TCP SYN packets are typically meant to initiate a three-way handshake for new connections and do not carry a payload. The only exception, according to the standards, is TCP Fast Open, where data is transmitted as TCP SYN payload.

The adoption of the QUIC protocol has significantly improved the performance and security of modern internet applications, mainly due to the central role that encryption plays in the protocol. However, this emerging protocol introduces new vulnerabilities that can be exploited for malicious purposes. This paper investigates the resilience of QUIC to selective traffic manipulation attacks aimed at inflating network traffic, which can lead to increased operational costs for service providers and degraded user experiences.We present three distinct attacks designed to manipulate QUIC traffic by selectively dropping or manipulating packets. One attack can be executed by any middlebox in the network path between the client and the server, while the others require the attacker to have some previous control of QUIC components. Through experimental analysis, we evaluate the impact of these attacks on inflating the packet and data accounting. Our results show that attackers can effectively increase data traffic up to 50% of the original transmission size without altering the content of the QUIC communication. These findings highlight the potential for significant traffic inflation and offer insights into countermeasures that could mitigate the risks posed by these vulnerabilities.

The ubiquitous presence of Internet-of-Things devices represents a menace to cybersecurity since their low computational power does not allow classic countermeasures techniques. In recent years, anomaly detection using Machine Learning has acquired popularity among researchers; however, current datasets in literature are sub-optimal, making exhaustive benchmarks challenging to create. Moreover, the current proposed ML solutions do not consider the necessity of adapting to IoT networks that mutate fast. We propose a Continuous Learning approach to anomaly detection on IoT networks: frequent model retraining and the exploitation of previous knowledge allow a classifier to quickly adapt to new network configurations. We deployed this approach firstly by defining a benchmark methodology for ML algorithms that helps train and test models for anomaly detection in IoT networks. This phase allowed us to identify the best-performing algorithm for the task. Then, we employed Semi-supervised Learning techniques to deploy the continuous part concretely. Our results show that applying Continuous Learning can progressively improve anomaly detection performance in key metrics such as Recall (up to 75%) and Roc AUC (up to 33%).

In this work, we present ISIDE, the prototype of a student dropout alert system integrated within Infostud, i.e., the online student portal of the Sapienza University of Rome. Our proposed solution is based on a student dropout prediction (SDP) module built from a large dataset of academic records using advanced machine learning techniques. Offline experiments show that the best-performing SDP model can detect students prone to leave the school with an F1score of 0.92. To further validate our prototype online, we run a pilot study on a subset of students from our School of Information Engineering, Informatics, and Statistics. This study shows that our prototype can detect students who are most likely to drop out early, as it clearly separates them from those with higher key engagement indicators.