Classifying cybersecurity vulnerabilities using the Common Weakness Enumeration (CWE) taxonomy is challenging due to extreme class imbalance and strong hierarchical dependencies among weakness categories. Although oversampling techniques such as Synthetic Minority Oversampling Technique (SMOTE) and Adaptive Synthetic Sampling (ADASYN) are widely adopted to mitigate class imbalance, their effectiveness for hierarchical CWE text classification remains largely unexplored. This paper proposes a Hierarchy-Aware RoBERTa framework that explicitly incorporates CWE structural information through learnable parent-class embeddings, preserving taxonomic consistency. Our experiments demonstrate that synthetic interpolation in high-dimensional embedding spaces violates the inherent parent-child constraints of the CWE hierarchy, offering only marginal benefits for classical ML models while consistently degrading deep learning architectures. Evaluated on a CWE Research Concept dataset, the proposed model achieves a weighted F1-score of 0.76 without data augmentation, outperforming all baselines with notable gains on minority classes, including the Class category whose F1-score improved from 0.40 to 0.60 over the BERT baseline. Our results suggest that hierarchy-aware representation learning is a more principled alternative to oversampling for structured vulnerability classification.

Cyberattacks on operational technology are increasingly causing costly downtime and physical damage, exposing the limitations of traditional rule-based monitoring in industrial IoT environments. While Large Language Models (LLMs) have strong semantic reasoning abilities to assist in decision support, their hallucinatory nature presents unacceptable safety liabilities for closed-loop control. This paper introduces a neuro-agentic control framework, a novel architecture that couples an LLM-based planner (i.e., such as Gemini 2.5 Flash-Lite) with a pre-trained Time-Series Foundation Model (TimesFM), to achieve physics-grounded autonomous defense. The paper introduces a ``Counterfactual Physics Injection'' mechanism that simulates the impact of LLM-proposed interventions within the numerical latent space of the foundation model before actuation, while allowing the system to reject hallucinatory or unsafe actions. Evaluated on an industrial dataset (e.g., the Secure Water Treatment (SWaT)) in the context of stochastic attack scenarios, the framework exhibited better performance compared to LSTM and TCN baselines. The Neuro-Agentic Loop prevented five breaches (33.3%) below the threshold versus LSTM (26.7%) and TCN (13.3%), with zero physically invalid (hallucinated) actions executed. These results demonstrate the efficacy of using foundation models as deterministic ``Sentinels'' to safeguard agentic AI in critical infrastructure.

Cyberattacks are increasing, and securing against such threats is costing industries billions of dollars annually. Threat Modeling, that is, comprehending the consequences of these attacks, can provide critical support to cybersecurity professionals, enabling them to take timely action and allocate resources that could be used elsewhere. Cybersecurity is heavily dependent on threat modeling, as it assists security experts in assessing and mitigating risks related to identifying vulnerabilities and threats. Recently, there has been a pressing need for automated methods to assess attack descriptions and forecast the future consequences of the increasing complexity of cyberattacks. This study examines how Natural Language Processing (NLP) and deep learning can be applied to analyze the potential impact of cyberattacks by leveraging textual descriptions from the MITRE Common Weakness Enumeration (CWE) database. We emphasize classifying attack consequences into five principal categories: Availability, Access Control, Confidentiality, Integrity, and Other. This paper investigates the use of Bidirectional Encoder Representations from Transformers (BERT) in combination with Hierarchical Attention Networks (HANs) for Multi-label classification, evaluating their performance in comparison with conventional CNN and LSTM-based models. Experimental findings show that BERT achieves an overall accuracy of 0.972 , far higher than conventional deep learning models in multi-label classification. HAN outperforms baseline forms of CNN and LSTM-based models on specific cybersecurity labels. However, BERT consistently achieves better precision and recall, making it more suitable for predicting the consequences of a cyberattack.

This paper intends to detect IoT malicious attacks through deep learning models and demonstrates a comprehensive evaluation of the deep learning and graph-based models regarding malicious network traffic detection. The models particularly are based on GraphSAGE, Bidirectional encoder representations from transformers (BERT), Temporal Convolutional Network (TCN) as well as Multi-Head Attention, together with Bidirectional Long Short-Term Memory (BI-LSTM) Multi-Head Attention and BI-LSTM and LSTM models. The chosen models demonstrated great performance to model temporal patterns and detect feature significance. The observed performance are mainly due to the fact that IoT system traffic patterns are both sequential and diverse, leaving a rich set of temporal patterns for the models to learn. Experimental results showed that BERT maintained the best performance. It achieved 99.94% accuracy rate alongside high precision and recall, F1-score and AUC-ROC score of 99.99% which demonstrates its capabilities through temporal dependency capture. The Multi-Head Attention offered promising results by providing good detection capabilities with interpretable results. On the other side, the Multi-Head Attention model required significant processing time like BI-LSTM variants. The GraphSAGE model achieved good accuracy while requiring the shortest training time but yielded the lowest accuracy, precision, and F1 score compared to the other models.

Purpose This study aimed to investigate how honest participants perceived an attacker to be during shoulder surfing scenarios that varied in terms of which Principle of Persuasion in Social Engineering (PPSE) was used, whether perceived honesty changed as scenarios progressed, and whether any changes were greater in some scenarios than others. Design/methodology/approach Participants read one of six shoulder surfing scenarios. Five depicted an attacker using one of the PPSEs. The other depicted an attacker using as few PPSEs as possible, which served as a control condition. Participants then rated perceived attacker honesty. Findings The results revealed honesty ratings in each condition were equal during the beginning of the conversation, participants in each condition perceived the attacker to be honest during the beginning of the conversation, perceived attacker honesty declined when the attacker requested the target perform an action that would afford shoulder surfing, perceived attacker honesty declined more when the Distraction and Social Proof PPSEs were used, participants perceived the attacker to be dishonest when making such requests using the Distraction and Social Proof PPSEs and perceived attacker honesty did not change when the attacker used the target’s computer. Originality/value To the best of the authors’ knowledge, this experiment is the first to investigate how persuasion tactics affect perceptions of attackers during shoulder surfing attacks. These results have important implications for shoulder surfing prevention training programs and penetration tests.

Recent advancements in Large Language Models (LLMs) have revolutionized Natural Language Processing (NLP) and Natural Language Understanding (NLU), showcasing their ability to produce coherent and contextually relevant responses. However, their widespread use raises serious concerns regarding the potential for generating and spreading false or misleading information. This research examines the effectiveness of customized Retrieval Augmented Generation (RAG) models, alongside fine-tuned versions of GPT-Neo and RoBERTa.The proposed framework leverages multiple generative language models, including GPT-Neo, RoBERTa, and a custom RAG model, to produce diverse fake news content grounded in retrieved contextual information. It employs a combination of large language models and a specialized fake news detection pipeline, which integrates embedding based retrieval with sentence transformers and Facebook AI Similarity Search (FAISS), while also enabling generation through GPT-Neo, RoBERTa, and custom RAG structures. Additionally, we employ a passive aggressive classifier trained on "Fake" and "Real" dataset from a public GitHub repository to assess the likelihood of generated responses being classified as "Fake" or "Real." This pipeline evaluates the authenticity of news articles and incorporates believability scores to enhance interpretability.Results indicate that while all models perform comparably, the custom RAG model consistently excels in providing contextually grounded and highly relevant fake information,in these fake news scenarios. This study highlights the robustness of retrieval augmented frameworks in adversarial tasks, offering superior alignment with factual references. It contributes to the AI driven misinformation detection landscape, providing valuable insights into model selection and training methodologies to combat social engineering and the spread of fake news.

Information plays a key role in decision making, influencing others and risk assessment. However, malicious actors often falsify facts to mislead viewers. With the advent of Generative AI models, creating and modifying information has become much easier and more accessible, significantly reducing the time and effort required for attackers. To address the challenges of misinformation and disinformation, this paper presents the "Information Reliability Framework (IRF)," a detection framework built with DarkBERT (a dark web-focused language model) [1] and LLaMA-3.1 (a large language model), which incorporates real-time web data for validation. DarkBERT was fine-tuned using the FEVER dataset (Fact Extraction and VERification) [2] to enhance its efficiency in misinformation, disinformation, and fact-checking tasks. This fine-tuning enables DarkBERT to assign a reliability score to a given statement by analyzing malicious keywords and contexts, which is then combined with LLaMA-3.1 to generate a detailed explanation for the user, leveraging its knowledge and logical reasoning. To minimize reliance on outdated information and reduce hallucinations in LLaMA-3.1, the framework integrates real-time web data using Retrieval-Augmented Generation (RAG). The framework was evaluated alongside standalone LLaMA-3.1 with RAG using two synthetic datasets: generic statements and DarkBERT-specific statements, generated by ChatGPT-4o with its latest "search the web" feature. The evaluation showed that the IRF provided promising results across metrics such as accuracy, precision, recall, and F1 score, making it effective for validating text from various sources, including social media, emails, articles, messages, websites, and blogs.

