Even though Large Language Models (LLMs) are highly beneficial, they pose significant security concerns, particularly in the realm of privacy protection. Sensitive information is often provided to LLMs during conversations and may be retained as in-context memory. This raises the risk of unintended data exposure. In the existing paradigm, a red team comprising human testers is tasked with generating input prompts (i.e., test cases) to provoke undesirable responses from LLMs. Yet, relying solely on human testers is both costly and time-intensive. This paper presents AutoRed, an innovative learning framework developed to automatically generate malicious attack scenarios for extracting sensitive information from LLMs. Our framework places particular emphasis on prompt injection—the process of injecting malicious prompts to extract conversation histories from LLMs to uncover private data. AutoRed comprises three key components: malicious prompt generator, sensitive information extractor, and stop point identifier. These components work together to enable prompt injection, ensuring a seamless process. Our extensive experimental evaluation, spanning diverse defense strategies and various LLMs, demonstrates the efficacy of AutoRed. This evaluation not only rigorously assesses the resilience of defense mechanisms but also measures the safety alignment of LLMs, thereby highlighting the potential of our automated framework as an efficient red teaming tool for identifying vulnerabilities and enhancing security within LLMs.

SQL injection (SQLi) compromises database-driven applications by enabling attackers to insert malicious SQL commands via input fields, potentially leading to unauthorized access, data manipulation, or system compromise. In recent years, alongside the development of various rule-based Web Application Firewalls (WAFs) aimed at mitigating SQL injection attacks, there has also been a notable rise in the utilization of machine learning and deep learning techniques to address this issue. Although significant progress has been made in these studies, detecting and mitigating SQLi-related attacks continues to present a significant challenge. A crucial factor contributing to the lack of extensive SQLi detection solutions is the absence of a comprehensive testing methodology. In this work, we introduce XploitSQL-an innovative approach to advance adversarial SQL injection generation by leveraging language models and reinforcement learning. Our model is trained to produce evasive SQLi samples, enhancing the robustness of SQLi detection models and offering opportunities for more comprehensive detection strategies. To assess the efficacy of the proposed method, we employed state-of-the-art SQL injection detection models in conjunction with commercially available web-based firewalls. Across all tested detection models, detection rates declined when faced with evasive samples generated by XploitSQL. Furthermore, our model outperforms existing methods for generating attack samples.

Fraudulent activities within the U.S. healthcare system cost billions of dollars each year and harm the wellbeing of many qualifying beneficiaries. The implementation of an effective fraud detection method has become imperative to secure the welfare of the general public. In this article, we focus on the problem of fraud detection using the current year's Medicare claims data from the perspective of utilizing temporal information from the previous years. We group the data into temporal trajectories of the key covariates and base our feature engineering around these trajectories. For effective feature engineering on the temporal data, we propose to use the functional principal component analysis (FPCA) method for analyzing the temporal covariates’ trajectory as well as the distributional FPCA for extracting features from the empirical probability density curve of the covariates. Moreover, we introduce the framework of cost-sensitive learning for analyzing the Medicare database to allow for asymmetrical losses in the confusion matrix, such that the classification rule reflects the realistic tradeoff between the fixed cost and the fraud cost. The issue of class imbalance in the database is tackled through the random undersampling scheme. Our results confirm that the trained classifier has a reasonably good prediction performance and a significant percentage of cost savings can be achieved by taking into account the financial cost.

Tracking fishing vessels individually plays a pivotal role in fisheries monitoring, control, and surveillance. Fishing trip is the most appropriate granularity level to study routine fishing activity patterns. Since self-reported information about fishing vessel trips is notoriously unreliable, we propose here TripTracker, an unsupervised learning approach to partition raw trajectories of ships and boats engaging in fishing into trips and identify trip types. TripTracker first partitions a fishing trip into micro-activities, then uses cluster analysis to confirm the microactivity type. Next, it employs multiple Hidden Markov Models to partition the trip into segments, each of which representing a routine activity. Finally, TripTracker utilizes maritime contextual information to differentiate various fishing trip types, revealing actionable knowledge about vessel activities and their operations. Our experimental evaluation on a large real-world fishing vessel trajectory dataset, confirms TripTracker’s practicability and effectiveness for enhancing maritime domain awareness.

