbed output, and encourages the model to suppress the vulnerability in the embedding space. We conduct comprehensive experiments on three image benchmarks, and the quantitative results demonstrate that our defense approach consistently outperforms prior state-of-the-art techniques, by improving the defense ability efficiently on various white-box attacks.

Good quality similarity metrics can significantly facilitate the performance of many large-scale, real-world applications. Existing studies have proposed various solutions to learn a Mahalanobis or bilinear metric in an online fashion by either restricting distances between similar (dissimilar) pairs to be smaller (larger) than a given lower (upper) bound or requiring similar instances to be separated from dissimilar instances with a given margin. However, these linear metrics learned by leveraging fixed bounds or margins may not perform well in real-world applications, especially when data distributions are complex. We aim to address the open challenge of "Online Adaptive Metric Learning" (OAML) for learning adaptive metric functions on the fly. Unlike traditional online metric learning methods, OAML is significantly more challenging since the learned metric could be non-linear and the model has to be self-adaptive as more instances are observed. In this paper, we present a new online metric learning framework that attempts to tackle the challenge by learning an ANN-based metric with adaptive model complexity from a stream of constraints. In particular, we propose a novel Adaptive-Bound Triplet Loss (ABTL) to effectively utilize the input constraints and present a novel Adaptive Hedge Update (AHU) method for online updating the model parameters. We empirically validate the effectiveness and efficacy of our framework on various applications such as real-world image classification, facial verification, and image retrieval., Comment: Accepted by WWW 2019 (Long Paper, Oral)

Social media systems have been the vehicle for spreading false rumors that could be damaging to the individuals and cause great harm. In addition, the social media systems as well as the analysis techniques could be compromised due to cyber-attacks and as a result the information posted could be compromised. Another type of network that AI and Cyber Security are being applied is the Internet of Transportation. With the advent of the web, it is now possible to collect, store, manage, and analyze vast amounts of sensor data emanating from numerous devices and sensors including from various transportation systems. Such systems collectively are known as the Internet of Transportation Systems. However, security and privacy for the Internet of Transportation and the infrastructures that support it is a challenge. Due to the large volumes of heterogeneous data being collected from numerous devices, the traditional cyber security techniques such as encryption are not efficient to secure the Internet of Transportation. Some Physics-based solutions being developed are showing promise. This keynote presentation will be divided into two parts. The first part explores the use of the applications of artificial intelligence (AI) techniques for social media as well as examines how social media systems could be protected from cyber-attacks. In addition, the privacy violations that could occur are also addressed. The presentation will also explore some of the emerging challenges we are faced with due to the fake news being posted and the novel cyber-attacks on social media systems. The second part of the presentation examines the developments on securing the Internet of Transportation and its supporting infrastructures as well as the privacy implications. Finally, it describes ways in which AI and Security could be incorporated into the Internet of Transportation and Infrastructures.

The world has seen pandemics, terrorism, hurricanes and other natural and man-made disasters. Each time such an event occurs we discuss technologies that can solve the problem and their impact on our privacy and civil liberties. Such discussions occurred after the 9/11 terrorist attacks and is happening now during the COVID-19 pandemic, the worst human crisis we have faced in a century. This paper discusses the applications of data science to detect and possibly prevent such pandemics and its impact on our privacy and civil liberties.

