Today, the pervasive influence of technology has created significant cybersecurity challenges, exacerbated by human error that is often overlooked in system design. Reports show that up to 95% of cyber attacks are due to human factors, such as susceptibility to phishing and lax software maintenance. Italian public administrations (PAs) face heightened cyber risks due to underinvestment compared to the private sector. To address these challenges, the DAMOCLES research project provides a tailored framework focusing on Human Vulnerability Assessment (HVA) and Human Vulnerability Mitigation (HVM). HVA activities include behavior-based assessments and controlled cyber-attack testing using Digital Twins (DT) to mirror user behavior. HVM uses insights from HVA to develop customized training programs, supported by non-coding approaches for easy adoption. DAMOCLES aims to improve cybersecurity in Italian government agencies by effectively addressing human-related security vulnerabilities.

Trigger-action platforms (TAPs) enable users without programming experience to personalize the behavior of Internet of Things applications and services through IF-THEN rules. Unfortunately, the arbitrary connection of smart devices and online services, even with simple rules, such as “IF the entrance Netatmo Wheather Station detects a temperature above 30 \({}^{\circ}C\) ( \(86^{\circ}F\) ) THEN open the shutters in the living room,” might expose users to potential security and privacy risks (e.g., the execution of the previous rule might provide an easy entry point for thieves, especially during the summer vacation period). The goal of our research is to make the users capable of understanding and mitigating the threats and risks associated with the execution of IF-THEN rules. To this end, we define a new challenging task, namely generating post hoc justifications of privacy and security risks associated with automation rules, and propose a novel natural language generation strategy based on hybrid prompt learning producing justifications in the form of real-life threat scenarios. The proposed strategy allows for prompt customization with task-specific information, providing contextual details enabling to grasp the nuances and subtleties of the domain language, resulting in more coherent justifications. The experiments conducted on the if-this-then-that (IFTTT) platform show that our method produces effective justifications, improving the explainability of discrete and hybrid prompting methods up to 27% in BLEURT score. The code of the software is publicly available on GitHub 1 .

Over the past decade, there have been numerous extensions to the definition of Functional Dependency (fd), culminating in the introduction of Relaxed Functional Dependency (rfd), offering more flexible constraints compared to traditionalfds. This increased flexibility makesrfds well-suited for exploring and profiling data in datasets with lower data quality. However, efficiently identifyingrfds within dynamic data sources presents a significant challenge, as it requires processing an entire dataset from scratch whenever modifications occur. To tackle this problem, incremental discovery algorithms have been defined, but they often suffer when the frequency and the size of batches of updates increase. This article presents a new algorithm, namelyD-IndiBits, relying on a new decentralized architecture to balance the workload that drives the incremental discovery process ofIndiBits, which is based on bitwise operators for computing attribute similarities. Experiments demonstrateD-IndiBits's effectiveness compared tofdandrfddiscovery algorithms on both static and dynamic real-world data. With batches of modifications of sizes 10 k and 100 k,D-IndiBitsis capable of updating the set ofrfds in a few seconds, whereas all other approaches often employ more than 3 hours.

One of the main challenges in data profiling is to efficiently extract metadata from dynamic information sources, by avoiding the processing of the whole dataset from scratch upon modifications. In this paper, we present IndiBits, an algorithm for discovering relaxed functional dependencies (RFDs for short), which represent data relationships relying on approximate matching paradigms. IndiBits is able to dynamically infer and update the RFDs holding on a dataset upon modification operations performed on it. It exploits a binary representation of data similarities, a new validation method, and specific search methods, to dynamically update the set of RFDs, based on previously holding RFDs and the type of modifications performed over data. Experimental results demonstrate the effectiveness of IndiBits on real-world datasets, even in comparison with FD and RFD discovery algorithms in both static and dynamic scenarios.

Trigger-action platforms are systems that enable users to easily define, in terms of conditional rules, custom behaviors concerning Internet of Things (IoT) devices and Web services. Unfortunately, although these tools stimulate the creativity of users in building automation, they may also introduce serious risks for the users. Indeed, trigger–action rules can lead to the possibility of users harming themselves, for example, by unintentionally disclosing nonpublic information, or unwillingly exposing their smart environment to cyber-threats. In this article, we propose to use natural language processing (NLP) techniques to detect automation rules, defined within trigger–action IoT platforms, that potentially violate the security or privacy of the users. The proposed NLP-based models capture the semantic and contextual information of the trigger-action rules by applying classification techniques to different combinations of rule’s features. We evaluate the proposed solution with the mainstream trigger-action platform, namely, If-This-Then-That, by training the NLP models with a data set of 76 741 rules labeled by using an ensemble of three semi-supervised learning techniques. The experimental results demonstrate that the model based on bidirectional encoder representations from transformers (BERTs) obtains the highest performances when trained on all features, achieving average Precision and Recall values between 88% and 93%. We also compare the achieved performances with those of a baseline system implementing information flow analysis.

Nowadays, when dealing with Internet of Things (IoT) for people with no prior experience in programming or in designing technology, End-User Development (EUD) solutions offer wide and powerful approaches to support end-users in designing their own IoT smart things and systems. The main goal of this edition of the workshop is to encourage and stimulate a wealthy confrontation on heterogeneous topics related to EUD for IoT applications that exploits different interaction paradigms and innovative interface design. The outcome of the workshop are thought-provoking contributions that range from accessibility and security for IoT systems and devices up to personalization of smart objects.

Abstract Gestural expressiveness plays a fundamental role in the interaction with people, environments, animals, things, and so on. Thus, several emerging application domains would exploit the interpretation of movements to support their critical designing processes. To this end, new forms to express the people’s perceptions could help their interpretation, like in the case of music. In this paper, we investigate the user’s perception associated with the interpretation of sounds by highlighting how sounds can be exploited for helping users in adapting to a specific environment. We present a novel algorithm for mapping human movements into MIDI music. The algorithm has been implemented in a system that integrates a module for real-time tracking of movements through a sample based synthesizer using different types of filters to modulate frequencies. The system has been evaluated through a user study, in which several users have participated in a room experience, yielding significant results about their perceptions with respect to the environment they were immersed.

Nowadays, the amount of information spread over networks is extremely large, and many sensible data are granted by legitimate owners aiming to exploit different networking services. In particular, the majority of people give their own consent for processing personal data without understanding how network providers will manage them, and if they will be shared among different network providers. In this paper, we propose a tool exploiting visualization techniques in order to make a user aware of how his/her personal data are exchanged and shared during daily web browsing activities. In particular, the proposed tool enables a user to interactively visualize the communication flows during the aforesaid browsing process, and to discover possibly hidden network providers involved in it. Moreover, the graphical interface also provides real-time summary graphs, which show the amount of information acquired from the network. Finally, we performed several users studies aiming to analyse how the tool can improve the user's perception on the privacy issues that s/he is exposed to. Results demonstrate the effectiveness of the proposed tool.