Large Language Models (LLMs) have demonstrated exceptional capabilities in the field of Artificial Intelligence (AI) and are now widely used in various applications globally. However, one of their major challenges is handling high-concurrency workloads, especially under extreme conditions. When too many requests are sent simultaneously, LLMs often become unresponsive which leads to performance degradation and reduced reliability in real-world applications. To address this issue, this paper proposes a queue-based system that separates request handling from direct execution. By implementing a distributed queue, requests are processed in a structured and controlled manner, preventing system overload and ensuring stable performance. This approach also allows for dynamic scalability, meaning additional resources can be allocated as needed to maintain efficiency. Our experimental results show that this method significantly improves resilience under heavy workloads which prevents resource exhaustion and enables linear scalability. The findings highlight the effectiveness of a queue-based web service in ensuring LLMs remain responsive even under extreme workloads.

The integration of quantum computing with knowledge graphs presents a transformative approach to intelligent information processing that enables enhanced reasoning, semantic understanding, and large-scale data inference. This study introduces a Quantum Knowledge Graph (QKG) framework that combines Neo4j’s LLM Knowledge Graph Builder with Quantum Natural Language Processing (QNLP) to improve the representation, retrieval, and inference of complex knowledge structures. The proposed methodology involves extracting structured relationships from unstructured text, converting them into quantum-compatible representations using Lambeq, and executing quantum circuits via Qiskit to compute quantum embeddings. Using superposition and entanglement, the QKG framework enables parallel relationship processing, contextual entity disambiguation, and more efficient semantic association. These enhancements address the limitations of classical knowledge graphs, such as deterministic representations, scalability constraints, and inefficiencies in the capture of complex relationships. This research highlights the importance of integrating quantum computing with knowledge graphs, offering a scalable, adaptive, and semantically enriched approach to intelligent data processing.

Traditional access control systems often use the extensible access control markup language (XACML), a widely adopted standard for defining and enforcing access control policies. XACML is flexible and compatible with various access control models. It comprises key components such as the Policy Decision Point (PDP), Policy Enforcement Point (PEP), Policy Administration Point (PAP), and Policy Information Point (PIP), which are centrally managed in traditional setups. However, this central management introduces vulnerabilities like Single Point of Failure (SPOF) and other security risks. This research addresses these challenges by proposing a decentralized access control architecture built on Hyperledger Fabric. The design distributes the four core components of XACML— PEP, PDP, PAP, and PIP- across multiple blockchain nodes, eliminating SPOF while enhancing scalability and data integrity. A proof of concept (PoC) implementation is developed to evaluate the system’s performance. The architecture and PoC are analyzed against predefined threats and requirements, demonstrating how the system delivers a secure, scalable, and resilient access control solution.

The impact of diabetes is significantly increasing in the USA in both prevalence and healthcare costs. The Centers for Disease Control and Prevention (CDC) reports that, as of 2020, approximately 34.2 million people in the United States have diabetes. This study analyzes the relationship between food consumption, exercise, and Glycosylated Hemoglobin (HbA1c) levels in non-diabetic individuals. Data from the National Health and Nutrition Examination Survey (NHANES) were used, and statistical analyses were performed using SAS software to identify food types that impact HbA1c levels.

This work introduces a novel physics-informed neural network (PINN)-based framework for modeling and optimizing false data injection (FDI) attacks on electric vehicle charging station (EVCS) networks, with a focus on centralized charging management system (CMS). By embedding the governing physical laws as constraints within the neural network’s loss function, the proposed framework enables scalable, real-time analysis of cyber-physical vulnerabilities. The PINN models EVCS dynamics under both normal and adversarial conditions while optimizing stealthy attack vectors that exploit voltage and current regulation. Evaluations on the IEEE 33-bus system demonstrate the framework’s capability to uncover critical vulnerabilities. These findings underscore the urgent need for enhanced resilience strategies in EVCS networks to mitigate emerging cyber threats targeting the power grid. Furthermore, the framework lays the groundwork for exploring a broader range of cyber-physical attack scenarios on EVCS networks, offering potential insights into their impact on power grid operations. It provides a flexible platform for studying the interplay between physical constraints and adversarial manipulations, enhancing our understanding of EVCS vulnerabilities. This approach opens avenues for future research into robust mitigation strategies and resilient design principles tailored to the evolving cybersecurity challenges in smart grid systems.

Although software developers of mHealth apps are responsible for protecting patient data and adhering to strict privacy and security requirements, many of them lack awareness of HIPAA regulations and struggle to distinguish between HIPAA rules categories. Therefore, providing guidance of HIPAA rules patterns classification is essential for developing secured applications for Google Play Store. In this work, we identified the limitations of traditional Word2Vec embeddings in processing code patterns. To address this, we adopt multilingual BERT (Bidirectional Encoder Representations from Transformers) which offers contextualized embeddings to the attributes of dataset to overcome the issues. Therefore, we applied this BERT to our dataset for embedding code patterns and then uses these embedded code to various machine learning approaches. Our results demonstrate that the models significantly enhances classification performance, with Logistic Regression achieving a remarkable accuracy of 99.95%. Additionally, we obtained high accuracy from Support Vector Machine (99.79%), Random Forest (99.73%), and Naive Bayes (95.93%), outperforming existing approaches. This work underscores the effectiveness and showcases its potential for secure application development.

In today’s fast-paced software development environments, DevOps has revolutionized the way teams build, test, and deploy applications by emphasizing automation, collaboration, and continuous integration/continuous delivery (CI/CD). However, with these advancements comes an increased need to address security proactively, giving rise to the DevSecOps movement, which integrates security practices into every phase of the software development lifecycle. DevOps security remains underrepresented in academic curricula despite its growing importance in the industry. To address this gap, this paper presents a hands-on learning module that combines Chaos Engineering and White- box Fuzzing to teach core principles of secure DevOps practices in an authentic, scenario-driven environment. Chaos Engineering allows students to intentionally disrupt systems to observe and understand their resilience, while White-box Fuzzing enables systematic exploration of internal code paths to discover corner- case vulnerabilities that typical tests might miss. The module was deployed across three academic institutions, and both pre- and post-surveys were conducted to evaluate its impact. Pre-survey data revealed that while most students had prior experience in software engineering and cybersecurity, the majority lacked exposure to DevOps security concepts. Post-survey responses gathered through ten structured questions showed highly positive feedback 66.7% of students strongly agreed, and 22.2% agreed that the hands-on labs improved their understanding of secure DevOps practices. Participants also reported increased confidence in secure coding, vulnerability detection, and resilient infrastructure design. These findings support the integration of experiential learning techniques like chaos simulations and white-box fuzzing into security education. By aligning academic training with real- world industry needs, this module effectively prepares students for the complex challenges of modern software development and operations.

Large language models (LLMs) are becoming a popular tool as they have significantly advanced in their capability to tackle a wide range of language-based tasks. However, LLMs applications are highly vulnerable to prompt injection attacks, which poses a critical problem. These attacks target LLMs applications through using carefully designed input prompts to divert the model from adhering to original instruction, thereby it could execute unintended actions. These manipulations pose serious security threats which potentially results in data leaks, biased outputs, or harmful responses. This project explores the security vulnerabilities in relation to prompt injection attacks. To detect whether a prompt is vulnerable or not, we follows two approaches: 1) a pre-trained LLM, and 2) a fine-tuned LLM. Then, we conduct a thorough analysis and comparison of the classification performance. Firstly, we use pre-trained XLM-RoBERTa model to detect prompt injections using test dataset without any fine-tuning and evaluate it by zero-shot classification. Then, this proposed work will apply supervised fine-tuning to this pre-trained LLM using a task-specific labeled dataset from deepset in huggingface, and this fine-tuned model achieves impressive results with 99.13% accuracy, 100% precision, 98.33% recall and 99.15% F1-score thorough rigorous experimentation and evaluation. We observe that our approach is highly efficient in detecting prompt injection attacks.

With the rapid growth of technology, accessing digital health records has become increasingly easier. Especially mobile health technology like mHealth apps help users to manage their health information, as well as store, share and access medical records and treatment information. Along with this huge advancement, mHealth apps are increasingly at risk of exposing protected health information (PHI) when security measures are not adequately implemented. The Health Insurance Portability and Accountability Act (HIPAA) ensures the secure handling of PHI, and mHealth applications are required to comply with its standards. But it is unfortunate to note that many mobile and mHealth app developers, along with their security teams, lack sufficient awareness of HIPAA regulations, leading to inadequate implementation of compliance measures. Moreover, the implementation of HIPAA security should be integrated into applications from the earliest stages of development to ensure data security and regulatory adherence throughout the software lifecycle. This highlights the need for a comprehensive framework that supports developers from the initial stages of mHealth app development and fosters HIPAA compliance awareness among security teams and end users. An iOS framework has been designed for integration into the Integrated Development Environment(IDE), accompanied by a web application to visualize HIPAA security concerns in mHealth app development. The web application is intended to guide both developers and security teams on HIPAA compliance, offering insights on incorporating regulations into source code, with the IDE framework enabling the identification and resolution of compliance violations during development. The aim is to encourage the design of secure and compliant mHealth applications that effectively safeguard personal health information.

The increasing use of high-dimensional imaging in medical AI raises significant privacy and security concerns. This paper presents a Bootstrap Your Own Latent (BYOL)-based self-supervised learning (SSL) framework for secure image processing, ensuring compliance with HIPAA and privacy-preserving machine learning (PPML) techniques. Our method integrates federated learning, homomorphic encryption, and differential privacy to enhance security while reducing dependence on labeled data. Experimental results on the MNIST and NIH Chest X-ray datasets demonstrate a classification accuracy of 97.5% and 99.99% (pre-fine-tuning 40%), with improved clustering performance using K-Means (Silhouette Score: 0.5247). These findings validate BYOL’s capability for robust, privacy-preserving image processing while emphasizing the need for fine-tuning to optimize classification performance.

Kubernetes has become a popular tool for automated container orchestration. Despite reported benefits, practitioners report that the secure configuration of Kubernetes is one of the primary challenges among practitioners. Moreover, there is a significant skill shortage of Kubernetes security experts. Understanding misconfigurations in Kubernetes can help practitioners prevent security incidents. We systematically investigate whether authentic learning can help students learn about misconfigurations in Kubernetes. We conduct an authentic learning exercise and collected responses from 295 students. Based on responses from the students, we find (i) students who have little to no experience in cybersecurity, software quality assurance, or static analysis perceived the authentic learning exercise as useful to learn misconfigurations in Kubernetes, and (ii) students perceptions of authentic learning exercise activities vary based on and educational background. We conclude our paper with recommendations for instructors and researchers.

The Internet has opened the floor to stakeholders by redefining the way of organizing, communicating, and collaborating that was initiated by the Web’s development. The advancement of the World Wide Web is an outright phenomenon and significant and we witnessed the evolution of the Web. As decentralized technologies continue to gain traction, Web3, or the decentralized internet, has emerged as a promising approach to enable a more secure, transparent, and privacy-preserved digital landscape. In this paper, we thoroughly conduct a systematic study to explore the challenges and opportunities encountered by blockchain developers in the context of decentralized applications (dApps) in Web3. We analyze a set of peer-reviewed research articles, whitepapers, and technical reports and present an in-depth understanding of the current state of Web3 development and its implications. Our finding indicates the opportunities that Web3 can facilitate, such as expanded use cases, enhanced security and privacy, decentralized infrastructure, and the potential for enabling inclusive development resources for blockchain developers. Additionally, we highlight various challenges that blockchain developers deal with including scalability, security, privacy, interoperability, and the need for standardized tools and frameworks along with various challenges in the software development lifecycle (SDLC). While there are significant challenges to overcome, the potential benefits of Web3 are substantial and could lead to a more inclusive, secure, and transparent digital ecosystem. Furthermore, we emphasize the importance of continued research, collaboration, and innovation among stakeholders to address the identified challenges and capitalize on Web3’s opportunities.

Machine learning has been successfully applied to big data analytics across various disciplines. However, as data is collected from diverse sectors, much of it is private and confidential. At the same time, one of the major challenges in machine learning is the slow training speed of large models, which often requires high-performance servers or cloud services. To protect data privacy while still allowing model training on such servers, privacy-preserving machine learning using Fully Homomorphic Encryption (FHE) has gained significant attention. However, its widespread adoption is hindered by performance degradation. This paper presents our experiments on training models over encrypted data using FHE. The results show that while FHE ensures privacy, it can significantly degrade performance, requiring complex tuning to optimize.

The primary goal of authentic learning is to provide students with an engaging learning environment that offers hands-on experiences in solving real-world security challenges. Each educational theme consists of prelab activities, lab activities, and hands-on lab activities. By implementing authentic learning, we design and build portable lab for data poisoning vulnerability in LLM models on Google Colab. These hands-on labs can be accessed and practiced in real-time without the need for complex installations and configurations. This allows students to focus on learning concepts and increase their hands-on problem-solving skills.

Recent research has shown growing interest in the arithmetic reasoning capabilities of large language models (LLMs), especially those built on the Transformer architecture. However, our understanding of the intrinsic processes within these models for arithmetic calculations remains scant. This study leverages causal mediation analysis to offer an in-depth look at how Transformer-based LLMs approach complex arithmetic problems. We experimentally intervened on particular model activations and assessed the resulting shifts in prediction probabilities, allowing us to pinpoint which parameters are crucial for such reasoning tasks. We discovered that for complex arithmetic operations, information is channeled from mid-layer activations to the final token through enhanced attention mechanisms. Subsequently, Multi-Layer Perceptrons (MLP) modules synthesize this data, integrating it into the model's residual pathways. To validate these observations, we also evaluated the activation dynamics across different types of tasks, such as retrieving numbers from text and answering fact-based questions.

Quantum machine learning, noted for its remarkable advancements in enhancing computational speed and augmenting data processing efficacy, is acquiring considerable recognition within the scientific community. Despite the noteworthy advancements of quantum machine learning, it shares with its traditional counterpart a susceptibility to adversarial threats. This presents a significant challenge and underscores the need for robust countermeasures in this emerging field of study. Developing effective adversarial attack algorithms, such as the Quantum Fast Gradient Sign Method (QFGSM), is crucial to opening the path for exploring robust defense mechanisms against these threats. However, unlike traditional machine learning, the quantum field currently lacks the effective techniques to orchestrate adversarial attacks. This study introduces and assesses the QFGSM, a adversarial attack algorithm tailored for QNNs. Additionally, we evaluate the effect of random noise and its quantum version on these models, providing a comprehensive comparison to understand the efficacy of adversarial attack methods. The evaluation is conducted on both traditional Neural Networks (NNs) and QNNs using the ClaMP dataset, a cybersecurity-focused dataset, and involves performance metrics like Accuracy, Precision, Recall, and F1 score. Our findings underscore the differential resilience of NNs and QNNs under adversarial attacks and reveal the contrasting effects of FGSM, QFGSM, and random noise-based methods. Our study reveals that Quantum Neural Networks (QNNs) show significant vulnerability to our proposed Quantum Fast Gradient Sign Method (QFGSM) compared to random noise, indicating a need for quantum-specific defenses in the face of this advanced adversarial attack algorithm.

