Containers have become a critical component of cloud-native technologies, enabling organizations to run scalable and isolated workloads. However, in recent years there has been an increase in the sophistication of attacks targeting the cloud-native environment. It is crucial to implement security controls that protect containers at all stages of their lifecycle to mitigate risks such as privilege escalation by malicious applications. Numerous studies have aimed to develop security profiles for container applications that limit their privileges and protect the host system from compromise. Despite these efforts, the shared underlying kernel may still permit several successful attacks. In this study, we strive to develop a concise system call whitelist to address the problem of excessive privileges while ensuring the operational availability of applications. To achieve this, we propose to enhance static analysis with dynamic analysis to gather comprehensive information about the containerized application during two distinct execution phases: the initialization and the serving phases. Using this information, we determine the essential system calls for the application's operation and prevent all unwarranted system calls. We then perform crash analysis on the container under test to identify and incorporate any missing system calls. Through numerous experiments with popular server applications, we confirm that our approach is effective in discovering the necessary system calls for the operation of containerized applications. The system call whitelists produced by this method are more concise than Docker's default seccomp profile, consequently reducing the attack surface for a wide variety of applications and host systems significantly.

Deepfakes, an increasingly prevalent form of information attack, pose serious threats to security and privacy. Deepfake voice attacks, in particular, have the potential to cause widespread disruption, creating an urgent need for an effective detection system. In this research, we propose the Trident of Poseidon - a novel set of triad training strategies aimed at enhancing the generalizability of deepfake voice detection models. Our solution comprises three key components: (1) Supervised Contrastive Learning, (2) Hard Negative Mining by Audio Re-synthesizing, and (3) Effective Proactive Batch Sampling. Together, these enable the model to learn more robust features. Our extensive experiments demonstrate that our approach outperforms existing methods in both in-domain and out-of-domain testing scenarios, making significant strides toward securing digital media against deepfake voice attacks.

Voice phishing (vishing) is increasingly popular due to the development of speech synthesis technology. In particular, the use of deep learning to generate an arbitrary-content audio clip simulating the victim’s voice makes it difficult not only for humans but also for automatic speaker verification (ASV) systems to distinguish. Countermeasure (CM) systems have been developed recently to help ASV combat synthetic speech. In this work, we propose BTS-E, a framework to evaluate the correlation between Breathing, Talking (speech), and Silence sounds in an audio clip, then use this information for deepfake detection tasks. We argue that natural human sounds, such as breathing, are hard to synthesize by Text-to-speech (TTS) system. We conducted a large-scale evaluation using ASVspoof 2019 and 2021 evaluation set to validate our hypothesis. The experiment results show the applicability of the breathing sound feature in detecting deepfake voices. In general, the proposed system significantly increases the performance of the classifier by up to 46%.