While the web interfaces of remotely managed devices offer convenience, their unstructured content can inadvertently leak geographic locations, posing a significant security risk. We aim to assess the feasibility of automatically exploiting this leakage, serving as a clear warning to cybersecurity regulators. To this end, we propose WebGeoInfer, a framework that does not rely on page structure. It extracts clues through page clustering and differential analysis to overcome the challenge of information heterogeneity. It also leverages search engines and large language models to augment sparse clues and infer precise coordinates, addressing the challenge of information sparsity. In large-scale experiments, WebGeoInfer successfully located 5,435 devices across 94 countries and 2,056 cities, achieving accuracy rates as high as 96.96% at the country level, 88.05% at the city level, and 79.70% at the street level. These findings provide the first conclusive evidence of the reality and scale of this threat. Furthermore, our analysis offers new insights and mitigation strategies for affected devices, establishing a key benchmark for future security research.

With the help of advanced sensors, virtual reality (VR) apps provide users with an immersive experience, but they also have the potential to collect a wider range of user data compared to traditional web and mobile apps. As a result, increasing numbers of regulations are being introduced globally, emphasizing the need for app developers to provide privacy policies that inform users about data collection, usage, and sharing (CUS) process. Unfortunately, despite the significant efforts made by VR developers to improve app performance, it remains unclear how they ensure their privacy policies comply with regulations and meet user expectations. In this study, we proposeVPVetto automatically vet privacy policy issues for VR apps. We first summarize five vetting criteria based on a study of privacy policies from popular apps: availability, completeness, granularity, minimization, and consistency. We then dissect VR data and entity ontologies and manually generate VR-related CUS sentences to fine-tune privacy policy language models, overcoming performance degradation when handling VR domain-specific sentences. Finally, we construct the largest VR privacy policy dataset to date, namedVRPP, consisting of privacy policies from 11,923 VR apps across 10 mainstream platforms. These policies were crawled in late 2022 and early 2025 to investigate the evolution of the VR ecosystem. Our vetting process examines platform, app category, and longitudinal perspectives, revealing that VR privacy policies have shown severe privacy issues over the past few years, including limited availability, poor quality, coarse granularity, a lack of adaptation to VR-specific traits, and inconsistencies between CUS statements and actual app behaviors.

Virtual reality (VR) apps can harvest a wider range of user data than web/mobile apps running on personal computers or smartphones. Existing law and privacy regulations emphasize that VR developers should inform users of what data are collected/used/shared (CUS) through privacy policies. However, privacy policies in the VR ecosystem are still in their early stages, and many developers fail to write appropriate privacy policies that comply with regulations and meet user expectations. In this paper, we propose VPVet to automatically vet privacy policy compliance issues for VR apps. VPVet first analyzes the availability and completeness of a VR privacy policy and then refines its analysis based on three key criteria: granularity, minimization, and consistency of CUS statements. Our study establishes the first and currently largest VR privacy policy dataset named VRPP, consisting of privacy policies of 11,923 different VR apps from 10 mainstream platforms. Our vetting results reveal severe privacy issues within the VR ecosystem, including the limited availability and poor quality of privacy policies, along with their coarse granularity, lack of adaptation to VR traits and the inconsistency between CUS statements in privacy policies and their actual behaviors. We open-source VPVet system along with our findings at repository https://github.com/kalamoo/PPAudit, aiming to raise awareness within the VR community and pave the way for further research in this field.

This study proposes a novel approach that utilizes Kolmogorov-Arnold Networks (KAN) for detecting fraud in trade orders within supply chains. The increasing prevalence of order fraud in supply chains poses a significant threat to the economic interests and reputations of organizations. Traditional fraud detection methods have limitations when addressing high-dimensional nonlinear data; however, the KAN model, with its superior nonlinear fitting capabilities and ability to learn complex data patterns, has emerged as a powerful tool for tackling this issue. In this study, we employ a high-dimensional dataset comprising a substantial number of actual trade orders and construct a KAN model for order fraud detection through systematic data cleaning and feature extraction. The experimental results demonstrate that the KAN model significantly outperforms traditional machine learning methods and other neural network models in identifying fraudulent orders, excelling in several evaluation metrics, including accuracy and F1 score. Furthermore, the KAN model exhibits enhanced robustness in addressing the data imbalance problem and effectively reduces the false alarm rate. This study not only validates the application potential of the KAN model in supply chain risk management but also offers new ideas and methodologies to further advance fraud detection technology.