Large Language Models (LLMs) have extensive ability to produce promising output. Nowadays, people are increasingly relying on them due to easy accessibility, rapid and outstanding outcomes. However, the use of these results without appropriate scrutiny poses serious security risks, particularly when they are integrated with other software, APIs, or plugins. This is because the LLM outputs are highly dependent on the prompts they receive. Therefore, it is essential to carefully clean these outputs before using them in additional software environments. This paper is designed to teach students about the potential dangers of contaminated LLM output within the context of web development through prelab, hands-on, and postlab experiences. Hands-on lab provides practical guidance on how to handle LLM vulnerabilities to make applications safe with some real-world examples in Python. This approach aims to provide students with a deeper understanding of the precautions necessary to ensure software against the vulnerabilities introduced by LLM output.

In medical data analysis, addressing challenges from high-dimensional datasets is crucial due to issues related to computational complexity, resource utilization, and model interpretability. Principal Component Analysis (PCA), a prevalent dimension reduction technique, aims to tackle these challenges by transforming high-dimensional data into a lower-dimensional representation while preserving maximum variance. However, PCA faces limitations in high-dimensional contexts, potentially leading to information loss and increased computational demands, particularly for sizable datasets, as PCA uses the entire dataset in the transformation process. In this paper, we propose a novel framework ActivePCA that integrates PCA and Active Machine Learning (AML) to leverage a subset of datasets in the dimension reduction process. The framework selectively identifies most informative instances from the dataset in the first step. In the second step, ActivePCA applies PCA on the selected subset of the dataset only. To demonstrate effectiveness, we applied our proposed framework to six different EHR datasets with varying dimensions. The framework significantly reduces both the number of observations and dimensions of datasets utilizing AML and PCA, respectively, resulting in improved performance from ML classifiers. ActivePCA approximately reduces 50% to 80% labeling cost on the EHR datasets compared to the original dimensions of the datasets. In addition, ActivePCA achieves significantly higher accuracy using the reduced dimensions, showing the effectiveness of AML while applying PCA.

Increased vehicle component complexity and increased interconnectedness of vehicles, with the wide adoption of the Internet of Things (IoT), has increased the possible attack vectors of vehicles. Vehicle threats have increased by 225 percent in recent times and with this number only continuing to rise an increase in focus on vehicle security has become evident. In this paper, we propose the development of a vehicle threat-sharing system to analyze and share vehicle-related threats.

Recent investigations into Quantum Machine Learning (QML) techniques have unveiled methodologies that accelerate training in established machine learning models to provide an alternative for capturing complex patterns. This study focuses on implementing a practical QML Algorithm, Variational Quantum Classification (VQC) for cybersecurity dataset so that detecting anomalies can be improved and faster by reducing number of attributes$\log_{2} M$while training the model using Qiskit. Also, we study quantum algorithms to understand how it impacts on cyber datasets to detect anomalies in a improved way as it follows logarithms in the dimensionality reduction of quantum states which opens new horizons to quantum big data applications. Most importantly, we aim to also investigate the impact of various parameterized quantum circuits on VQC using quantum data as quantum states encoded by the cyber security dataset, NSL-KDD. In this research, we train VQC with various structures and parameters of quantum circuits as well as optimizers to adjust parameters of quantum circuits (ansatz) to minimize the objective function values so as to improve accuracy of the model in which quantum circuit, EfficientSU2, along with optimizer, COBYLA, outperforms the accuracy than other circuits and optimizers which shows great potential for improving cybersecurity systems. The research could effectively bridge in the gap between theory and implementation based quantum machine learning on cybersecurity systems.

This paper presents an innovative approach to DevOps security education, addressing the dynamic landscape of cybersecurity threats. We propose a student-centered learning methodology by developing comprehensive hands-on learning modules. Specifically, we introduce labware modules designed to automate static security analysis, empowering learners to identify known vulnerabilities efficiently. These modules offer a structured learning experience with pre-lab, hands-on, and post-lab sections, guiding students through DevOps concepts and security challenges. In this paper, we introduce hands-on learning modules that familiarize students with recognizing known security flaws through the application of Git Hooks. Through prac-tical exercises with real-world code examples containing security flaws, students gain proficiency in detecting vulnerabilities using relevant tools. Initial evaluations conducted across educational institutions indicate that these hands-on modules foster student interest in software security and cybersecurity and equip them with practical skills to address DevOps security vulnerabilities.

-The integration of Artificial Intelligence (AI) in mobile health (mHealth) devices offers significant advancements in patient care but also raises complex security and privacy concerns for sensitive health data. This paper explores the evolving landscape of Health Insurance Portability and Accountability Act (HIP AA) compliance within the context of AI-based mHealth devices, focusing on anticipated challenges in 2024. It examines the current state of HIP AA compliance in AI-driven mHealth, identifying potential vulnerabilities and gaps among mHealth devices in considering privacy and security. The study outlines key security and privacy considerations specific to AI-powered mHealth technologies, emphasizing risks such as data breaches, ransomware attack and unauthorized access. The paper concludes by highlighting the importance of continual adaptation to the dynamic nature of AI technologies and offers insights for stakeholders to navigate the regulatory landscape and ensure the responsible deployment of AI in healthcare.

Machine Learning (ML) algorithms often exhibit reduced performance in the presence of class imbalance, leading to biased results favoring the majority class in a dataset. This imbalance can be addressed through various sampling techniques, including oversampling of the minority class, undersampling of the majority class, or a combination of both. However, these techniques utilize the entire set of samples of datasets. In this paper, we introduce E-SMOTE, an Entropy-based Synthetic Minority Oversampling Technique (SMOTE), which extends the traditional SMOTE method. E-SMOTE is a novel oversampling technique designed to utilize a subset of the dataset from the minority class for the oversampling process. We employ entropy as a guiding metric to identify influential minority class instances located near decision boundaries. By generating additional instances near these boundaries within a binary classification system, E-SMOTE strengthens the decision boundary during the ML classifier training process. We conducted experiments on two datasets, Heart Failure Records and AIDS Clinical Trail Records, to demonstrate the effectiveness of E-SMOTE compared to traditional SMOTE. Our experimental results illustrate that E-SMOTE outperforms baseline classifier for both Heart Failure and AIDS clinical trial datasets. Additionally, it provides reasonable and comparable performance using a subset of the datasets compared to SMOTE oversampling technique using the entire dataset.

This research paper systematically identifies the perceptions of learning machine learning (ML) topics. To keep up with the ever-increasing need for professionals with ML expertise, for-profit and non-profit organizations conduct a wide range of ML-related courses at undergraduate and graduate levels. Despite the availability of ML-related education materials, there is lack of understanding how students perceive ML-related topics and the dissemination of ML-related topics. A systematic categorization of students' perceptions of these courses can aid educators in understanding the challenges that students face, and use that understanding for better dissemination of ML-related topics in courses. The goal of this paper is to help educators teach machine learning (ML) topics by providing an experience report of students' perceptions related to learning ML. We accomplish our research goal by conducting an empirical study where we deploy a survey with 83 students across five academic institutions. These students are recruited from a mixture of undergraduate and graduate courses. We apply a qualitative analysis technique called open coding to identify challenges that students encounter while studying ML-related topics. Using the same qualitative analysis technique we identify quality aspects do students prioritize ML-related topics. From our survey, we identify 11 challenges that students face when learning about ML topics, amongst which data quality is the most frequent, followed by hardware-related challenges. We observe the majority of the students prefer hands-on projects over theoretical lectures. Furthermore, we find the surveyed students to consider ethics, security, privacy, correctness, and performance as essential considerations while developing ML-based systems. Based on our findings, we recommend educators who teach ML-related courses to (i) incorporate hands-on projects to teach ML-related topics, (ii) dedicate course materials related to data quality, (iii) use lightweight virtualization tools to showcase computationally intensive topics, such as deep neural networks, and (iv) empirical evaluation of how large language models can be used in ML-related education.

This research-to-practice paper reports students' perceptions on using a teaching framework called authentic learning to learn about information flow analysis. Using information flow analysis, practitioners find the flow of data across one or multiple programs. Information flow analysis is helpful for multiple software engineering activities, such as detecting software bugs and developing software fuzzing techniques. Despite being helpful in practice, learning about information flow analysis remains an impediment for students, which in turn prevents them from reaping the benefits of using information flow analysis. Therefore, an application of a teaching framework can aid students in learning about information flow analysis. To that end, we systematically investigate if authentic learning—a teaching framework that emphasizes on providing hands on experience for a practically relevant topic—is helpful for students to learn about information flow analysis. Upon conducting the exercise, students are asked to participate in a survey where they report perceptions about the conducted exercise. We analyze data from 170 students who were introduced to information flow analysis through an authentic learning-based exercise. From our analysis, we observe: (i) majority of the students to have little to no knowledge about information flow analysis prior to conducting the authentic learning-based exercise; (ii) 74.1% of the 170 students find the authentic learning-based exercise helpful to learn about information flow analysis; and (iii) student perceptions to vary for the three components of the authentic learning-based exercise. We conclude our paper by describing the implications of our findings for instructors and researchers. For example, instructors should consider the education level of students while designing activities for individual authentic learning components to educate students on information flow analysis. Furthermore, researchers can devise strategies on how instructors can allocate their efforts for each authentic learning component through empirical studies. These studies may investigate the correlation between reported helpfulness and socio-technical factors, such as education level of students.

Cyberbullying is becoming a relevant challenge in next-generation online connected systems , especially in the case of social networks , a relevant innovation of our times. This phenomenon is largely recognized as inducting relevant problems in modern societies, due to the pervasiveness of modern personal devices that originated larger and larger networks. Information and Communication Technologies (ICT) can really help to this end, thanks to the application of well-known models and methods mainly falling in the context of language transformers and neural networks , which both represent state-of-the-art solutions for supporting cyberbullying detection in text (e.g., posts). Inspired by this main research area, in this paper we provide an overview of state-of-the-art approaches for cyberbullying detection along with their experimental comparison against the reference TRAC-2 dataset .

The pivotal role of white-box testing with respect to software quality assurance, necessitates dissemination of education materials related to white-box testing in the course curriculum. In this poster, we describe our experiences in conducting an authentic learning-based exercise related to white-box testing. From a conducted survey with 124 students, we observe the authentic learning-based exercise to be helpful for students to learn about white-box testing.

The burgeoning fields of machine learning (ML) and quantum machine learning (QML) have shown remarkable potential in tackling complex problems across various domains. However, their susceptibility to adversarial attacks raises concerns when deploying these systems in security-sensitive applications. In this study, we present a comparative analysis of the vulnerability of ML and QML models, specifically conventional neural networks (NN) and quantum neural networks (QNN), to adversarial attacks using a malware dataset. We utilize a software supply chain attack dataset known as ClaMP and develop two distinct models for QNN and NN, employing Pennylane for quantum implementations and TensorFlow and Keras for traditional implementations. Our methodology involves crafting adversarial samples by introducing random noise to a small portion of the dataset and evaluating the impact on the models' performance using accuracy, precision, recall, and F1 score metrics. Based on our observations, both ML and QML models exhibit vulnerability to adversarial attacks. While the QNN's accuracy decreases more significantly compared to the NN after the attack, it demonstrates better performance in terms of precision and recall, indicating higher resilience in detecting true positives under adversarial conditions. We also find that adversarial samples crafted for one model type can impair the performance of the other, highlighting the need for robust defense mechanisms. Our study serves as a foundation for future research focused on enhancing the security and resilience of ML and QML models, particularly QNN, given its recent advancements. A more extensive range of experiments will be conducted to better understand the performance and robustness of both models in the face of adversarial attacks.

With the ever-growing concern for internet security, the field of quantum cryptography emerges as a promising solution for enhancing the security of networking systems. In this paper, 20 notable papers from leading conferences and journals are reviewed and categorized based on their focus on various aspects of quantum cryptography, including key distribution, quantum bit commitment, post-quantum cryptography, and counterfactual quantum key distribution. The paper explores the motivations and challenges of employing quantum cryptography, addressing security and privacy concerns along with existing solutions. Secure key distribution, a critical component in ensuring the confidentiality and integrity of transmitted information over a network, is emphasized in the discussion. The survey examines the potential of quantum cryptography to enable secure key exchange between parties, even when faced with eavesdropping, and other applications of quantum cryptography. Additionally, the paper analyzes the methodologies, findings, and limitations of each reviewed study, pinpointing trends such as the increasing focus on practical implementation of quantum cryptography protocols and the growing interest in post-quantum cryptography research. Furthermore, the survey identifies challenges and open research questions, including the need for more efficient quantum repeater networks, improved security proofs for continuous variable quantum key distribution, and the development of quantum-resistant cryptographic algorithms, showing future directions for the field of quantum cryptography.

Social media cyberbullying has a detrimental effect on human life. As online social networking grows daily, the amount of hate speech also increases. Such terrible content can cause depression and actions related to suicide. This paper proposes a trustable LSTM-Autoencoder Network for cyberbullying detection on social media using synthetic data. We have demonstrated a cutting-edge method to address data availability difficulties by producing machine-translated data. However, several languages such as Hindi and Bangla still lack adequate investigations due to a lack of datasets. We carried out experimental identification of aggressive comments on Hindi, Bangla, and English datasets using the proposed model and traditional models, including Long Short-Term Memory (LSTM), Bidirectional Long ShortTerm Memory (BiLSTM), LSTM-Autoencoder, Word2vec, Bidirectional Encoder Representations from Transformers (BERT), and Generative Pre-trained Transformer 2 (GPT-2) models. We employed evaluation metrics such as f1-score, accuracy, precision, and recall to assess the models’ performance. Our proposed model outperformed all the models on all datasets, achieving the highest accuracy of 95%. Our model achieves state-of-the-art results among all the previous works on the dataset we used in this paper.

With the growing adoption of unmanned aerial vehicles (UAVs) across various domains, the security of their operations is paramount. UAVs, heavily dependent on GPS navigation, are at risk of jamming and spoofing cyberattacks, which can severely jeopardize their performance, safety, and mission integrity. Intrusion detection systems (IDSs) are typically employed as defense mechanisms, often leveraging traditional machine learning techniques. However, these IDSs are susceptible to adversarial attacks that exploit machine learning models by introducing input perturbations. In this work, we propose a novel IDS for UAVs to enhance resilience against such attacks using generative adversarial networks (GAN). We also comprehensively study several evasion-based adversarial attacks and utilize them to compare the performance of the proposed IDS with existing ones. The resilience is achieved by generating synthetic data based on the identified weak points in the IDS and incorporating these adversarial samples in the training process to regularize the learning. The evaluation results demonstrate that the proposed IDS is significantly robust against adversarial machine learning-based attacks compared to the state-of-the-art IDSs while maintaining a low false positive rate.

