Privacy is one of the most critical issues associated with spreading the Internet of Things and Internet of Everything devices. Over the years, several methods have been introduced to address this phenomenon. In 2017, Google introduced the concept of Federated Machine Learning. This paradigm allows models to be trained collaboratively across multiple decentralized devices or servers, holding local data samples without exchanging them. This approach enhances data privacy and security by ensuring raw data remains on local devices while only model updates are shared and aggregated. This paper presents a privacy-preserving Android malware detector based on Federated Machine Learning. As a first step, we built a dataset comprising over 40,000 Android applications, including trusted and malicious (belonging to 71 malware families) samples. Afterward, we conducted experiments leveraging three different architectures by exploiting the CIFAR-10 and the ImageNet datasets, employing hyperparameters determined through a Grid Search algorithm by exploiting 40 clients. Moreover, the experimental analysis uses two distributions: Independent and identically distributed and non-independent and identically distributed data. To conclude the Federated Machine Learning experiments, we trained models for each architecture, with both weight types and distribution models, by applying the Clipping Norm Aggregator. The results exhibit interesting performances with Independent and identically distributed data, achieving an accuracy of 0.873 without normalization and 0.877 with the Clipping Norm aggregator. However, with non-independent and identically distributed data, the model accuracy equals 0.865 without normalization, 0.864 with the Clipping Norm aggregator using Custom MobileNet 2. In conclusion, to compare Federated Machine Learning with a centralized training approach, we trained several models adopting the same dataset, dataset splitting, and architectures, achieving an accuracy of 0.944 using InceptionV3. The outcomes show that the proposed method can provide engaging performances in privacy-preserving Android malware detection.

Recently, object detection in bioimage analysis has achieved interesting progress through deep learning models like those in the vision transformers, enabling high-accuracy predictions for tasks such as lesion detection in radiology, ophthalmology and organ segmentation. However, applying these models in healthcare raises critical challenges related to privacy and explainability. Centralized training is often infeasible due to strict data-sharing constraints, such as patient privacy regulations, while the black-box nature of modern detectors hinders clinician trust and adoption, particularly in clinical decision-making. To address these issues, we introduce BIOFED, a framework for privacy-preserving and explainable object detection specifically tailored for biomedical imaging. The idea behind BIOFED is to integrate distributed training of object detectors (for instance, the models belonging to the YOLO family) across decentralized clinical or research clients using aggregation strategies like FedAvg and FedProx, ensuring sensitive patient data never leaves the client side. Furthermore, BIOFED incorporates an explainability module based on Class Activation Mapping techniques, by generating heatmaps that highlight bioimage regions, like suspicious lesions in a chest X-ray or retinal fundus image that are most influential for model predictions. This combination of federated object detection and explainability enhances transparency, accountability, and trustworthiness in safety-critical bioimaging scenarios.

The lack of broad, high-quality, labeled datasets and, crucially, stringent data protection laws frequently make it difficult to integrate Deep Learning (DL), with medical imaging. These limitations make it impossible to centralize data, which results in models that don't generalize to other institutions (non-IID data). To address this, we introduce FLIP_VIT, a novel framework leveraging Federated Learning (FL) for explainable and privacy-preserving biomedical imaging. FL is a decentralized system where the training algorithm moves to the data. Hospitals (clients) train a model locally on their private data, and only the model updates (weights or gradients) are securely shared and aggregated by a central server using techniques like Federated Avareging (FedAvg) and Federeted Proximal (FedProx) to create a global model. Patient data never leaves its source, ensuring privacy and compliance.

In the biomedical field, the increased volume of unstructured data is becoming a prominent field of application for natural language processing, particularly for tasks such as sentence classification. Classifying sentences makes it possible to analyze clinical trial reports and perform clinical decision support. This study presents a framework that transforms sentences into word embedding-generated images to perform sentence classification. The proposed approach leverages the strengths of both natural language processing (NLP) and computer vision to perform robust sentence classification and offer interpretability through image processing. Furthermore, the proposed approach utilizes Class Activation Mapping (CAM) to visualize salient features within the generated images.

Large Language Models have revolutionized Natural Language Processing (NLP), displaying optimal capabilities in numerous tasks including summarization, question-answering, and paraphrasing. However, the intricate mechanisms of the models are often not clear, and hence they are increasingly becoming an inhibiting factor in understanding how they act, where they fall short, and where they may pose risks. This paper proposes a framework for fine-tuning LLMs for diverse text-to-text generation tasks and subsequently applying explainability techniques to foster transparency and trust in these complex models.

As transportation systems become more connected and automated, strong cybersecurity is essential. This paper presents a novel Intrusion Detection System (IDS) based on Federated Learning (FL) to improve security in transportation networks without compromising user privacy. FL enables multiple devices, such as vehicles and roadside units, to collaboratively train a shared model using local data. We focus on major challenges such as adversarial and data poisoning attacks that can disrupt system operations and reduce detection accuracy. To address these threats, we propose new techniques using model diversity and progressive training. These methods allow different network nodes to train slightly different models, making the system more resilient to attacks. Our experimental results on realworld datasets show that model diversity can improve accuracy by up to 25% under attack scenarios. Progressive training also helps reduce prediction errors by 40%, leading to better overall system performance. The proposed approach strengthens the robustness and adaptability of FL-based IDS in dynamic and hostile transportation environments.

With the increasingly growing use of Natural Language Processing (NLP) techniques, medical text classification is becoming a prominent field of application. The ability to employ model-based classification to medical abstracts, i.e. brief texts describing the condition of a patient, can potentially offer significant aid to medical experts in the diagnosis process. Transformer-based models have demonstrated significant advancements in NLP tasks. In this paper, we aim to evaluate the performance of four transformer models i.e., BERT, DeBERTa, DistilBERT, and RoBERTa, in classifying medical abstract as one of five possible conditions. By utilizing a labeled dataset consisting of five categories, we conduct a fine-tuning process of each model and finally analyze their performance using several metrics, specifically accuracy, precision, recall, F1-score, and graphical results, particularly confusion matrices and loss graphs. Our findings show comparable performance across models in terms of accuracy, F1-Score, loss, and confusion matrices. Furthermore, we make use of explainability techniques, specifically integrated gradients, to interpret model predictions by analyzing the least and most impactful tokens. The results show criticalities such as dataset imbalance, as well as a common tendency of the models to misclassify.

Access control policies have become a critical issue in the current digital environment, where data breaches and cyber threats are increasingly common. In this context, Large Language Models can simplify the dynamic adaption of access control policies in response to changes due to evolving technology, business processes, or regulatory requirements. This work presents a study that fine-tuned four different LLMs in access control policy classification by comparing two different approaches to train these models. We fine-tuned the presented models normally and used the Parameter Efficient Fine-Tuning approach, a trade-off between performance and efficiency. We trained four different architectures (BERT, GPT-Neo, RoBERTa, and XLNet) and compared their performance on a text classification task to identify ACP from a labeled dataset of 1,522 samples. We achieved the best performance with a maximum accuracy of 0.91 and an F1-score of 0.93, reflecting a strong balance between precision at 0.97 and recall at 0.90. Finally, we employed integrated gradients to explain the predictions of the best-performing model, enhancing the interpretability of the approach.

