Containers have become a critical component of cloud-native technologies, enabling organizations to run scalable and isolated workloads. However, in recent years there has been an increase in the sophistication of attacks targeting the cloud-native environment. It is crucial to implement security controls that protect containers at all stages of their lifecycle to mitigate risks such as privilege escalation by malicious applications. Numerous studies have aimed to develop security profiles for container applications that limit their privileges and protect the host system from compromise. Despite these efforts, the shared underlying kernel may still permit several successful attacks. In this study, we strive to develop a concise system call whitelist to address the problem of excessive privileges while ensuring the operational availability of applications. To achieve this, we propose to enhance static analysis with dynamic analysis to gather comprehensive information about the containerized application during two distinct execution phases: the initialization and the serving phases. Using this information, we determine the essential system calls for the application's operation and prevent all unwarranted system calls. We then perform crash analysis on the container under test to identify and incorporate any missing system calls. Through numerous experiments with popular server applications, we confirm that our approach is effective in discovering the necessary system calls for the operation of containerized applications. The system call whitelists produced by this method are more concise than Docker's default seccomp profile, consequently reducing the attack surface for a wide variety of applications and host systems significantly.

Deepfakes, an increasingly prevalent form of information attack, pose serious threats to security and privacy. Deepfake voice attacks, in particular, have the potential to cause widespread disruption, creating an urgent need for an effective detection system. In this research, we propose the Trident of Poseidon - a novel set of triad training strategies aimed at enhancing the generalizability of deepfake voice detection models. Our solution comprises three key components: (1) Supervised Contrastive Learning, (2) Hard Negative Mining by Audio Re-synthesizing, and (3) Effective Proactive Batch Sampling. Together, these enable the model to learn more robust features. Our extensive experiments demonstrate that our approach outperforms existing methods in both in-domain and out-of-domain testing scenarios, making significant strides toward securing digital media against deepfake voice attacks.

Voice phishing (vishing) is increasingly popular due to the development of speech synthesis technology. In particular, the use of deep learning to generate an arbitrary-content audio clip simulating the victim’s voice makes it difficult not only for humans but also for automatic speaker verification (ASV) systems to distinguish. Countermeasure (CM) systems have been developed recently to help ASV combat synthetic speech. In this work, we propose BTS-E, a framework to evaluate the correlation between Breathing, Talking (speech), and Silence sounds in an audio clip, then use this information for deepfake detection tasks. We argue that natural human sounds, such as breathing, are hard to synthesize by Text-to-speech (TTS) system. We conducted a large-scale evaluation using ASVspoof 2019 and 2021 evaluation set to validate our hypothesis. The experiment results show the applicability of the breathing sound feature in detecting deepfake voices. In general, the proposed system significantly increases the performance of the classifier by up to 46%.

Differences between Android versions affect not only application developers but also make the task of securing Android harder, as it is not easy to keep track of updates. In this paper, we first systematically analyze the Android framework, which includes APIs and enforced manifest permissions to realize the inconsistency currently exists in the OS. To carry out the analysis, fine-grained machine learning-based classifiers are constructed out of predefined malicious-benign datasets to perform the task of malware detection. We propose the use of multiple feature vectors to build machine learning-based models targeting different ranges of Android API levels. As a result, the process of choosing optimal learning features becomes more efficient while avoids complicating the machine learning model unnecessarily. Also, top features extracted from machine learning models provide us the insights about how important each of them is to specific Android versions. We eventually observe the improvement of detection rates in those fine-grained classifiers compared to a single classifier.

We present an arms race between rooting detection and rooting evasion. We investigate different methods to detect rooted device at both Java and native level and evaluate the counterattack from major hooking tools. To this end, an extensive study of Android rooting has been conducted, which includes the techniques to root the device and make it invisible to the detection of mobile antimalware product. We then analyze the evasion loopholes and in turn enhance our rooting detection tool. We also apply evasion techniques on rooted device and compare our work with 92 popular root checking applications and 18 banking and finance applications. Results show that most of them do not suffice and can be evaded through API hooking or static file renaming. Furthermore, over 28000 Android applications have been analyzed and evaluated in order to diagnose the characteristics of rooting in recent years. Our study shows that rooting has become more and more prevalent as an inevitable trend, and it raises big security concerns regarding detection and evasion. As a proof of concept, we have published our rooting detection application to Google Play Store to demonstrate the work presented in this paper.

ABSTRACT VANETs have been developed to improve the safety and efficiency of transportation systems (V2V communications) and to enable various mobile services for the traveling public (V2I communications). For VANET technologies to be widely available, security issues concerning several essential requirements should be addressed. The existing security architectures and mechanisms have been studied separately in V2V and V2I networks, which results in duplicated efforts, security modules, and more complex security architectures. In this paper, we propose a unified security architecture and its corresponding security protocols that achieve essential security requirements such as authentication, conditional privacy, non‐repudiation, and confidentiality. To the best of our knowledge, this paper is the first study that deals with the security protocol in V2V as well as the handover authentication in V2I communications. Our proposal is characterized by a low‐complexity security framework, owing to the design and unification of the security architectures and modules. Furthermore, the evaluation of the proposed protocols proves them to be more secure and efficient than existing schemes. Copyright © 2010 John Wiley & Sons, Ltd.

