While anonymity networks such as Tor provide invaluable privacy guarantees to society, they also enable all kinds of criminal activities. Consequently, many blameless citizens shy away from protecting their privacy using such technology for fear of being associated with criminals. To grasp the potential for alternative privacy protection for those users, we design Seldom , an anonymity network with integrated selective deanonymization that disincentivizes criminal activity. Seldom enables law enforcement agencies to selectively access otherwise anonymized identities of misbehaving users while providing technical guarantees preventing these access rights from being misused. Seldom further ensures translucency , as each access request is approved by a trustworthy consortium of impartial entities and eventually disclosed to the public (without interfering with ongoing investigations). To demonstrate Seldom ’s feasibility and applicability, we base our implementation on Tor, the most widely used anonymity network. Our evaluation indicates minimal latency, processing, and bandwidth overheads compared to Tor; Seldom ’s main costs stem from storing flow records and encrypted identities. With at most \(636 \,{\rm TB}\) of storage required in total to retain the encrypted identifiers of a Tor-sized network for two years, Seldom provides a practical and deployable technical solution to the inherent problem of criminal activities in anonymity networks. As such, Seldom sheds new light on the potentials and limitations when integrating selective deanonymization into anonymity networks.

Deep neural networks (DNNs) for image classification remain vulnerable to adversarial perturbations–subtle input manipulations that induce catastrophic misclassifications. To address this issue, we propose the Adversarial Image Rectifier (AIR), a linguistically inspired detection and mitigation framework that enhances DNN robustness by intercepting and inverting adversarial perturbations at the feature level. Unlike existing defenses, AIR operates without prior knowledge of attack patterns: it first encodes hierarchical hidden-layer feature maps of a DNN into semantically structured sentence representations, then identifies adversarial inputs through “sentiment” anomalies in these sentences–a linguistic metaphor for subtle adversarial traces. Crucially, we pinpoint a pivotal intermediate layer where adversarial perturbations dominantly propagate and train a lightweight rectifier network to selectively nullify adversarial features at this layer while preserving benign semantics. Extensive experiments on Tiny-ImageNet, CIFAR-10, SVHN, and MS COCO demonstrate that AIR achieves a correction rate of up to 95.02% and 94.62% when defending against known attacks and unknown attacks, respectively, significantly surpassing existing defense techniques.

Detecting malicious network traffic in large-scale, dynamic environments presents a significant challenge due to the complexity of network relationships and the evolving nature of cyber threats. Existing graph-based and sequence-based models often fail to capture both spatial dependencies and temporal patterns effectively, resulting in suboptimal detection. This study introduces the Multi-view Graph Adaptive Network (MGAN), a novel framework that integrates multi-hop graph neural network (GNN) aggregation with transformer-based sequence modeling to address these challenges. MGAN captures long-range spatial dependencies and temporal dynamics in network traffic, enabling the detection of complex attack patterns. It incorporates Dirichlet sampling for robust neighbor selection in sparse and noisy data environments and mutual information maximization to align multi-view representations for consistency. Additionally, a multi-view attention mechanism aggregates information across different hops, balancing local and global network context. Extensive experiments on four real-world datasets demonstrate MGAN’s superiority over 7 baseline models, achieving an average F1-Score above 97%, surpassing the best baseline by 2.35%. MGAN maintains detection accuracy above 97% and remains robust under data sparsity, achieving F1-Scores over 95% even when 40% of connectivity information is removed. Under noisy conditions, MGAN retains accuracy above 93%, outperforming baselines by over 4.5%. In zero-day attack scenarios, it achieves detection rates exceeding 96% for previously unseen attack categories. MGAN also exhibits exceptional computational efficiency, processing 2,034 samples per second with a detection time of 3.00 milliseconds per sample, outperforming all competing models in both accuracy and speed.