The rapid development of the smart healthcare system makes the early-stage detection of dementia disease more user-friendly and affordable. However, the main concern is the potential serious privacy leakage of the system. In this article, we take Alzheimer's disease (AD) as an example and design a convenient and privacy-preserving system namedADDetectorwith the assistance of Internet of Things (IoT) devices and security mechanisms. Particularly, to achieve effective AD detection,ADDetectoronly collects user's audio by IoT devices widely deployed in the smart home environment and utilizes novel topic-based linguistic features to improve the detection accuracy. For the privacy breach existing in data, feature, and model levels,ADDetectorachieves privacy-preserving by employing a unique three-layer (i.e., user, client, cloud, etc.) architecture. Moreover,ADDetectorexploitsfederated learning (FL) based schemeto ensure the user owns the integrity of raw data and secure the confidentiality of the classification model and implementdifferential privacy (DP) mechanismto enhance the privacy level of the feature. Furthermore, to secure the model aggregation process between clients and cloud in FL-based scheme, a novelasynchronous privacy-preserving aggregation frameworkis designed. We evaluateADDetectoron 1010 AD detection trials from 99 health and AD users. The experimental results show thatADDetectorachieves high accuracy of 81.9% and low time overhead of 0.7 s when implementing all privacy-preserving mechanisms (i.e., FL, DP, and cryptography-based aggregation).

As an important driving factor of emerging Internet-of-Things (IoT) applications, machine learning algorithms are currently facing the challenge of how to “clean” data noise, that is introduced during the training process (e.g., asynchronous execution and lossy data compression and quantization). In an attempt to guarantee data quality, various data cleaning approaches have been proposed to filter out abnormal data entries based on the global data distribution. However, most existing data cleaning approaches are based on a centralized paradigm and thus cannot be applied to future edge-based IoT applications, where each edge node (EN) has only a limited view of the global data distribution. Moreover, the increasing demand for privacy preservation largely prevents ENs from combining their data for centralized cleaning. In this study, we propose a federated data cleaning protocol, coined as FedClean, for edge intelligence (EI) scenarios that is designed to achieve data cleaning without compromising data privacy. More specifically, different ENs first generate Boolean shares of their data and distribute them to two noncolluding servers. These two servers then run the FedClean protocol to privately and efficiently compute the attribute value frequency (AVF) scores of the collected data entries, which are then sorted in ascending order via a bitonic sorting network without revealing their values. As a result, data entries with lower AVF scores are considered as abnormal and filtered out. The security, efficiency, and effectiveness of the proposed approach are then demonstrated via concrete security analysis and comprehensive experiments.

Mobile crowdsensing (MCS) has gained popularity for its potential to leverage individual mobile devices to sense, collect, and analyze data instead of deploying sensors. As the sensing data become increasingly fine-grained and complicated, there is a tendency to enhance MCS with the edge computing paradigm to reduce time delays and high bandwidth costs. The sensing data may reveal personal information, and thus it is of great significance to preserve the privacy of the participants. However, preserving privacy may hinder the process of handling malicious participants. In this paper, we propose two privacy preserving reputation management schemes for edge computing enhanced MCS to simultaneously preserve privacy and deal with malicious participants. In the basic scheme, a novel reputation value updating method is designed based on the deviations of the encrypted sensing data from the final aggregating result. The basic scheme is efficient at the expense of revealing the deviation value of each participant to the reputation manager. To conquer this drawback, we propose an advanced scheme by updating the reputation values utilizing the rank of deviations. Extensive experiments demonstrate that both these two schemes have high cost efficiency and are effective to deal with malicious participants.

Cognitive Radio (CR) technique is proved to be an efficient approach for mitigating the spectrum scarcity problem in wireless communications and spectrum allocation methods construct the foundation of such a technique. However, it will degrade the performance of CR when paying no attention to the behavior of second users (SUs) and their demands for spectrum attribute. In this paper, the spectrum allocation problem is first modeled as a coalition formation game, taking SUs reputation and requirements of spectrums into consideration. The rule named Assigning spectrum by probability among coalitions and by demand within coalitions is used to optimize the spectrum utilization and fairness when allocating spectrum among SUs. For each SU is equipped with an agent, a central authority is not needed and therefore the scheme can be more applicable in dynamic cognitive radio networks. Simulation results show that the proposed approach can efficiently improve the fairness and efficiency of spectrum allocation in CR context.

The multimedia social network (MSN), a combination of the multimedia sharing technology and social network, has prominent social features and diffusion characteristics. Owing to its centerlessness and lack of regulation, MSNs have some serious network environment problems, such as spread of negative digital content and serious data redundancy. To solve the above problems, this paper proposes a strong and weak ties feedback-based trust model in MSNs on the basis of the Weak Ties Theory of sociology. This model evaluates the trust level from two different aspects, multimedia content and user behaviors, and computes the reputation value by the Bayesian estimation principle and the damped window mechanism. On the basis of the trust model, we establish a trust-based information dissemination model in MSNs to study the relationship between trust and digital content dissemination. Simulation results indicate that the trust model is reliable in design, valid in network transmission, and effective in resisting malicious feedback and collusive attacks, enables positive digital data to spread rapidly and widely, and limits the dissemination of negative content.