Cryptography and Machine Learning are two computational science fields that intuitively seem related. Privacy-preserving machine learning-either utilizing encrypted models or learning over encrypted data-is an exploding field thanks to the maturation of primitives such as fully homomorphic encryption and secure multiparty computation. However there has been surprisingly little work on applying recent advances in machine learning to the task of cryptanalysis, the branch of cryptography that studies how cryptographic ciphers can be attacked. In particular, while a cryptographic cipher seeks to keep certain information secret by making it appear random, discerning patterns and structure from random data is a common machine learning task. This paper proposes EveGAN, an approach that treats cryptanalysis as a language translation problem. While treating cipher cracking as a language translation problem has been validated against a handful of classical substitution ciphers, the EveGAN approach builds on these results to create a new class of generative deep learning-based cryptanalysis attacks.

This workshop addresses the security and privacy issues that have developed as our society has become more interconnected, specifically with respect to multimedia data generated in the context of the Internet of Things (IoT) and Web 2.0/3.0. The word "multimedia" here has expanded beyond its original scope. With the rise of social media and online P2P sharing services, large quantities of multimedia data (e.g., pictures, videos, audio, and computer graphics) are being created and shared constantly. When all these data are stored in a networked environment, many people can connect to it for viewing, sharing, commenting, and storing information. Particularly, multimedia data in IoT networks serves a significant purpose as many people's status, locations, and live actions can be seen, disseminated, tracked, commented on, and monitored in real time. IoT opens up many possibilities for attacks since more people can broadcast themselves and allow their networks and networks' networks to view and share in their lives.

In 2009, Craig Gentry introduced the first "fully" homomorphic encryption scheme allowing arbitrary circuits to be evaluated on encrypted data. Homomorphic encryption is a very powerful cryptographic primitive, though it has often been viewed by practitioners as too inefficient for practical applications. However, the performance of these encryption schemes has come a long way from that of Gentry's original work: there are now several well-maintained libraries implementing homomorphic encryption schemes and protocols demonstrating impressive performance results, alongside an ongoing standardization effort by the community. In this tutorial we survey the existing homomorphic encryption landscape, providing both a general overview of the state of the art, as well as a deeper dive into several of the existing libraries. We aim to provide a thorough introduction to homomorphic encryption accessible by the broader computer security community. Several of the presenters are core developers of well-known publicly available homomorphic encryption libraries, and organizers of the homomorphic encryption standardization effort \hrefhttp://homomorphicencryption.org/. This tutorial is targeted at application developers, security researchers, privacy engineers, graduate students, and anyone else interested in learning the basics of modern homomorphic encryption.The tutorial is divided into two parts: Part I is accessible by everyone comfortable with basic college-level math; Part II will cover more advanced topics, including descriptions of some of the different homomorphic encryption schemes and libraries, concrete example applications and code samples, and a deeper discussion on implementation challenges. Part II requires the audience to be familiar with modern C++.

Malware mitigation for mobile technology is a long-standing problem for which there is not yet a good solution. In this paper, we focus on identifying malicious applications, and verifying the absence of malicious or vulnerable code in applications that agencies seek to utilize. Our analysis toolbox includes static analysis and permissions risk scoring as pre-installation vetting techniques designed to prevent malware from being installed on devices on an enterprise network. However, dynamic code-loading techniques and changing security requirements mean that applications which previously passed the static analysis verification process, and have been installed on devices, may no longer meet security standards, and may be malicious. To identify these apps, and prevent their future malfeasance, we propose a crowd-sourced behavioral analysis (CSBA) technique, using machine learning to identify anomalous activity by examining patterns in power consumption, network behavior, and sequences of system calls. These techniques apply effectively to a single user's device over time, as well as to individual devices within an enterprise network.

Botnet malware, which infects Internet-connected devices and seizes control for a remote botmaster, is a long-standing threat to Internet-connected users and systems. Botnets are used to conduct DDoS attacks, distributed computing (e.g., mining bitcoins), spread electronic spam and malware, conduct cyberwarfare, conduct click-fraud scams, and steal personal user information. Current approaches to the detection and classification of botnet malware include syntactic, or signature-based, and semantic, or context-based, detection techniques. Both methods have shortcomings and botnets remain a persistent threat. In this paper, we propose a method of botnet detection using Nonparametric Bayesian Methods.

This workshop addresses the technical challenges arising from our current interconnected society. Multitudes of devices and people can be connected to each other by intelligent algorithms, apps, social networks, and the infrastructure set by Internet of Things (IoT). As more people and their devices are connected without much restriction, the issues of security, privacy, and trust remain a challenge. Multimedia in IoT services should provide a robust and resilient security platforms and solutions against any unauthorized access. Recent literature shows increased concerns about hacking, security breaches, data manipulation, social engineering, and new attack methods. Malware can be hidden within multimedia files and visiting infected websites can trigger its download to victims' machines. There are a multitude of techniques to steal personal information and other sensitive media for unauthorized dissemination; imposters/identity thefts are common in social networks. In order to demonstrate the effectiveness of resilient security and privacy solutions, methods such as new standards, advance cryptography, improved algorithms for intrusion detection, personalized privacy, and isolation of questionable or malicious files can be used independently or all together to minimize the threats.

The practicality of existing techniques for processing encrypted data stored in untrusted cloud environments is a limiting factor in the adoption of cloud-based applications. Both public and private sector organizations are reluctant to push their data to the cloud due to strong requirements for security and privacy of their data. In particular, mission-critical defense applications used by governments do not tolerate any leakage of sensitive data. In this paper, we propose Nomad, a framework for developing mission-critical cloud-based applications. The framework is comprised of: 1) a homomorphism encryption-based service for processing encrypted data directly within the untrusted cloud infrastructure, and 2) a client service for encrypting and decrypting data within the trusted environment, and storing and retrieving these data to and from the cloud. Both services are equipped with GPU-based parallelization to accelerate the expensive homomorphic encryption operations. To evaluate the Nomad framework, we developed Call For Fire, amission-critical application which enables defense personnel to call for fire on targets. Due to the nature of the mission, this application requires guaranteed security. The experimental results highlight the performance enhancements of the GPU-based acceleration mechanism and the feasibility of the Nomad framework.