This paper represents the experience of women from STEM and Non-STEM fields from the perspective of the rural area of Bangladesh. In Bangladesh, the social and cultural perspectives differ from one area to another. Previously no work has been done in Bangladesh from the perspective of the rural areas. We have come up with the motivation to work on this particular area to find out what barriers and challenges women face when they move to urban areas to study in the STEM field. From our findings, we have found some barriers from the Non-STEM field and opportunities from the STEM field. We have studied n=8 participants (5 Non-STEM, 3 STEM). Through their shared experience, they face barriers such as early marriage, excessive usage of social media, lack of support from teachers, peers, institutions, and family, challenge of Accommodation and security system outside of the hometown, and parents’ mentality towards children’s career. We have found opportunities such as parents’ educational background, female role models, and family support from the shared experience of STEM field participants. This research uncovered the barriers and opportunities that rural women face for entering the STEM field, which is very important to mitigate the barriers to entering the STEM field for rural women, which will help to create a new dimension in the HCI field. We believe that by following our work, future researchers might get motivated to contribute in this area, which will help the area to be considered as a big and an important part of the future investigation.

Quantum machine learning (QML) is an emerging field of research that leverages quantum computing to improve the classical machine learning approach to solve complex real-world problems. QML has the potential to address cybersecurity-related challenges. Considering the novelty and complex architecture of QML, resources are not yet explicitly available that can pave cybersecurity learners to instill efficient knowledge of this emerging technology. In this research, we design and develop QML-based ten learning modules covering various cybersecurity topics by adopting student centering case-study based learning approach. We apply one subtopic of QML on a cybersecurity topic comprised of pre-lab, lab, and post-lab activities towards providing learners with hands-on QML experiences in solving real-world security problems. In order to engage and motivate students in a learning environment that encourages all students to learn, pre-lab offers a brief introduction to both the QML subtopic and cybersecurity problem. In this paper, we utilize quantum support vector machine (QSVM) for malware classification and protection where we use open source Pennylane QML framework on the drebin215 dataset. We demonstrate our QSVM model and achieve an accuracy of 95% in malware classification and protection. We will develop all the modules and introduce them to the cybersecurity community in the coming days.

The main objective of authentic learning is to offer students an exciting and stimulating educational setting that provides practical experiences in tackling real-world security issues. Each educational theme is composed of pre-lab, lab, and post-lab activities. Through the application of authentic learning, we create and produce portable lab equipment for AI Security and Privacy on Google CoLab. This enables students to access and practice these hands-on labs conveniently and without the need for time-consuming installations and configurations. As a result, students can concentrate more on learning concepts and gain more experience in hands-on problem-solving abilities.

This survey paper provides an overview of the current state of AI attacks and risks for AI security and privacy as artificial intelligence becomes more prevalent in various applications and services. The risks associated with AI attacks and security breaches are becoming increasingly apparent and cause many financial and social losses. This paper will categorize the different types of attacks on AI models, including adversarial attacks, model inversion attacks, poisoning attacks, data poisoning attacks, data extraction attacks, and membership inference attacks. The paper also emphasizes the importance of developing secure and robust AI models to ensure the privacy and security of sensitive data. Through a systematic literature review, this survey paper comprehensively analyzes the current state of AI attacks and risks for AI security and privacy and detection techniques.

Android developers have already adopted Kotlin as their preferred language. Kotlin is more well-accepted than Java because of its simplicity, readability, and new features like scope functions, extension functions, null safety, etc. Google has introduced several new libraries such as RoomDb, Jetpack-Compose, as well as dependency injection frameworks like Dagger-Hilt to enhance Android Development. The question is how secure these libraries are? Are there tools available to analyze new Libraries? DroidPatrol [1] is our existing static analysis plugin that works on Android Apps written in Java. To support Kotlin code analysis we were continuously working on upgrading our plugin. Finally, we released DroidPatrol 2.0 [2] which is compatible to perform static analysis of Android apps developed in Kotlin. It also works on Java-based Android app developed in Java. In this latest edition, we restructured the architecture of the plugin to optimize its efficiency. We also found a vulnerability in RoomDb. The latest version is developed in Kotlin, and we used IntelliJ Idea. Lastly, version 2.0 is independent of Android Studio editions meaning that any version of Android Studio is compatible.

Cardiovascular health is of utmost importance, and the rapid evolution of monitoring devices and applications has revolutionized the way we manage it. From smartwatches to electrocardiogram (ECG) devices and implantable solutions, these technological advancements aim to improve patient outcomes. However, the integration of patients' health information with technology necessitates stringent measures to protect personal health information (PHI) and ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA). This study investigates the compliance of various cardiovascular health management (CHM) software, applications, and systems with HIPAA regulations. Through an extensive literature review and systematic analysis, we assessed over 25 scholarly articles that discuss the intersection of cardiovascular health monitoring devices and HIPAA compliance. Our evaluation of the current state of compliance across different applications revealed both strengths and weaknesses in the industry’s privacy and security measures. Our findings indicate that although many CHM solutions demonstrate compliance with HIPAA regulations, there remain areas of concern, particularly regarding data encryption, storage, and access control. To address these gaps, we propose specific recommendations for enhancing privacy and security, including the adoption of robust encryption methods, strict access control policies, and regular security audits. Future research should focus on the development of standardized compliance frameworks for cardiovascular health management systems, as well as the assessment of emerging technologies and their potential impact on HIPAA compliance. By advancing our understanding of the challenges and opportunities in this field, we aim to contribute to the ongoing efforts to protect patients' PHI and promote secure, reliable, and effective health management solutions.

Quantum machine learning (QML) in the field of disease detection and prediction use quantum computing techniques and algorithms to analyze and classify large datasets of medical information, by identifying subtle patterns and predict the occurrence or progression of diseases. It involves applying machine learning techniques to data from biological and medical research, such as-genomic and proteomic data, medical imaging, electronic health records, and clinical trial data, using quantum computing algorithms and architectures to perform these analyses more efficiently and accurately than classical computing methods. This approach has the potential to provide new insights into complex biological systems and facilitate the development of more effective treatments and personalized medicine. In this paper, a systematic review of the use of QML algorithms has been conducted, which focuses on the detection and prediction of diseases among patients. The current essence of the field along with the challenges and limitations of current works have also been discussed. After evaluating the implemented and proposed methods of data analysis, algorithm development, usefulness and efficiency of the system in various disease detection and prediction, a recommendation was made on the open research scopes in this field at the end of the paper.

In the ongoing pandemic of COVID-19, the entire population of the world is getting affected either physically or mentally. In terms of physical diseases, the symptoms and treatments are more known, and people tend to be more aware of them. But the mental health is frequently ignored by general people, which has worsened during the pandemic. Though several research were conducted to cope with mental health analysis, detection and treatment in this current pandemic situation, the practical implementation are few. Among them the optimal results are produced by the ones adapting artificial intelligence (AI). Also, remote healthcare services have provided their supportive hands to combat the situation. In this paper, a systematic review of the use of AI and remote healthcare services has been conducted, which focuses on the detection, analysis and treatment of mental health among people during the COVID-19 pandemic. The current essence, challenges and limitations have also been discussed here. After evaluating the methods of data collection, usefulness and efficiency of the available works in symptom detection remotely and correctly, and data analysis algorithms used by them- a recommendation was made on the open research scopes in this field.

Heart disease is a leading cause of morbidity and mortality worldwide, necessitating the development of innovative diagnostic methodologies for early detection. This study presents a novel deep convolutional neural network model that leverages Mel-spectrograms to accurately classify heart sounds. Our approach demonstrates significant advancements in heart disease detection, achieving high accuracy, specificity, and unweighted average recall scores (UAR), which are critical factors for practical clinical applications. The comparison of our proposed model's performance with a PANN-based model from a previous study highlights the strengths of our approach, particularly in terms of specificity and UAR. The successful application of Mel-spectrograms in conjunction with deep learning techniques illustrates the potential for widespread clinical adoption of our model, ultimately contributing to early detection and improved patient outcomes. Furthermore, we discuss potential avenues for future research to enhance the model's effectiveness, such as incorporating additional features and exploring alternative deep learning architectures. In conclusion, our deep convolutional neural network model, combined with Mel-spectrograms, offers a significant step forward in the field of heart sound classification and the early detection of heart diseases, demonstrating its potential for real-world clinical applications and improved patient outcomes.

The primary goal of the authentic learning approach is to engage and motivate students in learning real world problem solving. We report our experience in developing k-nearest neighbor (KNN) classification for anomaly user behavior detection, one of the authentic machine learning for cybersecurity (ML4Cybr) learning modules based on 10 cybersecurity (CybrS) cases with machine learning (ML) solutions. All portable labs are made available on Google CoLab. So students can access and practice these hands-on labs anywhere and anytime without software installation and configuration which will engage students in learning concepts immediately and getting more experience for hands-on problem solving skills.

The software supply chain (SSC) attack has become one of the crucial issues that are being increased rapidly with the advancement of the software development domain. In general, SSC attacks execute during the software development processes lead to vulnerabilities in software products targeting downstream customers and even involved stakeholders. Machine Learning approaches are proven in detecting and preventing software security vulnerabilities. Besides, emerging quantum machine learning can be promising in addressing SSC attacks. Considering the distinction between traditional and quantum machine learning, performance could be varies based on the proportions of the experimenting dataset. In this paper, we conduct a comparative analysis between quantum neural networks (QNN) and conventional neural networks (NN) with a software supply chain attack dataset known as ClaMP. Our goal is to distinguish the performance between QNN and NN and to conduct the experiment, we develop two different models for QNN and NN by utilizing Pennylane for quantum and TensorFlow and Keras for traditional respectively. We evaluated the performance of both models with different proportions of the ClaMP dataset to identify the f1 score, recall, precision, and accuracy. We also measure the execution time to check the efficiency of both models. The demonstration result indicates that execution time for QNN is slower than NN with a higher percentage of datasets. Due to recent advancements in QNN, a large level of experiments shall be carried out to understand both models accurately in our future research.

Aggressive comments on social media negatively impact human life. Such offensive contents are responsible for depression and suicidal-related activities. Since online social networking is increasing day by day, the hate content is also increasing. Several investigations have been done on the domain of cyberbullying, cyberaggression, hate speech, etc. The majority of the inquiry has been done in the English language. Some languages (Hindi and Bangla) still lack proper investigations due to the lack of a dataset. This paper particularly worked on the Hindi, Bangla, and English datasets to detect aggressive comments and have shown a novel way of generating machine-translated data to resolve data unavailability issues. A fully machine-translated English dataset has been analyzed with the models such as the Long Short term memory model (LSTM), Bidirectional Long-short term memory model (BiLSTM), LSTM-Autoencoder, word2vec, Bidirectional Encoder Representations from Transformers (BERT), and generative pre-trained transformer (GPT-2) to make an observation on how the models perform on a machine-translated noisy dataset. We have compared the performance of using the noisy data with two more datasets such as raw data, which does not contain any noises, and semi-noisy data, which contains a certain amount of noisy data. We have classified both the raw and semi-noisy data using the aforementioned models. To evaluate the performance of the models, we have used evaluation metrics such as F1-score, accuracy, precision, and recall. We have achieved the highest accuracy on raw data using the gpt2 model, semi-noisy data using the BERT model, and fully machine-translated data using the BERT model. Since many languages do not have proper data availability, our approach will help researchers create machine-translated datasets for several analysis purposes.

A handwritten word recognition system comes with issues such as-lack of large and diverse datasets. It is necessary to resolve such issues since millions of official documents can be digitized by training deep learning models using a large and diverse dataset. Due to the lack of data availability, the trained model does not give the expected result. Thus, it has a high chance of showing poor results. This paper proposes a novel way of generating diverse handwritten word images using handwritten characters. The idea of our project is to train the BiLSTM-CTC architecture with generated synthetic handwritten words. The whole approach shows the process of generating two types of large and diverse handwritten word datasets: overlapped and non-overlapped. Since handwritten words also have issues like overlapping between two characters, we have tried to put it into our experimental part. We have also demonstrated the process of recognizing handwritten documents using the deep learning model. For the experiments, we have targeted the Bangla language, which lacks the handwritten word dataset, and can be followed for any language. Our approach is less complex and less costly than traditional GAN models. Finally, we have evaluated our model using Word Error Rate (WER), accuracy, f1-score, precision, and recall metrics. The model gives 39% WER score, 92% percent accuracy, and 92% percent f1 scores using non-overlapped data and 63% percent WER score, 83% percent accuracy, and 85% percent f1 scores using overlapped data.

Skin cancer is a deadly disease. Melanoma is a type of skin cancer responsible for the high mortality rate. Early detection of skin cancer can enable patients to treat the disease and minimize the death rate. Skin cancer detection is challenging since different types of skin lesions share high similarities. This paper proposes a computer-based deep learning approach that will accurately identify different kinds of skin lesions. Deep learning approaches can detect skin cancer very accurately since the models learn each pixel of an image. Sometimes humans can get confused by the similarities of the skin lesions, which we can minimize by involving the machine. However, not all deep learning approaches can give better predictions. Some deep learning models have limitations, leading the model to a false-positive result. We have introduced several deep learning models to classify skin lesions to distinguish skin cancer from different types of skin lesions. Before classifying the skin lesions, data preprocessing and data augmentation methods are used. Finally, a Convolutional Neural Network (CNN) model and six transfer learning models such as Resnet-50, VGG-16, Densenet, Mobilenet, Inceptionv3, and Xception are applied to the publically available benchmark HAM10000 dataset to classify seven classes of skin lesions and to conduct a comparative analysis. The models will detect skin cancer by differentiating the cancerous cell from the non-cancerous ones. The models’ performance is measured using performance metrics such as precision, recall, f1 score, and accuracy. We receive accuracy of 90, 88, 88, 87, 82, and 77 percent for inceptionv3, Xception, Densenet, Mobilenet, Resnet, CNN, and VGG16, respectively. Furthermore, we develop five different stacking models such as inceptionv3-inceptionv3, Densenet-mobilenet, inceptionv3-Xception, Resnet50-Vgg16, and stack-six for classifying the skin lesions and found that the stacking models perform poorly. We achieve the highest accuracy of 78 percent among all the stacking models.

