Large code language models (CodeLLMs) can generate and rewrite programs, enabling functionality-preserving code mutation that may be used to create diverse malware variants and evade signature-based detection. A key security question is whether this mutation capability survives model compression, which would make deployment feasible under limited hardware budgets. We propose SecRL-Prune, a structured pruning framework for CodeLLMs that operates on feed-forward (MLP/FFN) channels. Starting from a pretrained teacher, it learns a layer-wise pruning policy with reinforcement learning using a teacher-student KL-divergence reward. To improve efficiency, we cache the teacher's top-P predictions once and compare the pruned student against this compact target, avoiding simultaneous teacher-student residency in GPU memory. We evaluate SecRL-Prune on HumanEval using pass@k for execution correctness and var@k for code diversity across three 7B CodeLLMs at 10-30% compression. SecRL-Prune consistently preserves higher pass@k and var@k than recent structured pruning baselines under aggressive pruning. In a case study on real malware samples, semantics-preserving mutations from 20%-pruned models substantially reduced detections. These results show that code mutation capability can survive significant structured pruning, highlighting the security relevance of compressed CodeLLMs.

Agile network security is paramount in our modern world which is currently dominated by Internet systems and expanding digital spaces. This rapid digital transformation has created more opportunities for cyberattackers to exploit different vulnerabilities and launch sophisticated and continuously evolving cyberattacks. Increasingly, intrusion detection systems are relying on new methods based on Machine Learning (ML) and Deep Learning (DL) techniques to detect and mitigate such cyberattacks. While such techniques normally can identify known network attack patterns with a reasonable degree of success, their ability to identify complicated atypical, polymorphic, and unknown attacks is shown to be limited. In this paper, we present a comprehensive survey of recent research for detecting unknown, atypical, and polymorphic network attacks using DL techniques. We further highlight and discuss the main challenges in this area and identify the future research directions.

Today's networked systems face significant security challenges due to sophisticated attacks. Several Machine Learning (ML) and Deep Learning (DL) models are employed to combat these diverse attacks. Adversarial attacks, which can evade detection by AI-based intrusion detection systems (IDS) through small alterations to network attack traffic, pose a significant concern. These AI-synthesized adversarial attacks must adhere to network constraints to seem plausible. In this work, we explore the validation criteria for such adversarial attacks and propose a methodology for analyzing their quality. We evaluate adversarial attack samples synthesized by state-of-the-art generative DL models such as Variational autoencoder (VAE), Conditional Variational autoencoder (CVAE), Generative Adversarial Network (GAN) and compare the performance with our CVAE-Adversarial Network (CVAE-AN) model. Results indicate the effectiveness of CVAE-AN in synthesizing realistic adversarial attacks.

Machine learning and artificial intelligence can harness the immense stream of operational data from clouds, to services, to social and communication networks. In the era of big data and connected devices of all varieties, machine learning and artificial intelligence have found ways to improve operations and management of information technology and communications.

Machine learning and artificial intelligence can harness the immense stream of operational data from clouds, to services, to social and communication networks. In the era of big data and connected devices of all varieties, machine learning and artificial intelligence have found ways to improve operations and management of information technology and communications.

Network Intrusion Detection Systems (NIDS) are powerful tools for identifying and deterring cybersecurity attacks nowadays. However, while these modern IDS can detect typical attacks, recent studies show their poor performances in identifying unknown or dynamically changing atypical attacks. Another issue with the training aspect of such systems is the problem of class imbalance which impedes their performance, especially for minority attack classes. This renders IDS systems vulnerable to both adversarial as well as non-AI synthesized atypical attacks when deployed in a real network. To reduce misclassification (especially for minority classes) and detect atypical attack flows, we propose a novel adversarial incremental learning approach based on a hybrid model consisting of a Conditional Variational Autoencoder (CVAE) and a Generative Adversarial Network (GAN) namely, CVAE-Adversarial Network (CVAE-AN). The binary IDS has been trained using the CICIDS2017 dataset and evaluated using multiple atypical attacks. Simulation results demonstrate that the proposed technique significantly improves the performance of the IDS against different atypical attacks and outperforms the state-of-the-art detection models as well as class balancing methods.