In recent years, there has been a growing interest in and focus on the automatic detection of deceptive behavior. This attention is justified by the wide range of applications that deception detection can have, especially in fields such as criminology. This study specifically aims to contribute to the field of deception detection by capturing transcribed data, analyzing textual data using Natural Language Processing (NLP) techniques, and comparing the performance of conventional models using linguistic features with the performance of Large Language Models (LLMs). In addition, the significance of applied linguistic features has been examined using different feature selection techniques. Through extensive experiments, we evaluated the effectiveness of both conventional and deep NLP models in detecting deception from speech. Applying different models to the Real-Life Trial dataset, a single layer of Bidirectional Long Short-Term Memory (BiLSTM) tuned by early stopping outperformed the other models. This model achieved an accuracy of 93.57% and an F1 score of 94.48%.

Large language models (LLMs) have attracted considerable attention as they are capable of showcasing impressive capabilities generating comparable high-quality responses to human inputs. LLMs, can not only compose textual scripts such as emails and essays but also executable programming code. Contrary, the automated reasoning capability of these LLMs in performing statistically-driven descriptive analysis, particularly on user-specific data and as personal assistants to users with limited background knowledge in an application domain who would like to carry out basic, as well as advanced statistical and domain-specific analysis is not yet fully explored. More importantly, the performance of these LLMs has not been compared and discussed in detail when domain-specific data analysis tasks are needed. Additionally, the use of LLMs in isolation is often at times insufficient for creating powerful applications and the real potential comes when LLMs are combined with other sources of computation such as LangChain. This study, consequently, explores whether LLMs can be used as generative AI-based personal assistants to users with minimal background knowledge in an application domain infer key data insights. To demonstrate the performance of the LLMs, the study reports a case study through which descriptive statistical analysis, as well as Natural Language Processing (NLP) based investigations, are performed on a number of phishing emails with the objective of comparing the accuracy of the results generated by LLMs to the ones produced by analysts. The experimental results show that LangChain and the Generative Pre-trained Transformer (GPT-4) excel in numerical reasoning tasks i.e., temporal statistical analysis, achieve competitive correlation with human judgments on feature engineering tasks while struggle to some extent on domain specific knowledge reasoning, where domain-specific knowledge is required.

Ethereum Smart Contract (SC) is a sophisticated technology that enhances the scope of BlockChain automation. However, SCs’ vulnerable programs have marred BlockChain’s nascent technology’s brighter aspects. Two critical hacks, the DAO attack, caused by reentrancy vulnerability, and the Parity attack, caused by unprotected selfdestruct and frozen Ether vulnerabilities, are famous for their historical cryptocurrency frauds. DAO attack robbed a sixty million dollar amount of cryptocurrency from the victim’s account. But the Parity attack created a new trend in software vulnerabilities by freezing a thirty million dollar amount of Ether. In fact, the Parity attack wiped out the library SC. Subsequently, all the SCs, depending upon the library functions (e.g., the Parity SC’s Ether transfer), became paralyzed, which locked the investors’ funds. This paper enhances our dynamic analysis tool, TechyTech, to detect the Locked Ether (i.e., Frozen Ether) vulnerability. Furthermore, TechyTech adopts a transfer-based approach and uses case studies to compare TechyTech’s performance with Remix.

Phishing websites many a times look-alike to benign websites with the objective being to lure unsuspecting users to visit them. The visits at times may be driven through links in phishing emails, links from web pages as well as web search results. Although the precise motivations behind phishing websites may differ the common denominator lies in the fact that unsuspecting users are mostly required to take some action e.g., clicking on a desired Uniform Resource Locator (URL). To accurately identify phishing websites, the cybersecurity community has relied on a variety of approaches including blacklisting, heuristic techniques as well as content-based approaches among others. The identification techniques are every so often enhanced using an array of methods i.e., honeypots, features recognitions, manual reporting, web-crawlers among others. Nevertheless, a number of phishing websites still escape detection either because they are not blacklisted, are too recent or were incorrectly evaluated. It is therefore imperative to enhance solutions that could mitigate phishing websites threats. In this study, the effectiveness of the Bidirectional Encoder Representations from Transformers (BERT) is investigated as a possible tool for detecting phishing URLs. The experimental results detail that the BERT transformer model achieves acceptable prediction results without requiring advanced URLs feature selection techniques or the involvement of a domain specialist.

The advent of the Internet has enabled everyone with access to it to provide their views online. This freedom of expression has also resulted in an increasing amount of unstructured text data daily, which can be leveraged to build models that can help make better business decisions. Customer reviews have become an integral part of the decision-making process as there is a tremendous increase in online products and services. Reviews provided by users online have a major problem regarding reliability and authenticity. It is an arduous task to make business decisions based on unstructured reviews whose trustworthiness is not established. Hence, this paper focuses on classifying the reviews of certain restaurants available on the Internet using different machine/deep learning techniques and summarises the findings. The results show that deep learning methods are more efficient in identifying fake reviews. More specifically, combining BERT and a 4-layered Feed Forward network gave 96% accuracy in detecting fake reviews.

With the recent advent of Large Language Models (LLMs), such as ChatGPT from OpenAI, BARD from Google, Llama2 from Meta, and Claude from Anthropic AI, gain widespread use, ensuring their security and robustness is critical. The widespread use of these language models heavily relies on their reliability and proper usage of this fascinating technology. It is crucial to thoroughly test these models to not only ensure its quality but also possible misuses of such models by potential adversaries for illegal activities such as hacking. This paper presents a novel study focusing on exploitation of such large language models against deceptive interactions. More specifically, the paper leverages widespread and borrows well-known techniques in deception theory to investigate whether these models are susceptible to deceitful interactions. This research aims not only to highlight these risks but also to pave the way for robust countermeasures that enhance the security and integrity of language models in the face of sophisticated social engineering tactics. Through systematic experiments and analysis, we assess their performance in these critical security domains. Our results demonstrate a significant finding in that these large language models are susceptible to deception and social engineering attacks.

Federated learning is a decentralized machine learning paradigm that allows multiple clients to collaborate by leveraging local computational power and the model’s transmission. This method reduces the costs and privacy concerns associated with centralized machine learning methods while ensuring data privacy by distributing training data across heterogeneous devices. On the other hand, federated learning has the drawback of data leakage due to the lack of privacy-preserving mechanisms employed during storage, transfer, and sharing, thus posing significant risks to data owners and suppliers. Blockchain technology has emerged as a promising technology for offering secure data-sharing platforms in federated learning, especially in Industrial Internet of Things (IIoT) settings. This survey aims to compare the performance and security of various data privacy mechanisms adopted in blockchain-based federated learning architectures. We conduct a systematic review of existing literature on secure data-sharing platforms for federated learning provided by blockchain technology, providing an in-depth overview of blockchain-based federated learning, its essential components, and discussing its principles, and potential applications. The primary contribution of this survey paper is to identify critical research questions and propose potential directions for future research in blockchain-based federated learning.

Research in Ethereum BlockChain has resulted in the growth of several tools for vulnerability detection. As a typical example, the Vandal tool detects selfdestruct vulnerability.Even though Vandal is a static analysis tool, its approach is also employed by several dynamic analysis tools. There is a need for a different approach for dynamic analysis tools to detect vulnerabilities such as selfdestruct so that dynamic analysis tools can maintain their individuality. This paper uses dynamic analysis to detect the selfdestruct (or self-destructive) vulnerability. Our work balances the developmental pace of the static and dynamic analysis approaches. The novelty of the work presented in this paper is that we use an Ether transfer-based approach and name it as "terminating transfer" to detect the selfdestruct vulnerability using the tool developed by us called "TechyTech".

This paper presents a study of irradiance prediction using a transformer-based machine learning model for the photovoltaic (PV) renewable energy system. We explore the forecast of irradiance using ten years of data from the Texas Mesonet Data Archive at the Reese Center in Lubbock, Texas. After training our transformer model with 90% of the data, we show that it can fit the irradiance trend successfully, while the testing phase with the remaining 10% of the dataset indicates that the transformer can predict irradiance trends that align with the observed values. Additionally, we borrow the concept of rolling LSTMs to generate a rolling transformer in order to extrapolate values of irradiance even when the observed values are not available. Our extrapolation results show that the transformer can extrapolate irradiance values accurately in the short-term, but it is less precise in the long-term. To remedy this, we aim to explore more thoroughly the hyperparameter configuration of our model in order to move towards our goal of including machine learning methods in the control of PV systems.