The collection, storage, manipulation, analysis, and retention of massive amounts of data have resulted in new technologies including big data analytics and data science. It is now possible to analyse massive amounts of data and extract useful nuggets. However, the collection and manipulation of this data has also resulted in serious security and privacy considerations. Various regulations are being proposed to handle big data so that the privacy of the individuals is not violated. Furthermore, the massive amounts of data being stored may also be vulnerable to cyber attacks. Big Data, Data Science and Security are being integrated to solve many of the security and privacy challenges. For example, machine learning techniques are being applied to solve security problems such as malware analysis and insider threat detection. However, there is also a major concern that the machine learning techniques themselves could be attacked. Therefore, the machine learning techniques are being adapted to handle adversarial attacks. This area is known as adversarial machine learning. In addition, privacy of the individuals is also being violated through these machine learning techniques as it is now possible to gather and analyse vast amounts of data and therefore privacy enhanced data science techniques are being developed. With the advent of the web, computing systems are now being used in every aspect of our lives from mobile phones to autonomous vehicles. It is now possible to collect, store, manage, and analyse vast amounts of sensor data emanating from numerous devices and sensors including from various transportation systems. Such systems collectively are known as the Internet of Transportation, which is essentially the Internet of Things for Transportation, where multiple autonomous transportation systems are connected through the web and coordinate their activities. However, security and privacy for the Internet of Transportation and the infrastructures that support it is a challenge. Due to the large volumes of heterogenous data being collected from numerous devices, the traditional cyber security techniques such as encryption are not efficient to secure the Internet of Transportation. Some Physics-based solutions being developed are showing promise. More recently, the developments in Data Science are also being examined for securing the Internet of Transportation and its supporting infrastructures. To assess the developments on the integration of Big Data, Data Science and Security over the past decade and apply them to the Internet of Transportation, the presentation will focus on three aspects. First it will examine the developments on applying Data Science techniques for detecting cyber security problems such as insider threat detection as well as the advances in adversarial machine learning. Some developments on privacy aware and policy-based data management frameworks will also be discussed. Second it will discuss the developments on securing the Internet of Transportation and its supporting infrastructures and examine the privacy implications. Finally, it will describe ways in which Big Data, Data Science and Security could be incorporated into the Internet of Transportation and Infrastructures.

Corporate governance has received a lot of prominence since the accounting scandals of the early 2000s. Corporate governance not only includes maintaining correct financial records, but also the information technology aspects of the corporation. These include cyber security governance, artificial intelligence governance and cloud governance. Most corporations are migrating their data, software and processes to the cloud and therefore it is critical that the cloud be governed by appropriate policies and procedures. We also need cloud governance frameworks. The roles and responsibilities of the people involved have to be clearly identified. In this paper we discuss some of the essential points of cloud governance.

Blockchain technologies have been very effective in processing distributed transactions securely. They have many applications including in handling bitcoin cryptocurrencies and smart contracts. More recently the use of blockchain has been explored for data science applications. This paper examines blockchain technologies and discusses their applications in data science and cyber security.

Mobile devices are a rich source of sensitive location data. In this paper, we propose a method for harnessing this data to provide better location predictions without sacrificing the privacy of the users generating this data. To this end, we propose utilizing Federated Learning to train locally on a user's mobile device, while simultaneously identifying and combatting the possibility of bad actors or adversaries that may deliberately report problematic data to hurt the training process. Furthermore, we propose using a blockchain instead of a centralized server for the training process, to ensure that the process is secure.

With the rapid development of cloud technology and the huge amount of big data generation, outsourcing data storage to a cloud service provider is an efficient solution. The challenges on the trustworthiness of cloud providers are urgent to be solved due to many security and privacy violation incidents in recent years. Some enhanced data protection methods such as All-Or-Nothing Transformation (AONT) are proposed to provide additional protection on data security. However, the key management and access revocation operations will become a difficult task and the key manager will be vulnerable. In this paper, we propose to use the scalable consortium blockchain system to solve the key management for the AON-based data protection and outsourcing in the multi-clouds scenario. We propose a model that can provide secure data sharing through untrusted clouds with the key management provided by the consortium blockchain system as a service. We also provide practical case studies for using the novel AON data approaches to protect data security and tamper-proofing on key management.