This demonstration shows a process to collect critical video clips from car black boxes using smart phones. Critical video clips in the black box are hashed to provide data integrity before being transmitted to the police server. Without VANET infrastructure, smart phones are very useful communication media for car black boxes.

This demonstration shows how to effectively collect and manage information obtained from car black boxes in vehicular networks. The car black box is a vehicle-based CCTV which records video images, sound, GPS position, speed, and time. These data can be used for accurate car accident investigation and some public crimes prevention. However, there are important issues such as user privacy and a data management for a vehicle-based CCTV records. The proposed evidence collection system can reduce driver privacy concerns and communication and management overheads. Our contribution is that we propose a feasible and useful scenario for public safety.

This paper proposes an identification and key exchange scheme in secure VANETs based on group signature. Security requirements such as authentication, conditional privacy, non-repudiation, and confidentiality are required to satisfy various vehicular applications. Although the existing group signature schemes are suitable for secure vehicular communications, they do not provide mutual identification and key exchange for data confidentiality. The principal idea of this paper is that the proposed scheme allows only one credential to authenticate ephemeral Diffie-Hellman parameters generated be all the session keys. Our scheme achieves security requirements for various VANET-based applications.

This demonstration presents spam scenarios and a lightweight security mechanism for protecting spam calls in SIP- based VoIP services. Generally, VoIP providers have been applying only the HTTP digest scheme to authenticate a UA. They may be not consider protecting SIP signaling between the light-weight UA and the SIP proxy using the TLS mechanism since it suffers from the heavy overhead for computation on the resource-constrained UA. Therefore, the spammer can send SIP messages such as INVITE or 200 OK directly to the UA or the SIP proxy, and then communicate with the user by establishing a media channel. This paper demonstrates several spam scenarios when the TLS mechanism is not established at the light-weight SIP UA. Besides, we will show that these spam calls can be protected by using our proposed security scheme instead of TLS mechanism.

This paper proposes a security framework with strong non-repudiation and privacy using new approach of ID-based cryptosystem in VANETs. To remove the overheads of certificate management in PKI, security frameworks using an ID-based cryptosystem are proposed. These systems, however, cannot guarantee strong non-repudiation and private communication since they suffer from the inherent weakness of an ID-based cryptosystem like the key escrow problem. The key idea of this paper is that the ID of the third-party is used as the verifier of vehicle's ID and self-generated RSA public key instead of using the ID of the peers. Our scheme provides strong non-repudiation and privacy preservation without the inherent weaknesses of an ID-based cryptosystem in VANETs. Also, the proposed scheme is efficient in terms of signature and verification time for safety-related applications.

A time-domain approach for enhancing speech signals degraded by statistically independent additive nonstationary noise with no a priori information is developed. The autoregressive (AR)-hidden filter model (HFM) with gain contour is proposed for modeling the statistical characteristics of the clean speech signal. Given the HFM parameter set of the speech, speech enhancement becomes a set of problems of joint signal estimation for clean speech and system identification for the gain contour and time-varying parameter of noise. Then, the expectation-maximization (EM) algorithm is applied to signal estimation and system identification. In the E-step, the signal estimation becomes a weighted sum of conditional mean estimator using multiple Kalman filters with Markovian switching coefficient, where the weights equal to a posteriori probabilities of the specific state sequence history given the noisy speech. The probability is computed by the Viterbi algorithm (VA). In M-step, the gain contour and noise parameters are recursively updated by an adaptive algorithm modified from the gradient-based algorithm. The proposed method does not require framing of speech signal in, the train and enhancement procedure. The proposed method is tested against the noisy speech signals degraded by nonstationary noise at various input signal-to-noise ratios. An approximate improvement of 4.5-6.0 dB in signal-to-noise ratio (SNR) is achieved at the input SNR 10 and 15 dB.

We discuss a source model for VBR video traffic, and present an application to dynamic bandwidth allocation of the model. A two-state Markov chain model is used to extract useful parameters for adaptively allocating transmission bandwidth to variable-bit-rate traffic. The performance of our dynamic bandwidth allocation scheme has been compared with other schemes for both a homogeneous and a heterogeneous mix of traffic. Simulation results show that our dynamic bandwidth allocation scheme outperforms the static allocation or the low-pass filter scheme.

Dynamic bandwidth allocation using adaptive prediction can significantly improve the efficiency and QoS guarantees in transporting VBR video over an ATM network. Conventionally, the time-domain least-mean-square (LMS) predictor is used, with the drawback of slow convergence. In VBR video traffic characterized by frequent scene changes, this slow convergence may result in extended periods of intractability and excessive cell loss during scene changes. We propose an adaptive wavelet predictor for dynamic bandwidth allocation. The wavelet predictor converges faster and hence, tracks scene changes better. Our simulation results show that, in comparison with the LMS predictor, the wavelet predictor reduces the prediction error by an average of 11% over the six half-an-hour-long empirical MPEG-1 traces. The dynamic bandwidth allocation using wavelet prediction significantly reduces the cell-loss-rate over various network settings, especially at large buffer sizes.