The primary goal of the authentic learning approach is to engage and motivate students in a learning environment that encourages all students in learning. This approach provides students with hands-on experiences in solving real-world security problems. We designed and developed ten learning modules based on 10 cybersecurity cases with different ML solutions. Each learning module consists of pre-lab, lab, and post-lab (Pre/Lab/Post) activities. All portable labs are made available on Google CoLab for ML to cybersecurity so that students can access and practice these hands-on labs anywhere and anytime without time tedious installation and configuration which will engage students in learning concepts and getting more experience for hands-on problem-solving skills. In this paper, we adopt Neural Network Algorithms for Network Denial of Service (DOS) Detection where we apply the KDDCup 1999 datasets contain a standard set of data to be audited, which includes a wide variety of intrusions simulated in a military network environment. Our primary goal of this lab is to show whether a link is a malicious or safe connection. Our demonstration shows an achieved accuracy of 99.89%.

Bridges play a vital part in the transportation system by ensuring the connectedness of transportation systems, which is critical for a country’s social and economic prosperity by offering daily mobility to the people. However, according to the American Society of Civil Engineers (ASCE 2017), many U.S. bridges are in critical condition, raising safety issues, with 9.1 and 13.6 percent of the country’s 614,387 bridges, respectively, structurally defective, and functionally obsolete. Every day, 178 million people traverse these structurally defective bridges. Furthermore, the average annual failure rate is expected to be between 87 and 222. Bridge breakdowns have disastrous repercussions, and in many cases, result in death. While bridge authorities strive to improve bridge conditions, budget limits make it difficult to make cost-effective maintenance decisions. Bridge authorities distribute limited repair resources based on projected future bridge conditions. As a result, building a data-driven, autonomous, and effective bridge condition prediction model is critical for improving maintenance decision-making. In this paper, we present a novel bridge condition prediction framework using advanced Machine Learning (ML) algorithms on the National Bridge Inventory (NBI) dataset. The framework consists of two stages, where the most informative features from the NBI dataset are selected using the Recursive Feature Elimination process and in the 2ndstep, ML classifiers are applied to the selected features for bridge condition prediction. The experimental results show that the proposed framework can effectively predict bridge conditions by producing highly accurate results in terms of accuracy, precision, recall, and f1-score.

YouTube has emerged as the most popular video platform across the world. This paper proposes a system for stream based meta-data analytics, to gain insights and uncover hidden patterns, for YouTube videos. The system reports the number of videos uploaded for each category, the videos with the highest views and highest likes etc. It crowd-sources the calls to the YouTube’s search and data APIs, and feeds it to Kafka Stream to process using PySpark. Finally, the processed video meta-data in stored in Apache Cassandra for downstream consumption. By experimenting with different time windows from 5 to 30 minutes, it is observed that 15-minute window is optimum for getting adequate video data de-duplication. From the available 30 video categories, with the minimum video length of 30 minutes, our study observed that the top 10 video categories with the highest number of videos are Film & Animation, Autos & Vehicles, Music, Sports, Travel & Events, Entertainment, News & politics, Documentary, Science & Technology and Education. The highest videos are uploaded under Entertainment category, which clearly captures the content creator’s interest.

Context: Supervised learning-based projects (SLPs), i.e., software projects that use supervised learning algorithms, such as decision trees are useful for performing classification-related tasks. Yet, security weaknesses, such as the use of hard-coded passwords in SLPs, can make SLPs susceptible to security attacks. A characterization of security weaknesses in SLPs can help practitioners understand the security weaknesses that are frequent in SLPs and adopt adequate mitigation strategies. Objective: The goal of this paper is to help practitioners se-curely develop supervised learning-based projects by conducting an empirical study of security weaknesses in supervised learning-based projects. Methodology: We conduct an empirical study by quantifying the frequency of security weaknesses in 278 open source SLPs. Results: We identify 22 types of security weaknesses that occur in SLPs. We observe ‘use of potentially dangerous function’ to be the most frequently occurring security weakness in SLPs. Of the identified 3,964 security weaknesses, 23.79 % and 40.49 % respectively, appear for source code files used to train and test models. We also observe evidence of co-location, e.g., instances of command injection co-locates with instances of potentially dangerous function. Conclusion: Based on our findings, we advocate for a shift left approach for SLP development with security-focused code reviews, and application of security static analysis.

Predictive analytics is gaining momentum in health-care since the adoption of electronic health record (EHR) system in hospitals. In particular, machine learning models are built using the critical care EHR data and the information provided during the ICU admissions to predict the mortality of patients admitted in ICU. As per the MIMIC-IV dataset, the survival rate of patients admitted in ICU is found to be 89.76%. This paper proposes a hybrid prediction technique that uses Random Forest and XGBoost for predicting the mortality rate. The proposed techniques performed well in predicting mortality rate despite the class imbalance problem of the dataset. The experiments conducted on MIMIC-IV dataset yields prediction accuracy of 89.72%.

The primary goal of the authentic learning provides students with an engaging and motivating learning environment for students with hands-on experiences in solving real-world security problems. Each learning topic consists of pre-lab, lab, and post-lab (Pre/Lab/Post) activities. With an authentic learning approach, we design and develop portable labware on Google CoLab for ML for ransomware detection and prevention so that students can access and practice these hands-on labs anywhere and anytime without time tedious installation and configuration which will help students more focus on learning of concepts and getting more experience for hands-on problem-solving skills.

Interoperability remains one of the biggest challenges facing healthcare organizations today. Despite the advancements made through digital transformation and API that allow increased interoperability, patients still have to contend with a different patient portal for each provider they visit. Several health systems are unable to successfully exchange EHR data. API transfer and consolidate patient information including medical history and treatment records across the disparate health care systems. Mobile apps use API to gather data from various medical wearables and add the data to a patient's health record. However, API exposes application logic and sensitive data information giving patient data a window to the World Wide Web and has thus increasingly become a target for attackers. As the need for tighter API security grows, managing APIs becomes more important than ever. The goal of this paper is to provide an overview and discuss research questions that can aid in understanding and building the knowledge base on API data integration and interoperability.

This paper presents the machine learning algorithm to detect whether an executable binary is benign or ransomware. The ransomware cybercriminals have targeted our infrastructure, businesses, and everywhere which has directly affected our national security and daily life. Tackling the ransomware threats more effectively is a big challenge. We applied a machine-learning model to classify and identify the security level for a given suspected malware for ransomware detection and prevention. We use the feature selection data preprocessing to improve the prediction accuracy of the model.

Blockchain has become a key technology in a plethora of application domains owing to its decentralized public nature. The cyber-physical systems (CPS) is one of the prominent application domains that leverage blockchain for myriad oper-ations, where the Internet of Things (IoT) is utilized for data collection. Although some of the CPS problems can be solved by simply adopting blockchain for its secure and distributed nature, others require complex considerations for overcoming blockchain-imposed limitations while maintaining the core aspect of CPS. Even though a number of studies focus on either the utilization of block chains for different CPS applications or the blockchain-enabled security of CPS, there is no comprehensive survey including both perspectives together. To fill this gap, we present a comprehensive overview of contemporary advancement in using blockchain for enhancing different CPS operations as well as improving CPS security. To the best of our knowledge, this is the first paper that presents an in-depth review of research on blockchain-enabled CPS operation and security.

Post-stroke rehabilitation is always stressful in-home settings due to the unaccustomed environment, irregular sleep, and undergoing rehabilitation exercises. Usually, the intensity and difficulty of the exercise are inherent complex problems for the patients to manage daily. Physical rehabilitation is essential for all stroke patients to recover. Therefore, an automated in-home rehabilitation system with feedback support both for patient and therapist could assist post-stroke patients in managing and assessing exercise daily to recover faster. This work proposes a data acquisition and analysis framework named “MRehab” that helps collect multimodal sensor signals while patients perform both voluntary and non-voluntary (prescribed) exercises. “MRe-hab” assesses the exercise and physiological states of the patients through signal processing and multiple machine learning models. This framework monitors repetition, patient fatigue, and exercise quality and recommends frequency and intensity.

Data science, machine learning, and distributed computational models have evolved dramatically over the last decade. Cloud and cluster computing is full-fledged and ready for processing big data. Data driven research and decision have become the trend in multiple disciplines. However, very few organizations have experienced the full impact or competitive advantage from their advanced data analytics initiatives despite significant investments in data science and machine learning. There are a number of issues resulting in such a phenomenon including difficult to maintain and configure a cluster, complex transition from a platform to another, sophisticated programming interfaces to machine learning libraries, network congestion, and most importantly lake of well-trained personnel to sanitize and analyze data. We propose a flexible heterogeneous computing cluster with off-the-shelf computers and a Blockly programming interface for multidisciplinary users such as cybersecurity ana-lyst, biologist, geologist, musician, and choreographer.

Quantum Computing (QC) has gained immense popularity as a potential solution to deal with the ever-increasing size of data and associated challenges leveraging the concept of quantum random access memory (QRAM). QC promises-quadratic or exponential increases in computational time with quantum parallelism and thus offer a huge leap forward in the computation of Machine Learning algorithms. This paper analyzes speed up performance of QC when applied to machine learning algorithms, known as Quantum Machine Learning (QML). We applied QML methods such as Quantum Support Vector Machine (QSVM), and Quantum Neural Network (QNN) to detect Software Supply Chain (SSC) attacks. Due to the access limitations of real quantum computers, the QML methods were implemented on open-source quantum simulators such as IBM Qiskit and TensorFlow Quantum. We evaluated the performance of QML in terms of processing speed and accuracy and finally, compared with its classical counterparts. Interestingly, the experimental results differ to the speed up promises of QC by demonstrating higher computational time and lower accuracy in comparison to the classical approaches for SSC attacks.

In this paper, we present a portable labware on Google CoLab for Scalable Machine Learning (SML) with PySpark for facilitating research in Science and Engineering (SML4SE) applications. This will allow researchers to access, share, collaborate, and practice hands-on labs anywhere and anytime without time tedious installation and configuration which will help students more focus on learning concepts and getting more experience in hands-on problem-solving skills for big data analytics.

Software vulnerabilities have become a serious problem with the emergence of new applications that contain potentially vulnerable or malicious code that can compromise the system. The growing volume and complexity of software source codes have opened a need for vulnerability detection methods to successfully predict malicious codes before being the prey of cyberattacks. As leveraging humans to check sources codes requires extensive time and resources and preexisting static code analyzers are unable to properly detect vulnerable codes. Thus, artificial intelligence techniques, mainly deep learning models, have gained traction to detect source code vulnerability. A systematic review is carried out to explore and understand the various deep learning methods employed for the task and their efficacy as a prediction model. Additionally, a summary of each process and its characteristics are examined and its implementation on specific data sets and their evaluation will be discussed.

Machine learning (ML) operations or MLOps advo-cates for integration of DevOps- related practices into the ML development and deployment process. Adoption of MLOps can be hampered due to a lack of knowledge related to how development tasks can be automated. A characterization of bot usage in ML projects can help practitioners on the types of tasks that can be automated with bots, and apply that knowledge into their ML development and deployment process. To that end, we conduct a preliminary empirical study with 135 issues reported mined from 3 libraries related to deep learning: Keras, PyTorch, and Tensorflow. From our empirical study we observe 9 categories of tasks that are automated with bots. We conclude our work-in-progress paper by providing a list of lessons that we learned from our empirical study.

In teleradiology, medical images are transmitted to offsite radiologist for interpretation and the dictation report is sent back to the original site to aid timely diagnosis and proper patient care. Although teleradiology offers great benefits including time and cost efficiency, after-hour coverages, and staffing shortage management, there are some technical and operational limitations to overcome in reaching its full potential. We analyzed the current teleradiology workflow to identify inefficiencies. Image unavailability and delayed critical result communication stemmed from lack of system integration between teleradiology practice and healthcare institutions are among the most substantial factors causing prolonged turnaround time. In this paper, we propose a blockchain-based medical image sharing and automated critical-results notification platform to address the current limitation. We believe the proposed platform will enhance efficiency in workflow by eliminating the need for intermediaries and will benefit patients by eliminating the need for storing medical images in hard copies. While considerable progress was achieved, further research on governance and HIPAA compliance is required to optimize the adoption of the new application. Towards an idea to a working paradigm, we will implement the prototype during the next phase of our study.

Quality of software is determined by analyzing the source code metrics and defects. Prediction of pre-and post-release defects and fixing them when they are raised will improve overall quality of software systems. The main aim of this work is to reduce the cost incurred in identifying defects which is a challenging task. Over a decade, the academia and industry addressed the problem of software defect prediction using machine learning. This work emphasizes on the selection of static code metrics and process metrics for defect prediction. Metrics are mined from different open source projects hosted on GitHub. For our experiments, we have chosen projects with at least 10k commits. This paper is establishing a hypothesis that, as the number of commits increase, the bugs are also likely to increase, as our experiments indicate. The software metrics are carefully chosen to identify defects across software projects to help the development and testing teams.

The dark web is often discussed in taboo by many who are unfamiliar with the subject. However, this paper takes a dive into the skeleton of what constructs the dark web by compiling the research of published essays. The Onion Router (TOR) and other discussed browsers are specialized web browsers that provide anonymity by going through multiple servers and encrypted networks between the host and client, hiding the IP address of both ends. This provides difficulty in terms of controlling or monitoring the dark web, leading to its popularity in criminal underworlds. In this work, we provide an overview of data mining and penetration testing tools that are being widely used to crawl and collect data. We compare the tools to provide strengths and weaknesses of the tools while providing challenges of harnessing massive data from dark web using crawlers and penetration testing tools including machine learning (ML) techniques. Despite the effort to crawl dark web has progressed, there are still rooms to advance existing approaches to combat the ever-changing landscape of the dark web.

Many tech stars like Netflix, Amazon, PayPal, eBay, and Twitter are evolving from monolithic to a microservice (containerization) architecture due to the benefits for Agile and DevOps teams. Microservices architecture can be applied to multiple industries, like IoT, using containerization. Since the IoT industry has exponential growth, universities' responsibility is to teach IoT with hands-on labs to minimize the gap between what the students learn and what is on-demand in the job market. There are many approaches in the containerization field, but they can be challenging to use without depth knowledge in virtualization and code encapsulation. After a deep analysis of the containerization challenges, in this paper, we present a cyberinfrastructure based on containers to solve the virtualization and code-encapsulation problems. The cyberinfrastructure will provide the necessary tools for data collection and code development and testing using an IoT Cluster. It is a web-based platform that allows users to securely go into containerization without spending time learning virtualization. Results show that our proposed cyberinfrastructure allows the creation and deployment of microservices in multiple IoT devices and ensures easy data collection for posterior cyberanalysis.

Quantum Computing (QC) refers to an emerging paradigm that inherits and builds with the concepts and phenomena of Quantum Mechanic (QM) with the significant potential to unlock a remarkable opportunity to solve complex and computationally intractable problems that scientists could not tackle previously. In recent years, tremendous efforts and progress in QC mark a significant milestone in solving real-world problems much more efficiently than classical computing technology. While considerable progress is being made to move quantum computing in recent years, significant research efforts need to be devoted to move this domain from an idea to a working paradigm. In this paper, we conduct a systematic survey and categorize papers, tools, frameworks, platforms that facilitate quantum computing and analyze them from an application and Quantum Computing perspective. We present quantum Computing Layers, Characteristics of Quantum Computer platforms, Circuit Simulator, Open-source Tools- Cirq, TensorFlow Quantum, ProjectQ etc. that allow implementing quantum programs in Python using a powerful and intuitive syntax. Following that, we discuss the current essence, identify open challenges, and provide future research direction. We conclude that scores of frameworks, tools and platforms are emerged in the past few years, improvement of currently available facilities would exploit the research activities in the quantum research community.