Interdependent systems, with multiple interconnected assets, face escalating cybersecurity threats from external attackers. This article explores security decision-making, operating on complex interdependent systems and proposes a security resource allocation methodology to enhance their proactive security. Using attack graphs, we model vulnerabilities and propose different defense mechanisms integrating different network analysis algorithms, including degree, betweenness, and harmonic centralities, TrustRank, and Katz centrality. We introduce Average Based Node Ranking (ABNR) to average ranks from these methods. The resource allocation methods leverage four different graph-theoretic methods. Each ranking algorithm is combined with these four allocation techniques. Our methods show low sensitivity to simultaneous attacks on interdependent systems. We validate our framework using 11 attack graphs representing real-world systems, measuring security improvements against four well-known allocation algorithms: behavioral decision-making, defense-in-depth, risk-based defense, and min-cut. Our framework outperformed the baselines in most cases, with superior outcomes confirmed by the Friedman statistical test. We show that the main components in our framework have low-time overhead. We also evaluate our framework against multi-stage attacks and cascading failures Our framework enhances security decision-making across different scenarios, including top-1 and all attack paths for different attacks. We release the implementation of our resource allocation methodology to the research community

Federated Learning (FL) is vulnerable to backdoor attacks—especially distributed backdoor attacks (DBA) that are more persistent and stealthy than centralized backdoor attacks. However, we observe that the attack effectiveness of DBA can be largely reduced when encountering rebels, i.e., the agents promising to perform the attack but do not do so. To robustify DBAs, we present SSRDBA , a secret sharing-inspired robust DBA to FL. To be specific, given a same global trigger as DBA, SSRDBA carefully divides it into different shares based on secret sharing and exploits these shares to poison local data on malicious devices, respectively. SSRDBA enjoys several merits, e.g., only partial malicious agents guarantee the reconstruction of the global trigger. Extensive experimental results show that SSRDBA is more robust to rebels than DBA and can evade the state-of-the-art FL defenses mainly for centralized backdoor attacks. To mitigate SSRDBA , we further design a novel defense mechanism, termed NFDR, which shows great potential against SSRDBA on certain independent identically distributed datasets.

Sentence embeddings represent the meaning of a given sentence using a fixed dimensional vector. Different approaches have been proposed in the Natural Language Processing (NLP) community for learning encoders that can produce accurate sentence embeddings that perform well for diverse downstream tasks requiring sentence representations. Despite prior work focusing mainly on creating accurate sentence embeddings, how to keep private the sensitive information contained in the sentences remains an unexplored research problem. In this article, we propose Covering Metric Analytic Gaussian (CMAG), a covering metric Differential Privacy (DP) mechanism for sentence embeddings such that minimal random noise is added to a set of sentence embeddings produced by an encoder to protect the private information expressed in those sentences. Given a sentence embedding s , CMAG considers the Mahalanobis distance between s and the other sentence embeddings s ’ in the local neighbourhood of s to determine the minimal amount of random noise that must be added to s to obtain provable metric DP guarantees. Experimental results show that the proposed DP mechanism protects private information better than previously proposed DP mechanisms while reporting good performance in a broad range of downstream NLP tasks.

Secure multi-party computation has seen substantial performance improvements in recent years and is being increasingly used in commercial products. While a significant amount of work was dedicated to improving its efficiency under standard security models, the threat models do not account for information leakage from the output of secure function evaluation. Quantifying information disclosure about private inputs from observing the function outcome is the subject of this work. Motivated by the City of Boston gender pay gap studies, in this work, we focus on the computation of the average of salaries and quantify information disclosure about private inputs of one or more participants (the target) to an adversary via information-theoretic techniques. We study a number of distributions including log-normal, which is typically used for modeling salaries. We consequently evaluate information disclosure after repeated evaluation of the average function on overlapping inputs, as was done in the Boston gender pay study that ran multiple times, and provide recommendations for using the sum and average functions in secure computation applications. Our goal is to develop mechanisms that lower information disclosure about participants’ inputs to a desired level and provide guidelines for setting up real-world secure evaluation of this function.