Corporate governance and the roles and responsibilities of the corporate officers and the board of directors have received an increasing interest since the Enron scandal of the early 2000s. This scandal resulted in enacting policies, laws and regulations such as the Sarbanes-Oxley and others. More recently, with almost every corporation focusing on the applications of Artificial Intelligence (AI) and Data Science (DS) for their businesses in numerous industries including finance and banking, healthcare and medicine, manufacturing and retail and defense and intelligence, it is critical that these corporations take a serious look at the roles and responsibilities of the corporate officers and the board with respect to the governance of the AI and DS operations. This paper discusses the issues and challenges for AI and DS governance with an emphasis on the potential roles and responsibilities of the corporate officers and the board of directors.

The collection, storage, access, manipulation, and mining of massive amounts of data have resulted in the design and development of Big Data Management and Analytics (BDMA) Technologies over the past decade. Subsequently the HACE theorem has emerged as a way to characterize big data. As stated in [1], “big data starts with large volume, heterogeneous, autonomous sources with distributed decentralized control, and seeks to explore complex and evolving relationships among data.” Over the years, the HACE theorem has become fundamental to big data characterization as the Newton’s Laws are to Physics. Associated with the HACE theorem is the Big Data Processing Framework consisting of three tiers focusing on data access, data sharing and data mining/analytics. The big data processing framework dealing with heterogeneous, autonomous, complex and evolving data has resulted in Big Knowledge that deals with “fragmented knowledge from heterogeneous, autonomous information sources for complex and evolving relationships, in addition to domain expertise [2].”

The Internet of Things (IoT) has major implications in the transportation industry. Autonomous Vehicles (AVs) aim at improving day-to-day activities such as delivering packages, improving traffic, and the transportations of goods. AVs are not limited to ground vehicles but also include aerial and sea vehicles with a wide range of applications. The IoT systems consisting of a collection of AVs have come to be known as the Internet of Transportation systems. While such IoT systems manage large quantities of sensor data, much of the data is also sent to a cloud for offline analysis. While there is great potential in AVs and the improvements it can make to the transportation industry, security and privacy concerns pose new challenges that need to be addressed as we move forward. In addition, Artificial Intelligence techniques are also becoming crucial for such IoT systems to be able to intelligently manage the AVs. This paper discusses AI and security for cloud-based Internet of Transportation Systems.

The HACE Theorem has emerged as a way to characterize big data. Over the years it has become fundamental to big data characterization as the Newton’s Laws are to Physics. Associated with the HACE theorem is the Big Data Processing Framework for storing, managing, analyzing and sharing massive amounts of heterogenous, autonomous and distributed data with complex and evolving relationships. This paper examines the security and privacy aspects for the HACE theorem. It argues that what is needed is a Policy-Aware Big Data Processing Framework for the collection, storage, management, mining, and sharing of the massive amounts of data. It also examines knowledge graphs to represent the big data and determines ways to reason about the graphs and yet maintain security and privacy.

Social media systems such as Facebook and Twitter are playing a major role in society connecting over a billion people worldwide and enabling them to communicate and share information with each other as well as within a group of individuals. These social media systems can vastly help humanity such as spread information about infectious diseases and discuss solutions to problems faced by humanity including preventing child trafficking and violence against women. However, social media systems can also do harm, such as shared false information, more popularly known as fake news, as well as violating the privacy of individuals. With the proliferation of Artificial Intelligence (AI) systems together with powerful machine learning techniques as well as the cyber-attacks on information systems are changing the way the social media systems are being used by humans. This paper discusses the role of both AI and Cyber Security for social media systems including the benefits of AI as well as protecting social media systems.

Artificial Intelligence (AI) is affecting every aspect of our lives from healthcare to finance to driving to managing the home. Sophisticated machine learning techniques with a focus on deep learning are being applied successfully to detect cancer, to make the best choices for investments, to determine the most suitable routes for driving as well as to efficiently manage the electricity in our homes. We expect AI to have even more influence as advances are made with technology as well as in learning, planning, reasoning and explainable systems. While these advances will greatly advance humanity, organizations such as the United Nations have embarked on initiatives such as "AI for Good" and we can expect to see more emphasis on applying AI for the good of humanity especially in developing countries. However, the question that needs to be answered is Can AI be for Good when when the AI techniques can be attacked and the AI techniques themselves can cause privacy violations? This position paper will provide an overview of this topic with protecting children and children's rights as an example.