Despite yielding benefits for organizations, infrastructure as code (IaC) scripts are susceptible to security weaknesses, such as hard-coded passwords. Existence of such security weaknesses necessitate integration of education materials related to secure development of IaC scripts. In this preliminary work, we describe our experiences of how application of authentic learning helped students learn about secure development of IaC scripts. Our paper shows education materials based on authentic learning to help students learn about secure IaC development.

Software Engineering is the process of systematic, disciplined, quantifiable approach that has significant impact on large-scale and complex software development. Scores of well-established software process models have long been adopted in the software development life cycle that pour stakeholders towards the completion of final software products development. Within the boundary of advanced technology, various emerging and futuristic technology is evolving that really need the attention of software engineering community whether the conventional software process techniques are capable to inherit the core fundamental into the futuristic software development. In this paper, we study the impact of existing software engineering processes and models including Agile, and DevOps in Blockchain-Oriented Software Engineering. We also examine the essentiality of adopting state-of-art concepts and evolving the current soft-ware engineering process for blockchain-oriented systems. We discuss the insight of software project management practices in BOS development. The findings of this study indicate that utilizing state-of-art techniques in software processes for futur-istic technology would be challenging and promising research is needed extensively towards addressing and improving state-of - the-art software engineering processes and methodology for novel technologies.

New cyberattacks grow in an exponential rate. However, the state-of-the-art in cyber defense efforts cannot keep pace with the sophisticated cybersecurity threats and attacks. The industry relies excessively on anti-virus software which is effective for known malware signatures, but not sustainable for the massive amount of malware samples released daily, and its inefficiency in handling cyberattacks such as zero-day or polymorphic/metamorphic malware. Machine learning (ML) has been extensively studied with a good performance in identifying and extracting knowledge from a big dataset. This can be an alternative to the signature-based approach. Currently, many schools offer courses on topics in ML and cybersecurity (MLC), individually. It is believed that cybersecurity professionals require a deep understanding on ML in order to cope with the growing cyberattacks. Research has shown that authentic learning will create an engaging and motivating learning environment in learning emerging technologies. We propose to develop cyber workforce using authentic learning on machine learning in cybersecurity through a set of real-world cybersecurity learning modules, including a Pre/Lab/Post model focusing on real-world problem solving skills. Our goal is to integrate developed resources into existing curriculum, disseminate the resources through webinars and faculty workshops, and assess the effectiveness of authentic learning of MLC for fostering cybersecurity workforce.

Elections make a fundamental contribution to democratic governance and are very important to select the appropriate person to determine the fate of a nation while a large number of citizens do not trust the ballot-paper-based voting system. As a result, e-Voting is being adopted by various countries throughout the world. With advantages, there are a number of constraints of e-voting systems, a single vulnerability can lead to large-scale manipulations of voting results. Leveraging and intersecting both cutting-edge technologies including biometric and blockchain technology can address the limitations of current e-Voting frameworks. In this research, we analyze the requirements for systems modeling of voting technology and possible opportunities to adopt biometrics and blockchain technology. Based on the requirements analysis, we propose a biometric-enabled and hyperledger fabric-based voting framework to automate identity verification that will ensure transparency and security of electronic voting. We utilize the software architecture analysis method and active reviews for intermediate designs for evaluating the proposed framework. Demonstration indicates the efficiency and quality attributes of architectural design that shall lead us to implement the system in real-world scenarios in future studies. Initially, we develop a Webbased prototype to demonstrate the framework. In future studies, we aim to implement on large scale and evaluate the prototype against the requirements and security standard.

With the rapid technological advancement, security has become a major issue due to the increase in malware activity that poses a serious threat to the security and safety of both computer systems and stakeholders. To maintain stakeholder’s, particularly, end user’s security, protecting the data from fraudulent efforts is one of the most pressing concerns. A set of malicious programming code, scripts, active content, or intrusive software that is designed to destroy intended computer systems and programs or mobile and web applications is referred to as malware. According to a study, naive users are unable to distinguish between malicious and benign applications. Thus, computer systems and mobile applications should be designed to detect malicious activities towards protecting the stakeholders. A number of algorithms are available to detect malware activities by utilizing novel concepts including Artificial Intelligence, Machine Learning, and Deep Learning. In this study, we emphasize Artificial Intelligence (AI) based techniques for detecting and preventing malware activity. We present a detailed review of current malware detection technologies, their shortcomings, and ways to improve efficiency. Our study shows that adopting futuristic approaches for the development of malware detection applications shall provide significant advantages. The comprehension of this synthesis shall help researchers for further research on malware detection and prevention using AI.

Machine Learning (ML) analyze, and process data and develop patterns. In the case of cybersecurity, it helps to better analyze previous cyber attacks and develop proactive strategy to detect, prevent the security threats. Both ML and cybersecurity are important subjects in computing curriculum but ML for security is not well presented there. We design and develop case-study based portable labware on Google CoLab for ML to cybersecurity so that students can access, share, collaborate, and practice these hands-on labs anywhere and anytime without time tedious installation and configuration which will help students more focus on learning of concepts and getting more experience for hands-on problem solving skills.

Traditional network intrusion detection approaches encounter feasibility and sustainability issues to combat modern, sophisticated, and unpredictable security attacks. Deep neural networks (DNN) have been successfully applied for intrusion detection problems. The optimal use of DNN-based classifiers requires careful tuning of the hyper-parameters. Manually tuning the hyperparameters is tedious, time-consuming, and computationally expensive. Hence, there is a need for an automatic technique to find optimal hyperparameters for the best use of DNN in intrusion detection. This paper proposes a novel Bayesian optimization-based framework for the automatic optimization of hyperparameters, ensuring the best DNN architecture. We evaluated the performance of the proposed framework on NSL-KDD, a benchmark dataset for network intrusion detection. The experimental results show the framework’s effectiveness as the resultant DNN architecture demonstrates significantly higher intrusion detection performance than the random search optimization-based approach in terms of accuracy, precision, recall, and f1-score.

Ride-hailing and ride-sharing applications have recently gained popularity as a convenient alternative to traditional modes of travel. Current research into autonomous vehicles is accelerating rapidly and will soon become a critical component of a ride-hailing platform’s architecture. Implementing an autonomous vehicle ride-hailing platform proves a difficult challenge due to the centralized nature of traditional ride-hailing architectures. In a traditional ride-hailing environment the drivers operate their own personal vehicles so it follows that a fleet of autonomous vehicles would be required for a centralized ride-hailing platform to succeed. Decentralization of the ride-hailing platform would remove a roadblock along the way to an autonomous vehicle ride-hailing platform by allowing owners of autonomous vehicles to add their vehicle to a community-driven fleet when not in use. Blockchain technology is an attractive choice for this decentralized architecture due to its immutability and fault tolerance. This thesis proposes a framework for developing a decentralized ride-hailing architecture that is verifiably secure. This framework is implemented on the Hyperledger Fabric blockchain platform. The evaluation of the implementation is done by applying known security models, utilizing a static analysis tool, and performing a performance analysis under heavy network load.

HTML and JavaScript have become the go-to languages for many developers making apps for multiple smartphone operating systems. HTML provides developers with a way to make a universal framework to build cross-platform apps. This convenience does not come without risk, however. Being HTML-based, these apps are susceptible to Cross-Site Scripting (XSS). In this paper, we break down what a cross-site scripting attack is, how it works, and the security risks that come with it. We also investigate several different methods used to detect and path code with vulnerability.

The ubiquitous usage of robots in modern society necessitates secure development of robotics systems. Practitioners who engage in robot development can benefit from a systematic study that investigates the categories of vulnerabilities that appear in robotics systems. The goal of this paper is to help practitioners mitigate vulnerabilities in robotics systems by conducting an empirical study of vulnerabilities in robotics systems. We conduct an empirical study where we analyze 176 robotics-related vulnerabilities collected from the Robot Vulnerability Database (RVD). Our findings show that: (i) robotics-related vulnerabilities can be classified into nine categories; (ii) memory-related vulnerabilities are the most frequent category, (iii) 92.6% of the reported vulnerabilities are software-related, and (iv) software components in robotics systems include more critical vulnerabilities compared to that of hardware components. Based on our findings, we provide a list of development activities that can be used to mitigate vulnerabilities for robotics systems.

Neurotechnology describes as one of the focal points of today’s research of hundreds of academicians and researchers globally; particularly around the domain of Brain-Computer Interfaces (BCI) that was introduced in the 1970s and has been at the forefront of many neurotechnological discoveries. The primary attempts of BCI research are to decoding human speech from brain signals, implementing creativity by imagination, and controlling neuro-psychological patterns by utilizing billion of neural activities that would significantly benefit people suffering from neurological disorders. In this study, we illustrate the progress of BCI research and present scores of unveiled contemporary approaches. First, we explore a decoding natural speech approach that is designed to decode human speech directly from the human brain onto a digital screen introduced by Facebook Reality Lab and University of California San Francisco. Then, we study a recently presented visionary project to control the human brain using Brain-Machine Interfaces (BMI) approach. We also investigate well-known electroencephalography (EEG) based Emotiv Epoc+ Neuroheadset to identify six emotional parameters including engagement, excitement, focus, stress, relaxation, and interest using brain signals by experimenting the neuroheadset among three human subjects where we utilize two two supervised learning classifiers, Naïve Bayes and Linear Regression to show the accuracy and competency of the Epoc+ device and its associated applications in neurotechnological research. We present experimental studies and the demonstration indicates 69 % and 62 % improved accuracy for the aforementioned classifiers respectively in reading the performance matrices of the participants. We envision that non-invasive, insertable, and low-cost BCI approaches shall be the focal point for not only an alternative for patients with physical paralysis but also understanding the brain that would pave us to access and control the memories and brain somewhere very near.

Modern building control systems integrate the internet of things (IoT) for real-time monitoring of the building’s demand and manage the heating, ventilation, and air conditioning (HVAC) cost-efficiently and reliably. However, adversarial alterations of the sensor data can disrupt the occupants’ comfort or increase energy consumption. Several intrusion detection systems (IDSs) are proposed to detect the tempering of the sensor measurements. However, these approaches either demonstrate a high false alarm rate or fail to detect anomalies, putting the HVAC control or the building occupants in a vulnerable condition. This paper proposes a novel intrusion detection technique amalgamating two unsupervised machine learning techniques, namely autoencoder(AE) and one-class support vector machine (OCSVM), for identifying abnormality in smart building sensor measurements. Our experimental analysis shows that the AE model-based anomaly detector demonstrates satisfactory performance for lowering false alarms but fails to detect a number of anomalous samples. In contrast, the OCSVM-based anomaly detection model performs significantly well for anomaly detection while raises a lot of false alarms. Our proposed ensembled AE-OCSVM model combines both models’ benefits, resulting in significant reductions of false positive and false negative rates compared to the existing smart building IDSs. We evaluate the proposed intrusion detection system on the commercial occupancy dataset (COD) and find that the proposed IDS model can achieve a 99.6% F1-score.

Every day, web credibility is becoming an increasingly important. It affects how we interact with information on the internet as well as the quality of those interactions. Web credibility also spills into the real world, as misinformation from the internet can have very real consequences and catastrophic losses. It also sets an aggressive challenge of choice among different web services in the internet user community. In this paper, we investigate the existing practice and research work on evaluating web service credibility. We classify the available techniques and discuss their capabilities and impacts on user/web interactions. This work will help discover the venues for credibility measures and highlight the effective techniques in different web service domains. It will also help build more rigorous techniques to disseminate credibility measures and support internet user choices.

The global spread of the novel coronavirus (COVID-19) has prompted the workforce, business, healthcare service and education along with individual to migrate from traditional work method to remote environment. The shifting from traditional to remote work environment has created many challenges towards security and privacy risks. In this paper, we have surveyed the potential user data security breach and privacy situation, cyber-threat that can affect business, health organization, and solution to protect data security and privacy.

Innovations in health monitoring systems are fundamental for the continuous improvement of remote healthcare. With the current presence of SARS-CoV-2, better known as COVID-19, in people’s daily lives, solutions for monitoring heart and especially respiration and pulmonary functions are more needed than ever. In this paper, we survey the current approaches that utilize the advantages of sensor technologies to sense, analyze, and estimate health data related to respiration, heart, and sleep monitoring. We focus on illustrating the signal processing and machine learning techniques used on each approach to facilitate researchers’ understanding of how data is processed nowadays. We have classified the reviewed papers into two main categories: contact and contactless sensors. In each category, we discuss the different types of used sensors, the data analysis technique, and the accuracy of those techniques.

This Innovative Practice, work in progress (WIP) paper presents our experience related to two exercises that focus on automated security static analysis, a practice used to integrate security into development and operations (DevOps). The concept has gained popularity amongst information technology (IT) organizations. However, security-related concerns, such as security weaknesses in DevOps artifacts can cause serious consequences. Our preliminary findings indicate that (i) students positively perceive the introduced exercises; and (ii) the students perform well if they are provided necessary background on the exercises. Our WIP paper lays the groundwork to build course materials that will facilitate development, deployment, and dissemination of DevOps-related education materials that also incorporate cybersecurity concepts.

Billions of IoT devices are connected to networks all around us, enabling cyber-physical systems. These devices can carry and generate user-sensitive data, examples of such devices are smartwatches, medical equipment, and smart home gadgets. Individual IoT devices have some form of intrusion detection system integrated, but once they are all connected, a network threat to one device could mean a threat to many. IoT devices must have a robust intrusion detection system that would keep devices secure over a network. To aid with this, we provide a machine learning solution that adheres to Global Data Protection Regulation by keeping the user data secure locally on the IoT device itself. We propose a Federated Learning (FL) approach that capitalizes on a decentralized and collaborative way of training machine learning models. In this study, we practice federated learning technique to train and create a robust intrusion detection model for the security of IoT devices. We evaluate our proposed approach using three different use-cases to show the security enhancements that improve using the FL technique, resulting in a more reliable performance in this domain.

The constant rise of cyber-attacks poses an increasing demand for more qualified people with cybersecurity knowledge. Games have emerged as a well-fitted technology to engage users in learning processes. In this paper, we analyze the emotional parameters of people while learning cybersecurity through computer games. The data are gathered using a noninvasive Brain-Computer Interface (BCI) to study the signals directly from the users’ brains. We analyze six performance metrics (engagement, focus, excitement, stress, relaxation, and interest) of 12 users while playing computer games to measure the effectiveness of the games to attract the attention of the participants. Results show participants were more engaged with parts of the games that are more interactive instead of those that present text to read and type.