Breast cancer is a kind of cancer that forms in the cells of the breasts. After skin cancer, breast cancer represents the most common cancer diagnosed in women in the United States. As a matter of fact, in January 2022, there are more than 3.8 million women with a history of breast cancer in the United States, this is the reason why there is a need for novel methods for automatic breast cancer screening, with the aim of starting any therapy as quickly as possible to try to limit the proliferation of the disease. In this article, we propose a method aimed at detecting breast cancer through a deep learning network developed by authors. Moreover, the proposed method is able to provide prediction explainability by means of class activation mapping, aimed to automatically highlight the suspicious area on the image. We take into account a way to understand whether the cancer prediction and localization can be considered robust by analyzing the output of two different class activation mapping algorithms. We evaluate the effectiveness of the proposed method by using a dataset composed of 9,016 images obtaining an accuracy equal to 93.5%, thus showing the effectiveness of the proposed network for breast cancer detection and localization.

Skin lesions are any abnormal growths or appearances on the skin, ranging from benign (i.e., non-cancerous) to malignant (i.e., cancerous). The identification of a skin lesion is a crucial task that is carried out in short periods of time to initiate an eventual therapeutic treatment. In this paper, we propose a method for automatic skin lesion detection, implementing Convolutional Neural Networks. Moreover, with the aim of providing a rationale behind the model prediction, we also consider explainability by adopting two different Class Activation Mapping algorithms, which highlight regions in skin images that most contribute to the network’s classification decision. We also include the indices of similarity for further quantitative analysis. Several Convolutional Neural Networks are considered, by obtaining the best results with the MobileNet model, achieving an accuracy equal to 0.935 in skin lesion detection. Moreover, in the experimental analysis, we discuss the effectiveness of Class Activation Mapping algorithms exploited for skin lesion localization.

Vehicular platooning has emerged as a promising paradigm in intelligent transportation, offering significant benefits such as reduced energy consumption, improved road throughput and mitigated traffic congestion. However, the open nature of vehicular communication channels exposes platoons to a wide range of security and privacy threats. Although existing group key-based protocols provide foundational security services, they often incur substantial computation overhead and insufficiently address vehicle privacy, making them unsuitable for dynamic vehicular platoon. Therefore, this paper introduces an efficient group authentication protocol (EEGAP) for dynamic vehicular platoons, which ensures privacy-preserving and secure communication during platoon restructuring operations, such as merging and splitting, by integrating anonymous authentication, fog computing, and group key agreement mechanisms. Leveraging Elliptic Curve Cryptography (ECC) and secret sharing mechanisms, EEGAP enables lightweight yet robust group key negotiation, reducing computation overhead by 7.08% and communication overhead by 6.85% compared to existing schemes. Both formal security proofs and informal analysis confirm that EEGAP satisfies the stringent security requirements of vehicular platoon communication systems.

This paper explores the need for new systems to detect and monitor cyberattacks in Connected Vehicles (CVs). Sensor health in CVs is vital, as prediction errors and communication issues can weaken the sensor network. Intrusion Detection Systems (IDS) for CVs must be continuously updated to meet changing needs and be robust against adversarial attacks. We developed a new Label Flipping system against Deep learning-based IDS (LFD-IDS) to help cloud operators understand unusual vehicle sensor data. LFD-IDS specifically targets detecting and explaining sensor data manipulation from poisoning attacks. We proposed two label-flipping attacks based on Bootstrapping and Bagging and a defensive strategy using a multi-layer deep neural network. Our LFD-IDS achieves at least 90% accuracy in identifying cyberattacks.

In an era of escalating cyber threats, the imperative for robust and comprehensive cybersecurity measures has never been more pressing. To address this challenge, SYNAPSE presents a pioneering approach by conceptualising, designing, and delivering an Integrated cybersecurity Risk & Resilience Management Platform. The innovation of this platform lies in the integration of key elements, such as situational awareness, incident response, and preparedness (i.e., cyber range), augmented by advanced AI capabilities. Through its holistic approach, SYNAPSE aims to elevate cyber resilience by not only mitigating threats but also fostering a culture of proactive defence, informed decision-making, and collaborative response within organisations and across industries.

Malware analysis researchers are currently focused on the design and development of innovative approaches to detect zero-day malware, with particular regard to mobile environments. It is widely recognized that existing free and commercial anti-malware tools struggle to detect unknown threats, operating within the constraints of the signature-based paradigm. Among the set of techniques frequently exploited by researchers for spotting malware, machine learning, with particular regard to deep learning, is quickly gaining prominence as a highly promising method for zero-day malware detection. Unfortunately, many of the proposed methods are not effectively implemented in research prototypes and, therefore, do not truly become usable by end users. For this reason, in this paper, we present the DroidDefender proof-of-concept, an Android antimalware specifically designed and developed to detect zero-day malware. DroidDefender is based on representing an Android application as an image and employs a deep learning model. The DroidDefender research prototype is freely available for research purposes at the following URL: https://www.cybersecurityosservatorio.it/Services/malwareImage.jsp?lang=en.

The ability to manage and enforce security policies in a rapidly changing digital environment is vital. When enforcing and verifying policies on complex systems, it can be challenging for them to be understood by humans. Furthermore, updating access control rules or configurations that are translated from natural language documents might take considerable time and eventually cause errors and damage. It is crucial for the rules and configurations to be modified with care in order to prevent such mistakes. The aim of the following proposal is the design of a method to convert security policies written in natural language into a machine-understandable format that can easily be enforced, verified as well and understood by machines. To this end, we propose using advanced policy languages like XACML and Rego to translate security policies into formats that are automatically enforceable and verifiable by the system. In addition, this transformation will facilitate the implementation of security policies within modern application architectures including micro-services and cloud-native environments. Therefore, under its auspices, a framework that eases policy enforcement and minimizes human errors while ensuring conformity to safety standards set out shall be born out of this research proposal.

This paper proposes an edge server deployment strategy based on multi-agent reinforcement learning (CKM-MAPPO) to address the multi-objective optimization problem in a vehicle networking environment. CKM-MAPPO focuses on optimizing the load balancing among edge servers and minimizing edge servers’ delay and energy consumption. Firstly, the Canopy and K-means algorithms determine the edge server deployment’s number and initial location. Then, we utilize the multi-agent reinforcement learning algorithm to decide the optimal deployment location of the edge server. We performed a series of tests, and the experimental results show that CKM-MAPPO improves load balancing by 26.5% and reduces delay and energy consumption by 12.4% and 17.9%, respectively.

In recent years, we have seen an impressive expansion of a family of Artificial intelligence models, known as generative AI, that are capable of producing fresh, unique material, including text, images, audio, and even code. Large datasets of previously published information are used to train these models, enabling them to mimic the patterns and structures of the data and produce original output that is stylistically and qualitatively comparable to the training set. While these models have many promising applications, they also carry significant risks and potential dangers that must be carefully considered, such as misinformation, intellectual property violations, or biased information. For these reasons, in this work, we have proposed a method to detect whether a sentence is human-generated or AI-generated. To achieve this goal, we used a labeled dataset to train four different models from the BERT family, achieving an Accuracy of 96%.

The rapid evolution of deep learning techniques, applied in the smart cities context, has revolutionized computer vision applications, with particular significance in the field of object detection. In this paper, we explore the application of deep learning for real-time car detection in visual data, such as images or video streams. The proposed deep learning model is trained on large-scale datasets containing diverse images of cars, encompassing various lighting conditions, weather patterns, and traffic scenarios. Moreover, once the presence of car(s) is detected, we consider finding the distance between the detected car(s) and the camera: in this way, it is possible to understand the distance to the vehicle to take a certain countermeasure (for example braking or slowing down). The experimental analysis, performed on a dataset composed of 25532 different images confirms the effectiveness of the proposed method for real-world car detection. Moreover, examples of the distance computed between the camera and the detected cars are shown to provide samples of the adoption of the proposed method in the real-world environment.