Driving simulators play an important role in vehicle research. However, existing virtual reality simulators do not give users a true sense of presence. UniNet is our driving simulator, designed to allow users to interact with and visualize simulated traffic in mixed reality. It is powered by SUMO and Unity. UniNet's modular architecture allows us to investigate interdisciplinary research topics such as vehicular ad-hoc networks, human-computer interaction, and traffic management. We accomplish this by giving users the ability to observe and interact with simulated traffic in a high fidelity driving simulator. We present a user study that subjectively measures user's sense of presence in UniNet. Our findings suggest that our novel mixed reality system does increase this sensation.

As over 95% of IT security breaches result from human error, there is a need to design a system to detect and prevent it. In this paper, we propose a human error prevention system that examines the users’ eye gaze behavior and determines if a human error is likely to occur. 13 expert network administrators and 18 non-experts were selected for this study. The results confirm the ability to detect human error using eye gaze data with 99.74%, 99.47%, 99.23% accuracy using KStar, Random Forest and J48 classifiers.

This article introduces a service that helps provide context and an explanation for the outlier score given to any network flow record selected by the analyst. The authors propose a service architecture for the delivery of contextual information related to network flow records. The service constructs a set of contexts for the record using features including the host addresses, the application in use and the time of the event. For each context the service will find the nearest neighbors of the record, analyze the feature distributions and run the set through an ensemble of unsupervised outlier detection algorithms. By viewing the records in shifting perspectives one can get a better understanding as to which ways the record can be considered an anomaly. To take advantage of the power of visualizations the authors demonstrate an example implementation of the proposed service architecture using a linked visualization dashboard that can be used to compare the outputs.

This paper presents a framework which enables a user to more easily make corrections to adversarial texts. While attack algorithms have been demonstrated to automatically build adversaries, changes made by the algorithms can often have poor semantics or syntax. Our framework is designed to facilitate human intervention by aiding users in making corrections. The framework extends existing attack algorithms to work within an evolutionary attack process paired with a visual analytics loop. Using an interactive dashboard a user is able to review the generation process in real time and receive suggestions from the system for edits to be made. The adversaries can be used to both diagnose robustness issues within a single classifier or to compare various classifier options. With the weaknesses identified, the framework can also be used as a first step in mitigating adversarial threats. The framework can be used as part of further research into defense methods in which the adversarial examples are used to evaluate new countermeasures. We demonstrate the framework with a word swapping attack for the task of sentiment classification.

Over the last few years, vehicles have been used in many attacks to inflict damages to the public. As it is very difficult to prevent these occurrences in which the vehicle is a weapon, new technologies need to be developed and embedded in the vehicle for preventing or at least minimizing this from happening. In this paper, we examine the approach of using machine learning with engine attributes, such as speed, acceleration and horsepower, to differentiate between malicious and normal driving behaviors. The attributes are preprocessed and placed through algorithms to determine the greatest accuracy in determining malicious driving, using different classifiers. Our results show 99.48% and 99.84% accuracy when classifying normal vs. malicious driving in a controlled environment using J48 and Random Tree classifiers respectively, and 99.95% accuracy using Random Tree and Random Forest Classifiers in a real-world environment.

The need for security1 continues to grow in distributed computing. Today's security solutions require greater scalability and convenience in cloud-computing architectures, in addition to the ability to store and process larger volumes of data to address very sophisticated attacks. This paper explores some of the existing architectures for big data intelligence analytics, and proposes an architecture that promises to provide greater security for data intensive environments. The architecture is designed to leverage the wealth in the multi-source information for security intelligence.

