Integration of machine learning (ML) components in critical applications introduces novel challenges for software certification and verification. New safety standards and technical guidelines are under development to support the safety of ML-based systems, e.g., ISO 21448 SOTIF for the automotive domain and the Assurance of Machine Learning for use in Autonomous Systems (AMLAS) framework. SOTIF and AMLAS provide high-level guidance but the details must be chiseled out for each specific case. We initiated a research project with the goal to demonstrate a complete safety case for an ML component in an open automotive system. This paper reports results from an industry-academia collaboration on safety assurance of SMIRK, an ML-based pedestrian automatic emergency braking demonstrator running in an industry-grade simulator. We demonstrate an application of AMLAS on SMIRK for a minimalistic operational design domain, i.e., we share a complete safety case for its integrated ML-based component. Finally, we report lessons learned and provide both SMIRK and the safety case under an open-source license for the research community to reuse.

Many cloud-application vendors open their APIs for third-party developers to easily extend the functionality of their applications. The features implemented with these APIs are called add-ons (also called add-ins or apps). This is a relatively new phenomenon, and its effects on the application security have not been widely studied. It seems likely that some of the add-ons have lower code quality than the core applications themselves and, thus, may bring in security vulnerabilities. In this work, we found that many of such add-ons are vulnerable to cross-site scripting (XSS). The attacker can take advantage of the document-sharing and messaging features of the cloud applications to send malicious input to them. The vulnerable add-ons then execute client-side JavaScript from the carefully crafted malicious input. In a major analysis effort, we systematically studied 300 add-ons for three popular application suites, namely Microsoft Office Online, G Suite and Shopify, and discovered a significant percentage of vulnerable add-ons among them. We present the results of this study, as well as analyze the add-on architectures to understand how the XSS vulnerabilities can be exploited and how the threat can be mitigated.

The objective of the SOLSA project (EU-H2020) is to develop an analytical expert system for on-line-on-mine-real-time mineralogical and geochemical analyses on sonic drill cores. As one aspect of the system, this paper presents the building of the hyperspectral library and its incorporation into sparse unmixing techniques for mineral identification. Twenty seven spectra representing 14 minerals have been collected for the library. Three sparse unmixing techniques have been investigated and evaluated using simulated data generated from our hyperspectral library, and real hyperspectral data acquired from a serpentinized harzburgite sample. Among the three techniques, the collaborative sparse unmixing by variable splitting and augmented Lagrangian (CLSUnSAL) method provided the best accurate results on the simulated data. In addition, the results of the CLSUnSAL method show high correlation with that of the QEMSCAN® analysis on the harzburgite hyperspectral data.

Social relationships are a natural basis on which humans make trust decisions. Online Social Networks (OSNs) are increasingly often used to let users base trust decisions on the existence and the strength of social relationships. While most OSNs allow users to discover the length of the social path to other users, they do so in a centralized way, thus requiring them to rely on the service provider and reveal their interest in each other.

Imagine if there is a privacy-preserving mechanism for two mobile devices to determine if their owners have common friends. It can be useful for access control in applications like ride-sharing, sharing Internet access or even just a simple "people radar" app for showing nearby friends and friends-of-friends. Current mechanisms for doing this come at the cost of revealing these interactions and the users' locations to central servers. In a paper that appears in the WiSec 2015 proceedings, we describe Social Pal [2], a framework that allows privacy-preserving discovery of the distance between two users in a social network. Social Pal was implemented as a general purpose software framework that can be easily used by application developers who wish to incorporate such functionality into their applications.