The volumes and sophistication of cyber threats in today’s cyber threat landscape have risen to levels where automated quantitative tools for Cyber Threat Intelligence (CTI) have become an indispensable part in the cyber defense arsenals. The AI and cyber security research communities are producing novel automated tools for CTI that quickly find their ways into commercial products. However, the quality of such automated intelligence products is being questioned by the intelligence community. Cyber security operators are forced to complement the automated tools with costly and time-consuming human intelligence analysis in order to improve the quality of the end product. For improving the quality, it has been suggested that researchers should incorporate methods from traditional intelligence analysis into the quantitative algorithms. This article presents a novel approach to cyber intelligence analysis called AMBARGO, which takes the inherent ambiguity of evidence into account in the analysis, using the Choquet integral, in formalizing the re-evaluation of evidence and hypotheses made by human analysts. The development of AMBARGO revolves around a cyber attribution use case, one of the hardest problems in CTI. The results of our evaluating experiments show that the robustness of AMBARGO outperforms state-of-the-art quantitative approaches to CTI in the presence of ambiguous evidence and potentially deceptive threat actor tactics. AMBARGO has thus the potential to fill a gap in the CTI state-of-the-art, which currently handles ambiguity poorly. The findings are also confirmed in a large-scale realistic experimental setting based on data from an APT campaign obtained from the MITRE ATT&CK Framework.

FAPI 2.0 is a suite of Web protocols developed by the OpenID Foundation’s FAPI Working Group (FAPI WG) for third-party data sharing and digital identity in high-risk environments. Even though the specifications are not completely finished, several important entities have started to adopt the FAPI 2.0 protocols, including Norway’s national HelseID, Australia’s Consumer Data Standards, as well as private companies like Authlete and Australia-based connectID; the predecessor FAPI 1.0 is in widespread use with millions of users. The FAPI WG asked us to accompany the standardization of the FAPI 2.0 protocols with a formal security analysis to proactively identify vulnerabilities before widespread deployment and to provide formal security guarantees for the standards. In this paper, we report on our analysis and findings. Our analysis is based on a detailed model of the Web infrastructure, the so-called Web Infrastructure Model (WIM), which we extend to be able to carry out our analysis of the FAPI 2.0 protocols including important extensions like FAPI-CIBA. Based on the (extended) WIM and formalizations of the security goals and attacker model laid out in the FAPI 2.0 specifications, we provide a formal model of the protocols and carry out a formal security analysis, revealing several attacks. We have worked with the FAPI WG to fix the protocols, resulting in several amendments to the specifications. With these changes in place, we have adjusted our protocol model and formally proved that the security properties hold true under the strong attacker model defined by the FAPI WG.

Facial recognition technology has been developed and widely used for decades. However, it has also made privacy concerns and researchers’ expectations for facial recognition privacy-preserving technologies. To provide privacy, detailed or semantic contents in face images should be obfuscated. However, face recognition algorithms have to be tailor-designed according to current obfuscation methods, as a result the face recognition service provider has to update its commercial off-the-shelf (COTS) products for each obfuscation method. Meanwhile, current obfuscation methods have no clearly quantified explanation. This paper presents a universal face obfuscation method for a family of face recognition algorithms using global or local structure of eigenvector space. By specific mathematical explanations, we show that the upper bound of the distance between the original and obfuscated face images is smaller than the given recognition threshold. Experiments show that the recognition degradation is 0% for global structure based and 0.3%-5.3% for local structure based, respectively. Meanwhile, we show that even if an attacker knows the whole obfuscation method, he/she has to enumerate all the possible roots of a polynomial with an obfuscation coefficient, which is computationally infeasible to reconstruct original faces. So our method shows a good performance in both privacy and recognition accuracy without modifying recognition algorithms.