This paper extends the applications of ContextMiner, a framework that we proposed recently aiming to extract interpretable contextual features to conceptualize knowledge in security texts. We show that contextual features are suitable for building a document-level representation that can be used further in a downstream machine learning and natural language processing task: document clustering. Our results show that the intrinsic readability of contextual features is usable for analyzing the document clusters obtained in our experiments. Such analysis is performed through a density-based feature selection, cluster visualization, and statistical methods in order to unveil which contextual features better characterize each document cluster. Our findings suggest that statistical techniques alongside feature analysis can be utilized to discover meaningful commonalities among documents in a particular cluster without the need of querying each document manually.

It is important to learn about attackers and their attacking strategies so that better and more effective defense systems can be built. During the reconnaissance stage, attackers intend to probe potential targets through various techniques including social engineering attacks. Phishing through email is a well-known, cheap, easy, and surprisingly effective technique for obtaining the needed information. This type of attack targets individuals and thus utilizes weaknesses that might exist in each person. Given the uniqueness of each individual’s personality, attackers make sure the right persuasion principle technique is employed for each targeted individual. This paper describes efforts to build machine-learning transformers, the emerging technique in language modeling, with the goal of building classifiers that take into account different types of persuasion principles. More specifically, the paper describes efforts to build machine-learning transformers based on BERT, RoBERTa, and DistilBERT and captures their classification results. The results show that these transformers are accurate enough to build a classification of phishing emails with respect to persuasion techniques. Furthermore, we report that the RoBERTa model is able to train faster than BERT and DistilBERT models.

This paper presents two concept models to compare and contrast conventional software development life cycle(SDLC) and the development of smart applications where Artificial Intelligence/Machine Learning (AI/ML) modules are integrated into the software products. The first concept model illustrates the intersections and differences between SDLC and AI/ML-based application development; whereas, the second concept model depicts the processes/concepts involved in data preprocessing stage of AI/ML-based application development. The concept models show that while there are some similarities between SDLC and AI/ML-based application development; AI/ML-based development follows its own unique features and challenges that need development of further software engineering techniques.

Various decentralized applications have deployed millions of smart contracts (SCs) on the Blockchain networks. SCs enable programmable transactions involving the transfer of monetary assets between peers on a Blockchain network without any need to a central authority. However, similar to any software program, SCs may contain security issues. Software se-curity engineers and researchers have already uncovered several Ethereum BlockChain and SC vulnerabilities. Still, researchers continuously discover many more security flaws in deployed SCs. Indeed, the popularity of SCs attracts adversaries to launch new attack vectors. Thus, efficient vulnerability detection is necessary. This paper lists broad known vulnerabilities in SCs and classifies them based on the multi-class categories such as Suicidal, Prodigal, Greedy, and Normal SCs. The paper adopts artificial recurrent neural network architecture such as Long Short-Term Memory (LSTM) and Temporal Convolutional Network (TCN) used in deep learning to identify and then classify vulnerable Scs.

Threat modeling is a process by which security designers and researchers analyze the security of a system against known threats and vulnerabilities. There is a myriad of threat intelligence and vulnerability databases that security experts use to make important day-to-day decisions. Security experts and incident responders require the right set of skills and tools to recognize attack consequences and convey them to various stakeholders. In this paper, we used natural language processing (NLP) and deep learning to analyze text descriptions of cyberattacks and predict their consequences. This can be useful to quickly analyze new attacks discovered in the wild, help security practitioners take requisite actions, and convey attack consequences to stakeholders in a simple way. In this work, we predicted the multilabels (availability, access control, confidentiality, integrity, and other) corresponding to each text description in MITRE’s CWE dataset. We compared the performance of various CNN and LSTM deep neural networks in predicting these labels. The results indicate that it is possible to predict multilabels using a LSTM deep neural network with multiple output layers equal to the number of labels. LSTM performance was better when compared to CNN models.

Purpose Nonexperts do not always follow the advice in cybersecurity warning messages. To increase compliance, it is recommended that warning messages use nontechnical language, describe how the cyberattack will affect the user personally and do so in a way that aligns with how the user thinks about cyberattacks. Implementing those recommendations requires an understanding of how nonexperts think about cyberattack consequences. Unfortunately, research has yet to reveal nonexperts’ thinking about cyberattack consequences. Toward that end, the purpose of this study was to examine how nonexperts think about cyberattack consequences. Design/methodology/approach Nonexperts sorted cyberattack consequences based on perceived similarity and labeled each group based on the reason those grouped consequences were perceived to be similar. Participants’ labels were analyzed to understand the general themes and the specific features that are present in nonexperts’ thinking. Findings The results suggested participants mainly thought about cyberattack consequences in terms of what the attacker is doing and what will be affected. Further, the results suggested participants thought about certain aspects of the consequences in concrete terms and other aspects of the consequences in general terms. Originality/value This research illuminates how nonexperts think about cyberattack consequences. This paper also reveals what aspects of nonexperts’ thinking are more or less concrete and identifies specific terminology that can be used to describe aspects that fall into each case. Such information allows one to align warning messages to nonexperts’ thinking in more nuanced ways than would otherwise be possible.

There exist several data-driven approaches that enable us model time series data including traditional regression-based modeling approaches (i.e., ARIMA). Recently, deep learning techniques have been introduced and explored in the context of time series analysis and prediction. A major research question to ask is the performance of these many variations of deep learning techniques in predicting time series data. This paper compares two prominent deep learning modeling techniques. The Recurrent Neural Network (RNN)-based Long Short-Term Memory (LSTM) and the convolutional Neural Network (CNN)-based Temporal Convolutional Networks (TCN) are compared and their performance and training time are reported. According to our experimental results, both modeling techniques per-form comparably having TCN-based models outperform LSTM slightly. Moreover, the CNN-based TCN model builds a stable model faster than the RNN-based LSTM models.

The Internet of Things (IoT) has already changed our daily lives by integrating smart devices together towards delivering high quality services to its clients. These devices when integrated together form a network through which massive amount of data can be produced, transferred, and shared. A critical concern is the security and integrity of such a complex platform to ensure the sustainability and reliability of these IoT-based systems. Blockchain is an emerging technology that has demonstrated its unique features and capabilities for different problems and application domains including IoT-based systems. This survey paper reviews the adaptation of Blockchain in the context of IoT to represent how this technology is capable of addressing the integration and security problems of devices connected to IoT systems. The innovation of this survey is that we present a survey based upon the integration approaches and security issues of IoT data and discuss the role of Blockchain in connection with these issues.

To understand how end-users conceptualize consequences of cyber security attacks, we performed a card sorting study, a well-known technique in Cognitive Sciences, where participants were free to group the given consequences of chosen cyber attacks into as many categories as they wished using rationales they see fit. The results of the open card sorting study showed a large amount of inter-participant variation making the research team wonder how the consequences of security attacks were comprehended by the participants. As an exploration of whether it is possible to explain user’s mental model and behavior through Artificial Intelligence (AI) techniques, the research team compared the card sorting data with the outputs of a number of Natural Language Processing (NLP) techniques with the goal of understanding how participants perceived and interpreted the consequences of cyber attacks written in natural languages. The results of the NLP-based exploration methods revealed an interesting observation implying that participants had mostly employed checking individual keywords in each sentence to group cyber attack consequences together and less considered the semantics behind the description of consequences of cyber attacks. The results reported in this paper are seemingly useful and important for cyber attacks comprehension from user’s perspectives. To the best of our knowledge, this paper is the first introducing the use of AI techniques in explaining and modeling users’ behavior and their perceptions about a context. The novel idea introduced here is about explaining users using AI.

It is important to predict any adversarial attacks and their types to enable effective defense systems. Often it is hard to label such activities as malicious ones without adequate analytical reasoning. We propose the use of Hidden Markov Model (HMM) to predict the family of related attacks. Our proposed model is based on the observations often agglomerated in the form of log files and from the target or the victim’s perspective. We have built an HMM-based prediction model and implemented our proposed approach using Viterbi algorithm, which generates a sequence of states corresponding to stages of a particular attack. As a proof of concept and also to demonstrate the performance of the model, we have conducted a case study on predicting a family of attacks called Action Spoofing.

We aimed to understand whether warning message design recommendations address the reasons why non-experts choose to not protect themselves from cybersecurity threats. Toward that end, we synthesized literature to investigate why non-experts choose to not protect themselves, and catalog design recommendations aimed at influencing how non-experts think about threats. We then evaluated whether those recommendations addressed non-experts’ reasons. We are the first to synthesize and compare these important literatures. Our results revealed that current recommendations do not adequately address many of non-experts’ reasons for not protecting themselves. Therefore, implementing those recommendations probably will not convince those non-experts to protect themselves, which may partially explain why warning messages that implement current recommendations improve user compliance but to levels that are still lower than desired. Our results also highlight the need for future research that could lead to new warning message design recommendations that better address non-experts’ reasons for not protecting themselves.

