Search

To address the challenging problem of detecting phishing webpages, researchers have developed numerous solutions, in particular those based on machine learning (ML) algorithms. Among these, brand-based phishing detection that uses models from Computer Vision to detect if a given webpage is imitating a well-known brand has received widespread attention. However, such models are costly and difficult to maintain, as they need to be retrained with labeled dataset that has to be regularly and continuously collected. Besides, they also need to maintain a good reference list of well-known websites and related meta-data for effective performance. In this work, we take steps to study the efficacy of large language models (LLMs), in particular the multimodal LLMs, in detecting phishing webpages. Given that the LLMs are pretrained on a large corpus of data, we aim to make use of their understanding of different aspects of a webpage (logo, theme, favicon, etc.) to identify the brand of a given webpage and compare the identified brand with the domain name in the URL to detect a phishing attack. We propose a two-phase system employing LLMs in both phases: the first phase focuses on brand identification, while the second verifies the domain. We carry out comprehensive evaluations on a newly collected dataset. Our experiments show that the LLM-based system achieves a high detection rate at high precision; importantly, it also provides interpretable evidence for the decisions. Our system also performs significantly better than a state-of-the-art brand-based phishing detection system while demonstrating robustness against two known adversarial attacks., Comment: To appear in eCrime 2024

We study new cohomologies for the BPS operators of the $\mathcal{N}=4$ Yang-Mills theory with $SU(3)$ and $SU(4)$ gauge groups, to better understand the black hole microstates. We first study the index of these black hole operators and identify their apparent threshold levels. For $SU(3)$, we find many towers of states and partial no-hair behaviors. We explicitly construct the threshold cohomology in the $SU(3)$ theory. We study throughout this paper a subsector of the field theory corresponding to the BMN matrix theory. We also argue that the BMN sector exhibits a black hole like entropy growth at large $N$., Comment: 48 pages; v2: minor revision

We consider the existence problem of uniformly resolvable decompositions of $K_v$ into subgraphs such that each resolution class contains only blocks isomorphic to the same graph. We give a complete solution for the case in which one resolution class is $K_2$ and the rest are $K_{1,5}$., Comment: 30 pages, 2 figures

Recent times have witnessed the rise of anti-phishing schemes powered by deep learning (DL). In particular, logo-based phishing detectors rely on DL models from Computer Vision to identify logos of well-known brands on webpages, to detect malicious webpages that imitate a given brand. For instance, Siamese networks have demonstrated notable performance for these tasks, enabling the corresponding anti-phishing solutions to detect even "zero-day" phishing webpages. In this work, we take the next step of studying the robustness of logo-based phishing detectors against adversarial ML attacks. We propose a novel attack exploiting generative adversarial perturbations to craft "adversarial logos" that evade phishing detectors. We evaluate our attacks through: (i) experiments on datasets containing real logos, to evaluate the robustness of state-of-the-art phishing detectors; and (ii) user studies to gauge whether our adversarial logos can deceive human eyes. The results show that our proposed attack is capable of crafting perturbed logos subtle enough to evade various DL models-achieving an evasion rate of up to 95%. Moreover, users are not able to spot significant differences between generated adversarial logos and original ones., Comment: To appear in ESORICS 2023

Topological crystalline insulators (TCIs) can host anomalous surface states which inherits the characteristics of crystalline symmetry that protects the bulk topology. Especially, the diversity of magnetic crystalline symmetries indicates the potential for novel magnetic TCIs with distinct surface characteristics. Here, we propose a topological magnetic Dirac insulator (TMDI), whose two-dimensional surface hosts fourfold-degenerate Dirac fermions protected by either the $p'_c4mm$ or $p4'g'm$ magnetic wallpaper group. The bulk topology of TMDIs is protected by diagonal mirror symmetries, which give chiral dispersion of surface Dirac fermions and mirror-protected hinge modes. We propose candidate materials for TMDIs including Nd$_4$Te$_8$Cl$_4$O$_{20}$ and DyB$_4$ based on first-principles calculations, and construct a general scheme for searching TMDIs using the space group of paramagnetic parent states. Our theoretical discovery of TMDIs will facilitate future research on magnetic TCIs and illustrate a distinct way to achieve anomalous surface states in magnetic crystals., Comment: 10+36 pages, 4+23 figures, published version

We study AdS$_5$ black holes from a recently suggested giant graviton expansion formula for the index of $U(N)$ maximal super-Yang-Mills theory. We compute the large $N$ entropy at fixed charges and giant graviton numbers $n_I$ by a saddle point analysis, and further maximize it in $n_I$. This agrees with the dual black hole entropy in the small black hole limit. To get black holes at general sizes, one should note that various giant graviton indices cancel because gauge theory does not suffer from a Hagedorn-like pathology by an infinite baryonic tower. With one assumption on the mechanism of this cancellation, we account for the dual black hole entropy at general sizes. We interpret our results as analytic continuations of the large $N$ free energies of SCFTs, and based on it compute the entropies of AdS$_{4,7}$ black holes from M5, M2 giant gravitons., Comment: 27 pages, 4 figures