The impact of marine life on the oceans of our planet is undeniable and overfishing is a serious threat to marine ecosystems worldwide. Maritime domain awareness calls for continuous monitoring and tracking of fisheries using data from maritime intelligence sources to detect illegal fishing activities. Marine traffic data from vessel tracking services is a promising source for identifying, locating, and capturing vessel information. Given the volume of such data, manual processing is impossible, raising an immediate need for autonomous and smart systems to follow the footprints of vessels and detect their activity types in near real-time. To achieve this goal, we propose FishNET, a simple yet effective convolutional neural network (CNN) model for vessel trajectory classification. The model is trained using a set of invariant spatiotemporal feature sequences extracted from the behavioral characteristics of vessel movements.

In this paper we propose a data-driven approach to detection and tracking of dark fishing in high-volume marine traffic datasets from vessel tracking services. Dark fishing refers to stealthy fishing operations by vessels trying to hide their illicit activities related to various forms of illegal fishing-one of the most serious threats to world fisheries and fish populations worldwide as well as to global food security. Our approach builds on profiling and ranking fishing vessels by analyzing their routine operations over extended time periods to uncover abnormal activity patterns associated with dark fishing. The focus is on vessel movement patterns rendered as a trajectory with defined starting and endpoints such as ports and known anchorage locations. Specifically, we analyze scenarios where the fishing pattern, with the fishing gear in the water, is obscured in a vessel's reported trip data. Our experimental evaluation, using a large dataset of fishing vessel trajectories from coastal waters of North America, shows the effectiveness and efficiency of the proposed method in differentiating between suspicious and normal fishing vessels irrespective of the vessel type.

Intelligent monitoring and control of critical infrastructure such as electric power grids, public water utilities and transportation systems produces massive volumes of time series data from heterogeneous sensor networks. Time Series Forecasting (TSF) is essential for system safety and security, and also for improving the efficiency and quality of service delivery. Being highly dependent on various external factors, the observed system behavior is usually stochastic, which makes the next value prediction a tricky and challenging task that usually needs customized methods. In this paper we propose a novel deep learning based framework for time series analysis and prediction by ensembling parametric and nonparametric methods. Our approach takes advantage of extracting features at different time scales, which improves accuracy without compromising reliability in comparison with the state-of-the-art methods. Our experimental evaluation using real-world SCADA data from a municipal water management system shows that our proposed method outperforms the baseline methods evaluated here.

Considering the fact that fully immunizing critical infrastructure such as water supply or power grid systems against physical and cyberattacks is not feasible, it is crucial for every public or private sector to invigorate the detective, predictive, and preventive mechanisms to minimize the risk of disruptions, resource loss or damage. This paper proposes a methodical approach to situation analysis and anomaly detection in SCADA-based water supply systems. We model normal system behavior as a hierarchy of hidden semi-Markov models, forming the basis for detecting contextual anomalies of interest in SCADA data. Our experimental evaluation on real-world water supply system data emphasizes the efficacy of our method by significantly outperforming baseline methods.

Crime reduction and prevention strategies are vital for policymakers and law enforcement to face inevitable increases in urban crime rates as a side effect of the projected growth of urban population by the year 2030. Studies conclude that crime does not occur uniformly across urban landscapes but concentrates in certain areas. This phenomenon has drawn attention to spatial crime analysis, primarily focusing on crime hotspots, areas with disproportionally higher crime density. In this paper we present CRIMETRACER, a personalized random walk based approach to spatial crime analysis and crime location prediction outside of hotspots. We propose a probabilistic model of spatial behavior of known offenders within their activity space. Crime Pattern Theory concludes that offenders, rather than venture into unknown territory, frequently commit opportunistic crimes and serial violent crimes by taking advantage of opportunities they encounter in places they are most familiar with as part of their activity space. Our experiments on a large real-world crime dataset show that CRIMETRACER outperforms all other methods used for location recommendation we evaluate here.