Purpose This study aims to examine how social engineers use persuasion principles during vishing attacks. Design/methodology/approach In total, 86 examples of real-world vishing attacks were found in articles and videos. Each example was coded to determine which persuasion principles were present in that attack and how they were implemented, i.e. what specific elements of the attack contributed to the presence of each persuasion principle. Findings Authority (A), social proof (S) and distraction (D) were the most widely used persuasion principles in vishing attacks, followed by liking, similarity and deception (L). These four persuasion principles occurred in a majority of vishing attacks, while commitment, reciprocation and consistency (C) did not. Further, certain sets of persuasion principles (i.e. authority, distraction, liking, similarity, and deception and social proof; , authority, commitment, reciprocation, and consistency, distraction, liking, similarity and deception, and social proof; and authority, distraction and social proof) were used more than others. It was noteworthy that despite their similarities, those sets of persuasion principles were implemented in different ways, and certain specific ways of implementing certain persuasion principles (e.g. vishers claiming to have authority over the victim) were quite rare. Originality/value To the best of authors’ knowledge, this study is the first to investigate how social engineers use persuasion principles during vishing attacks. As such, it provides important insight into how social engineers implement vishing attacks and lays a critical foundation for future research investigating the psychological aspects of vishing attacks. The present results have important implications for vishing countermeasures and education.

Sonification is the science of communication of data and events to users through sounds. Auditory icons, earcons, and speech are the common auditory display schemes utilized in sonification, or more specifically in the use of audio to convey information. Once the captured data are perceived, their meanings, and more importantly, intentions can be interpreted more easily and thus can be employed as a complement to visualization techniques. Through auditory perception it is possible to convey information related to temporal, spatial, or some other context-oriented information. An important research question is whether the emotions perceived from these auditory icons or earcons are predictable in order to build an automated sonification platform. This paper conducts an experiment through which several mainstream and conventional machine learning algorithms are developed to study the prediction of emotions perceived from sounds. To do so, the key features of sounds are captured and then are modeled using machine learning algorithms using feature reduction techniques. We observe that it is possible to predict perceived emotions with high accuracy. In particular, the regression based on Random Forest demonstrated its superiority compared to other machine learning algorithms.

The growth of Cyber-physical Systems (CPS) has been increased in recent years. This has led to the coupling of highly complex cyber-physical components. With the integration of such complex components, new security challenges have emerged. Studies involving security issues in CPS have been quite difficult to be generalized due to the presence of heterogeneity and the diversity of the CPS components. These systems are subject to various vulnerabilities, threats and attacks, as a consequence of complex versions of CPS being introduced over time. This paper deals with vulnerabilities caused due to improper configurations in the software component of cyber-physical systems. Evolutionary algorithms such as Genetic Algorithms (GA) and Particle Swarm Optimization (PSO) can be employed to adequately test the underlying software for certain categories of vulnerabilities. This paper provides a detailed sensitivity analysis of these evolutionary algorithms in order to find out whether changing parameters involved in tuning these algorithms affect the overall performance. This analysis is based on the estimate of the number of generation of secure vulnerability pattern vectors under the variation of different parameters. The results indicate that while there is no evidence of influential parameters in Genetic Algorithms (i.e., mutation rate and population size), changes in the parameters involved in Particle Swarm Optimization algorithms (i.e., velocity rate and fitness range) have some positive impacts on the number of secure configurations generated.

Cyber-physical systems posit a complex number of security challenges due to interconnection of heterogeneous devices having limited processing, communication, and power capabilities. Additionally, the conglomeration of both physical and cyber-space further makes it difficult to devise a single security plan spanning both these spaces. Cyber-security researchers are often overloaded with a variety of cyber-alerts on a daily basis many of which turn out to be false positives. In this paper, we use machine learning and natural language processing techniques to predict the consequences of cyberattacks. The idea is to enable security researchers to have tools at their disposal that makes it easier to communicate the attack consequences with various stakeholders who may have little to no cybersecurity expertise. Additionally, with the proposed approach researchers' cognitive load can be reduced by automatically predicting the consequences of attacks in case new attacks are discovered. We compare the performance through various machine learning models employing word vectors obtained using both tf-idf and Doc2Vec models. In our experiments, an accuracy of 60% was obtained using tf-idf features and 57% using Doc2Vec method for models based on LinearSVC model.

The problem of detecting phishing emails through machine learning techniques has been discussed extensively in the literature. Conventional and state-of-the-art machine learning algorithms have demonstrated the possibility of building classifiers with high accuracy. The existing research studies treat phishing and genuine emails through general indicators and thus it is not exactly clear what phishing features are contributing to variations of the classifiers. In this paper, we crafted a set of phishing and legitimate emails with similar indicators in order to investigate whether these cues are captured or disregarded by email embeddings, i.e., vectorizations. We then fed machine learning classifiers with the carefully crafted emails to find out about the performance of email embeddings developed. Our results show that using these indicators, email embeddings techniques is effective for classifying emails as phishing or legitimate.

It is important and informative to compare and contrast major economic crises in order to confront novel and unknown cases such as the COVID-19 pandemic. The 2006 Great Recession and then the 2019 pandemic have a lot to share in terms of unemployment rate, consumption expenditures, and interest rates set by Federal Reserve. In addition to quantitative historical data, it is also interesting to compare the contents of Federal Reserve statements for the period of these two crises and find out whether Federal Reserve cares about similar concerns or there are some other issues that demand separate and unique monetary policies. This paper conducts an analysis to explore the Federal Reserve concerns as expressed in their statements for the period of 2005 to 2020. The concern analysis is performed using natural language processing (NLP) algorithms and a trend analysis of concern is also presented. We observe that there are some similarities between the Federal Reserve statements issued during the Great Recession with those issued for the 2019 COVID-19 pandemic.

We present an exploratory study of responses from 75 security professionals and ethical hackers in order to understand how they abuse cloud platforms for attack purposes. The participants were recruited at the Black Hat and DEF CON conferences. We presented the participants' with various attack scenarios and asked them to explain the steps they would have carried out for launching the attack in each scenario. Participants' responses were studied to understand attackers' mental models, which would improve our understanding of necessary security controls and recommendations regarding precautionary actions to circumvent the exploitation of clouds for malicious activities. We observed that in 93.78% of the responses, participants are abusing cloud services to establish their attack environment and launch attacks.

Cloud computing offers users scalable platforms and low resource cost. At the same time, the off-site location of the resources of this service model makes it more vulnerable to certain types of adversarial actions. Cloud computing has not only gained major user base, but also, it has the features that attackers can leverage to remain anonymous and stealth. With convenient access to data and technology, cloud has turned into an attack platform among other utilization. This paper reports our study to show that cyber attackers heavily abuse the public cloud platforms to setup their attack environments and launch stealth attacks. The paper first reviews types of attacks launched through cloud environment. It then reports case studies through which the processes of launching cyber attacks using clouds are demonstrated. We simulated various attacks using a virtualized environment, similar to cloud platforms, to identify the possible countermeasures from a defender's perspective, and thus to provide implications for the cloud service providers.

We present a novel idea on adequacy testing called "vulnerability coverage." The introduced coverage measure examines the underlying software for the presence of certain classes of vulnerabilities often found in the National Vulnerability Database (NVD) website. The thoroughness of the test input generation procedure is performed through the adaptation of evolutionary algorithms namely Genetic Algorithms (GA) and Particle Swarm Optimization (PSO). The methodology utilizes the Common Vulnerability Scoring System (CVSS), a free and open industry standard for assessing the severity of computer system security vulnerabilities, as a fitness measure for test inputs generation. The outcomes of these evolutionary algorithms are then evaluated in order to identify the vulnerabilities that match a class of vulnerability patterns for testing purposes.

The performance of coverage-based fault localization greatly depends on the quality of test cases being executed. These test cases execute some lines of the given program and determine whether the underlying tests are passed or failed. In particular, some test cases may be well-behaved (i.e., passed) while executing faulty statements. These test cases, also known as coincidentally correct test cases, may negatively influence the performance of the spectra-based fault localization and thus be less helpful as a tool for the purpose of automated debugging. In other words, the involvement of these coincidentally correct test cases may introduce noises to the fault localization computation and thus cause in divergence of effectively localizing the location of possible bugs in the given code. In this paper, we propose a hybrid approach of ensemble learning combined with a supervised learning algorithm namely, Random Forests (RF) for the purpose of correctly identifying test cases that are mislabeled to be the passing test cases. A cost-effective analysis of flipping the test status or trimming (i.e., eliminating from the computation) the coincidental correct test cases is also reported.