An enterprise today deploys multiple security middleboxes such as firewalls, IDS, IPS, etc. in its network to collect different kinds of events related to threats and attacks. These events are streamed into a SIEM (Security Information and Event Management) system for analysts to investigate and respond quickly with appropriate actions. However, the number of events collected for a single enterprise can easily run into hundreds of thousands per day, much more than what analysts can investigate under a given budget constraint (time). In this work, we look into the problem of prioritizing suspicious events or anomalies to analysts for further investigation. We develop SIERRA, a system that processes event logs from multiple and diverse middleboxes to detect and rank anomalous activities. SIERRA takes an unsupervised approach and therefore has no dependence on ground truth data. Different from other works, SIERRA defines contexts, that help it to provide visual explanations of highly-ranked anomalous points to analysts, despite employing unsupervised models. We evaluate SIERRA using months of logs from multiple security middleboxes of an enterprise network. The evaluations demonstrate the capability of SIERRA to detect top anomalies in a network while outperforming naive application of existing anomaly detection algorithms as well as a state-of-the-art SIEM-based anomaly detection solution., Comment: to appear in IEEE European Symposium on Security and Privacy (EuroS&P) 2022

Security function outsourcing has witnessed both research and deployment in the recent years. While most existing services take a straight-forward approach of cloud hosting, on-path transit networks (such as ISPs) are increasingly more interested in offering outsourced security services to end users. Recent proposals (such as SafeBricks and mbTLS) have made it possible to outsource sensitive security applications to untrusted, arbitrary networks, rendering on-path security function outsourcing more promising than ever. However, to provide on-path security function outsourcing, there is one crucial component that is still missing -- a practical end-to-end network protocol. Thus, the discovery and orchestration of multiple capable and willing transit networks for user-requested security functions have only been assumed in many studies without any practical solutions. In this work, we propose Opsec, an end-to-end security-outsourcing protocol that fills this gap and brings us closer to the vision of on-path security function outsourcing. Opsec automatically discovers one or more transit ISPs between a client and a server, and requests user-specified security functions efficiently. When designing Opsec, we prioritize the practicality and applicability of this new end-to-end protocol in the current Internet. Our proof-of-concept implementation of Opsec for web sessions shows that an end user can easily start a new web session with a few clicks of a browser plug-in, to specify a series of security functions of her choice. We show that it is possible to implement such a new end-to-end service model in the current Internet for the majority of the web services without any major changes to the standard protocols (e.g., TCP, TLS, HTTP) and the existing network infrastructure (e.g., ISP's routing primitives)., Comment: Proceedings of International Conference on Distributed Computing and Networking (ICDCN 2022)

We document the activities performed during the second MadAnalysis 5 workshop on LHC recasting, that was organised in KIAS (Seoul, Korea) on February 12-20, 2020. We detail the implementation of 12 new ATLAS and CMS searches in the MadAnalysis 5 Public Analysis Database, and the associated validation procedures. Those searches probe the production of extra gauge and scalar/pseudoscalar bosons, supersymmetry, seesaw models and deviations from the Standard Model in four-top production., Comment: 119 pages, 37 figures, 48 tables and 12 new analyses added to the MadAnalysis 5 Public Analysis Database. More information available from https://indico.cern.ch/event/873524/ and http://madanalysis.irmp.ucl.ac.be/wiki/PublicAnalysisDatabase

We found resonantly excited precession motions of a three-dimensional vortex core in soft magnetic nanospheres and controllable precession frequency with the sphere diameter 2R, as studied by micromagnetic numerical and analytical calculations. The precession angular frequency for an applied static field $H_{DC}$ is given as $\omega_{MV}= \gamma_{eff} H_{DC}$, where $\gamma_{eff} = \gamma $ is the effective gyromagnetic ratio in collective vortex dynamics, with the gyromagnetic ratio $\gamma$ and the average magnetization component $$ of the ground-state vortex in the core direction. Fitting to the micromagnetic simulation data for $$ yields a simple explicit form of $ = (73.6 \pm 3.4)(l_{ex}/2R)^{2.20 \pm 0.14}$, where $l_{ex}$ is the exchange length of a given material. This dynamic behavior might serve as a foundation for potential bio-applications of size-specific resonant excitation of magnetic vortex-state nanoparticles, for example, magnetic particle resonance imaging., Comment: 23 pages, 6 figures