The Aviation Industry has always been adopting superior technology and state-of-art concept that includes Aero-dynamics, Avionics, and Jet Engine Technologies, etc. There is, however, a new frontier in the Aviation Industry, development of the “Connected Aircraft” or so-called “Smart Aircraft”. However, as with any other new frontier, there are possibilities of pitfalls that need to be discussed and addressed. This paper discusses Wi-Fi connectivity on Smart Aircraft, the technologies involved, and the threats to security. The research was conducted via several sources including online research, scholarly papers, pilot interviews, and consultation with various aviation academies that train pilots focus only on aircraft/airliner Wi-Fi connectivity from within the cabin during the flight. Findings reveal the industry as emerging and in infancy, there are still scores of issues related to security and cost that aviation organizations must work extensively towards secure and safe Smart Aircraft.

Electronic health record (EHR) applications are digital versions of paper-based patient health information. EHR applications are increasingly being adopted in many countries. They have resulted in improved quality in healthcare, convenient access to histories of patient medication and clinic visits, easier follow up of patient treatment plans, and precise medical decision-making process. The goal of this paper is to identify HIPAA technical requirements, evaluate two open source EHR applications (OpenEMR and OpenClinic) for security vulnerabilities using two open-source scanner tools (RIPS and PHP VulnHunter), and map the identified vulnerabilities to HIPAA technical requirements.

The coronavirus disease 2019 (COVID-19) caused a pandemic outbreak with affecting 213 nations worldwide. Global policymakers are imposing many measures to slow and reduce the rapid growth of the infections. On the other hand, the healthcare system is encountering significant challenges for a massive number of COVID-19 confirmed or suspected individuals seeking treatment. Therefore, estimating the number of confirmed cases is necessary to provide valuable insights into the growth of the outbreak and facilitate policy making process. In this study, we apply ARIMA models as well as LSTM-based recurrent neural network to forecast the daily cumulative confirmed cases. The LSTM architecture generates more precise forecasting by leveraging both short- and long-term temporal dependencies from the pandemic time series data. Due to the stochastic nature in optimization and random initialization of weights in neural network, the LSTM based model produce less reproducible outcome. In this paper, we propose a reproducible-LSTM (r-LSTM) framework that produces a reproducible and robust results leveraging z-score outlier detection method. We performed five round of nested cross validation to show the consistency in evaluating model performance. The experimental results demonstrate that r-LSTM outperformed the ARIMA model producing minimum MAPE, RMSE, and MAE.

In response to the COVID-19 pandemic, the White House and a coalition of leading research groups have prepared the COVID-19 Open Research Dataset (CORD-19) containing over 51,000 scholarly articles, including over 40,000 with full text, about COVID-19, SARS-CoV-2, and related coronaviruses. Medical professional including physicians frequently seek answers to specific questions to improve guidelines and decisions. The huge resource of medical literature is important sources to generate new insights that can help medical communities to provide relevant knowledge and overall fight against the infectious disease. There are ongoing attempts to develop intelligent systems to automatically extract relevant knowledge from many unstructured documents. In this paper, we propose an efficient question answering framework based on automatically analyzing thousands of articles to generate both long text answers (sections/ paragraphs) in response to the questions that are posed by medical communities. In the process of developing the framework, we explored natural language processing techniques like query expansion, data preprocessing, and vector space models early. We show the initial results of an example query answering for the incubation period.

A water treatment center (WTC) removes contaminants and unwanted components from the water and makes the water more acceptable to the end-users. A modern WTC is equipped with different water sensors and uses a combination of wired/wireless communication network. During the water treatment process, controllers periodically collect sensor measurements and make critical operational decisions. Since accuracy is vital, a WTC also uses different data validation mechanisms to validate the incoming sensor measurements. However, like any other cyber-physical system, water treatment facilities are prone to cyberattacks, and an intelligent adversary can alter the sensors measurements stealthily, and corrupt the water treatment process. In this work, we propose WTC Checker (WTC2), an impact-aware formal analysis framework that demonstrates the impact of stealthy false data injection attacks on the water treatment sensors. Through our work, we demonstrate that if an adversary has sufficient access to sensor measurements and can evade the data validation process, he/she can compromise the sensors measurements, change the water disinfectant contact time, and inflict damage to the clean water production process. We model this attack as a constraint satisfaction problem (CSP) and encode it using Satisfiability Modulo Theories (SMT). We evaluate the proposed framework for its threat analysis capability as well as its scalability by executing experiments on different synthetic test cases.

Authentication is a key step for accessing resources and services. Currently, there are several ways of performing authentication such as text-based passwords and graphical images. These methods can be circumvented to bypass authentication system. Biometric signatures have been gaining popularity for user authentication. In this paper, we examine various attacks on iris-based authentication system followed by some common examples of mitigation techniques.

In recent years, security has been a major concern to everyone. Some devices like energy meters, health appliances have been a life changing technology for smart city. These devices have assisted in connecting several different services and in turn have made life better for people living in smart city. Other services such as emergency responder, water system, disaster management, sanitation and infrastructure have evolved with the birth of a smart city. The rapid advancements in services provided in a smart city are now drawing major security concerns. One of the major security concerns are integrated systems. The purpose of this paper is to educate the audience of the vulnerabilities that are associated with the devices of a smart city. We demonstrate an example of hands-on lab hacking a CCTV camera and some suggestions to prevent attacks on smart city.

Alzheimer's disease, the most common type of dementia, is ranked sixth amongst the leading causes of death in the United States. As the disease progresses, individuals affected will experience challenges with memory loss, vision impairment, word-finding, and reasoning. When riddled with such symptoms, password memorization can pose a problem. Even though there are several authentication systems in play, none considers all signs and symptoms Alzheimer's disease can cause. We propose a two-step password authentication system that would utilize geolocation and fingerprint biometric screening to assist this specific population by providing a more secure way to access their information.

Fall is a major concern among elderly population. Accidental fall if unattended for long time, may lead to severe injuries and disability. Prompt detection of fall is an important research problem, particularly in the homecare settings for elderly citizens, where not enough service providers are available to monitor their health and welfare daily. There are some available fall detection approaches, however, they are either expensive or the accuracy of fall detection is not satisfactory. In this paper, we develop a low cost fall detection framework using Android phone's built in sensors with the goal of detecting fall and notifying to emergency responders. We generate a dataset and train 3 popular machine learning algorithms to detect fall events: Logistic Regression, Naïve Bayes and Neural Network. Our study shows the performance comparison of the learning algorithms. The evaluation results show that our approach can successfully detect fall and neural network-based technique can perform better than other learning techniques.

Epileptic Seizure is a neurological disorder that occurs due to abnormal activities of brain neurons. Epilepsy can affect patients' health and can lead to life-threatening emergencies. Predicting epilepsy before the initiation of the onset is highly effective to avoid the seizure by medication. machine learning algorithms have been implemented in classifying epilepsy from Electroencephalograms (EEG) data. Machine learning algorithms experience reduced performance when classes are imbalanced. The imbalance class problem can be handled by different sampling techniques including oversampling minority class, undersampling majority class, and combined of both. In this paper, both traditional and state-of-the-art sampling techniques have been experimented and evaluated for their capability of improving the imbalance ratio. A Deep Neural Network (DNN) based framework is also presented in this paper. The classification performance has been investigated by applying several ML approaches with the effect of different balancing ratio. We performed experiments on Epileptic Seizure Recognition dataset. The experimental results show that the sampling techniques improve the imbalance class ratio as well as the classification performance.

While the number of mobile and web applications is growing exponentially, the mobile and web security threat landscape is growing explosively. Malicious malware may attack vulnerable applications and obtain personal or enterprise confidential data anywhere and anytime. Most vulnerabilities should be addressed and fixed during the early stages of software development. However, many software development professionals lack the awareness of the importance of security vulnerabilities and the necessary knowledge and skills at the software development stage. This paper addresses the needs and challenges of the lack of pedagogical materials and real-world learning environment in ProActive Control for Software Security (PASS) through effective, engaging, and investigative authentic learning approaches.

Machine learning plays a critical role in detecting and preventing in the field of cybersecurity. However, many students have difficulties on configuring the appropriate coding environment and retrieving datasets on their own computers, which, to some extent, wastes valuable time for learning core contents of machine learning and cybersecurity. In this paper, we propose an approach with learning environment containerization of machine learning algorithm and dataset. This will help students focus more on learning contents and have valuable hand-on experience through Docker container and get rid of the trouble of configuration coding environment and retrieve dataset. This paper provides an overview of case-based hands-on lab with logistic regression algorithm for credit card fraud prediction.

Mobile wearable health devices have expanded prevalent usage and become very popular because of the valuable health monitor system. These devices provide general health tips and monitoring human health parameters as well as generally assisting the user to take better health of themselves. However, these devices are associated with security and privacy risk among the consumers because these devices deal with sensitive data information such as users sleeping arrangements, dieting formula such as eating constraint, pulse rate and so on. In this paper, we analyze the significant security and privacy features of three very popular health tracker devices: Fitbit, Jawbone and Google Glass. We very carefully analyze the devices' strength and how the devices communicate and its Bluetooth pairing process with mobile devices. We explore the possible malicious attack through Bluetooth networking by hacker. The outcomes of this analysis show how these devices allow third parties to gain sensitive information from the device exact location that causes the potential privacy breach for users. We analyze the reasons of user data security and privacy are gained by unauthorized people on wearable devices and the possible challenge to secure user data as well as the comparison of three wearable devices (Fitbit, Jawbone and Google Glass) security vulnerability and attack type.

The current COVID-19 pandemic has emerged as a serious disease with life-threatening clinical manifestations and a high mortality rate. One of the major complications of this disease is the rapid and dangerous pulmonary deterioration that can lead to critical pneumonia conditions, resulting in death. The current healthcare system around the world faces the potential problem of lacking resources to assist a large number of patients at the same time; then, the non-critical patients are mostly referred to perform self-isolation/quarantine at home. With the advancement of IoT and Cloud technologies now it is possible to monitor patient's symptoms in real-time to detect and quickly report sudden and dangerous changes to the healthcare provider. In this paper, we propose the concept of R-Mon, an mhealth tool for diagnostic-assistance, and real-time communication with healthcare providers that can be used with COVID-19 patients in self-isolation and any other disease in pandemic situations. We propose the use of a pressure sensor under the bed that can monitor the respiratory rate and pulmonary function of the patients. We also propose a framework in which the detected information can be directly seen by the practitioner for the decision-making process. We envision that this kind of mhealth tool and framework can be implemented for better health response in future pandemics.

We developed a hands-on lab for students to learn macro malware detection using decision trees on an open sourced data analytics software, HPCC, running on a virtual machine. The labware along with required software and documents are freely available at our project website. Our design is low cost, customizable and can be easily replicated to other institutions. Our experience shows that students have difficulties in configuring software environment for the lab. The virtual machine approach allows pre-configurations for datasets and required software installations and setting to facilitate students' learning and instructors' teaching. Since students are working on malware, the virtual machine provides an isolated network environment for testing without affecting normal operating network. This lab design can also be integrated into online courses by simply downloading and installing the customized virtual machine.

A set of Information Assurance and Security hands-on learning modules is developed and open to the public. Topics include networking security, database security, defensive programming, web security, system fundamentals, mobile security, malware detection using Machine learning, and big data analytics on network intrusion detection. The design follows hands-on case- based pedagogical model, which yields a satisfaction rate up to 92.5% for self-learners.

Machine Learning (ML) analyzes, and processes data and develop patterns. In the case of cybersecurity, it helps to better analyze previous cyber attacks and develop proactive strategy to detect and prevent the security threats. Both ML and cybersecurity are important subjects in computing curriculum, but ML for cybersecurity is not well presented there. We design and develop case-study based portable labware on Google CoLab for ML to cybersecurity so that students can access and practice these hands-on labs anywhere and anytime without time tedious installation and configuration which will help students more focus on learning of concepts and getting more experience for hands-on problem solving skills.

short-paper Share on Malicious URL Detection Using Supervised Machine Learning Techniques Authors: Vara Vundavalli Kennesaw State University Kennesaw State UniversityView Profile , Farhat Barsha Military Institute of Science and Technology Military Institute of Science and TechnologyView Profile , Mohammad Masum KSU KSUView Profile , Hossain Shahriar Kennesaw State University Kennesaw State UniversityView Profile , Hisham Haddad KSU KSUView Profile Authors Info & Claims SIN 2020: 13th International Conference on Security of Information and NetworksNovember 2020 Article No.: 21Pages 1–6https://doi.org/10.1145/3433174.3433592Published:01 February 2021Publication History 2citation237DownloadsMetricsTotal Citations2Total Downloads237Last 12 Months139Last 6 weeks19 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my Alerts New Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

Mobile Health (mhealth) applications are widely used applications to monitor our health, well being and daily activities. The privacy and security of personal information while using mHealth apps are of great concerns. In this paper, we propose a method based on HIPAA privacy rule and security rule to analyze mHealth applications. There are total four parts in this method: privacy policy analysis, static analysis, dynamic analysis, and HTTP analysis. Through our analysis, we identify that mHealth applications are not as safe as they are shown in the posted privacy policy. Many mhealth apps could cause damage to personal privacy.

Android, the most dominant Operating System (OS), experiences immense popularity for smart devices for the last few years. Due to its' popularity and open characteristics, Android OS is becoming the tempting target of malicious apps which can cause serious security threat to financial institutions, businesses, and individuals. Traditional anti-malware systems do not suffice to combat newly created sophisticated malware. Hence, there is an increasing need for automatic malware detection solutions to reduce the risks of malicious activities. In recent years, machine learning algorithms have been showing promising results in classifying malware where most of the methods are shallow learners like Logistic Regression (LR). In this paper, we propose a deep learning framework, called Droid-NNet, for malware classification. However, our proposed method Droid-NNet is a deep learner that outperforms existing cutting-edge machine learning methods. We performed all the experiments on two datasets (Malgenome-215 & Drebin-215) of Android apps to evaluate Droid-NNet. The experimental result shows the robustness and effectiveness of Droid-NNet.

Machine Learning (ML) analyzes, and processes data and discover patterns. In cybersecurity, it effectively analyzes big data from existing cybersecurity attacks and develop proactive strategies to detect current and future cybersecurity attacks. Both ML and cybersecurity are important subjects in computing curriculum, but using ML for cybersecurity is not commonly explored. This paper designs and presents a case study-based portable labware experience built on Google's CoLaboratory (CoLab) for a ML cybersecurity application to provide students with hands-on labs accessing from anywhere and anytime, reducing or eliminating tedious installations and configurations. This approach allows students to focus on learning essential concepts and gaining valuable experience through hands-on problem solving skills. Our preliminary results and student evaluations are reported for a case-based hands-on regression labware in cyber fraud prediction using credit card fraud as an example.