Customers represent their satisfactions of consuming products by sharing their experiences through the utilization of online reviews. Several machine learning-based approaches can automatically detect deceptive and fake reviews. Recently, there have been studies reporting the performance of ensemble learning-based approaches in comparison to conventional machine learning techniques. Motivated by the recent trends in ensemble learning, this paper evaluates the performance of ensemble learning-based approaches to identify bogus online information. The application of a number of ensemble learning-based approaches to a collection of fake restaurant reviews that we developed show that these ensemble learning-based approaches detect deceptive information better than conventional machine learning algorithms.

Ensuring compliance with complex privacy related regulations is more challenging in the presence of changing operating environments, such as cloud based services. This motivates the needs for tools and techniques that support systematic modeling and analysis of compliance requirements checking while considering the impact of operating environment changes on them. This paper demonstrates how goaloriented requirements engineering tools can be used to model variability in compliance sources and operating environments. We report a case study to demonstrate that the proposed modeling approach enables preforming trade-off analysis between organizational goals and alternative compliance controls.

Online reviews play an integral part for success or failure of businesses. Prior to purchasing services or goods, customers first review the online comments submitted by previous customers. However, it is possible to superficially boost or hinder some businesses through posting counterfeit and fake reviews. This paper explores a natural language processing approach to identify fake reviews. We present a detailed analysis of linguistic features for distinguishing fake and trustworthy online reviews. We study 15 linguistic features and measure their significance and importance towards the classification schemes employed in this study. Our results indicate that fake reviews tend to include more redundant terms and pauses, and generally contain longer sentences. The application of several machine learning classification algorithms revealed that we were able to discriminate fake from real reviews with high accuracy using these linguistic features.

This paper proposes to use Fast Fourier Transformation-based U-Net (a refined "fully convolutional networks") and perform image convolution in neural networks. Leveraging the Fast Fourier Transformation, it reduces the image convolution costs involved in the Convolutional Neural Networks (CNNs) and thus reduces the overall computational costs. The proposed model identifies the object information from the images. We apply the Fast Fourier transform algorithm on an image data set to obtain more accessible information about the image data, before segmenting them through the U-Net architecture. More specifically, we implement the FFT-based convolutional neural network to improve the training time of the network. The proposed approach was applied to publicly available Broad Bioimage Benchmark Collection (BBBC) dataset. Our model demonstrated improvement in training time during convolution from 600 - 700 ms/step to 400-500 ms/step. We evaluated the accuracy of our model using Intersection over Union (IoU) metric showing significant improvements.

More specialized cybersecurity education programs are needed to address workforce needs, but it is unclear which knowledge, skills, and abilities (KSAs) fulfil industry needs. We interviewed 48 professionals within four cyber defense specialty areas: (1) Cyber Network Defense Analysis, (2) Cyber Network Defense Infrastructure Support, (3) Incident Response, and (4) Vulnerability Assessment and Management. The professionals rated a number of specialized KSAs along two dimensions: how important the KSA was to their job and how difficult the KSA was to learn. Overall, communication and other non-technical skills were rated as being very important for all cyber defense jobs. Findings indicated that, for some specialty areas, technical knowledge and skills vary considerably between jobs and so the ability to teach oneself is more valuable than proficiency in any one KSA. Findings may be used to inform the development of general cybersecurity curricula, as well as curricula that focus on Cyber Network Defense Analysis, Cyber Network Defense Infrastructure Support, or Vulnerability Assessment and Management.

The detection of zero-day attacks and vulnerabilities is a challenging problem. It is of utmost importance for network administrators to identify them with high accuracy. The higher the accuracy is, the more robust the defense mechanism will be. In an ideal scenario (i.e., 100% accuracy) the system can detect zero-day malware without being concerned about mistakenly tagging benign files as malware or enabling disruptive malicious code running as none-malicious ones. This paper investigates different machine learning algorithms to find out how well they can detect zero-day malware. Through the examination of 34 machine/deep learning classifiers, we found that the random forest classifier offered the best accuracy. The paper poses several research questions regarding the performance of machine and deep learning algorithms when detecting zero-day malware with zero rates for false positive and false negative.

Machine and deep learning-based algorithms are the emerging approaches in addressing prediction problems in time series. These techniques have been shown to produce more accurate results than conventional regression-based modeling. It has been reported that artificial Recurrent Neural Networks (RNN) with memory, such as Long Short-Term Memory (LSTM), are superior compared to Autoregressive Integrated Moving Average (ARIMA) with a large margin. The LSTM-based models incorporate additional “gates” for the purpose of memorizing longer sequences of input data. The major question is that whether the gates incorporated in the LSTM architecture already offers a good prediction and whether additional training of data would be necessary to further improve the prediction. Bidirectional LSTMs (BiLSTMs) enable additional training by traversing the input data twice (i.e., 1) left-to-right, and 2) right-to-left). The research question of interest is then whether BiLSTM, with additional training capability, outperforms regular unidirectional LSTM. This paper reports a behavioral analysis and comparison of BiLSTM and LSTM models. The objective is to explore to what extend additional layers of training of data would be beneficial to tune the involved parameters. The results show that additional training of data and thus BiLSTM-based modeling offers better predictions than regular LSTM-based models. More specifically, it was observed that BiLSTM models provide better predictions compared to ARIMA and LSTM models. It was also observed that BiLSTM models reach the equilibrium much slower than LSTM-based models.

Phishing is the simplest form of cybercrime with the objective of baiting people into giving away delicate information such as individually recognizable data, banking and credit card details, orev encredentials and pass words. This type of simple yet most effective cyber-attack is usually launched through emails, phone calls, or instant messages. The credential or private data stolen are then used to get access to critical records of the victims and can result in extensive fraud and monetary loss. Hence, sending malicious messages to victims is a stepping stone of the phishing procedure. A phisher usually setups a deceptive website, where the victims are conned into entering credentials and sensitive information. It is therefore important to detect these types of malicious websites before causing any harmful damages to victims. Inspired by the evolving nature of the phishing websites, this paper introduces a novel approach based on deep reinforcement learning to model and detect malicious URLs. The proposed model is capable of adapting to the dynamic behavior of the phishing websites and thus learn the features associated with phishing website detection.

This paper introduces an approach based on control theory to model, analyze and select optimal security policies for Moving Target Defense (MTD) deployment strategies. A Markov Decision Process (MDP) scheme is presented to model states of the system from attacking point of view. The employed value iteration method is based on the Bellman optimality equation for optimal policy selection for each state defined in the system. The model is then utilized to analyze the impact of various costs on the optimal policy. The MDP model is then applied to two case studies to evaluate the performance of the model.

Water is a critical natural resource that has significant impacts on human living and society. Growing population and energy consumption exacerbate the scarcity of water and our ability to manage this resource. This demonstration paper presents WaterScope, a smart and connected platform for water resource management, which integrates multiple data sources such as water level data, social media data, and water related articles. Furthermore, the tool enables forecasting underground water levels, identifying water concerns, sharing knowledge and expertise among stakeholders, and thus bringing new insights to our understanding and insights of the water supplies and resource management. The prototype engages water stakeholders who face problems of similar nature but deal with the problem in an ad-hoc and isolated manner. The interactive WaterScope platform targets creating an interconnected virtual community that aims to improve water supply resilience.

Billions of devices in the Internet of Things (IoT) are inter-connected over the internet and communicate with each other or end users. IoT devices communicate through messaging bots. These bots are important in IoT systems to automate and better manage the work flows. IoT devices are usually spread across many applications and are able to capture or generate substantial influx of big data. The integration of IoT with cloud computing to handle and manage big data, requires considerable security measures in order to prevent cyber attackers from adversarial use of such large amount of data. An attacker can simply utilize the messaging bots to perform malicious activities on a number of devices and thus bots pose serious cybersecurity hazards for IoT devices. Hence, it is important to detect the presence of malicious bots in the network. In this paper we propose an evidence theory-based approach for malicious bot detection. Evidence Theory, a.k.a. Dempster Shafer Theory (DST) is a probabilistic reasoning tool and has the unique ability to handle uncertainty, i.e. in the absence of evidence. It can be applied efficiently to identify a bot, especially when the bots have dynamic or polymorphic behavior. The key characteristic of DST is that the detection system may not need any prior information about the malicious signatures and profiles. In this work, we propose to analyze the network flow characteristics to extract key evidence for bot traces. We then quantify these pieces of evidence using apriori algorithm and apply DST to detect the presence of the bots.

With the continued improvement and innovation, technology has become an integral part of our daily lives. The rapid adoption of technology and its affordability has given rise to the Internet-of-Things (IoT). IoT is an interconnected network of devices that are able to communicate and share information seamlessly. IoT encompasses a gamut of heterogeneous devices ranging from a small sensor to large industrial machines. One such domain of IoT that has seen a significant growth in the recent few years is that of the wearable devices. While the privacy issues for medical devices has been well-researched and documented in the literature, the threats to privacy arising from the use of consumer wearable devices have received very little attention from the research community. This paper presents a survey of the literature to understand the various privacy challenges, mitigation strategies, and future research directions as a result of the widespread adoption of wearable devices.