With a modest adoption of biometrics for security controls, privacy remains a great concern for many individuals as biometric features, once compromised, cannot be renewed and will render protected resources vulnerable to a number of attacks by a threat agent. Several biometric encryption mechanisms have been proposed to preserve privacy, however there has been very little industry usage and implementation. In this paper, a practical biometric encryption technique is presented. The proposed approach is used to provide the desired level of privacy for stored biometric templates through anonymization. This scheme also addresses the limitation of renewability as biometric templates are fused with a biometric key, which may be renewed in the event of compromise of the biometric key. A prototype of the proposed scheme indicates that it could be a viable replacement for traditional biometric security controls with an increased confidence in the preservation of the end-user's privacy.

Trust is an important concept in human relationships. However, trust yields a false sense of security as trust leads to decreased vigilance towards a threat. Cases related to fraudulent activities and life-threatening incidents highlight the importance and necessity of peers trust re-evaluation. Trust re-evaluation has been studied over the last decade, yet none of the approaches targets the physiological measurements of a trustee nor does any provide the trustor a system to detect the intentions of a trustee when providing/requesting information. In this paper, we present the design of a trust re-evaluation system (TrustMe) that provides the trustor with the risk levels when trusting a trustee. TrustMe is a cloud-based service that detects the intention and motivation levels behind the information a trustee provides using the intent and motivation detection components of the Intent-based Access Control (IBAC) model. A trustor is provided the risk of trusting a trustee; hence, a trustor can make informed decisions whether to trust the trustee and accept the provided information. Further, a certificate of good intention is granted to a trustee to present to a trustor if the risk levels are determined to be lower than a pre-determined threshold set by the trustor. The current design of TrustMe assesses risk in decisions that involve personal and financial matters.

Phishing is one of the most dangerous information security threats present in the world today, with losses toping 5.9 billion dollars in 2013. Evolving from the original concept of phishing, spear phishing also attempts to scam individuals online, however it uses personalized mail to yield a far higher success rate. This paper suggests an increased threat of spear phishing success due to the presence of social media. Assessing this new threat is important not only to the individuals, but also to companies whose employees may specifically be targeted through their social media accounts. The paper presents the design and implementation of an architecture to determine phishing susceptibility of a user through their social media accounts, and methods to reduce the threat. Preliminary testing shows that social media provides a publicly accessible resource to assess targeted individuals for phishing attacks through their accounts.

Over the last few years, there has been an increase in the adoption of consumer-level health monitoring devices. These off-the-shelf devices are being utilized to collect data anywhere from tracking users' daily activities such as steps taken and calories burned, to monitoring of vital parameters such as heart rate and blood pressure. These devices collect a wealth of health related data which, depending on where it is processed and stored, require implementing sufficient privacy and security controls to prevent misuse or abuse of the data. This paper presents a comprehensive analysis of the privacy and security requirements based on industry best practices, laws and regulations for the collection, usage, storage and sharing of person health information.

High speed physiological data produced by medical devices at intensive care units (ICUs) has all the characteristics of Big Data. The proper use and management of such data can promote the health and reduces mortality and disability rates of critical condition patients. The effective use of Big Data within ICUs has great potential to create new cloud-based health analytics solutions for disease prevention or earlier condition onset detection. The Artemis project aims to achieve the above goals in the area of neonatal intensive care units (NICU). In this paper, we proposed an analytical model for an extended version of Artemis system which is being deployed at SickKids hospital in Toronto. Using the proposed analytical model, we predict the amount of storage, memory and computation power required for Artemis. In addition, important performance metrics such as mean number of patients in the NICU, blocking probability and mean patient residence time for different configurations are obtained. Capacity planning and trade-off analysis would be more accurate and systematic by applying the proposed analytical model in this paper. Numerical results are obtained using real inputs acquired from a pilot deployment of the system at SickKids hospital.

