F-Secure (Finland)

This paper presents an overview of how Artificial Intelligence (AI) and edge technology have been used to improve wireless connectivity in multiple industrial Use Cases (UCs) of the EU project “Intelligent Secure Trustable Things” (InSecTT). We present a brief introduction of the InSecTT framework for crossdomain architecture design, which targets UCs assisted by reusable and/or interoperable technical Building Blocks (BBs). These BBs constitute the construction bricks containing AI and supporting components that were used to build different UCs. The framework consists of multiple stages based on the processing of UC/BB requirements (RQs). These stages include: i) collection, ii) harmonization, iii) refinement, iv) classification, v) architecture alignment, and vi) functionality modeling of RQs. The most relevant results of these stages are discussed here, with emphasis on the need for a refined granularity of technical components with common functionalities named sub-building blocks (SBBs), where collaboration and cross-domain reusability were optimized. The design process shed light on how AI and SBBs were implemented across different layers and entities of our reference architecture for the Internet-of-Things (IoT), including the interfaces used for information exchange. This detailed interface analysis is expected to reveal issues such as bottlenecks, constraints, vulnerabilities, scalability problems, security threats, etc. This will, in turn, contribute to identifying design gaps in AI-enabled IoT systems. The paper summarizes the SBBs related to wireless connectivity, including a general description, implementation issues, comparison of results, adopted interfaces, and conclusions across domains.

Federated learning is a distributed learning technique where machine learning models are trained on client devices in which the local training data resides. The training is coordinated via a central server which is, typically, controlled by the intended owner of the resulting model. By avoiding the need to transport the training data to the central server, federated learning improves privacy and efficiency. But it raises the risk of model theft by clients because the resulting model is available on every client device. Even if the application software used for local training may attempt to prevent direct access to the model, a malicious client may bypass any such restrictions by reverse engineering the application software. Watermarking is a well-known deterrence method against model theft by providing the means for model owners to demonstrate ownership of their models. Several recent deep neural network (DNN) watermarking techniques use backdooring: training the models with additional mislabeled data. Backdooring requires full access to the training data and control of the training process. This is feasible when a single party trains the model in a centralized manner, but not in a federated learning setting where the training process and training data are distributed among several client devices. In this paper, we present WAFFLE, the first approach to watermark DNN models trained using federated learning. It introduces a retraining step at the server after each aggregation of local models into the global model. We show that WAFFLE efficiently embeds a resilient watermark into models incurring only negligible degradation in test accuracy (-0.17%), and does not require access to training data. We also introduce a novel technique to generate the backdoor used as a watermark. It outperforms prior techniques, imposing no communication, and low computational (+3.2%) overhead¹¹The research report version of this paper is also available in https://arxiv.org/abs/2008.07298, and the code for reproducing our work can be found at https://github.com/ssg-research/WAFFLE.

In this paper, we present a coverage-based regression test selection (RTS) approach and a developed tool for Python. The tool can be used either on a developer’s machine or on build servers. A special characteristic of the tool is the attention to easy integration to continuous integration and deployment. To evaluate the performance of the proposed approach, mutation testing is applied to three open-source projects, and the results of the execution of full test suites are compared to the execution of a set of tests selected by the tool. The missed fault rate of the test selection varies between 0–2% at file-level granularity and 16–24% at line-level granularity. The high missed fault rate at the line-level granularity is related to the selected basic mutation approach and the result could be improved with advanced mutation techniques. Depending on the target optimization metric (time or precision) in DevOps/MLOps process the error rate could be acceptable or further improved by using file-level granularity based test selection.

Anomaly detection is valuable in many domains. Distance-based algorithms are one of the most well-known techniques for anomaly detection. These algorithms have been shown to produce good accuracy in a wide range of applications. However, distance-based algorithms are limited in terms of scalability. This makes it difficult for these algorithms to handle massive data sets. To overcome this limitation, in this paper we propose a parallel formulation of the popular KNN distance-based algorithm for unsupervised anomaly detection. Our formulation focused on improving scalability by analyzing in parallel different parts of the data. This approach is valuable whenever the analyzed data does not fit comfortably into memory, or when it is distributed across several locations. To reduce synchronization latency, the proposed algorithm computes approximate nearest neighborhoods. We show, both theoretically and empirically, how this approach greatly improves scalability without significantly penalizing detection accuracy. To validate our approach, we perform extensive experiments on both synthetic and real-world data sets.

We consider the problem of secure distributed matrix multiplication (SDMM) in which a user wishes to compute the product of two matrices with the assistance of honest but curious servers. We construct polynomial codes for SDMM by studying a combinatorial problem on a special type of addition table, which we call the degree table. The codes are based on arithmetic progressions, and are thus named GASP (Gap Additive Secure Polynomial) Codes. GASP Codes are shown to outperform all previously known polynomial codes for secure distributed matrix multiplication in terms of download rate.

In this paper we present Securebox, an affordable and deployable platform for securing and managing IoT networks. Our proposal targets an alarming spot in the fast growing IoT industry where security is often overlooked due to device limitation, budget constraint, and development deadline. In contrast to existing host-centric and hardware-coupled solutions, Securebox empowers a cloud-assisted charge for network service model that is dedicated to budget and resource constrained IoT environments. Owing to its cloud-driven and modular design, Securebox allows us to 1) flexibly offload and onload security and management functions to the cloud and network edge components; 2) offer advanced security and management services to end users in an affordable and on-demand manner; 3) ease the upgrade and deployment of new services to guard against abrupt security breakouts. To demonstrate Securebox, we have implemented the platform consisting of a plug-n-play frontend, a Kubernetes-powered backend cluster, and a smartphone mobile application. Based on the testbed evaluation, we show that Securebox is robust and responsive. Its collaborative and extensible architecture enforces rapid update cycles and can scale with the growing diversity of IoT devices.

Handling personal data in a legally compliant way is an important factor for ensuring the trustworthiness of a service provider. The EU data protection directive (EU DPD) is built in such a way that the outcomes of rules are subject to explanations, contexts with dependencies, and human interpretation. Therefore, the process of obtaining deterministic and formal rules in policy languages from the EU DPD is difficult to fully automate. To tackle this problem, we demonstrate in this paper the use of a Controlled Natural Language (CNL) to encode the rules of the EU DPD, in a manner that can be automatically converted into the policy languages XACML and PERMIS. We also show that forming machine executable rules automatically from the controlled natural language grammar not only has the benefit of ensuring the correctness of those rules but also has potential of making the overall process more efficient.

A swift execution from idea to market has become a key competitive advantage for software companies to enable them to survive and grow in turbulent business environments. To combat this challenge, companies are using hackathons. A hackathon is a highly engaging, continuous event in which people in small groups produce working software prototypes in a limited amount of time. F-Secure, a software product company, views hackathons as a possible solution to the fundamental business problem of how to make revenue from an idea, spanning the phases from creating the idea to producing a software prototype. However, hackathons pose the challenge of how to transform those promising prototypes into finalized products that create revenue and real business value.

We present a model-based testing approach to support automated test generation with domain-specific concepts.This includes a language expert who is an expert at building test models and domain experts who are experts in the domain of the system under test.First, we provide a framework to support the language expert in building test models using a full (Java) programming language with the help of simple but powerful modeling elements of the framework.Second, based on the model built with this framework, the toolset automatically forms a domain-specific modeling language that can be used to further constrain and guide test generation from these models by a domain expert.This makes it possible to generate a large set of test cases covering the full model, chosen (constrained) parts of the model, or manually define specific test cases on top of the model while using concepts familiar to the domain experts.