The emerging Internet of Things (IoT) has increased the complexity and difficulty of network administration. Fortunately, Software-Defined Networking (SDN) provides an easy and centralized approach to administer a large number of IoT devices and can greatly reduce the workload of network administrators. SDN-based implementation of networks, however, has also introduced new security concerns, such as increasing number of DDoS attacks. This paper introduces an easy and lightweight defense strategy against DDoS attacks on IoT devices in a SDN environment using Markov Decision Process (MDP) in which optimal policies regarding handling network flows are determined with the intention of preventing DDoS attacks.

Moving Target Defense (MTD) has been introduced as a new game changer strategy in cybersecurity to strengthen defenders and conversely weaken adversaries. The successful implementation of an MTD system can be influenced by several factors including the effectiveness of the employed technique, the deployment strategy, the cost of the MTD implementation, and the impact from the enforced security policies. Several efforts have been spent on introducing various forms of MTD techniques. However, insufficient research work has been conducted on cost and policy analysis and more importantly the selection of these policies in an MTD-based setting. This poster paper proposes a Markov Decision Process (MDP) modeling-based approach to analyze security policies and further select optimal policies for moving target defense implementation and deployment. The adapted value iteration method would solve the Bellman Optimality Equation for optimal policy selection for each state of the system. The results of some simulations indicate that such modeling can be used to analyze the impact of costs of possible actions towards the optimal policies.

Search engines are the major instruments on the Web. The determination of the liability of the results returned by a typical search engine is a daunting challenge mainly due to the presence of Web spams. New types of Web spams are continuously introduced every now and then, which makes it drastically challenging to decide about the accuracy of the results. The problem looks like a reasoning problem in the presence of uncertainty. This paper presents a methodology for predicting Web spam where the spamicity of hosts is formulated as a reasoning problem. The approach is based on evidence theory, a mathematical prediction model based on Dempster-Shafer Theory (DST). The key benefit of our approach for Web spam is DST's ability to deal with the uncertainty. When a new spam is introduced in the system, the system lacks a reasonable prior knowledge. This is where DST provides more liable solution to detect spams without any prior information. The paper presents detailed statistical evaluations of the proposed approach where an accuracy of 99.27% in detecting Web spams is reported.

Forecasting time series data is an important subject in economics, business, and finance. Traditionally, there are several techniques to effectively forecast the next lag of time series data such as univariate Autoregressive (AR), univariate Moving Average (MA), Simple Exponential Smoothing (SES), and more notably Autoregressive Integrated Moving Average (ARIMA) with its many variations. In particular, ARIMA model has demonstrated its outperformance in precision and accuracy of predicting the next lags of time series. With the recent advancement in computational power of computers and more importantly development of more advanced machine learning algorithms and approaches such as deep learning, new algorithms are developed to analyze and forecast time series data. The research question investigated in this article is that whether and how the newly developed deep learning-based algorithms for forecasting time series data, such as "Long Short-Term Memory (LSTM)", are superior to the traditional algorithms. The empirical studies conducted and reported in this article show that deep learning-based algorithms such as LSTM outperform traditional-based algorithms such as ARIMA model. More specifically, the average reduction in error rates obtained by LSTM was between 84 - 87 percent when compared to ARIMA indicating the superiority of LSTM to ARIMA. Furthermore, it was noticed that the number of training times, known as "epoch" in deep learning, had no effect on the performance of the trained forecast model and it exhibited a truly random behavior.

This demonstration paper introduces MalViz, a visual analytic tool for analyzing malware behavioral patterns through process monitoring events. The goals of this tool are: 1) to investigate the relationship and dependencies among processes interacted with a running malware over a certain period of time, 2) to support professional security experts in detecting and recognizing unusual signature-based patterns exhibited by a running malware, and 3) to help users identify infected system and users' libraries that the malware has reached and possibly tampered. A case study is conducted in a virtual machine environment with a sample of four malware programs. The result of the case study shows that the visualization tool offers a great support for experts in software and system analysis and digital forensics to profile and observe malicious behavior and further identify the traces of affected software artifacts.

There is a growing need for cybersecurity professionals with the knowledge, skills, and abilities (KSAs) necessary for risk and vulnerability analysis. Cybersecurity curricula should emphasize KSAs most important in cyber work. To determine which KSAs should be prioritized in curricula, we interviewed 38 cyber professionals with a specialty in vulnerability assessment and management. Interviews took place at the premier hacking conferences Black Hat and DEF CON in 2016 and 2017. Participants rated the importance of 31 KSAs taken from the National Initiative for Cybersecurity Education's Cybersecurity Workforce Framework. Of the 31 KSAs, 12 were rated as being significantly important to vulnerability assessment and management work. Half of these KSAs dealt with system and application vulnerabilities (e.g., Skills in conducting vulnerability scans and recognizing vulnerabilities). The other 6 most important KSAs concerned attacks (e.g., Knowledge of different classes of attacks), penetration testing (e.g., Skill in the use of penetration testing tools and techniques), and network protocols (e.g., Knowledge of network protocols). Overall, results suggest that vulnerability assessment students should graduate with: 1) knowledge of and skills in identifying vulnerabilities and robustness of systems and applications; 2) conceptual familiarity with classes of attacks and attack stages; 3) knowledge of and skills in penetration testing principles and tools, and 4) knowledge of network traffic and network protocols. Handouts will be provided.

Empirical studies show that coverage-based fault localizations are very effective in testing and debugging software applications. It is also a commonly held belief that no software testing techniques would perform best for all programs with various data structures and complexity. An important research question posed in this paper is whether the type and complexity of faults in a given program has any influence on the performance of these fault localization techniques. This paper investigates the performance of coverage-based fault localizations for different types of faults. We explore and compare the accuracy of these techniques for two large groups of faults often observed in object-oriented programs. First, we explore different types of traditional method-level faults grouped into six categories including those related to arithmetic, relational, conditional, logical, assignment, and shift. We then focus on class-level faults related to object-oriented features and group them into four categories including inheritance, overriding, Java-specific features, and common programming mistakes. The results show that coverage-based fault localizations are less effective for class-level faults associated with object-oriented features of programs. We therefore advocate the needs for designing more effective fault localizations for debugging object-oriented and class-level defects.

We introduce a technique to formally represent and specify race conditions in multithreaded applications. Answer set programming (ASP) is a logic-based knowledge representation paradigm to formally express belief acquired through reasoning in an application domain. The transparent and expressiveness representation of problems along with powerful non-monotonic reasoning power enable ASP to abstractly represent and solve some certain classes of NP hard problems in polynomial times. We use ASP to formally express race conditions and thus represent potential data races often occurred in multithreaded applications with shared memory models. We then use ASP to generate all possible test inputs and thread interleaving, i.e. scheduling, whose executions would result in deterministically exposing thread interleaving failures. We evaluated the proposed technique with some moderate sized Java programs, and our experimental results confirm that the proposed technique can practically expose common data races in multithreaded programs with low false positive rates. We conjecture that, in addition to generating threads scheduling whose execution order leads to the exposition of data races, ASP has several other applications in constraint-based software testing research and can be utilized to express and solve similar test case generation problems where constraints play a key role in determining the complexity of searches.

Our cybersecurity workforce needs surpass our ability to meet them. These needs could be mitigated by developing relevant curricula that prioritize the knowledge, skills, and abilities (KSAs) most important to cybersecurity jobs. To identify the KSAs needed for performing cybersecurity jobs, we administered survey interviews to 44 cyber professionals at the premier hacker conferences Black Hat 2016 and DEF CON 24. Questions concerned 32 KSAs related to cyber defense. Participants rated how important each KSA was to their job and indicated where they had learned that KSA. Fifteen of these KSAs were rated as being of higher-than-neutral importance. Participants also answered open-ended questions meant to uncover additional KSAs that are important to cyber-defense work. Overall, the data suggest that KSAs related to networks, vulnerabilities, programming, and interpersonal communication should be prioritized in cybersecurity curricula.

There is a job gap in cybersecurity with many more security jobs than qualified candidates. The cybersecurity workforce shortage could be mitigated by developing better curricula that prioritize the Knowledge, Skills, and Abilities (KSAs) most important to security related jobs. To determine which KSAs should be included in cybersecurity education and training, we administered survey-interviews to 44 security professionals at the premier hacking conferences Black Hat and DEF CON. Questions concerned 32 cybersecurity-relevant KSAs. Participants were asked how important each KSA was to their job and where they had learned that KSA. Fifteen KSAs were rated as being of higher-than-neutral importance. Most of these important KSAs concerned networks (example KSA: knowledge of network protocols) and threats/vulnerabilities (example KSA: knowledge of types of security threats and vulnerabilities). Of the 32 KSAs, participants learned the most about 31 of them while on the job and not through formal training. Overall, the data suggest that network KSAs and threat and vulnerability KSAs should be prioritized in course curricula and that historically threat and vulnerability KSAs have not been emphasized in school. This work is supported by National Science Foundation under award number DGE-1516636.