The detection of road signs is pivotal for effective traffic management and the operation of autonomous vehicles. In this context, deep learning, especially with respect to object detection models, can make a substantial contribution by facilitating the direct detection of road signs from images captured by moving vehicles. In this paper, we propose a method aimed at detecting road signs by exploiting the You Only Look Once model. We experiment with a dataset composed by 10000 different road sign images by obtaining interesting performances, thus showing that the proposed model can be considered reliable for real-time road sign detection.

Artificial intelligence is pervading our lives. As a matter of fact, from voice assistants to self-driving cars, a multitude of aspects of our lives are influenced from decisions made by systems trained through artificial intelligence techniques, for instance machine learning. A multitude of decision support systems has been developed as black boxes, i.e. systems that hide the internal logic to the final user. This lack of explanation represents a practical but also ethical issue. Considering the critical issues of the decisions made by these systems in recent times is emerging the need for artificial intelligence techniques able to explain the reasons why a certain decision is taken by these artificial intelligence algorithms. We propose an approach considering the adoption of the counterexample, automatically provided by model checking techniques, with the aim to explain the rationale behind a decision made by the system. Moreover, we propose a case study showing how the proposed approach can be useful to provide explainability in classification tasks.

Background and Objective: Alzheimer’s disease is nowadays the most common cause of dementia. It is a degenerative neurological pathology affecting the brain, progressively leading the patient to a state of total dependence, thus creating a very complex and difficult situation for the family that has to assist him/her. Early diagnosis is a primary objective and constitutes the hope of being able to intervene in the development phase of the disease. Methods: In this paper, a method to automatically detect the presence of Alzheimer’s disease, by exploiting deep learning, is proposed. Five different convolutional neural networks are considered: ALEX_NET, VGG16, FAB_CONVNET, STANDARD_CNN and FCNN. The first two networks are state-of-the-art models, while the last three are designed by authors. We classify brain images into one of the following classes: non-demented, very mild demented and mild demented. Moreover, we highlight on the image the areas symptomatic of Alzheimer presence, thus providing a visual explanation behind the model diagnosis. Results: The experimental analysis, conducted on more than 6000 magnetic resonance images, demonstrated the effectiveness of the proposed neural networks in the comparison with the state-of-the-art models in Alzheimer’s disease diagnosis and localization. The best results in terms of metrics are the best with STANDARD_CNN and FCNN with accuracy, precision and recall between 98% and 95%. Excellent results also from a qualitative point of view are obtained with the Grad-CAM for localization and visual explainability. Conclusions: The analysis of the heatmaps produced by the Grad-CAM algorithm shows that in almost all cases the heatmaps highlight regions such as ventricles and cerebral cortex. Future work will focus on the realization of a network capable of analyzing the three anatomical views simultaneously.

With the growth of the mobile market, malicious applications represent a risk to the security of the users. To mitigate this aspect, researchers proposed different techniques to spot and identify unsafe software placed on the market. On the other hand, malicious writers started to develop ever more sophisticated strategies to hide malicious payloads, in particular through the adoption of obfuscation techniques. The latter consists of hiding the behavior and purpose of malware from antimalware. In this paper, we propose and design a method aimed to detect obfuscated malware. The proposed method builds images directly from system call traces obtained from legitimate, malicious, and obfuscated Android applications. In addition, to show that dynamic analysis and deep learning can build resilient models we propose two experiments using a convolutional neural network. In the first experiment, we train and test the model using a dataset composed of malware, while in the second we train the model using the malware dataset but the model is evaluated using a dataset composed of obfuscated malware. Finally, we analyze the malware and obfuscated detection models from the point of view of explainability using two different class activation mapping algorithms, to understand whether the model predictions can be considered resilient.

Data privacy has become increasingly important in recent years, with the rise of cyber threats and the unauthorized sharing of sensitive information. Our work within the E-Corridor project has focused on developing a secure framework for sharing information in multimodal transport systems, while ensuring data privacy is maintained. Our implementation of a two-party computation schema using Yao’s garbled circuits in an Android mobile setting has enabled us to create an application that allows users to find points of interest, e.g., restaurants or hotels, near specific areas without sharing any personal information. The application matches user requests using the secure two-party without disclosing any of the user’s preferences with external actors. We design a threat model based on LINDDUN to show the reliability of our project. It highlights also the potential of using secure computing techniques to enable information sharing while maintaining privacy. Our work demonstrates the importance of prioritizing data privacy in our increasingly interconnected world and the potential of secure two-party computing techniques in achieving this goal. Besides, this framework is flexible and can be extended to various domains where data privacy is of utmost importance.

In the last two decades, one of the most important topics of discussion is the environmental problem, and to solve the latter, scientists have proposed several types of solutions. Recently Smart Grid concept has taken hold. The latter was presented in 2007 to manage electricity and integrate renewable energy sources. In that context, one of the problems is obtaining power system stability. This pertains to the ability of an electrical grid, transforming smart grid technologies, to maintain steadfast and dependable operation despite the inherent variability introduced by renewable resources. In this paper, we propose a technique to determine if a network is stable or unstable by employing several deep-learning architectures. In detail, we used a dataset retrieved from Kaggle, where all data have been converted into images thanks to the usage of a Python script designed and built by the authors. After getting the related pictures, the new dataset obtained was divided into 80-10-10 (training-validation-test). After this step, we executed several experiments where we reached an accuracy and precision of 0.998. In particular, to perform them we employed different Convolutional Neural Networks present in the state-of-the-art like AlexNet, DenseNet, LeNet, ResNet50, Standard CNN, VGG16, and VGG19. In the final step, to perform the explainability, we also employed three different CAMs Grad-CAM, Grad-CAM++, and Score-CAM, to highlight the most distinctive areas of an image.

Artificial intelligence has increasingly pervaded both everyday life and business environments, assuming a role in supporting human decision-making. These systems have grown progressively intricate and effective, carrying the potential to unearth valuable insights across various applications. Nevertheless, for Artificial Intelligence to gain widespread acceptance, human trust in its outcomes is essential. Trustworthy Artificial Intelligence is a term used to describe legal, ethically compliant, and technically sound Artificial Intelligence. In this paper, we design a proposal with the aim to introduce trustworthiness in Artificial Intelligence models. In the proposed workflow, we consider from a set of models contained in a model repository, the computation of a trustworthy index obtained from the prediction explainability in both training and testing phases. The latter is to consider the most reliable model from the trustworthy index point of view.

Data poisoning represents a set of techniques aimed at perturbing data for training machine learning models, affecting performance. Such intentional attacks are widespread in many applications involving deep learning algorithms and are aimed to provide misclassifications. In this paper, data poisoning on retinal images for the diabetic retinopathy binary classification (health and sick) is presented and evaluated. The presented attacks are almost imperceptible perturbations of the images that nevertheless decrement the metrics of the trained models. Once exposed to the data poisoning distortions on these images, a possible countermeasure to enhance the security from these attacks is shown. In this way, the robustness and vulnerabilities of the network are highlighted and the best result is also analyzed through the use of heatmaps, for the qualitative point of view. The paper aims to focus on the effects of data poisoning in deep learning model testing phase and to discuss possible countermeasures.

In the smart grid ecosystem, the automated reading of water meters is a critical task that can be accomplished with deep learning algorithms instead of the traditional way that relies on the physical presence of employees or utility representatives. The YOLO (You Only Look Once) family of models has gained prominence among these approaches because of its excellent accuracy and quick processing time. In this study, we compare the performance of four YOLO models for automated reading in water metering systems (YOLOv5, YOLOv6, YOLOv7, and YOLOv8). We assess the model's precision, recall, and processing time using a custom dataset of water meter images. In terms of precision and processing time, our testing results demonstrate that YOLOv8 surpasses YOLOv7, YOLOv6, and YOLOv5 by scoring 0.889 in precision, making it a suitable alternative for automated reading in smart metering systems. This benchmarking study provides a valuable reference for researchers and practitioners in the field of smart grid and deep learning, and it can aid in the selection of the most appropriate model for this task.