Crime reduction and prevention strategies are essential to increase public safety and reduce the crime costs to society. Law enforcement agencies have long realized the importance of analyzing co-offending networks---networks of offenders who have committed crimes together---for this purpose. Although network structure can contribute significantly to co-offence prediction, research in this area is very limited. Here we address this important problem by proposing a framework for co-offence prediction using supervised learning. Considering the available information about offenders, we introduce social, geographic, geo-social and similarity feature sets which are used for classifying potential negative and positive pairs of offenders. Similar to other social networks, co-offending networks also suffer from a highly skewed distribution of positive and negative pairs. To address the class imbalance problem, we identify three types of criminal cooperation opportunities which help to reduce the class imbalance ratio significantly, while keeping half of the co-offences. The proposed framework is evaluated on a large crime dataset for the Province of British Columbia, Canada. Our experimental evaluation of four different feature sets show that the novel geo-social features are the best predictors. Overall, we experimentally show the high effectiveness of the proposed co-offence prediction framework. We believe that our framework will not only allow law enforcement agencies to improve their crime reduction and prevention strategies, but also offers new criminological insights into criminal link formation between offenders.

In this paper, we analyze co-offending networks derived from a large real-world crime dataset for the purpose of identifying organized crime structures and their constituent entities. We focus on methodical and analytical aspects in using social network analysis methods and data mining techniques. The goal of our work is to promote computational co-offending network analysis as an effective means for extracting information about criminal organizations from large real-life crime datasets, specifically police-reported crime data. We contend that it would be virtually impossible to obtain such information by using traditional crime analysis methods. For our approach we provide an experimental evaluation with promising results.

Individuals frequently have routine daily activities that require commuting between several places, such as their home, work, shopping centres and recreational facilities. According to Crime Pattern Theory, offenders most likely commit opportunistic crimes, including serial and violent crimes, within their Activity Space, that is the space that they visit most frequently during the course of their daily routine activities, since they are aware of the opportunities and risks within these spaces. However, others within the social network of an offender can introduce the offender to new opportunities outside of his Activity Space, a phenomenon that Crime Pattern Theory does not address. This paper explores an important and interesting question about social networks: What is the relation between social and spatial distance of actors? We study this question in the context of crime and co-offending networks to better understand the impact of an offender's social network on the Activity Space of the offender. Our experiments on real-life crime data show that there is a strong correlation between social and spatial distance of offenders: offenders who are socially close are also spatially close.

A co-offending network is a network of offenders who have committed crimes together. Recently different researches have shown that there is a fairly strong concept of network among offenders. Analyzing these networks can help law enforcement agencies in designing more effective strategies for crime prevention and reduction. One of the important tasks in co-offending network analysis is central actors identification. In this paper, firstly we introduce a data model, called unified crime data model to bridge the conceptual gap between abstract crime data level and co-offending network mining level. Using this data model, we extract the co-offending network of five years real-world crime data. Then we apply different variations of centrality methods on the extracted network and discuss how key player identification and removal can help law enforcement agencies in policy making for crime reduction.

Law enforcement and intelligence agencies have long realized that analysis of co-offending networks, networks of offenders who have committed crimes together, is invaluable for crime investigation, crime reduction and prevention. Investigating crime can be a challenging and difficult task, especially in cases with many potential suspects and inconsistent witness accounts or inconsistencies between witness accounts and physical evidence. We present here a novel approach to crime suspect recommendation based on partial knowledge of offenders involved in a crime incident and a known co-offending network. To solve this problem, we propose a random walk based method for recommending the top-K potential suspects. By evaluating the proposed method on a large crime dataset for the Province of British Columbia, Canada, we show experimentally that this method outperforms baseline random walk and association rule-based methods. Additionally, results obtained for public domain data from experiments for co-author recommendation on a DBLP co-authorship network are consistent with those on the crime dataset. Compared to the crime dataset, the performance of all competitors is much better on the DBLP dataset, confirming that crime suspect recommendation is an inherently harder task.

Blogs have become one of most important parts of web but we do not have so efficient search engines for them. One reason is differences between regular web pages and blog pages and inefficiency of conventional web pages ranking algorithms for blogs ranking. There are some works in this field but users' behavioral features have not considered yet. In this paper we present a new blogs ranking algorithm called B2Rank based on these features.