We introduce a novel application of feature ranking methods to the fault localization problem. We envision the problem of localizing causes of failures as instances of ranking program’s elements where elements are conceptualized as features. In this paper, we define features as program’s statements. However, in its fine-grained definition, the idea of program’s features can refer to any traits of programs. This paper proposes feature ranking-based algorithms. The algorithms analyze execution traces of both passing and failing test cases, and extract the bug signatures from the failing test cases. The proposed procedure extracts possible combinations of program’s elements when executed together from bug signatures. The feature ranking-based algorithms then order statements according to the suspiciousness of the combinations. When viewed as sequences, the combination of program’s elements produced and traced in bug signatures can be utilized to reason about the common longest subsequence. The common longest subsequence of bug signatures represents the common statements executed by all failing test cases and thus provides a means for identifying statements that contain possible faults. Our evaluation indicates that the proposed feature-based fault localization outperforms existing fault localization ranking schemes.

Many of the current policy-based management systems implement policies that depend on dynamic operational environment contexts. The existing formal-based approaches for enforcing security policies are mainly expressed using first-order logic. A major drawback of using first-order logic in implementing dynamic policies is that new observations cannot override previously inferred consequences. In fact, a security system whose enterprise policies are implemented using first-order logic is required to have complete access to data in advance in order to be able to perform an informed reasoning and enforce restricting policies. As a major problem, the systems designed based on these first order logic-based approaches are often static, inflexible, and hard to manage and scale. This paper introduces an approach for expressing and enforcing adaptive access control policies dynamically. The paper presents a non-monotonic formal approach based on Answer Set Programming where default policies are explicitly separated from context-dependent and exception policies that often occur in dynamic systems and in particular when the required context data are unavailable ahead of time. The results of presented case study demonstrate the flexibility of the proposed approach compared to the first order logic-based context-sensitive approaches as implemented in Organizational-Based Access Control (ORBAC) model.

Self-adaptive systems have received great attention in the last decade. In the context of self-adaptive systems, adaptive security concerns with adjusting protection mechanisms at runtime while changes occur in the operating environment. One of the challenges with self-adaptation paradigm is that the reasoning engine must leverage existing requirements and constraints and at the same time deal with different types of imperfections due to absence of knowledge or data. The problem arises when the existing runtime requirements models offer no explicit support for imperfections. By imperfections, we mean the values of some attributes of interest are not available at certain points. To address this problem, we propose uncertain reasoning based on imperfect requirements using non-monotonic logic. We model security requirements, system executions and changes in operation environment through non-monotonic logic that explicitly represents imperfect information and accounts for uncertainty.

Software components, which are vulnerable to being exploited, need to be identified and patched. Employing any prevention techniques designed for the purpose of detecting vulnerable software components in early stages can reduce the expenses associated with the software testing process significantly and thus help building a more reliable and robust software system. Although previous studies have demonstrated the effectiveness of adapting prediction techniques in vulnerability detection, the feasibility of those techniques is limited mainly because of insufficient training data sets. This paper proposes a prediction technique targeting at early identification of potentially vulnerable software components. In the proposed scheme, the potentially vulnerable components are viewed as mislabeled data that may contain true but not yet observed vulnerabilities. The proposed hybrid technique combines the supports vector machine algorithm and ensemble learning strategy to better identify potential vulnerable components. The proposed vulnerability detection scheme is evaluated using some Java Android applications. The results demonstrated that the proposed hybrid technique could identify potentially vulnerable classes with high precision and relatively acceptable accuracy and recall.

The aim of this research is to advance the user active authentication using keystroke dynamics. Through this research, we assess the performance and influence of various keystroke features on keystroke dynamics authentication systems. In particular, we investigate the performance of keystroke features on a subset of most frequently used English words. The performance of four features such as i) key duration, ii) flight time latency, iii) diagraph time latency, and iv) word total time duration are analyzed. Two machine learning techniques are employed for assessing keystroke authentications. The selected classification methods are support vector machine (SVM), and k-nearest neighbor classifier (K-NN). The logged experimental data are captured for 28 users. The experimental results show that key duration time offers the best performance result among all four keystroke features, followed by word total time.

Efficient keystroke authentication systems should have the ability to capture and build the user's pattern in minimal time. These systems also should be able to achieve quickest detection while maintaining good detection accuracy. However, maintaining high detection accuracy and minimal detection delay are conflicting requirements that need to be balanced. A possible approach to tackle this problem is reducing the number of features that need to be learned by a classifier and thereby decreasing the processing time. A wrapper based feature subset selection approach is presented in this paper with the objective of reducing the dimensionality of the user data through identifying a smaller subset of features that represent the most discriminating features in keystrokes dynamic. Several features selection techniques such as genetic and greedy algorithms, best first search Algorithms, and Particle Swarm Optimization (PSO) are used to search for the best subset features. These selection techniques are integrated (Wrapped) with different machine learning classifiers namely Support Vector Machine (SVM), Naive Bayesian (NB), and K Nearest Neighbors (KNN) for feature subset selection procedure that can automatically select the most appropriate and representative subset of features.

This paper presents a novel probabilistic approach for the fault localization challenge based on importance sampling. The iterative approach utilizes test results and execution profiles to estimate the likelihood of suspiciousness of program statements. Over a few iterations of probability updates and sampling, the procedure directs its attention towards those statements that are more likely to be faulty. The proposed approach is designed to be more sensitive to failing test cases in comparison to passing test cases. The effectiveness of the proposed stochastic approach is evaluated through two case studies and the results are compared against other popular fault localization methods.

Vulnerabilities need to be detected and removed from software. Although previous studies demonstrated the usefulness of employing prediction techniques in deciding about vulnerabilities of software components, the accuracy and improvement of effectiveness of these prediction techniques is still a grand challenging research question. This paper proposes a hybrid technique based on combining N-gram analysis and feature selection algorithms for predicting vulnerable software components where features are defined as continuous sequences of token in source code files, i.e., Java class file. Machine learning-based feature selection algorithms are then employed to reduce the feature and search space. We evaluated the proposed technique based on some Java Android applications, and the results demonstrated that the proposed technique could predict vulnerable classes, i.e., software components, with high precision, accuracy and recall.

Enabling software systems to adjust their protection in continuously changing environments with imperfect context information is a grand challenging problem. The issue of uncertain reasoning based on imperfect information has been overlooked in traditional logic programming with classical negation when applied to dynamic systems. This paper sketches a non-monotonic approach based on Answer Set Programming to reason with imperfect context data in adaptive security where there is little or no knowledge about certainty of the actions and events.

Summary Mutation testing is a fault‐based software testing technique in which a large number of mutants are generated in order to assess the adequacy of test cases devised. One of the daunting problems in this area consists in determining whether a mutant can be killed by a test case or it cannot be killed easily because the mutant is semantically equivalent to the original programme. A possible solution, as proposed in this paper, is to measure the complexity of each mutant and prioritize them according to how easy or hard they are to be exposed. As a result, using a proper metric based on the mutants' complexity, the tester may decide whether to focus on killing easy or hard mutants first. This paper introduces MuRanker, a mutation ranking tool that ranks mutants according to their predicted difficulty and complexity in being detected. The tool uses distance functions to decide the difficulty level of mutants. The computation of the distance function score is based on three representations, namely the control‐flow‐graph representation, the Jimple representation and the information captured through the code coverage data to differentiate the changes in the original and mutant programs. The tool generates a report that displays mutants in an ordered list based on their complexity. Using this tool, the tester can choose mutants and then devise appropriate test cases with the goal of killing them. The mutation ranking idea and the developed tool allow the software tester to save substantial time and effort on a task that, otherwise, would require the user to manually identify the difficult mutants. To our knowledge, MuRanker is the first mutation tool that proposes ranking mutants to facilitate mutation testing.Copyright © 2014 John Wiley & Sons, Ltd.

Although empirical studies have demonstrated the usefulness of statistical fault localizations based on code coverage, the effectiveness of these techniques may be deteriorated due to the presence of some undesired circumstances such as the existence of coincidental correctness where one or more passing test cases exercise a faulty statement and thus causing some confusion to decide whether the underlying exercised statement is faulty or not. Fault localizations based on coverage can be improved if all possible instances of coincidental correctness are identified and proper strategies are employed to deal with these troublesome test cases. We introduce a technique to effectively identify coincidentally correct test cases. The proposed technique combines support vector machines and ensemble learning to detect mislabeled test cases, i.e. Coincidentally correct test cases. The ensemble-based support vector machine then can be used to trim a test suite or flip the test status of the coincidental correctness test cases and thus improving the effectiveness of fault localizations.