Resources and personnel availability in Intensive Care Units (ICUs) of hospitals are scarce and challenging to manage, particularly certain group of patients are more likely to be dead than alive after released from ICUs. There has been availability of ICU data, opening the door for performing analytical approach to uncover the trends and patterns for better policy and resource allocation decision towards improved outcome of the patients. In this paper, we explored MIMIC III dataset and applied supervised and unsupervised learning approaches to shed some lights on the complex underlying relationships between the patient's Length of Stay (LOS) and a number of attributes available from data. Our results indicate that neural network-based approaches perform the best for predicting the mortality outcome compared to other supervised and unsupervised approaches.

Presents the introductory welcome message from the conference proceedings. May include the conference officers' congratulations to all involved with the conference event and publication of the proceedings record.

Electronic Health Records have proven to be indispensable yet continue to present a host of problems. One of the most pressing concerns is how to share patient information freely and efficiently. Hospitals and clinics may share data internally, but there is an inability due to the lack of infrastructure or an unwillingness to share data between systems. Implementing a peer-to-peer distributed digital ledger, known as a blockchain, to record and transmit transactional data in conjunction with Cloud based technologies may be a solution to bridge the communication gap. This paper sets forth a new approach for a blockchain and cloud computing network utilizing Amazon Web Services and Ethereum blockchain to facilitate semantic level interoperability of Electronic Health Records systems without standardized data forms and formatting.

IoT devices can be used to fulfil many of our daily tasks. IoT could be wearable devices, home appliances, or even light bulbs. With the introduction of this new technology, however, vulnerabilities are being introduced and can be leveraged or exploited by malicious users. One common vehicle of exploitation is malicious software, or malware. Malware can be extremely harmful and compromise the confidentiality, integrity and availability (CIA triad) of information systems. This paper analyzes the types of malware attacks, introduce some mitigation approaches and discusses future challenges.

One of the current challenges that faces individual organizations that are attempting to utilize blockchain in making more secure and transparent transaction between organizations are standards. Not all platforms, however, are suitable. In this paper, we provide a comparison of blockchain development platforms for developers to choose the best platform based on their need.

Electronic Health Record (EHR) applications are digital versions of paper-based patient's health information. They are increasingly adopted to improved quality in healthcare, such as convenient access to histories of patient medication and clinic visits, easier follow up of patient treatment plans, and precise medical decision-making process. EHR applications are guided by measures of the Health Insurance Portability and Accountability Act (HIPAA) to ensure confidentiality, integrity, and availability. Furthermore, Office of the National Coordinator (ONC) for Health Information Technology (HIT) certification criteria for usability of EHRs. A compliance checking approach attempts to identify whether or not an adopted EHR application meets the security and privacy criteria. There is no study in the literature to understand whether traditional static code analysis-based vulnerability discovered can assist in compliance checking of regulatory requirements of HIPAA and ONC. This paper attempts to address this issue. We identify security and privacy requirements for HIPAA technical requirements, and identify a subset of ONC criteria related to security and privacy, and then evaluate EHR applications for security vulnerabilities. Finally propose mitigation of security issues towards better compliance and to help practitioners reuse open source tools towards certification compliance.

The exploration of smart systems and their capability to record health data is growing rapidly today. Health data can be sent directly to medical professionals, and alerts can be sent to users at their convenience on mobile devices or other applications. The utilization of Wi-Fi sensors in smart systems can be a major shift in how data is collected and distributed as well as in the way patients utilize this to be independent and aware of their health. Non-invasive technology has many benefits that range from no scars or wounds, reduction of pain, and a faster recovery time for patients. In this paper, we reviewed non-invasive technologies, the type of health status they can identify, and barriers of adopting smart health solutions.

Security vulnerabilities in an application open the ways to security dangers and attacks, which can easily jeopardize the system executing that application. Therefore, it is important to develop vulnerability-free applications. The best approach would be to counteract against potential vulnerabilities during the coding with secure programming practices. Software security proactive control education for secure portable and web application advancement is of enormous interests in the Information Technology (IT) fields. In this paper, we proposed and developed innovative learning modules for software security proactive control based on several real world scenarios to broaden and promote proactive control for secure software development in computing education.

While the number of mobile applications are rapidly growing, these applications are often coming with numerous security flaws due to the lack of appropriate coding practices. Security issues must be addressed earlier in the development lifecycle rather than fixing them after the attacks because the damage might already be extensive. Early elimination of possible security vulnerabilities will help us increase the security of our software and mitigate or reduce the potential damages through data losses or service disruptions caused by malicious attacks. However, many software developers lack necessary security knowledge and skills required at the development stage, and Secure Mobile Software Development (SMSD) is not yet well represented in academia and industry. In this paper, we present a static analysis-based security analysis approach through design and implementation of a plugin for Android Development Studio, namely DroidPatrol. The proposed plugins can support developers by providing list of potential vulnerabilities early.

Insecure data storage may open a door to malicious malware to steal users' and system sensitive information. These problems may due to developer negligence or lack of security knowledge. Android developers use various storage methods to store data. However, Attackers have attacked these vulnerable data storage. Although the developers have modified the apps after knowing the vulnerability, the user's personal information has been leaked and caused serious consequences. As a result, instead of patching and fixing the vulnerability, we should conduct proactive control for secure Android data storage. In this paper, we analyzed Android external storage vulnerability and discussed the prevention solutions to prevent sensitive information in external storage from disclosure.

An imbalanced dataset is a dataset that has a majority class which is a class has far more example distributions than other classes. It is difficult to deal with unbalanced datasets in classification problems, and many classification algorithms do not perform well in unbalanced datasets. In this paper, we present our logistic regression analysis with Python on imbalanced datasets and determine different thresholds for classification according to the data proportion of imbalanced datasets.

The majority of malicious mobile attacks take advantage of vulnerabilities in mobile applications, such as sensitive data leakage via inadvertent or side channel, unsecured sensitive data storage, data transmission, and many others. Most of these mobile vulnerabilities can be detected in the mobile software testing phase. However, most development teams often have virtually no time to address them due to critical project deadlines. To combat this, the more defect removal filters there are in the software development life cycle, the fewer defects that can lead to vulnerabilities will remain in the software product when it is released. As part of Secure Mobile Software Development (SMSD) project, we are currently developing capacity to address the lack of pedagogical materials and real world learning environment in secure mobile software development through effective, engaging, and investigative approaches. In this session, we provide details of a new implemented module named data protection. We also share our initial experience and feedback on the developed module.

Web Application Firewalls (WAFs) are deployed to protect web applications and they offer in depth security as long as they are configured correctly. A problem arises when there is over-reliance on these tools. A false sense of security can be obtained with the implementation of a WAF. In this paper, we provide an overview of traffic filtering models and some suggestions to avail the benefit of web app firewall.

Electronic Health Records (EHRs) are digital versions of paper-based patient's health information. EHR applications are increasingly being adopted in many countries. They have resulted in improved quality in healthcare, convenient access to histories of patient medication and clinic visits, easier follow up of patient treatment plans, and precise medical decision-making process. EHR applications are guided by measures of the Health Insurance Portability and Accountability Act (HIPAA) to ensure confidentiality, integrity, and availability. However, there have been reported breaches of Protected Health Identifier (PHI) data stored by EHR applications. In many reported breaches, improper use of EHRs has resulted in disclosure of patient's PHI data. Inefficient application design threatens the integrity of EHRs, which leads to fraud and endangering patient's health. The goal of this paper is to identify HIPAA technical requirements, evaluate an open source EHR application (OpenEMR) for security vulnerabilities using an open-source scanner tool (RIPS), and map identified vulnerabilities to HIPAA technical requirements.

Car manufacturers are investing heavily in Autonomous Vehicles (AVs) because of their increasing popularity. AVs employ a combination of high-tech sensors and innovative algorithms to detect and respond to their surroundings, including radar, laser light, GPS, odometer, drive-by-wire control systems, and computer vision. When a user requests for a ride share or rent, the responding AV/IoT device does not have the sufficient capability to store, process, or verify each other. Currently, every AV/IoT device typically needs to rely on a trusted third party, which invokes another trust issue. If the trusted third party is rogue or loses credibility, the whole system will collapse. This paper introduces Chained of Things Framework and develops a blockchain-based secure ride-sharing service between passengers and autonomous vehicles. We implement an initial prototype and provide our initial results based on a proposed protocol.

The security threats to mobile application are growing explosively. Mobile app flaws and security defects could open doors for hackers to easily attack mobile apps. Secure software development must be addressed earlier in the development lifecycle rather than fixing the security holes after attacking. Early elimination of possible security vulnerability will secure our software, and mitigate the security risk threats by potential malicious attacking. However, many software developer professionals lack the necessary security knowledge and skills at the development stagef. In this paper we explore the Android common IPC vulnerability and present our developed IPC flaw detectors with open source FindSecurityBugs plugin in Android Studio IDE.

Consistent growth in the software sector of the world economies has attracted both targeted and mass-scale attacks by cybercriminals. Producing reliable and secure software is difficult because of its growing complexity and the increasing number of sophisticated attacks. Developers cannot afford to believe that their security measures during development are perfect and impenetrable. In fact, many new software security vulnerabilities are discovered on a daily basis. Therefore, it is vital to identify and resolve those security vulnerabilities as early as possible. Security Vulnerability Testing (SVT), as an active defense, is the key to the agile detection and prevention of known and unknown security vulnerabilities. However, many software engineers lack the awareness of the importance of security vulnerability and the necessary knowledge and skills at the testing and operational stages. As a first step towards filling this gap, this paper advocates for building skills in selecting proper benchmarks for the assessment of SVT tools to enable distinguishing effective security tools from trivial ones. Thus, we develop a set of benchmark requirements to fulfill this need, primarily guiding newcomers and researcher into this discipline.

Presents the introductory welcome message from the conference proceedings. May include the conference officers' congratulations to all involved with the conference event and publication of the proceedings record.

The majority of malicious mobile attacks take advantage of vulnerabilities in mobile software (applications), such as sensitive data leakage, unsecured sensitive data storage, data transmission, and many others. Most of these vulnerabilities can be detected by analyzing the mobile software. In this paper, we describe a tainted dataflow approach to detect mobile software security vulnerability, particularly, SQL Injection.

This paper first presents an in-depth study of potential security vulnerabilities in MongoDB and Cassandra, two popular NoSQL databases. We provide examples of attacks. We then explore some popular data masking techniques as ways of mitigating security threats in these databases.

A decision tree is an important classification technique in data mining classification. Decision trees have proved to be valuable tools for the classification, description, and generalization of data. J48 is a decision tree algorithm which is used to create classification model. J48 is an open source Java implementation of the C4.5 algorithm in the Weka data mining tool. In this paper, we present the method of improving accuracy for decision tree mining with data preprocessing. We applied the supervised filter discretization on J48 algorithm to construct a decision tree. We compared the results with the J48 without discretization. The results obtained from experiments show that accuracy of J48 after discretization is better than J48 before discretization.

Attacks on authentication services are major security concerns. Password-based authentication systems can be compromised using known techniques, such as brute force and dictionary-based attacks. Biometric-based authentication systems are becoming the preferred choice to replace password-based authentication systems. Among several variations of biometrics (e.g., face, eye, fingerprint), iris-based authentication is commonly used in various applications. In iris-based authentication systems, iris images from legitimate users are captured and certain features are extracted to be used for matching during the authentication process. Literature works suggest that iris-based authentication systems can be subject to presentation attacks where an attacker obtains printed copy of the victim's eye image and displays it in front of an authentication system to gain unauthorized access. Such attacks can be performed by displaying static eye images on mobile devices or ipads (known as screen attacks). Since human iris features so not changed, once the iris image is compromised, it is hard to avoid this type of attack. To address this challenge, this paper proposes a framework for iris code generation by considering the changes of the area between the pupil and the sclera due to light density level. The proposed approach relies on capturing iris images using near infrared light. We train HaarCascade and LBP classifiers to capture the area between the pupil and the cornea. The image of iris is then stored in the database. This approach also generates a QR code from the iris. The code acts as a password and the user is required to provide it during authentication. A prototype is built using OpenCV platform tool. The prototype has been tested using samples obtained from publicly available iris database. The initial results show that the proposed approach has lower false positive and false negative rates.

Presents the introductory welcome message from the conference proceedings. May include the conference officers' congratulations to all involved with the conference event and publication of the proceedings record.

As mobile computing is becoming more and more popular, the security threats to mobile applications are simultaneously increasing explosively. Most malicious activities hack the user's private information, such as contact and location information, hijack the user's transactions and communications, and exploit the confidential enterprise data stored in mobile databases or in cache on mobile devices. Database security is one of the most important security areas to be addressed. Many schools are integrating database security topics into database and cybersecurity education. This paper addresses the needs for pedagogical learning materials for database security education and the challenges of building database security capacity through effective, engaging, and investigative learning approaches, through transferrable and integratable mobile-based learning modules with hands-on companion labs based on the OWASP recommendations, such as input validation, data encryption, data sharing, auditing, and others. The primary goal of this learning approach is to create a motivating learning environment that encourages and engages all students in database security concepts and practices learning. The preliminary feedback from students was positive. Students gained hands-on real world learning experiences on Mobile Database Security (MDS) with Android mobile devices, which also greatly promoted students' self-efficacy and confidence in their mobile security learning.

This poster addresses the needs of pedagogical learning materials for Secure Mobile Software Development(SMSD) education and challenges of building SMSD capacity. In this poster, we present an innovative authentic learning approach for SMSD through real-world-scenario case studies. The primary goal of this learning approach is to create an engaging and motivating learning environment that encourages students in learning emerging security concepts and practices such as mobile software developments. It provides students with hands-on laboratory practices on real-world mobile app developments and security. Each module consists of a series of progressive sub-labs: a pre-lab, lab activities, and a student add-on post-lab. The preliminary feedback from students is positive. Students have gained hands-on real world experiences on mobile security with Android mobile devices, which also greatly promoted students' self-efficacy and confidences in their mobile security learning.

In this poster we present an innovative authentic learning approach for Secure Mobile Software Development(SMSD) through real-world-scenario case studies. The primary goal of this learning approach is to create an engagement and motivating learning environment that encourages all students in learning emerging SMSD technologies and enhances their secure software development concepts. This approach provides students with hands-on laboratory practices on real-world SMSD and mobile security. The laboratory consists of multiple modules covering input validation, output encoding, secure inter-process communication, secure data protection, secure mobile database. Each topic consists of a series of progressive sub-labs: a pre-lab, lab activities, and a student add-on post-lab. The preliminary feedback from students is positive. Students have gained hands-on real world experiences on Android software security with Android mobile devices, which also greatly promoted students' self-efficacy and confidences in their mobile security learning.

