The serverless architecture has attracted significant attention due to its cost-effectiveness and ease of management. However, the serverless framework increases the attack surface of applications, resulting in frequent security incidents. Consequently, conducting comprehensive attack investigation and analysis in serverless applications has become critically important. Current serverless investigation methods face challenges such as dependency explosion (DE), incomplete information records, and lack of user transparency. These challenges lead to inadequate visibility of application interaction behaviors, complicating effective attack investigation and analysis. To mitigate these issues, this paper introducesErinyes, a solution that facilitates request-level attack investigation and analysis in serverless environments through the construction of provenance graph.Erinyesimproves the visibility of serverless applications via three core components. The partition enabling module effectively partitions function operations based on incoming requests; the log collection module is responsible for aggregating audit and network logs pertinent to function operations; and the provenance graph builder consolidates and parses the collected logs into a comprehensive provenance graph.Erinyeshas been evaluated on the OpenFaaS platform in 5 distinct attack scenarios, achieving an average accuracy of 99.6% in execution partition, a completeness of 100% in provenance graph, and an average runtime overhead of 7.05%.

Camouflage image generation plays a vital role in various research fields. Current methods typically rely on manually selecting and blending objects with backgrounds, which often produce incongruous combinations where the object does not seamlessly integrate with the background, leading to unrealistic and unnatural visual outcomes. To address these challenges, we introduce a novel Attention Fusion Diffusion Model (AFDM) designed to generate realistic camouflage images from a single input image containing an object and its surrounding background. The AFDM framework is comprised of two essential components: an Attention Fusion Module, which adeptly integrates object features with surrounding background information to produce convincingly camouflaged objects, and a content guidance strategy designed to mitigate content drift during the fusion process, thereby ensuring that the camouflaged image remains faithfully aligned with the original content. In addition, we build the outdoor Solidier Dataset(OSD) for advancing camouflage target recognization and in-depth research on this topic. Extensive experiments and user studies demonstrate the performance of our method in camouflage image generation and its potential to enhance image segmentation-related fields. Our code and dataset will be available at https://github.com/xhxhzhz/AFDM.

The Intrusion Detection System (IDS) is an essential component of cybersecurity for Advanced Persistent Threat (APT) defense. A successful APT attack is a series of tactics aimed at achieving specific goals. Due to the versatility of these tactics, IDS must respond to numerous novel and previously unobserved attacks. However, traditional IDS systems are ineffective in defending against unknown attacks, as they assume that training and real data belong to the same distribution. To tackle this problem, we introduce OpenSentinel, which leverages a deep open set recognition method to effectively detect unknown attacks and pinpoint them to specific APT stages. With a specially designed log modeling approach and a neural network model, OpenSentinel generates human-readable reports to characterize attacks and facilitate further analysis for security experts. We validate the detection performance of OpenSentinel in two experimental environments with over 100 scenarios. Qualitative and quantitative results demonstrate that our method achieves an accuracy of over 90% and remains robust when facing real-world attacks. Meanwhile, we developed a benchmark APT attack dataset with well-defined stages named BeATT&CKed, which can be used for future research.

In the era where Web3.0 values data security and privacy, adopting groundbreaking methods to enhance privacy in recommender systems is crucial. Recommender systems need to balance privacy and accuracy, while also having the ability to overcome cold start problems. The Differential Trust Mechanism (DTM) introduced in this paper is such an approach. The DTM provides a unique use of Gaussian distributions in modeling trust relationships within data, offering a novel way to balance recommendation accuracy with user privacy. This mechanism innovatively applies differential privacy principles, using Gaussian noise addition to protect individual user data from inference attacks, while maintaining the integrity and utility of the overall dataset. Unlike traditional anonymization techniques that often compromise data utility or vulnerability to reverse engineering, DTM provides a robust solution by dynamically adjusting privacy levels based on the trustworthiness of data requests. By combining DTM with existing mainstream recommendation algorithms, the prediction accuracy of MAE and RMSE increases by at least 6.60% and 2.69%, respectively. This dual benefit positions DTM as a significant advancement in secure data processing, especially relevant for online businesses and platforms where personalized recommendations are crucial yet privacy concerns are paramount.

