As AI writing support becomes ubiquitous, the question of how disclosing its use affects reader perception remains critical and underexplored. We conducted a controlled study with 261 participants to examine how disclosing varying levels of AI involvement shifts perceptions of the author across six distinct communicative acts. Our analysis of 990 evaluations reveals that disclosure generally erodes perceived trustworthiness, caring, competence, and likability, with the most precipitous declines observed in social and interpersonal writing. A thematic analysis of participant feedback attributes these negative shifts to a perceived loss of human sincerity, diminished authorial effort, and the contextual inappropriateness of AI. Notably, however, we find that higher AI literacy mitigates these negative perceptions, leading to greater tolerance or even appreciation for AI assistance. Our results highlight the nuanced social dynamics of AI-mediated authorship and inform design implications for transparent, context-sensitive writing systems that better preserve trust and authenticity.

Domain squatting poses a significant threat to Internet security, with attackers employing increasingly sophisticated techniques. This study introduces DomainLynx, an innovative compound AI system leveraging Large Language Models (LLMs) for enhanced domain squatting detection. Unlike existing methods focusing on predefined patterns for top-ranked domains, DomainLynx excels in identifying novel squatting techniques and protecting less prominent brands. The system's architecture integrates advanced data processing, intelligent domain pairing, and LLM-powered threat assessment. Crucially, DomainLynx incorporates specialized components that mitigate LLM hallucinations, ensuring reliable and context-aware detection. This approach enables efficient analysis of vast security data from diverse sources, including Certificate Transparency logs, Passive DNS records, and zone files. Evaluated on a curated dataset of 1,649 squatting domains, DomainLynx achieved 94.7% accuracy using Llama-3-70B. In a month-long real-world test, it detected 34,359 squatting domains from 2.09 million new domains, outperforming baseline methods by 2.5 times. This research advances Internet security by providing a versatile, accurate, and adaptable tool for combating evolving domain squatting threats. DomainLynx's approach paves the way for more robust, AI-driven cybersecurity solutions, enhancing protection for a broader range of online entities and contributing to a safer digital ecosystem.

The persistent threat posed by malicious domain names in cyber-attacks underscores the urgent need for effective detection mechanisms. Traditional machine learning methods, while capable of identifying such domains, often suffer from high false positive and false negative rates due to their extensive reliance on historical data. Conventional approaches often overlook the dynamic nature of domain names, the purposes and ownership of which may evolve, potentially rendering risk assessments outdated or irrelevant. To address these shortcomings, we introduce DomainDynamics, a novel system designed to predict domain name risks by considering their lifecycle stages. DomainDynamics constructs a timeline for each domain, evaluating the characteristics of each domain at various points in time to make informed, temporal risk determinations. In an evaluation experiment involving over 85,000 actual malicious domains from malware and phishing incidents, DomainDynamics demonstrated a significant improvement in detection rates, achieving an 82.58% detection rate with a low false positive rate of 0.41%. This performance surpasses that of previous studies and commercial services, improving detection capability substantially.

In cybersecurity, allow lists play a crucial role in distinguishing safe websites from potential threats. Conventional methods for compiling allow lists, focusing heavily on website popularity, often overlook infrequently visited legitimate domains. This paper introduces DomainHarvester, a system aimed at generating allow lists that include trustworthy yet infrequently visited domains. By adopting an innovative bottom-up methodology that leverages the web's hyperlink structure, DomainHarvester identifies legitimate yet underrepresented domains. The system uses seed URLs to gather domain names, employing machine learning with a Transformer-based approach to assess their trustworthiness. DomainHarvester has developed two distinct allow lists: one with a global focus and another emphasizing local relevance. Compared to six existing top lists, DomainHarvester's allow lists show minimal overlaps, 4% globally and 0.1 % locally, while significantly reducing the risk of including malicious domains, thereby enhancing security. The contributions of this research are substantial, illuminating the overlooked aspect of trustworthy yet underrepresented domains and introducing DomainHarvester, a system that goes beyond traditional popularity-based metrics. Our methodology enhances the inclusivity and precision of allow lists, offering significant advantages to users and businesses worldwide, especially in non-English speaking regions.

Phishing attacks continue to evolve, with cloaking techniques posing a significant challenge to detection efforts. Cloaking allows attackers to display phishing sites only to specific users while presenting legitimate pages to security crawlers, rendering traditional detection systems ineffective. This research proposes PhishParrot, a novel crawling environment optimization system designed to counter cloaking techniques. PhishParrot leverages the contextual analysis capabilities of Large Language Models (LLMs) to identify potential patterns in crawling information, enabling the construction of optimal user profiles capable of bypassing cloaking mechanisms. The system accumulates information on phishing sites collected from diverse environments. It then adapts browser settings and network configurations to match the attacker’s target user conditions based on information extracted from similar cases. A 21-day evaluation showed that PhishParrot improved detection accuracy by up to 33.8% over standard analysis systems, yielding 91 distinct crawling environments for diverse conditions targeted by attackers. The findings confirm that the combination of similar-case extraction and LLM-based context analysis is an effective approach for detecting cloaked phishing attacks.