In recent times is increasing the number of cyberattacks. Daily, we employ computers and mobile devices to perform different tasks, and malicious users are always ready to perpetrate malicious actions. Usually, they use malicious applications able to gain personal information. To avoid these troubles researchers are always focused on the design of new ways to detect malware, typically exploiting machine learning. The progress and recent increasing adoption of quantum computing allowed the inclusion of quantum algorithms into machine learning methods. In this paper, we present a malware detection method based on a quantum machine learning model. In addition, to understand the explainability we adopted two different Class Activation Mapping algorithms to highlight the areas of the images under study that are responsible for a specific categorization of the malware's families. Moreover, we also compare the best results obtained using the quantum model we propose with one of the first convolutional neural network models, i.e., the Le-Net one, to understand whether quantum models can be promising in the malware detection task.

The COVID-19 pandemic has radically changed our daily habits. One of these habits introduced is the use of a face mask, to avoid the spread of the infection, to be used especially in closed and crowded environments. To protect people and to counter the spread of COVID-19, in this paper we propose a method to automatically verify from images whether people are wearing a face mask. We designed a deep learning network to classify whether an image under analysis is with a mask or without a face mask. With the aim to provide explainability to the classifier decision, the proposed method is able to localise the areas of the image under analysis symptomatic of a certain prediction: in this way it is possible to understand the reason why the model predicts a certain label. The experimental analysis considers 7553 (with mask and without mask) images showing that the proposed approach is able to obtain interesting performances in face mask detection.

Detecting structural damage is a fundamental process for visually assessing the quality of any building, such as a bridge or skyscraper. Unfortunately, access to inspect buildings, especially in the case of very tall buildings, is usually not immediate, and in any case, it is difficult. For this reason, unmanned aerial vehicles and drones are used to access inaccessible places, having the possibility of reaching them, making videos and taking photos which are then analyzed by ground personnel. In this paper, we propose a method for the automatic detection of structural damage from images. The proposed method employs an object detection model, i.e., YOLO, for the automatic localization of structural damages on different types of buildings. In the evaluation of a dataset composed of more than 700 images acquired from unmanned aerial vehicles and drones, the proposed method obtains a precision of 0.897, a recall equal to 0.904, and a mean Average Precision value (with an Intersection over Union greater than 0.5) equal to 0.924, showing the effectiveness of the proposed method for the identification and location of structural damage.

Object detection is one of the crucial tasks that has made deep learning of fundamental importance in last years, also thanks to the use of drones and unmanned aerial vehicles able to obtain images and videos in real-time from any location. In the absence of daylight or artificial light for object detection, it is necessary to resort to thermal images, obtained by converting infrared radiation (i.e., heat) into visible images that depict the spatial distribution of temperature differences in a scene viewed by a thermal camera. However, object detection in this type of image and video stream is still challenging due to the complicated scene information and coarse resolution compared to a visible image or video. In this paper, we propose a method aimed to detect objects in thermal images, in particular, the proposed method is aimed to identify persons and dogs acquired from a thermal camera installed, for instance, on drones or unmanned aerial vehicles. We employ an object detection model, i.e., the ”You only look once” one, for the automatic localization of objects in thermal images. In the evaluation of a dataset composed of 203 images with 257 annotations, the proposed method obtains a precision of 0.897, a recall equal to 0.904, and a mean Average Precision value (with an Intersection over Union greater than 0.5) equal to 0.924, showing the effectiveness of the proposed method for the identification and location of persons and dogs from images directly acquired with thermal cameras.

In light of the growing reliance on digital technology, the security of digital devices and networks has become a critical concern in the information technology industry. Network analysis can be helpful for identifying and mitigating network-based attacks, as it enables the monitoring of network behavior and the detection of anomalous activity. Through the use of network analysis, organizations can better defend against potential security threats and protect their interconnected digital systems.

In the next decade, electric road vehicles have the potential to reduce climate change and improve mobility. However, not all charging methods are equally secure and private, so this work provides a comprehensive analysis of the security and privacy of various EV charging methods and highlights the importance of addressing vulnerabilities to meet homologation standards. Five charging methods are described in terms of physical components, communication protocols, and standards. This research identifies weaknesses in each method and determines which are less prone to cyber attacks or privacy disclosures. The impact of different charging methods on vehicle homologation is also discussed, as required by the cybersecurity regulation UNECE R155. A mapping is provided between vulnerabilities and suggested mitigations from the regulation. The evidence suggests that different charging methods result in different security and privacy levels, with conductive methods being more vulnerable to security attacks and privacy disclosure, while methods with fewer components may reduce security and privacy risks.

Summary Cyber‐attacks are considered the most significant threat to organizations from different sectors, including critical infrastructure. Access to critical assets, including industrial control systems, and control over their usage is one of the security approaches implemented to protect those systems from unauthorized access. However, existing implementations do not support the enforcement of fine‐grained authorization policies and do not provide continuous control over data access. Furthermore, existing implementations of the access control paradigm require policy‐makers to perform a manual update of policies that do not consider information about potential or ongoing cyber attacks. In this work, we propose a framework that enables continuous control on the execution of access rights in the industrial domain. Furthermore, the framework relies on cyber incident information shared by trusted entities. This information is used for updating security policies in order to prevent possible incidents within the smart factory infrastructure. We also provide experimental results that show the operability and the efficiency of the proposed framework.

Security and privacy issues have become a major hindrance to the broad adoption of Ride-Hailing Services (RHSs). In this article, we introduce a new collusion attack initiated by the Ride-Hailing Service Provider (RHSP) and a driver that could easily link the real riders and their anonymous requests (credentials). Besides this attack, existing work requires heavy computations to execute user matching, and it is challenging for riders to verify matching results. Meanwhile, a malicious driver may cancel an assigned ride order due to its short distance. To address these issues, we present a RHS system named Nereus to support collusion resistance, efficiency, verifiability, and accountability. First, we integrate a smart contract into a Software Guard Extensions (SGX) enclave to establish aprivate smart contractfor collusion resistance. We use a Bloom filter to achieve efficient matching. Second, we leverage privacy-preserving range query and Merkle proofs to make matching results verifiable. Meanwhile, we adopt short group signatures to provide anonymous authentication and deposit commitments to hold the runaway driver accountable. We formally state and prove the security and privacy of Nereus. We build a prototype based on Ethereum and SGX to conduct extensive performance analysis in regard to gas costs, computational costs, and communication overhead. Experimental results show that Nereus significantly improves over existing schemes in terms of computational costs.

The rising connection of vehicles with the road infrastructure enables the creation of data-driven applications to offer drivers customized services. At the same time, these opportunities require innovative solutions to protect the drivers’ privacy in a complex environment like an Intelligent Transportation System (ITS). This need is even more relevant when data are used to retrieve personal behaviors or attitudes. In our work, we propose a privacy-preserving solution, called Private Driver DNA, which designs a possible architecture, allowing drivers of an ITS to receive customized services. The proposed solution is based on the concept of Driver DNA as characterization of driver’s driving style. To assure privacy, we perform the operations directly on sanitized data, using the Order Revealing Encryption (ORE) method. Besides, the proposed solution is integrated with ITS architecture defined in the European project E-Corridor. The result is an effective privacy-preserving architecture for ITS to offer customized products, which can be used to address drivers’ behaviors, for example, to environmental-friendly attitudes or a more safe driving style. We test Private Driver DNA using a synthetic dataset generated with the vehicle simulator CARLA. We compare ORE with another encryption method like Homomorphic Encryption (HE) and some other privacy-preserving schemas. Besides, we quantify privacy gain and data loss utility after the data sanitization process.