Cyberattacks have caused significant damage and losses in various domains. While existing attack investigations against cyberattacks focus on identifying compromised system entities and reconstructing attack stories, there is a lack of information that security analysts can use to locate software vulnerabilities and thus fix them. In this paper, we present AiVl, a novel software vulnerability location method to push the attack investigation further. AiVl relies on logs collected by the default built-in system auditing tool and program binaries within the system. Given a sequence of malicious log entries obtained through traditional attack investigations, AiVl can identify the functions responsible for generating these logs and trace the corresponding function call paths, namely the location of vulnerabilities in the source code. To achieve this, AiVl proposes an accurate, concise, and complete specific-domain program modeling that constructs all system call flows by static-dynamic techniques from the binary, and develops effective matching-based algorithms between the log sequences and program models. To evaluate the effectiveness of AiVl, we conduct experiments on 18 real-world attack scenarios and an APT, covering comprehensive categories of vulnerabilities and program execution classes. The results show that compared to actual vulnerability remediation reports, AiVl achieves a 100% precision and an average recall of 90%. Besides, the runtime overhead is reasonable, averaging at 7%.

Empathy is the ability to share someone else’s feelings or experiences; it influences how people interact and relate. Socially assistive robots (SAR) are a promising means of conveying and eliciting empathy toward facilitating human-robot interaction. This work examines factors that influence the amount of empathy elicited by a SAR storyteller and users’ perceptions of that robot. We conducted an empirical mixed-design study (N=46) using an autonomous SAR storyteller that told three stories, each with a different human or robot target of empathy. The robot storyteller used the first-person narrative voice (1PNV) with half of the participants and the third-person narrative voice (3PNV) with the other half. We found that the SAR storyteller elicited significantly more empathy when the story target of empathy matched the SAR narrator, i.e., was also a robot. Additionally, the 1PNV robot elicited significantly more empathy and was perceived as more human-like, easy to interact with, and trustworthy than the 3PNV robot. Finally, participants who empathized more with the robot displayed facial expressions consistent with the emotional story content. These insights inform the design of SAR storytellers capable of eliciting empathy toward creating compelling and effective human-robot interactions.

Virtual and robotic agents capable of perceiving human empathy have the potential to participate in engaging and meaningful human-machine interactions that support human well-being. Prior research in computational empathy has focused on designing empathic agents that use verbal and nonverbal behaviors to simulate empathy and attempt to elicit empathic responses from humans. The challenge of developing agents with the ability to automatically perceive elicited empathy in humans remains largely unexplored. Our paper presents the first approach to modeling user empathy elicited during interactions with a robotic agent. We collected a new dataset from the novel interaction context of participants listening to a robot storyteller (46 participants, 6.9 hours of video). After each storytelling interaction, participants answered a questionnaire that assessed their level of elicited empathy during the interaction with the robot. We conducted experiments with 8 classical machine learning models and 2 deep learning models (long short-term memory networks and temporal convolutional networks) to detect empathy by leveraging patterns in participants’ visual behaviors while they were listening to the robot storyteller. Our highest-performing approach, based on XGBoost, achieved an accuracy of 69% and AUC of 72% when detecting empathy in videos. We contribute insights regarding modeling approaches and visual features for automated empathy detection. Our research informs and motivates future development of empathy perception models that can be leveraged by virtual and robotic agents during human-machine interactions.

OBJECTIVE: To compare the use of structured reporting software and the standard electronic medical records (EMR) in the management of patients with bladder cancer. The use of a human factors laboratory to study management of disease using simulated clinical scenarios was also assessed. DESIGN: eCancerCare(Bladder) and the EMR were used to retrieve data and produce clinical reports. Twelve participants (four attending staff, four fellows, and four residents) used either eCancerCare(Bladder) or the EMR in two clinical scenarios simulating cystoscopy surveillance visits for bladder cancer follow-up. MEASUREMENTS: Time to retrieve and quality of review of the patient history; time to produce and completeness of a cystoscopy report. Finally, participants provided a global assessment of their computer literacy, familiarity with the two systems, and system preference. RESULTS: eCancerCare(Bladder) was faster for data retrieval (scenario 1: 146 s vs 245 s, p=0.019; scenario 2: 306 vs 415 s, NS), but non-significantly slower to generate a clinical report. The quality of the report was better in the eCancerCare(Bladder) system (scenario 1: p<0.001; scenario 2: p=0.11). User satisfaction was higher with the eCancerCare(Bladder) system, and 11/12 participants preferred to use this system. LIMITATIONS: The small sample size affected the power of our study to detect differences. CONCLUSIONS: Use of a specific data management tool does not appear to significantly reduce user time, but the results suggest improvement in the level of care and documentation and preference by users. Also, the use of simulated scenarios in a laboratory setting appears to be a valid method for comparing the usability of clinical software.