Web application attacks are an extreme threat to the world's information technology infrastructure. A web application is generally defined as a client-server software application where the client uses a user interface within a web browser. Most users are familiar with web application attacks. For instance, a user may have received a link in an email that led the user to a malicious website. The most widely accepted solution to this threat is to deploy an Intrusion Detection System (IDS). Such a system currently relies on signatures of the predefined set of events matching with attacks. Issues still arise as all possible attack signatures may not be defined before deploying an IDS. Attack events may not fit with the pre-defined signatures. Thus, there is a need to detect new types of attacks with a mutated signature based detection approach. Most traditional literature works describe signature based IDSs for application layer attacks, but several works mention that not all attacks can be detected. It is well known that many security threats can be related to software or application development and design or implementation flaws. Given that fact, this work expands a new method for signature based web application layer attack detection. We apply a genetic algorithm to analyze web server and database logs and the log entries. The work contributes to the development of a mutated signature detection framework. The initial results show that the suggested approach can detect specific application layer attacks such as Cross-Site Scripting, SQL Injection and Remote File Inclusion attacks.

Clickjacking attacks are emerging threat for web application users where click operations performed by victims lead to security breaches such as compromising webcams and posting unintended messages. Effective client-side defense technique could prevent the possible victims. This paper presents a client side approach to detect clickjacking attacks. The authors' approach examines web page requests and responses; the proposed approach is designed to detect advanced attack types such as cursorjacking, double click, and history object-based attacks. They evaluate the proposed approach with a set of legitimate and malicious websites. The results indicate that our approach has low false positive and false negative rates. The overhead imposed by the proposed approach is negligible.

This paper is addressing the challenges of incorporating networking and security concepts into effective teaching and learning platform (PLab) that highlights real-world technical issues. PLab is an innovative portable learning platform that allows network applications to be safely tested. The isolated network without the need for a server promotes learning at anytime and anywhere. The strong connection between academic subjects and reality and digital-native students' everyday lives engages students in learning this emerging field, and better prepares students for the high industrial demands in mobile application development workforce. Moreover, this pedagogical model will help faculty develop expertise in the latest development of networking and security. The modular labware is designed to offer faculty the flexibility to implement it in many existing courses. Curricular materials will be delivered on Google cloud for its sustainability. This "ready-to-adopt" model will greatly save resources and time for enhancing modern networking and security education to meet the emerging workforce.

Although much research effort has focused on Android malware detection, very little attention has been given to implementation-level vulnerabilities. This paper focuses on Content Provider Leakage vulnerability that can be exploited by viewing or editing sensitive data through malware. We present a new technique for detecting content provider leakage vulnerability. We propose Kullback-Leibler Divergence (KLD) as a measure to detect the content provider leakage vulnerability. In particular, our contribution includes the development of a set of elements and mapping the elements to programming principles for secure implementation of content provider classes. These elements are captured from the implementation to form the initial population set. The population set is used to measure the divergence of a newly implemented application with content provider to identify potential vulnerabilities. We also apply a back-off smoothing technique to compute the KLD value. We implement a java prototype tool to evaluate a set of content provider implementations to show the effectiveness of the proposed approach. The initial results show that by choosing an appropriate threshold level, KLD is an effective method for detecting content provider leakage vulnerability.

Various reports show that web browsers are known for being insecure, with growing amount of flaws that make them vulnerable to various attacks. Such attacks can be used to execute arbitrary procedures on the victims' computer and silently install malicious software, turning them into bots. In addition, browsers are complex and typically incorporate third-party libraries installed on-demand. This makes it very difficult for security experts to analyze the causes of such flaws or devise countermeasures. In this paper, we present an approach to detect and prevent attacks against a browser by intercepting the interactions between its core libraries and the underlying operating system. We then build mathematical models that capture the behavior of the browser during the rendering of web objects. Finally, we show that such models can be leveraged to automatically classify web objects as malicious or benign using real-world malicious websites.

Web applications contain vulnerabilities, which may lead to serious security breaches such as stealing of confidential information. To protect against security breaches, it is necessary to understand the detailed steps of attacks and the pros and cons of existing defense mechanisms. This tutorial provides an overview of four web application security vulnerabilities: SQL injection, Cross-Site Scripting, Cross-Site Request Forgery, and clickjacking. Then it discusses two popular mitigation approaches: security testing and monitoring. The tutorial is intended to enable practitioners for choosing the right technique to defend against web application security vulnerabilities.

Clickjacking attacks are an emerging threat on the web. An attacker application presents a User Interface (UI) element of a target application out of context, such as hiding sensitive UI element by making it transparent to the end user. The user is tricked to click on the hidden element out of context. These attacks can cause severe damages such as compromising webcams and posting unintended messages. A large number of websites are still vulnerable to clickjacking and have no minimal protection at the server side (e.g., frame busting, X-Frame-Options header). Further, client-side defense techniques have been ineffective to deal with sophisticated clickjacking attack types and suffer from performance issues. This paper presents a proxy-level framework, ProClick, to detect clickjacking attacks. ProClick examines the content of requests and response pages at the proxy level to detect clickjacking attacks. We evaluate the proposed approach with a set of legitimate and malicious websites. The results indicate that our approach has low false positive and false negative rates. The overhead imposed by the proposed approach is also very negligible.

Event processing queries are intended to process continuous event streams. These queries are partially similar to traditional SQL queries, but provide the facilities to express rich features (e.g., pattern expression, sliding window of length and time). An error while implementing a query may result in abnormal program behaviors and lost business opportunities. Moreover, queries can be generated with unsanitized inputs and the structure of intended queries might be altered. Thus, a tester needs to test the behavior of queries in presence of malicious inputs. Mutation testing has been found to be effective to assess test suites quality and generating new test cases. Unfortunately, there is no effort to perform mutation testing of event processing queries. In this work, we propose mutation-based testing of event processing queries. We choose Event Processing Language (EPL) as our case study and develop necessary mutation operators and killing criteria to generate high quality event streams and malicious inputs. Our proposed operators modify different features of EPL queries (pattern expression, windows of length and time, batch processing of events). We develop an architecture to generate mutants for EPL and perform mutation analysis. We evaluate our proposed EPL mutation testing approach with a set of developed benchmark containing diverse types EPL queries. The evaluation results indicate that the proposed operators and mutant killing criteria are effective to generate test cases capable of revealing anomalous program behaviors (e.g., event notification failure, delay of event reporting, unexpected event), and SQL injection attacks. Moreover, the approach incurs less manual effort and can complement other testing approach such as random testing.

Cross site scripting (XSS) vulnerabilities are widespread in web-based programs. Server side detection of suspected contents can mitigate XSS exploitations early. Unfortunately, existing serve side approaches impose modification of server and client side environments. In this paper, we develop an automated framework to detect XSS attacks at the server side based on the notion of boundary injection and policy generation. Boundaries mark content generation locations in server script code. We derive expected benign features of dynamic contents that are matched during response page generation to detect attacks. We develop a prototype tool to automatically insert boundaries and generate policies for JSP programs. We evaluate the approach with four JSP programs. The results indicate that the approach detects most of the well known XSS attacks. Moreover, the false positive rates vary between zero and 5.2%. The approach suffers from negligible runtime overhead.

Buffer overflow (BOF) vulnerabilities in programs might result in unwanted consequences such as neighboring data corruption and execution of arbitrary code. To assure that implemented programs are free from BOF, auditing is a well known quality assurance method. Today, there exist few tools that aid an auditor to partially automate the task of BOF vulnerability auditing. These tools provide too many warnings that are often similar types to be dealt with and do not allow an auditor providing his/her opinions to better interpret the generated warnings. To improve the quality of warnings, we propose a fuzzy logic-based BOF vulnerability auditor. Our contribution includes the development of crisp BOF vulnerability characteristics and the corresponding fuzzy sets. We apply Mamdani style fuzzy inferences by developing sets of rules to infer the presence of BOF warning present in programs. Moreover, for the overall assessment of a program's vulnerability level, we design a multi-unit fuzzy logic-based system. The auditor has been evaluated with benchmark programs that contain BOF vulnerabilities. The results show that our auditor performs better compared to the existing auditing tools. The auditor can be used as a basis to assure the quality of a program against BOF vulnerabilities.

Content sniffing attacks occur if browsers render non-HTML files embedded with malicious HTML contents or JavaScript code as HTML files. The rendering of these embedded contents might cause unwanted effects such as the stealing of sensitive information through the execution of malicious JavaScript code. The primary source of these attacks can be stopped if the uploading of malicious files can be prevented from the server side. However, existing server side content sniffing attack detection approaches suffer from a number of limitations. First, file contents are checked only to a fixed amount of initial bytes whereas attack payloads might reside anywhere in the file. Second, these approaches do not provide any mechanism to assess the malicious impact of the embedded contents on browsers. This paper addresses these issues by developing a server side content sniffing attack detection mechanism based on content analysis using HTML and JavaScript parsers and simulation of browser behavior via mock download testing. We have implemented our approach in a tool that can be integrated in web applications written in various languages. In addition, we have developed a benchmark suite for the evaluation purpose that contains both benign and malicious files. We have evaluated our approach on three real world PHP programs suffering from content sniffing vulnerabilities. The evaluation results indicate that our approach can secure programs against content sniffing attacks by successfully preventing the uploading of malicious files.

Buffer overflow is one of the worst program vulnerabilities. Many preventive approaches are applied to mitigate buffer overflow (BOF) vulnerabilities. However, BOF vulnerabilities are still being discovered in programs on a daily basis which might be exploited to crash programs and execute unwanted code at runtime. Monitoring is a popular approach for detecting BOF attacks during program execution and can prevent the consequences of BOF vulnerability exploitations. However, there is no classification of the proposed approaches to understand their common characteristics, objectives, and limitations. In this paper, we classify the current BOF vulnerability monitoring approaches based on the following five characteristics: monitoring objective, program state utilization, implementation mechanism, environmental change, and attack response. The classification will enable researchers to differentiate among existing monitoring approaches. Moreover, it will provide a guideline to choose monitoring approaches suitable for their needs.

Cross Site Request Forgery (CSRF) allows an attacker to perform unauthorized activities without the knowledge of a user. An attack request takes advantage of the fact that a browser appends valid session information for each request. As a result, a browser is the first place to look for attack symptoms and take appropriate actions. Current browser-based detection methods are based on cross-origin policies that allow white listed third party websites to perform requests to a trusted website. These approaches are not effective if policies are specified incorrectly. Moreover, these approaches do not focus on the detection of stored CSRF attacks where attack payloads reside in trusted web pages. To alleviate these limitations, we present a CSRF attack detection mechanism for the client side. Our approach relies on the matching of parameters and values present in a suspected request with a form's input fields and values that are being displayed on a webpage (visibility). To overcome an attacker's attempt to circumvent form visibility checking, we compare the response content type of a suspected request with the expected content type. We have implemented a prototype plug-in tool for the Firefox browser and evaluated our approach on three real PHP programs vulnerable to CSRF attacks. We have also developed a benchmark test suite containing 134 test cases for emulating CSRF attack requests for the three programs. The evaluation results indicate that our approach can detect most of the common form of reflected and stored CSRF attacks. Moreover, our approach can stop attack requests that include subsets of visible form fields and values.

Over the last few years, numerous vulnerabilities have been reported in software, and successful exploitations of these vulnerabilities have resulted in severe consequences such as denial of services and application state corruptions. Researches have shown that effective quality assurance methods can prevent such consequences when applied during software (or applications) development processes. Software security testing is a popular assurance method in this direction. However, effective testing involves obtaining an effective test suite (or collection of test cases) that can reveal specific faults. Over the last few years, different testing approaches have been applied for revealing vulnerabilities in software. However, only few works have assessed the effectiveness of test suites for revealing vulnerabilities. We believe that bringing the idea of mutation-based assessment of test adequacy for vulnerabilities can help in detecting and removing vulnerabilities proactively. In this work, we apply mutation-based adequate testing for one of the worst vulnerabilities namely buffer overflow (BOF). We propose 16 mutation operators to force the generation of adequate test suites for BOF vulnerabilities. A prototype tool is developed to automatically generate mutants and perform mutation analysis with input test cases. The effectiveness of the operators is evaluated by using several benchmark programs having BOF vulnerabilities, and the results indicate that the proposed operators are effective for testing BOF vulnerabilities. Moreover, we present an analysis to find selective mutation operators for reducing the cost of mutation-based testing of BOF vulnerabilities.

Vulnerabilities in applications and their widespread exploitation through successful attacks are common these days. Testing applications for preventing vulnerabilities is an important step to address this issue. In recent years, a number of security testing approaches have been proposed. However, there is no comparative study of these work that might help security practitioners select an appropriate approach for their needs. Moreover, there is no comparison with respect to automation capabilities of these approaches. In this work, we identify seven criteria to analyze program security testing work. These are vulnerability coverage, source of test cases, test generation method, level of testing, granularity of test cases, testing automation, and target applications. We compare and contrast prominent security testing approaches available in the literature based on these criteria. In particular, we focus on work that address four most common but dangerous vulnerabilities namely buffer overflow, SQL injection, format string bug, and cross site scripting. Moreover, we investigate automation features available in these work across a security testing process. We believe that our findings will provide practical information for security practitioners in choosing the most appropriate tools.

Buffer overflow (BOF) is one of the major vulnerabilities that leads to non-secure software. Testing an implementation for BOF vulnerabilities is challenging as the underlying reasons of buffer overflow vary widely. Moreover, the existing vulnerability testing approaches do not address the issue of generating adequate test data sets for testing BOF vulnerabilities. In this work, we apply the idea of mutation-based testing technique to generate adequate test data set for BOF vulnerabilities. Our work addresses those BOF vulnerabilities, which are related to an implementation language and its associated libraries. We apply the concept for ANSI C language and its associated libraries. We propose 12 mutation operators to force the generation of adequate test data set for BOF vulnerabilities. The proposed operators are validated by using four open source programs. The results indicate that the proposed operators are effective for testing BOF vulnerabilities.

The modularization concept behind component-based software (CBS) cannot be applied effectively for cross-cutting concerns such as security. Aspect-oriented programming (AOP) helps in better modularization by identifying cross-cutting concerns and providing a suitable way to separate those concerns. In this paper, we provide an aspect-connector based intrusion response (detection and prevention) architecture for CBS by bringing the concepts of aspects into components. The aspect-connector is named as ACIR (aspect connector for intrusion response). Component interfaces act as join points, and aspects containing pointcuts and advices are defined in ACIR configuration file. Advices applicable to particular pointcuts are two types. Signature advices are used to detect intrusions, and action advices are executed to prevent intrusions. A prototype of this architecture is implemented and evaluated using some intrusions included in the Web application security consortium (WASC) intrusion list. This approach detects and prevents intrusions in CBS while maintaining encapsulation, reusability, and modularity.