Mobile malware are increasing their complexity to be able to evade the current detection mechanism by gathering our sensitive and private information. For this reason, an active research field is represented by malware detection, with a great effort in the development of deep learning models starting from a set of malicious and legitimate applications. The recent introduction of quantum computing made possible quantum machine learning i.e., the integration of quantum algorithms within machine learning algorithms. In this paper, we propose a comparison between several deep learning models, by taking into account also a hybrid quantum malware detector. We explore the effectiveness of different architectures for malicious family detection in the Android environment: LeNet, AlexNet, a Convolutional Neural Network model designed by authors, VGG16 and a Hybrid Quantum Convolutional Neural Network i.e., a model where the first layer is a quantum convolution that uses transformations in circuits to simulate the behavior of a quantum computer. Experiments performed on a real-world dataset composed of 8446 Android malicious and legitimate applications allow us to compare the various models, with particular regard to the quantum model concerning the other ones.

Cardiovascular diseases include a very long series of diseases that afflict many people in the world. Many of them can be diagnosed by listening to the heartbeat, however in the face of the large number of patients performing checks, great delays can occur given the few doctors available. In this paper we propose a convolutional neural network aimed to discriminate regular heartbeats from abnormal ones, making a first screening of patients. Moreover we provide classification explainability through activation maps. The experimental analysis consists of 3240 (regular and abnormal) heartbeat phonocardiogram signals, showing the effectiveness of the proposed method.

Cervical cancer develops in the lower part of the uterus, the organ of the female apparatus where the embryo is received and develops during pregnancy. In this paper we investigate the possibility to automatically detect the presence of cancerous cells and to predict of the stage of the cancerous lesion of the uterine cervix by exploiting images of cervical cells captured by the microscope. We extract a set of numerical features from each images and we build supervised machine learning models to diagnose the cervix cancer. The experimental analysis show that the proposed method is promising in distinguish between healthy and cancerous cells and to detect also high and low-grade squamous intraepithelial lesions.

Over the years, the number of compromised accounts dramatically increased. To avoid this type of attack various types of authentication methods were introduced. In particular, currently, researchers are focusing on biometric-based techniques such as physical-biometric and behavior-biometric. The idea at the bottom of the last technique is that each person exhibits a unique behavior. Starting from the touch dynamics, and keyboard dynamics nowadays, one of the most promising investigation areas is currently represented by mouse dynamics. Because of the simpler technology necessary to gather biometric data without employing user sensor data, the latter has recently been a popular study area. In this paper, we propose an approach for continuous and silent user authentication based on mouse dynamics and explainable deep learning. We build a set of images using an existing dataset of mouse dynamics in CSV format. The images obtained were then used to train a deep-learning model to discriminate between legitimate and malicious users. We also adopted the Gradient-weighted Class Activation Mapping, to allow highlighting the areas of the images which are responsible for a specific legitimate/attack prediction, thus providing explainability behind the model classification. The preliminary experimental analysis based on ten different users shows that the proposed method can be promising in silent and continuous user authentication.

Many tasks that require a big workforce are automated. In many areas of the world, the consumption of utilities such as electricity, gas, and water is monitored by meters that need to be read by humans. The reading of such meters requires the presence of an employee or a representative of the utility provider. Automatic meter reading is a crucial in the implementation of smart grids. For this reason, with the aim to boost the implementation of the smart grid paradigm, in this paper we propose a method aimed to automatically read digits in a dial meter. In detail the proposed method is aimed to localise the dial meter from an image, to detect the digits and the classify the digits. Deep learning is exploited, in particular the YOLOv5s model is considered for the localisation of digits and for their recognition. An experimental real-world case study is proposed to confirm the effectiveness of the proposed method for automatic digits localisation recognition in dial meter.

Nowadays pathologists have to analyse blood cells manually with the aim to diagnose diseases. In order to perform this manual task blood samples must be collected from the patient and then placed on a microscope slide. This slide is studied with the aim to detect the abnormality presence. The manual method used to identify abnormality of blood cells is tedious, prone to human errors and time consuming. Hence there is a need for computer aided system which can analyze blood cells automatically at faster rate with accuracy. Such systems can be designed using image processing techniques. To automatise this process by helping pathologists, in this paper we propose the adoption of deep learning to automatically count and localise red blood cells, white blood cells and platelets by analysing blood microscopic images. We resort to the YOLO object detection model, able to look at the whole image so its predictions are informed by global context in the image. To show the effectiveness of the proposed method we evaluate our model on a dataset composed by 874 microscopic blood images, obtaining interesting results. Furthermore we show several examples related to how the proposed method can be helpful for the pathologists in their real-world work.

Often when we have a lot of data available we can not give them an interpretability and an explainability such as to be able to extract answers, and even more so diagnosis in the medical field. The aim of this contribution is to introduce a way to provide explainability to data and features that could escape even medical doctors, and that with the use of Machine Learning models can be categorized and "explained".

Deep Learning models demonstrated high accuracies performance in malware classification, but they are still lacking "explainability" to ensure robustness and reliability in the generated prediction. In this short contribution, we summarize the researches that we conducted in the latest years in the Malware Analysis field.

The new coronavirus disease (COVID-19), declared a pandemic on 11 March 2020 by the World Health Organization, has caused over 6 million victims worldwide. Because of the rapid spread of the virus, with the aim to perform screening we exploit deep learning model to quickly diagnose altered respiratory conditions. In this paper, we propose a method to recognize and classify cough audio files into three classes to distinguish patients with COVID-19 disease, symptomatic ones and healthy subjects, with the use of a convolutional neural network (CNN). Cough audios were recorded by using a smartphone and its built-in microphone. From cough recordings, we generate spectrogram images and we obtain an accuracy equal to 0.82 with a deep learning network developed by authors. Our method also provides heatmaps, which show the relevant input areas used by the model for the final forecast, and this aspect ensures the explainability of the method.

Over the years the number of fraud credential attacks increased drastically. To avoid this type of attack many types of authentication methods have been introduced, in particular, recently taken hold biometric-based such as physical-biometric and behavior-biometric. The idea at the bottom of the latter is that each person has a unique behavior. Starting from the touch dynamics, and keyboard dynamics nowadays, the main topic of study is mouse dynamics. Unlike the other techniques, mouse dynamics require simpler hardware to capture the biometric data without using sensitive data from the users. In this paper, we propose a method based on mouse dynamics and explainable deep learning for continuous and silent user authentication. We propose four different images obtained starting from mouse dynamics and we submit these images to several deep learning models obtaining interesting results in user behavior detection. Moreover, we propose the adoption of the Gradient-weighted Class Activation Mapping to highlight the areas of the images under study that is responsible for a specific categorization to explain the model decision.

Nowadays pathologists have to analyse blood cells manually with the aim to diagnose diseases. In order to perform this manual task blood samples must be collected from the patient and then placed on a microscope slide. This slide is studied with the aim to detect the abnormality presence. To automatise this process by helping pathologists, in this paper we propose the adoption of deep learning to automatically count and localise red blood cells, white blood cells and platelets by analysing blood microscopic images. We resort to the YOLO object detection model, able to look at the whole image so its predictions are informed by global context in the image. To show the effectiveness of the proposed method we evaluate our model on a dataset composed by 874 microscopic blood images, obtaining interesting results. Furthermore we show several examples related to how the proposed method can be helpful for the pathologists in their real-world work.