Due to the complex causality of failure and the special characteristics of test cases, the faults in GUI (Graphic User Interface) applications are difficult to localize. This paper adapts feature selection algorithms to localize GUI-related faults in a given program. Features are defined as the subsequences of events executed. By employing statistical feature ranking techniques, the events can be ranked by the suspiciousness of events being responsible to exhibit faulty behavior. The features defined in a given source code implementing (event handle) the underlying event are then ranked in suspiciousness order. The evaluation of the proposed technique based on some open source Java projects verified the effectiveness of this feature selection based fault localization technique for GUI applications.

The effectiveness of coverage-based fault localizations in the presence of multiple faults has been a major concern for the software testing research community. A commonly held belief is that the fault localization techniques based on coverage statistics are less effective in the presence of multiple faults and their performance deteriorates. The fault interference phenomenon refers to cases where the software under test contains multiple faults whose interactions hinder effective debugging. The immediate research question that arises is to what extent fault interactions are influential. This paper focuses on verifying the existence of fault interference phenomenon in programs developed in programming languages with object-oriented features. The paper then statistically measures the influence and significance of fault interactions on the performance of debugging based on coverage-based fault localizations. The result verifies that the fault interleaving phenomenon occurs. However, its impact on the performance of fault localizations is negligible.

Testing is the most time consuming and expensive process in the software development life cycle. In order to reduce the cost of regression testing, we propose a test case classification methodology based on k-means clustering with the purpose of classifying test cases into two groups of effective and non-effective test cases. The clustering strategy is based on Hamming distances measured over the differences between coverage information obtained for current and the previous releases of the program under test. Our empirical study shows that the clustering-based test case classification can identify effective test cases with high recall ratio and considerable accuracy percentage. The paper also investigates and compares the performance of the proposed clustering-based approach with various factors including coverage criteria and the weights factor used in measuring distances.

Mutation analysts has emerged as a standard approach for empirical assessment of testing techniques. The test practitioners decide about cost-effectiveness of testing strategies based on the number of mutants the testing techniques detect. Though fundamental rigor to empirical software testing, the use of mutants in the absence of real-world faults has raised the concern of whether mutants and real faults exhibit similar properties. This paper revisits this important concern and disseminates interesting findings regarding mutants and whether these synthetic faults can predict fault detection ability of test suites. The results of controlled experiments conducted in this paper show that mutation when used in testing experiments is highly sensitive to external threats caused by some influential factors including mutation operators, test suite size, and programming languages. This paper raises the awareness message of the use of mutation in testing experiment and suggests that any interpretation or generalization of experimental findings based on mutation should be justified according to the influential factors involved.

Testing multi-threaded applications is a daunting problem mainly due to the non-deterministic runtime behavior of paralleled programs. Though the execution of multi-threaded applications primarily depends on context switches, it is not clear which environmental factors and to what degree control the threads scheduling. In this paper, we intend to identify environmental factors and their effects on the frequency of concurrency fault occurrences. The test practitioners and researchers will find the identified factors beneficial when testing paralleled applications. We conduct an exploratory study on the effect of multicore platforms on fault exposures. The result provides no support of the hypothesis that number of cores has some impact on fault exhibitions.

Software engineering researchers analyze programs by applying a range of test cases, measuring relevant statistics and reasoning about the observed phenomena. Though the traditional statistical methods provide a rigorous analysis of the data obtained during program analysis, they lack the flexibility to build a unique representation for each program. Bayesian methods for data analysis, on the other hand, allow for flexible updates of the knowledge acquired through observations. Despite their strong mathematical basis and obvious suitability to software analysis, Bayesian methods are still largely under-utilized in the software engineering community, primarily because many software engineers are unfamiliar with the use of Bayesian methods to formulate their research problems. This tutorial will provide a broad introduction of Bayesian methods for data analysis, with a specific focus on problems of interest to software engineering researchers. In addition, the tutorial will provide an in-depth understanding of a subset of popular topics such as Bayesian inference, probabilistic prediction techniques, Markov models, information theory and sampling. The core concepts will be explained using case studies and the application of prominent statistical tools on examples drawn from software engineering research. At the end of the tutorial, the participants will acquire the necessary skills and background knowledge to formulate their research problems using Bayesian methods, and analyze their formulation using appropriate software tools.

Mutation testing is a fault-based testing technique for measuring the adequacy of a test suite. Test suites are assigned scores based on their ability to expose synthetic faults (i.e., mutants) generated by a range of well-defined mathematical operators. The test suites can then be augmented to expose the mutants that remain undetected and are not semantically equivalent to the original code. However, the mutation score can be increased superfluously by mutants that are easy to expose. In addition, it is infeasible to examine all the mutants generated by a large set of mutation operators. Existing approaches have therefore focused on determining the sufficient set of mutation operators and the set of equivalent mutants. Instead, this paper proposes a novel Bayesian approach that prioritizes operators whose mutants are likely to remain unexposed by the existing test suites. Probabilistic sampling methods are adapted to iteratively examine a subset of the available mutants and direct focus towards the more informative operators. Experimental results show that the proposed approach identifies more than 90% of the important operators by examining ? 20% of the available mutants, and causes a 6% increase in the importance measure of the selected mutants.

We study the relationship between three properties of test suites: size, structural coverage, and fault-finding effectiveness. In particular, we study the question of whether achieving high coverage leads directly to greater effectiveness, or only indirectly through forcing a test suite to be larger. Our experiments indicate that coverage is sometimes correlated with effectiveness when size is controlled for, and that using both size and coverage yields a more accurate prediction of effectiveness than size alone. This in turn suggests that both size and coverage are important to test suite effectiveness. Our experiments also indicate that no linear relationship exists among the three variables of size, coverage and effectiveness, but that a nonlinear relationship does exist.

Mutants are automatically-generated, possibly faulty variants of programs. The mutation adequacy ratio of a test suite is the ratio of non-equivalent mutants it is able to identify to the total number of non-equivalent mutants. This ratio can be used as a measure of test effectiveness. However, it can be expensive to calculate, due to the large number of different mutation operators that have been proposed for generating the mutants.

Agent-based e-business opens up a computational direction, in which software agents behave on behalf of their owners. However, enabling agents to make decisions and exploiting information to other unknown agents have introduced some security challenges among them is trust relationship while agents are dealing with unknown environments and their residences. Despite existing of some sophisticated proposed approaches addressing the above problem, most of them are suffering from complexity and therefore drawback from development. We propose an efficient trust model for distributed systems mainly focusing on multi-agent systems. We provide a feasible mechanism using some well-known cryptographic techniques such that not only it addresses the above issue but also guarantees the security and resistibility of the model against some attacks

The empirical assessment of test techniques plays an important role in software testing research. One common practice is to seed faults in subject software, either manually or by using a program that generates all possible mutants based on a set of mutation operators. The latter allows the systematic, repeatable seeding of large numbers of faults, thus facilitating the statistical analysis of fault detection effectiveness of test suites; however, we do not know whether empirical results obtained this way lead to valid, representative conclusions. Focusing on four common control and data flow criteria (block, decision, C-use, and P-use), this paper investigates this important issue based on a middle size industrial program with a comprehensive pool of test cases and known faults. Based on the data available thus far, the results are very consistent across the investigated criteria as they show that the use of mutation operators is yielding trustworthy results: generated mutants can be used to predict the detection effectiveness of real faults. Applying such a mutation analysis, we then investigate the relative cost and effectiveness of the above-mentioned criteria by revisiting fundamental questions regarding the relationships between fault detection, test suite size, and control/data flow coverage. Although such questions have been partially investigated in previous studies, we can use a large number of mutants, which helps decrease the impact of random variation in our analysis and allows us to use a different analysis approach. Our results are then; compared with published studies, plausible reasons for the differences are provided, and the research leads us to suggest a way to tune the mutation analysis process to possible differences in fault detection probabilities in a specific environment

A successful result of choosing, invoking, integrating and composing services in a collaborative environment depends directly on locating reliable services with respect to their performances, histories, feedbacks from their customers, and generally their reputations. Nevertheless, lacking a secure mechanism to create countable reputation information may lead service providers to exaggerate their performances. We propose to apply threshold schemes under the context of service reputation towards providing an unconditionally secure "reputation" credits and systems for services and their providers. We argue that applying such a secure mechanism for reputation of services is not forgeable. As a result, any service requester was able to rely on valuable reputation information and choose the most reliable services with confidence.