We present Admin-CBAC, an administrative model for Category- Based Access Control (CBAC). Since most of the access control models in use nowadays are instances of CBAC, in particular the popular RBAC and ABAC models, from Admin-CBAC we derive administrative models for RBAC and ABAC too. We define Admin- CBAC using Barker's metamodel, and use its axiomatic semantics to derive properties of administrative policies. Using an abstract operational semantics for administrative actions, we show how properties (such as safety, liveness and effectiveness of policies) and constraints (such as separation of duties) can be checked, and discuss the impact of policy changes. Although the most interesting properties of policies are generally undecidable in dynamic access control models, we identify particular cases where reachability based properties are decidable and can be checked using our operational semantics, generalising previous results for RBAC and ABACalpha.

As one of the most significant issues in the financial industry, customers’ privacy information protection has been considered a challenging research over years. The constant emergence of the novel technologies often leads to dynamic threats from both internal and external service providers. We consider the implementations of mobile cloud-based financial services an important approach of service provisions, which also causes risks to privacy protections due to the data sharing with the unknown third parties. The data generated by mobility are usually associated with mobile users’ personal privacy information. This paper addresses this issue and proposes an approach proactively protect financial customers’ privacy information using Attributed-Based Access Control (ABAC) as well as data self-deterministic scheme. The proposed approach is called Proactive Dynamic Secure Data Scheme (P2DS), which aims to guarantee the unanticipated parties cannot reach the privacy data. There are two main algorithms supporting the proposed scheme, which are Attribute-based Semantic Access Control (A-SAC) Algorithm and Proactive Determinative Access (PDA) Algorithm . The main contributions of this paper have three aspects. First, we propose a semantic approach for constraining data accesses. Second, we propose a user-centric approach that proactively prevents users’ data from unexpected operations on the cloud side. Finally, the proposed scheme has a higher-level secure sustainability since it can deal with dynamic threats, including the emerging and future hazards. We have examined that our proposed scheme had a quality performance matching our expected goal.

The four articles in this special section focus on digital trust management in cyberspace. The aim of this special issue is to present some of the most recent advances in trust management for different application domains as well as to discuss new issues and directions for future research and development work. The focus is also on the rise of new technologies, such as Blockchain, which has the potential for being a key pillar to trust management in decentralized settings, by replacing trust in institutions or end users to trust in technology.

Public resources and services (e.g., datasets, training platforms, pre-trained models) have been widely adopted to ease the development of Deep Learning-based applications. However, if the third-party providers are untrusted, they can inject poisoned samples into the datasets or embed backdoors in those models. Such an integrity breach can cause severe consequences, especially in safety- and security-critical applications. Various backdoor attack techniques have been proposed for higher effectiveness and stealthiness. Unfortunately, existing defense solutions are not practical to thwart those attacks in a comprehensive way. In this paper, we investigate the effectiveness of data augmentation techniques in mitigating backdoor attacks and enhancing DL models' robustness. An evaluation framework is introduced to achieve this goal. Specifically, we consider a unified defense solution, which (1) adopts a data augmentation policy to fine-tune the infected model and eliminate the effects of the embedded backdoor; (2) uses another augmentation policy to preprocess input samples and invalidate the triggers during inference. We propose a systematic approach to discover the optimal policies for defending against different backdoor attacks by comprehensively evaluating 71 state-of-the-art data augmentation functions. Extensive experiments show that our identified policy can effectively mitigate eight different kinds of backdoor attacks and outperform five existing defense methods. We envision this framework can be a good benchmark tool to advance future DNN backdoor studies.