Diabetic retinopathy is a disease afflicting the retina and currently is manually diagnosed by specialists through eye tomography inspection. In order to assist the clinician in this time-consuming task, in this paper, we propose a method aimed to automatically diagnose the (proliferative and non-proliferative) diabetic retinopathy by exploiting deep learning. Furthermore, we investigate the possibility to automatically localise the areas related to the disease by exploiting class activation maps. We evaluate different deep learning models from a quantitative point of view (i.e, using metrics like accuracy, precision and recall) and a qualitative point of view (by exploiting class activation maps and image similarity metrics) with the aim to understand the quality of predictions performed by a model in retinopathy diagnosis, reducing the amount of knowledge required to assess the model performance. From the experimental analysis is emerging that deep learning shows an interesting diagnostic potential in the retinopathy disease localisation and can effectively help the clinician in retinopathy diagnosis. Moreover, the adoption of the class activation maps and its comparison evaluation can help the developers to debug the training step of the model without medical expertise.

Shallow machine learning is massively applied by researchers with the aim to detect (novel and unseen) malicious applications. Machine learning models are typically evaluated using malicious and trusted applications generated over a short period. In the real world, these models aim to identify malware that were not seen previously during the training phase. In this paper, we investigate how well machine learning-based malware detectors can actually detect malware in the real-world environment. By representing an Android application in terms of image, we evaluate the resilience of several popular supervised machine learning algorithms exploited by current literature for the malware detection task. The experimental results demonstrate the poor resilience of the machine learning models used for malware detection.

As a result of the spread in the mobile market, new kinds of malware have developed. Many malicious users began to produce harmful applications for open-source operating systems such as Android, and closed-source operating systems like iOS. For this reason, new anti-malware methodologies are necessary to identify them. Currently, most of them base their approach on the signature, and it does not allow users to defend themselves from current threats. In this article, we propose an automatic tool able to identify dangerous iOS applications by defining a system model through Milner's Calculus of Communicating Systems and the consequence use of the State Transitions System to evaluate the behaviors of an application, to categorize if it is malware or a legitimate application. As a result of the experiments conducted, we obtained relevant performances with good precision and recall levels.

Image segmentation is becoming a component of medical image processing with a significant role to analyze gross anatomy, to locate an infirmity and to plan the surgical procedures. Segmentation of brain magnetic resonance Imaging (MRI) is of increasing importance for the accurate diagnosis. For this reason, precise and accurate segmentation of brain MRI is a challenging task. In this paper we propose an approach for brain segmentation from MRI. Our method relies on a modified version of the U-Net convolutional neural network. Experiments performed on high grade brain cancer MRI demonstrate the effectiveness of the proposed approach for high grade brain cancer segmentation.

Unmanned aerial vehicles (drones) are widely available on today's market for use for use both as a hobby and to meet specific industrial needs, such as agriculture or parcel transport. This intensive use in various areas has also led to an increase in the illegitimate and criminal use of them, which has led to an interest in identification and detection techniques in the academic world. To address this topic, we propose a method that automates drone detection processes using their acoustic characteristics with different machine learning algorithms. In this study, we show the advantage of using machine learning techniques for drone detection. Experimental analysis demonstrates that the proposed method is promising in drone detection.

The advent and development of the smart grid have introduced a number of opportunities for improving efficiencies and overall performance. Along with the opportunities, each technology wave brings with it new opportunities for attackers to perpetrate damage, that in the smart grid scenario afflict electricity networks i.e. a cyber physical environment. In this paper we propose a method aimed to detect intrusion in smart grid by exploiting supervised machine learning techniques. By real-time log analysis, obtained from SCADA systems, widely exploited in a plethora of industrial applications, we extract a set of 26 features to build seven different machine learning models. Experimental analysis performed with 7 machine learning algorithms shows the effectiveness of the proposed method.

Summary In this article we present an application of the Usage Control paradigm to a Smart Home infrastructure, based on a model extension and structured use of obligations. In the proposed extended model obligations are exploited to enforce two different access revocation time, namely revoke and suspend. This increases the policy expressiveness and enable to optimize the resource usage. Furthermore, obligations are exploited to send commands via IFTTT to different interconnected Smart Home devices, to impose safety‐relevant behaviors, or to act on policy attributes to implement a self‐healing paradigm for revoked sessions. The article is motivated by a parental control use case where deep learning is used in combination with Usage Control to regulate dynamically viewing rights of a smart‐TV and interactions with interconnected devices. Accuracy and performance experiments show the effectiveness and feasibility of the proposed work.

Recently, several research efforts have been focused on automotive safety, due to the increasing technology embedded in our vehicles. Research community have produced different methods aimed, for instance, to profile driver behaviour, starting from a feature set gathered by the vehicle. The provided methods are mainly machine learning-based: these solutions, as largely demonstrate in literature, suffer from several issues, due to the context variability but also because they are not able to provide a rational reason for the specific prediction. To overcome these limitations, in this paper we propose a novel model checking based approach to driver identification. Furthermore, a novel automatic procedure able to infer a logical representation of the driver behaviour is discussed. Two real-world datasets for the evaluation of the proposed method are considered, obtaining interesting results in driver identification.

Mobile malware is growing in number and its complexity is constantly increasing. Malware authors are continuously looking new ways to elude anti-malware controls. Anti-malware are not able to detect zero-day malware, because to detect malicious behaviour they need to know its signature, but to have this information the malware must already be widespread. Furthermore, anti-malware are able to scan one application at a time: for this reason a type of malware characterized by the colluding attack, where the malicious action is split in two (or more) applications, can not be recognised.

We propose a malware classification system that is shown to be robust to some common intra-procedural obfuscation techniques.Indeed, by training the Contextual Graph Markov Model on the call graph representation of a program, we classify it using only topological information, which is unaffected by such obfuscations.In particular, we show that the structure of the call graph is sufficient to achieve good accuracy on a multi-class classification benchmark.

Cybercriminals are continually working to develop increasingly aggressive malicious code to steal sensitive and private information from mobile devices. Antimalware are not always able to detect all threats, especially when they do not have previous knowledge of the malware signature. Moreover, malware code analysis remains a time-consuming process for security analysts. In this regard, we propose a method aimed to detect the malware belonging family and automatically pointing out a subset of potentially malicious classes. The rationale behind this work aims (i) to save valuable time for the security analyst by decreasing the amount of code to analyse, and (ii) to improve the interpretability of image-based deep learning model for malware family detection. We represent an application as an image and classify it with a deep learning model aimed to predict the belonging family; then, exploiting the use of activation maps, the approach points out potentially malicious classes to help the security analysts in the malicious behaviour recognition. The proposed method obtains an overall accuracy of 0.944 in the evaluation of a dataset composed of 8430 real-world Android malware, showing also that the use of activation maps can provide explainability about the deep learning model decision.

Social distancing is becoming really important in last month as a vehicle to limit the COVID-19 Coronavirus pandemic. Generally speaking, it is effective to control the spread of contagious diseases. In this context there is the need to monitor social distancing violations: for this reason in this paper we propose a social distancing detector able to count the violations by analysing video streams. Preliminary results show that the proposed method can be employed to guarantee social distancing. Moreover we discuss several suggestions aimed to improve the following proposal.

In this paper, we evaluate the performance of machine learning classifiers (Logistic Regression, CART, Random Forest) by fabricating adversarial examples (malware samples) statistically identical to goodware. To this end, we demonstrate three scenarios, (a) random attribute injection (b) insertion of prominent attributes from legitimate apps and (c) poisoning of class labels, for creating tainted malware samples, to mislead reduce accuracy of classification models. Experiments were conducted on data-set consisting of 15649 android applications comprising 5373 malicious and 10276 legitimate apps. The outcome of investigations demonstrates significant drop in accuracies in the range of 12-50%. However, in the absence of adversarial examples in the test set, the performance of classifiers was observed between 94.8-97.9%.