As the Internet evolves, the diversification of information dissemination has led to the growth of various social media platforms and an increase in abandoned blogs. These abandoned blogs, if not properly managed, present a significant security risk. In this study, we introduce “Zombified Blogs,” defined as blogs deserted by their administrators and targeted for continuous submissions of unsolicited malicious content. We explore the causes and effects of this global phenomenon on a large scale, using data from multiple blog services over the past 18 years for the first time. To this end, we propose an innovative method for the continuous identification and collection of Zombified Blogs using a search engine. We analyzed data spanning 18 years, encompassing approximately 1.5 million blog posts, including 258, 547 malicious posts, across 1,141 Zombified Blogs on six different blog services. Our findings show a significant rise in malicious posts, primarily social engineering attacks, over the past four years on previously active blogs. We identify the email posting function as a critical area exploited by attackers, leading to the unintended posting of content. Finally, we provide an overview of the current challenges facing blog services and administrators, and discuss potential content management solutions.

The persistent threat of malicious domains in cybersecurity necessitates robust detection systems. Traditional machine learning approaches often struggle to accurately assess domain name risks due to their static analysis methods and lack of consideration for temporal changes in domain attributes. To address these limitations, we developed DomainDynamics, a novel system that evaluates domain name risks by analyzing their lifecycle phases. This study provides a comprehensive evaluation and refinement of the DomainDynamics framework. The system creates temporal profiles for domains and assesses their attributes at various stages, enabling informed, time-sensitive risk assessments. Our initial evaluation, involving over 85,000 malicious domains, achieved an 82.58% detection rate with a low 0.41% false positive rate. We expanded our research to include benchmarking against commercial services, feature significance analysis using interpretable AI techniques, and detailed case studies. This investigation not only validates the effectiveness of DomainDynamics but also reveals temporal indicators of malicious intent. Our findings demonstrate the advantages of lifecycle-based analysis over static methodologies, providing valuable insights for practical cybersecurity applications. • DomainDynamics: lifecycle-based detection (82.58% Detection Rate, 0.41% FPR). • Temporal analysis outperforms static methods on 85,000+ malicious domains. • Explainable AI offers deep insights into domain risk through real case studies. • Benchmarks against commercial tools confirm lifecycle indicators’ significance. • Enhances malicious domain detection via temporal context and dynamic changes.

Malware attacks have become increasingly prevalent, and accurate and reliable malware detection is essential for combating them. However, mislabeling, where data is given a different/noisy label than its true label, can significantly affect the accuracy and reliability of malware detection. In this paper, we propose a new method for detecting noisy labels in multi-labeled malware datasets. Our approach involves a new transformation method that allows malware datasets with multiple labels to be treated as data with a single label without losing any essential information. We also introduce a new machine learning model for detecting mislabeling, based on this transformation method. We conducted experiments on a real-world malware dataset to evaluate the effectiveness of our proposed method, and our findings indicate that our method can detect mislabels with high accuracy, up to 94.7%. Our research aims to improve the quality of labeling and reduce the factors contributing to mislabeling in malware datasets, leading to more accurate and reliable malware detection.

The rise in phishing attacks via e-mail and short message service (SMS) has not slowed down at all. The first thing we need to do to combat the ever-increasing number of phishing attacks is to collect and characterize more phishing cases that reach end users. Without understanding these characteristics, anti-phishing countermeasures cannot evolve. In this study, we propose an approach using Twitter as a new observation point to immediately collect and characterize phishing cases via e-mail and SMS that evade countermeasures and reach users. Specifically, we propose CrowdCanary, a system capable of structurally and accurately extracting phishing information (e.g., URLs and domains) from tweets about phishing by users who have actually discovered or encountered it. In our three months of live operation, CrowdCanary identified 35,432 phishing URLs out of 38,935 phishing reports, 31,960 (90.2%) of these phishing URLs were later detected by the anti-virus engine. We analyzed users who shared phishing threats by categorizing them into two groups: experts and non-experts. As a results, we discovered that CrowdCanary extracts non-expert report-specific information, like company brand name in tweets, phishing attack details from tweet images, and pre-redirect landing page information.

Domain squatting is a technique used by attackers to create domain names for phishing sites. In recent phishing attempts, we have observed many domain names that use multiple techniques to evade existing methods for domain squatting. These domain names, which we call generated squatting domains (GSDs), are quite different in appearance from legitimate domain names and do not contain brand names, making them difficult to associate with phishing. In this paper, we propose a system called PhishReplicant that detects GSDs by focusing on the linguistic similarity of domain names. We analyzed newly registered and observed domain names extracted from certificate transparency logs, passive DNS, and DNS zone files. We detected 3,498 domain names acquired by attackers in a four-week experiment, of which 2,821 were used for phishing sites within a month of detection. We also confirmed that our proposed system outperformed existing systems in both detection accuracy and number of domain names detected. As an in-depth analysis, we examined 205k GSDs collected over 150 days and found that phishing using GSDs was distributed globally. However, attackers intensively targeted brands in specific regions and industries. By analyzing GSDs in real time, we can block phishing sites before or immediately after they appear.