Political news reports are populated all over the world in various languages. It has a great value to automatically detect the geolocation from these reports for a better understanding of the associated events. Although various open-source and commercial tools exist to identify geolocation, they fail to identify at a granular level such as locality or city and they do not support most languages. Most of the techniques view the problem in terms of Named Entity Recognition (NER) and identify geolocation information at the country level for a given text. In this paper, we consider English, Spanish and Arabic news articles from different publishers. We define primary focus location as the actual location where the event occurred amongst other focus locations mentioned in the report. Our aim is to extract the primary focus location regardless of the language from articles belonging to different news agencies. We propose a mechanism to identify potential sentences containing focus locations using NER. After that, we perform sentence embedding over words from different languages and then employ a supervised classification mechanism to predict the primary focus location. We also perform bias correction over the training data using a suitable adaptation mechanism to reduce the sampling bias in training data. Our method trains a classifier using bias-corrected training data from news articles published by an agency in one language, while testing the model on news articles published by another agency in a different language. Our empirical results when compared to baseline approaches show superior performance on real-world English, Spanish and Arabic news articles.

Among the many challenges in computer network trace data collection is the automation, or mimicking, of human users in situations where humans-in-the-loop are either impracticable or not possible. While client-side human behavior has been automated in various static settings, autonomous clients which dynamically change their behavior as the environment changes may result in a more accurate representation of human behavior in captured network trace data, and thus may be better suited for problems in which humans-in-the-loop are important. In this work, we set out to create dynamic autonomous client-side behavioral models, which we call agents, that can interact with the network environment in much the same way that humans do, and are scalable in shared-resource environments, such as emulated computer networks. We show through multiple experiments and a web crawling case study on an emulated network that our agents can mimic interactive human behavior, and do so at scale.

We propose a cloud-IoT architecture, called Data Bank, aiming at protecting users' sensitive data by allowing them to control which kind of data is transmitted by their devices and providing supportive tools for agreement visualisation and privacy-utility trade-off. The architecture consists of several layers, from IoT objects in the lower layer to web and mobile applications in the top layer, with regulated communication mechanisms to transfer data from the lower level to data processing services in the top level. We illustrate our proposal with an example in a smart vehicle environment.

Since fall 2012, several National Centers of Academic Excellence in Cyber Defense Research have fielded a collaborative course—the Information Security Research and Education (INSuRE) program—to engage students in applied cybersecurity research. Recent experiences with INSuRE are discussed, including an overview of the project-based research course, student projects, and outcomes and lessons learned.

The Attribute-Based Access Control (ABAC) model is one of the most powerful access control models in use. It subsumes popular models, such as the Role-Based Access Control (RBAC) model, and can also enforce dynamic policies where authorisations depend on values of user, resource or environment attributes. However, in its general form, ABAC does not lend itself well to some operations, such as review queries, and ABAC policies are in general more difficult to specify and analyse than simpler RBAC policies. In this paper we propose a formal specification of ABAC in the category-based metamodel of access control, which adds structure to ABAC policies, making them easier to design and understand. We provide an axiomatic and an operational semantics for ABAC policies, and show how to use them to analyse policies and evaluate review queries.

Although there has been a plethora of work in generating deceptive applications, generating deceptive data that can easily fool attackers received very little attention. In this book chapter, we discuss our secure deceptive data generation framework that makes it hard for an attacker to distinguish between the real versus deceptive data. Especially, we discuss how to generate such deceptive data using deep learning and differential privacy techniques. In addition, we discuss our formal evaluation framework.

Smart industrial control systems (e.g., smart grid, oil and gas systems, transportation systems) are connected to the internet, and have the capability to collect and transmit data; as such, they are part of the IoT. The data collected can be used to improve services; however, there are serious privacy risks. This concern is usually addressed by means of privacy policies, but it is often difficult to understand the scope and consequences of such policies. Better tools to visualise and analyse data collection policies are needed. Graph-based modelling tools have been used to analyse complex systems in other domains. In this paper, we apply this technique to IoT data-collection policy analysis and visualisation. We describe graphical representations of category-based data collection policies and show that a graph-based policy language is a powerful tool not only to specify and visualise the policy, but also to analyse policy properties. We illustrate the approach with a simple example in the context of a chemical plant with a truck monitoring system. We also consider policy administration: we propose a classification of queries to help administrators analyse policies, and we show how the queries can be answered using our technique.