Smartphones, tablets and other mobile devices have become objects that we can no longer do without, as a matter of fact for us they are like an extension of our body and many people are addicted to them; this behavior is a consequence of the use we make of it, since these devices allow us to manage sensitive data (i.e., financial ones) and access information of different types (i.e., photos, messages or health data). For this reason it is essential to detect the harmful behaviors present within our smartphones, taking into account the weaknesses of the current anti-malware mechanisms. In this article we propose an approach capable of discriminating trusted applications from those that instead have malicious behavior, since they are involved in a colluding attack. We resort to the processing of the audio signal extracted from the conversion of an application into an audio file. The processing allows to generate a vector of characteristics to be analyzed with different classifiers. The experimental analysis is performed on a set of Android applications consisting of 359 trusted and (colluding) untrusted applications, showing the effectiveness of our method in detecting colluding applications.

The proliferation of info-entertainment systems in today’s vehicles has provided a really cheap and easy-to-deploy platform with the ability to gather information about the vehicle under analysis. Ultra-response connectivity networks with a latency below 10 milliseconds are providing the perfect infrastructure in which this information can be sent to improve safety and security. With the purpose of providing an architecture to increase safety and security in an automotive context, we in this paper propose a method for detecting the driver in real-time exploiting supervised machine learning techniques. The experimental analysis performed on real-world data shows that the proposed method obtains encouraging results.

The detection mechanism provided by current antimalware is the so-called signature based, requiring that a threat must be widespread to be recognised by the antimalware. Even if a malware is rightly recognized, by applying even trivial obfuscation techniques, it is really easy to bypass the antimalware detection mechanism. In this paper we propose a method to detect if an Android application is obfuscated with the call indirection obfuscation techniques by exploiting formal equivalence checking. In the experimental analysis we show the effectiveness of the propose approach for call indirection obfuscation technique detection, by exploiting two obfuscation tools.

Considering the pervasiveness of mobile devices, malicious writers are constantly focusing their attention in developing malicious payload aimed to gather sensible information from mobile devices without user content. As a matter of fact, it is really easy for malware writers to embed malicious payloads into legitimate applications, by applying the so-called repackaging paradigm, to generate a sample with a signature unknown to anti-malware software. In this paper we propose a twofold approach for the triage and the detection of repackaged Android applications. We propose a visualization schema to assist the malware analyst in the triage of unseen applications and a set of metrics for the automatic detection of repackaged applications. Experimental results show the effectiveness of the proposed approach.

This work presents a framework that provides ongoing control on actions execution in the industrial environment exploiting the OPC Unified Architecture (OPC-UA) framework and the Usage Control (UCON) paradigm. We present a fine-grained usage control model, referred as OPC-UCON, satisfying security and privacy needs of the OPC-UA framework. Our proposed framework exploits the OPC-UA connectivity between simulated industrial components and uses the UCON paradigm for dynamically controlling actions execution according to fine-grained policies reported in the standardized format. The UCON paradigm, in a form of the system, is in charge of controlling the process of dynamic policy reevaluation and the possibility of revoking already granted authorization by stopping previously authorized actions if conditions do not satisfy policy anymore. We presented the implementation and deployment of the proposed framework in a simulated industrial environment with relevant security policies to reflect the advantages of the OPC-UCON model.

Everyday born a new cyberattack and among these an emerging attack is represent by the so-called colluding. The application collusion attack is a new form of threat that is becoming widespread in mobile environment, especially in Android platform. This technique requires that two or more apps cooperate in some way with the aim to perform a malicious action that they are unable to perform independently. Detecting colluding apps is challenging problem, because currently there are no effective tools due to the search space of all possible combination of apps. In this paper we present a method exploiting model checking technique with the aim to detect a collusion attack between two applications. The method uses a heuristic function able to reduce the number of the analyzed apps and to localize the collusion attack. This heuristic function is based on the study of execution flow of an application, to identify the execution flow and verify it. The proposed algorithm verify if there is a flow of sensitive data that ends up in a shared resource and if this happens the app could be marked as potentially collusive, otherwise it is possible to exclude the app from the analysis, in order to reduce the number of apps to be analyzed. Experimental results on a data-set of Android applications show promising performances in colluding mobile app detection.

Artificial Intelligence systems have enabled significant benefits for users and society, but whilst the data for their feeding are always increasing, a side to privacy and security leaks is offered. The severe vulnerabilities to the right to privacy obliged governments to enact specific regulations to ensure privacy preservation in any kind of transaction involving sensitive information. In the case of digital and/or physical documents comprising sensitive information, the right to privacy can be preserved by data obfuscation procedures. The capability of recognizing sensitive information for obfuscation is typically entrusted to the experience of human experts, who are over-whelmed by the ever increasing amount of documents to process. Artificial intelligence could proficiently mitigate the effort of the human officers and speed up processes. Anyway, until enough knowledge won't be available in a machine readable format, automatic and effectively working systems can't be developed. In this work we propose a methodology for transferring and leveraging general knowledge across specific-domain tasks. We built, from scratch, specific-domain knowledge data sets, for training artificial intelligence models supporting human experts in privacy preserving tasks. We exploited a mixture of natural language processing techniques applied to unlabeled domain-specific documents corpora for automatically obtain labeled documents, where sensitive information are recognized and tagged. We performed preliminary tests just over 10.000 documents from the healthcare and justice domains. Human experts supported us during the validation. Results we obtained, estimated in terms of precision, recall and F1-score metrics across these two domains, were promising and encouraged us to further investigations.

Most of death causes are related to cardiovascular disease. In fact, there are several anomalies afflicting the heart beat, for instance heart murmur or artefact. We propose a method for heart disease detection. By gathering a set of feature obtainable directly from cardiac sounds, we consider this feature vector as input for a deep neural network to discriminate whether a cardiac sound is belonging to an healthy or to a patient with a cardiac disease. The experiment we performed demonstrated the effectiveness of the proposed approach in real-world environment.

At the end of 2019, a new form of Coronavirus, called COVID-19, has widely spread in the world. To quickly screen patients with the aim to detect this new form of pulmonary disease, in this paper we propose a method aimed to automatically detect the COVID-19 disease by analysing medical images. We exploit supervised machine learning techniques building a model considering a data-set freely available for research purposes of 85 chest X-rays. The experiment shows the effectiveness of the proposed method in the discrimination between the COVID-19 disease and other pulmonary diseases.

Modern vehicles contain a plethora of electronic units aimed to send and receive data by exploiting the serial communication provided by the CAN bus. CAN packets are broadcasted to all components and it is in charge of the single component to decide if it is the receiver of the packets. Furthermore, this protocol does not provide source identification of authentication: for these reason it clear that the CAN bus can be easily exposed to attacks. In this paper we propose a method to detect CAN bus targeting attacks. We take into account deep learning algorithms and we evaluate the proposed method by exploiting CAN messages obtained from a real vehicle injecting four different attacks (i.e. dos, fuzzy, gear and rpm), with interesting results in CAN bus attacks detection.