Insider threat damages vary from intellectual property loss and fraud to IT sabotage. As insider threat incidents have evolved to cause potentially catastrophic damages, there exists a need for a detection mechanism in order to build solutions that prevent such threats. Studies over the years show an understanding of the threat, and many approaches have been suggested to detect it, yet none of the approaches targets the physiological aspect of the threat. Bio-signals are impossible to mimic or change, as opposed to behavioral approaches. In this paper, we investigate the use of physiological signals as a measurement to detect insider threat. We design an insider threat monitoring system called Physiological Signals Monitoring (PSM) that detects incidents seconds before they occur. The main measurement in PSM is the abnormal deviation rate of electrocardiogram (ECG) amplitude, Galvanic Skin Response (GSR) and skin temperature that occurs seconds before an incident is executed. Our experiment on 15 human subjects explores this new area and shows the promise of the proposed solution with all of the tested incidents being correctly classified with Nearest Neighbor and Functional Trees classifiers.

We propose a suite of user interface widgets to intuitively inform a user of a mobile device's sense of comfort at the user's proposed actions.

Existing access control systems are mostly identity-based. However, such access control systems impose risks because recognized identity is not essentially an interpretation of good intentions of access. On the other hand, an un-identified individual might request access to suppress damage or prevent a catastrophic incident from happening. To address the limitation of current access control systems, we propose an access control method that is based on feelings which relates an access decision to the current detected emotion of the user, and map it to a category of feelings. Feelings categories are either negative resulting in denying access, or positive leading to access being granted. The proposed emotion-based access control (EBAC) mechanism adds the feelings sensation to the access control machines by analyzing the requesters' current brain signals at the time of access request to detect their current emotions, and then grants or denies access.

In an eHealth peer-to-peer database management system(P2PDBMS), peers exchange data in a pair-wise fashion on-the-fly in response to a query without any centralized control. Generally, the communication link between two peers is insecure and peers create a temporary session while exchanging data. When peers exchange highly confidential data in an eHealth network over an insecure communication link, the data might be tampered with or trapped and disclosed by intruders, which is a serious offence for the clients of an eHealth P2PDBMS. As there is no centralized control for data exchange in eHealth P2PDBMS, it is infeasible to assume a centralized third party security infrastructure to protect confidential data. So far, there is currently no available/existing security protocol for secured data exchange in eHealth P2PDBMS. In this paper we propose three models for secure data exchange in eHealth P2PDBMSs and the corresponding security protocols. The proposed protocol allows the peers to compute their secret session keys dynamically during data exchange based on the policies between them. Our proposed protocol is robust against the man-in-the middle attack, the masquerade attack, and the replay attack.

Intrusion Detection Systems (IDSs) are a major line of defense for protecting network resources from illegal penetrations. A common approach in intrusion detection models, specifically in anomaly detection models, is to use classifiers as detectors. Selecting the best set of features is central to ensuring the performance, speed of learning, accuracy, and reliability of these detectors as well as to remove noise from the set of features used to construct the classifiers. In most current systems, the features used for training and testing the intrusion detection systems consist of basic information related to the TCP/IP header, with no considerable attention to the features associated with lower level protocol frames. The resulting detectors were efficient and accurate in detecting network attacks at the network and transport layers, but unfortunately, not capable of detecting 802.11-specific attacks such as deauthentication attacks or MAC layer DoS attacks. In this paper, we propose a novel hybrid model that efficiently selects the optimal set of features in order to detect 802.11-specific intrusions. Our model for feature selection uses the information gain ratio measure as a means to compute the relevance of each feature and the k-means classifier to select the optimal set of MAC layer features that can improve the accuracy of intrusion detection systems while reducing the learning time of their learning algorithm. In the experimental section of this paper, we study the impact of the optimization of the feature set for wireless intrusion detection systems on the performance and learning time of different types of classifiers based on neural networks. Experimental results with three types of neural network architectures clearly show that the optimization of a wireless feature set has a significant impact on the efficiency and accuracy of the intrusion detection system.