With the spread of service platforms that enable users to generate content, people use user-generated content (UGC) to search for and access information on the web instead of search engines. Attackers can also use UGC on a service platform (UGC platform) to spread web-based social engineering (SE) attacks to a large number of people. In this paper, we focus on a type of web-based SE attack, called an event-synced navigation attack, which generates UGC with links navigating users to malicious websites and distribute it synced with a real-life event at a specific time. To understand the attacks in the wild, we propose a new system for detecting event-synced navigation attacks in real time by capturing the inevitable footprints left by attacks that affect a large number of users. We evaluate each of the three steps of the proposed system and finally find that the system can classify malicious and non-malicious UGC with 97% accuracy. Furthermore, we perform a comprehensive measurement study on event-synced navigation attacks spread from popular UGC platforms (Twitter, Facebook, YouTube, and Reddit) and confirm that many event-synced navigation attacks are deployed in the wild.

We propose a method for disparity estimation in stereo video. We address the problems associated with spatially-temporally-correlated disparity variations (STCDV). STCDV problems are caused by complex motions, e.g., yaw-rotation, pan-tilt-zoom camera movements, etc. The key novelty of this study is to introduce a spatio-temporal disparity hyperplane (STDH) model. The proposed STDH model represents a hyperplane defined in four-dimensional space spanned by disparity, image plane, and time coordinates. Our STDH model is represented by surface normals varying with the spatially-temporally-correlated changes in disparity. Thus, our STDH model is effective in estimating disparity in a stereo video including STCDVs. We estimate video disparity by incorporating our STDH model into the PatchMatch brief propagation framework. Our experiments demonstrate that the proposed method outperforms other methods.

This research focuses on the recognition of vehicle external objects using selective visual attention system. We had proposed the selective visual attention system with the feedback of recognition results. The system has three visual features such as still image feature, motion feature and blinking feature, and has intention maps for each visual feature. The intention maps have come to express existing regions of objects according to recognition feedback. Motion feature and blinking feature have strong correlation with each other. That causes a deviation of feature extraction and of intention map update. Consequently, the regions of attractive objects disappear on intention maps. Blinking feature must be independent from motion feature. We propose the blinking brand-new feature extracted by FFT applied to dozens of frames. As the results of experiments, the proposed feature can affect goodly to visual attention system.

The Cell Broadband Engine (Cell/B.E.) is a novel multi-core microprocessor designed to provide high-performance processing capabilities for a wide range of applications. In this paper, we describe the world's first JPEG 2000 and Motion JPEG 2000 encoder on Cell/B.E. Novel parallelization techniques for a Motion JPEG 2000 encoder that unleash the performance of the Cell/B.E. are proposed. Our Motion JPEG 2000 encoder consists of multiple video frame encoding servers on a cluster system for high-level parallelization. Each video frame encoding server runs on a heterogeneous multi-core Cell/B.E. processor, and utilizes its 8 Synergistic Processor Elements (SPEs) for low-level parallelization of the time consuming parts of the JPEG 2000 encoding process, such as the wavelet transform, the bit modeling, and the arithmetic coding. The effectiveness of high-level parallelization by the cluster system is also described, not only for the parallel encoding, but also for scalable performance improvement for real-time encoding and future enhancements. We developed all of the code from scratch for effective multilevel parallelization. Our results show that the Cell/B.E. is extremely efficient for this workload compared with commercially available processors, and thus we conclude that the Cell/B.E. is quite suitable for encoding next generation large pixel formats, such as 4K/2K-Digital Cinema.

The cell broadband engine (CBE) is a novel multi-core microprocessor designed to provide compact and high-performance processing capabilities for a wide range of applications. Real-time image processing applications with parallelism for large amounts of data are good examples to demonstrate the unique capabilities of the CBE. In this paper, we describe the evaluation of the performance for image processing using wavelet transforms on CBE. Our results show that the CBE is extremely efficient in this processing compared with commercially available processors, and thus, we conclude that the CBE is quite suitable for next generation large pixel formats, such as 4K/2K-digital cinema

The paper describes a method for classifying the motions of human bodies in an image sequence. First, a set of templates is prepared in advance, which includes the spatio-temporal Gabor features of key motions. Next, processing is performed to obtain the Gabor features of all unknown motion. Correlation coefficients between the feature vectors of both the key motions and the unknown motions are then calculated by using dynamic programming (DP), and finally the unknown motion is classified as one of the key motions. This study also compares the effectiveness between Gabor features and principal component analysis (PCA) for sequences of postures. Experimental results using image sequences from a volleyball game show the effectiveness of the proposed method.

Describes a method for classifying the motions of human bodies in an image sequence. First a set of templates is prepared in advance, which includes the spatio-temporal Gabor wavelet expansion coefficients of key motions. Next, processing is performed to obtain the Gabor wavelet expansion coefficients of an unknown motion. Matching factors between the expansion coefficients of both the key motions and the unknown motions are then calculated, and finally the unknown motion is classified as one of the key motions. Experimental results using image sequences from a volleyball game show the effectiveness of the proposed method.