With an increase in targeted attacks such as advanced persistent threats (APTs), enterprise system defenders require comprehensive frameworks that allow them to collaborate and evaluate their defense systems against such attacks. MITRE has developed a framework which includes a database of different kill-chains, tactics, techniques, and procedures that attackers employ to perform these attacks. In this work, we leverage natural language processing techniques to extract attacker actions from threat report documents generated by different organizations and automatically classify them into standardized tactics and techniques, while providing relevant mitigation advisories for each attack. A naive method to achieve this is by training a machine learning model to predict labels that associate the reports with relevant categories. In practice, however, sufficient labeled data for model training is not always readily available, so that training and test data come from different sources, resulting in bias. A naive model would typically underperform in such a situation. We address this major challenge by incorporating an importance weighting scheme called bias correction that efficiently utilizes available labeled data, given threat reports, whose categories are to be automatically predicted. We empirically evaluated our approach on 18,257 real-world threat reports generated between year 2000 and 2018 from various computer security organizations to demonstrate its superiority by comparing its performance with an existing approach.

Many novel problems in computer networking require relevant network trace data during the research process. Unfortunately, such data can often be hard to find, which becomes a problem within itself. While generating appropriate data using in-lab network testbeds and simulators are feasible solutions, the former has limitations in terms of network scale, while the latter has limitations in the generated data. To help address these issues, we present an approach for the generation of realistic network trace data in a contained, large-scale network environment. We use network emulation to enable large-scale, in-lab networking, and a software framework we developed to support autonomous client-side protocols and services, including user-behavioral models which scale in a shared CPU environment. Our framework also enables quick experiment setup and monitoring. We show through experimentation on a low-end laptop that our approach enables network scale into the hundreds of nodes, allowing anyone with even basic hardware to generate potentially relevant, realistic network data.

Massive amounts of data are being collected, stored, and analyzed for various business and marketing purposes. While such data analysis is critical for many applications, it could also violate the privacy of individuals. This paper describes the issues involved in designing a privacy aware data management framework for collecting, storing, and analyzing the data. We also discuss behavioral aspects of data sharing as well as aspects of a formal framework based on rewriting rules that encompasses the privacy aware data management framework.

In Attribute-Based Access Control (ABAC) systems, access to resources is controlled by evaluating rules against the attributes of the user and the object involved in the access request, as well as the values of the relevant attributes from the environment. This is a powerful concept: ABAC is able to enforce DAC and RBAC policies, as well as more general, dynamic access control policies, where the decision to grant or deny an access request is based on the system's state. However, in its current definition, ABAC does not lend itself well to some operations, such as review queries, and it is in general more costly to specify and maintain than simpler systems such as RBAC. To address these issues, in this paper we propose a formal model of ABAC based on the notion of a category that underlies the general category-based metamodel of access control (CBAC). Our proposed approach adds structure to ABAC, so that policies are easier to design and understand, review queries become easy to evaluate, and simple systems such as RBAC can be implemented as instances of ABAC without additional costs.

Data streams are continuous flows of data points. Novel class detection is an important part of data stream mining. A novel class is a newly emerged class that has not previously been modeled by the classifier over the input stream. This paper proposes deep embedding for novel class detection — a novel approach that combines feature learning using denoising autoencoding with novel class detection. A denoising autoencoder is a neural network with hidden layers aiming to reconstruct the input vector from a corrupted version. A nonparametric multidimensional change point detection approach is also proposed, to detect concept-drift (the change of data feature values over time). Experiments on several real datasets show that the approach significantly improves the performance of novel class detection.