An encryption protocol is the first line of defense against network attacks. The wired equivalent privacy (WEP), used to secure 802.11 based networks, suffers from many weaknesses that were exploited in order to compromise the security of the network, data confidentiality and integrity. An attack named chopchop can decrypt the content of a frame without knowing the encryption key. There has been no theoretical proof of the functionality of the attack. In this paper, we will give a review of the attack and build a mathematical model to prove theoretically that the attack is capable of decrypting messages in WEP enabled wireless networks without requiring the knowledge of the encryption key.

Abstract Technological advances coupled with the proliferation of wireless devices among mobile users require efficient resource management and reuse of the scare radio spectrum allocated to wireless and mobile communication systems. Several channel allocation protocols based on a mutual exclusion paradigm have been developed. However, very little data have been reported to compare these protocols. In this paper, we review four of the best known distributed dynamic channel and resource allocation algorithms based on the mutual exclusion paradigm. While the first three channel alloctaion protocols (Caoet al., Choyet al. and Prakashet al.) are based on the co‐channel interference, the fourth protocol, which is known as DDRA, adopts the co‐group interference approach. We present an extensive set of simulation experiments to evaluate and compare the performance of these four protocols using realistic scenarios. Our results indicate clearly that DDRA algorithm has shown the shortestresponse timeand highestblocking rateamong all of the four channel allocation protocols. Caoet al. algorithm exhibits a betterblocking ratewhen compared to the three other schemes. This is due to the fact that it reuses communication channels optimally. Last, but not least, we discuss the basic fault tolerant machanisms that can be used to enhance further these protocols while dealing with the base stations, mobile hosts, or links' failure. Copyright © 2006 John Wiley & Sons, Ltd.

Providing security and privacy in mobile ad hoc networks has been a major issue over the last few years. Most research work has so far focused on providing security for routing and data content, but nothing has been done in regard to providing privacy and anonymity over these networks. We propose a novel distributed routing protocol which guarantees security, anonymity and high reliability of the established route in a hostile environment, such as an ad hoc wireless network, by encrypting the routing packet header and abstaining from using unreliable intermediate nodes. The major objective of our protocol is to allow trustworthy intermediate nodes to participate in the path construction protocol without jeopardizing the anonymity of the communicating nodes. We describe our protocol, SDAR (secure distributed anonymous routing), and provide its proof of correctness.

The tremendous growth of the Internet has introduced a number of interoperability problems for distributed multimedia applications. These problems are related to the heterogeneity of client devices, network connectivity, content formats, and user's preferences. The purpose of this paper is to present a framework for transcoding multimedia streams. The proposed infrastructure takes into consideration the profile of communicating devices, network connectivity, exchanged content format, context description, and available customization services to find a chain of services that could be applied to adapt the content to the required needed format. Part of the framework is a QoS-based selection algorithm that finds the best sequence of adaptation services which can maximize users' satisfaction with the delivered content.

A layered architecture for advanced collaborative environments has been developed to map the definition of a collaboration task from the requirements needed, to accomplish the task to the collaboration services that can be used to satisfy those needs, and to the technologies on which the services can be delivered. The architecture takes into account the users' goals and needs in configuring the services required for a collaboration task. By understanding and designing for users' needs and requirements, we can ensure a high quality of experience (QoE). The architecture was used to create a prototype system that is currently being tested through user studies.

Abstract Ubiquitous computing environment is defined by the shift of computing technology from the desktop to the background. One of its most notable attributes is its potential to extend the scope of service and personal mobility. This paper describes an agent‐based architecture that brings personal and service mobility to the ubiquitous computing environment. A software agent, running on a portable device carried by the user, leverages the existing service discovery protocols to learn about all services available in the vicinity of the user. Short‐range wireless technology such as Bluetooth can be used to build a personal area network connecting only devices that are close enough to the user. Acting on behalf of the user and based on a number of aspects, the software agent runs a quality of service (QoS) negotiation and selection algorithm to select the most appropriate available service(s) to be used for a given communication session. The software agent selects as well the configuration parameters for each service. The proposed architecture supports also service hand‐off to recompense for service volatility during user movement. Copyright © 2004 John Wiley & Sons, Ltd.