This work describes the architecture and prototype implementation of a novel trust-aware continuous authorization technology that targets consumer Internet of Things (IoT), e.g., Smart Home. Our approach extends previous authorization models in three complementary ways: (1) By incorporating trust-level evaluation formulae as conditions inside authorization rules and policies, while supporting the evaluation of such policies through the fusion of an Attribute-Based Access Control (ABAC) authorization policy engine with a Trust-Level-Evaluation-Engine (TLEE). (2) By introducing contextualized, continuous monitoring and re-evaluation of policies throughout the authorization life-cycle. That is, mutable attributes about subjects, resources and environment as well as trust levels that are continuously monitored while obtaining an authorization, throughout the duration of or after revoking an existing authorization. Whenever change is detected, the corresponding authorization rules, including both access control rules and trust level expressions, are re-evaluated. (3) By minimizing the computational and memory footprint and maximizing concurrency and modular evaluation to improve performance while preserving the continuity of monitoring. Finally we introduce an application of such model in Zero Trust Architecture (ZTA) for consumer IoT.

In last years vehicular network safety and security are attracting interest from both industries and researchers. In this paper, starting from a set of features gathered from the in-vehicle CAN bus, we show how machine learning algorithms can be useful to discriminate between the car owner and impostors. Furthermore, we assess several machine learning classifiers ability to predict instances not evaluated in the training set.

Mobility trajectories of users contain personal information that when analyzed may reveal relevant data usable as message-sharing condition, e.g., interests in common or similar mobility patterns. In particular, leveraging on mobility patterns, in [12] we designed and presented a Geo-casting routing protocol called LoSeRO for opportunistic networks, which uses knowledge of the locations most frequently visited by a user to route messages. LoSeRO forwards messages-in a multi-casting way-to all users who have a mobility profile that intersects the packet's destination zone. LoSeRO presented a relative good performance value, however, to improve its performances, in this paper our contribution is to propose an upgraded version of our earlier proposed protocol, termed as LoSeRO v2. In particular, it upgrades the traditional working fashion of LoSeRO by extending the knowledge of the most frequented locations to those users not only directly met, i.e., two-hops away. With this purpose, through simulations, we compare the performance of LoSeRO v2, with LoSeRO and other existing routing geo-casting protocols, and we illustrate how LoSeRO v2 achieves enhanced performances comparing precision, coverage and additional metrics.

The application collusion attack is a new form of threat that is becoming widespread in mobile environment. This technique requires that two or more apps cooperate in some way with the aim to perform a malicious action that they are unable to perform independently. In this paper we propose the adoption of model checking to detect whether two or more apps are performing a collusion attack.

The current authentication systems based on password and pin code are not enough to guarantee attacks from malicious users. For this reason, in the last years, several studies are proposed with the aim to identify the users basing on their typing dynamics. In this paper, we propose the adoption of formal methods to discriminate between different users by exploiting a set of keystroke features. The idea behind the proposed method is to identify the users silently and continuously during their typing on a monitored system. To perform such user identification effectively, we consider a feature vector able to capture the typing style that is specific to each given user. By considering this feature model, in detail we propose to consider model checking with logic temporal properties to discriminate between different users using a set of keystroke features.

Data usually evolve according to specific processes, with the consequent possibility to identify a profile of evolution: the values it may assume, the frequencies at which it changes, the temporal variation in relation to other data, or other constraints that are directly connected to the reference domain. A violation of these conditions could be the signal of different menaces that threat the system, as well as: attempts of a tampering or a cyber attack, a failure in the system operation, a bug in the applications which manage the life cycle of data. To detect such violations is not straightforward as processes could be unknown or hard to extract. In this paper we propose an approach to model the data life cycle by observing the data evolution in its life cycle. Thus, we represent users able to alter data through timed automata. Through model checking, the obtained profile of evolution can be used to detect anomalies in relational database, data warehouse and big data.

This paper proposes a machine-learning framework for supporting intelligent web phishing detection and analysis, and provides its experimental evaluation. In particular we make use of state-of-the-art decision tree algorithms for detecting whether a Web site is able to perform phishing activities. If this is the case, the Web site is classified as a Web-phishing site. Our experimental evaluation confirms the benefits of applying machine learning methods to the well-known web-phishing detection problem.

The current authentication systems based on password and pin code are not enough to guarantee attacks from malicious users. For this reason, in the last years, several studies are proposed with the aim to identify the users basing on their typing dynamics. In this paper, we propose a deep neural network architecture aimed to discriminate between different users using a set of keystroke features. The idea behind the proposed method is to identify the users silently and continuously during their typing on a monitored system. To perform such user identification effectively, we propose a feature model able to capture the typing style that is specific to each given user. The proposed approach is evaluated on a large dataset derived by integrating two real-world datasets from existing studies. The merged dataset contains a total of 1530 different users each writing a set of different typing samples. Several deep neural networks, with an increasing number of hidden layers and two different sets of features, are tested with the aim to find the best configuration. The final best classifier scores a precision equal to 0.997, a recall equal to 0.99 and an accuracy equal to 99% using an MLP deep neural network with 9 hidden layers. Finally, the performances obtained by using the deep learning approach are also compared with the performance of traditional decision-trees machine learning algorithm, attesting the effectiveness of the deep learning-based classifiers in the domain of keystroke analysis.

Considering the increasing diffusion of mobile devices, attackers started to explore the possibility to perpetrate attacks using mobile surfaces (i.e., smartphones and tablets). Unfortunately, common antimalware techniques are often ineffective to detect new threats with the current signature based approach mainly adopted. In this we paper propose a set of features with the aim to discriminate between malware and trusted mobile applications: in detail we design a cascade learner where the first classifier of the cascade performs a coarse-grain analysis (it discriminates between malware and legitimate apps), while the second one performs a fine-grain analysis (it is aimed to identify the malware family). We obtain a precision equal to 0.947 and a recall equal to 0.962 in legitimate samples identification, while a precision equal to 0.961 and a recall equal to 0.946 is obtained in malware detection. With regard to family identification, an average precision and recall of 0.961 is obtained across 12 malware families.

Nowadays social networks are widespread used not only to enable users to share comments with other users but also as tool from which is possible to extract knowledge. As a matter of fact, social networks are increasingly considered to understand the opinion trend about a politician or related to a certain event that occurred: in general social networks have been proved useful to understand the public opinion from both governments and companies. In addition, also from the end users point of view it is difficult to identify real contents. This is the reason why in last years we are witnessing a growing interest in tools for analyzing big data gathered from social networks in order to find common opinions. In this context, content polluters on social networks make the opinion mining process difficult to browse valuable contents. In this paper we propose a method aimed to discriminate between pollute and real information from a semantic point of view. We exploit a combination of word embedding and deep learning techniques to categorize semantic similarities between (pollute and real) linguistic sentences. We experiment the proposed method on a dataset composed of real-world sentences gathered from the Twitter social network obtaining interesting results in terms of precision and recall.

Data tipically evolve according to specific processes, with the consequent possibility to identify a profile of evolution: the values it may assume, the frequencies at which it changes, the temporal variation in relation to other data, or other constraints that are directly connected to the reference domain. A violation of these conditions could be the signal of different menaces that threat the system, as well as: attempts of a tampering or a cyber attack, a failure in the system operation, a bug in the applications which manage the life cycle of data. To detect such violations is not straightforward as processes could be unknown or hard to extract. In this paper we propose an approach to detect data anomalies. We represent data user behaviours in terms of labelled transition systems and through the model checking techniques we demonstrate the proposed modeling can be exploited to successfully detect data anomalies.

The ineffectiveness of signature-based malware detection systems prevents the detection of malware, even objects of trivial obfuscation techniques, makes mobile devices vulnerable. In this paper a dynamic technique to detect malware on Android platform is proposed. We exploit a set of energy related features i.e., feature which can be symptomatic of abnormal battery consumption. We built different models exploiting four different supervised machine learning classification algorithms, obtaining for all the evaluated models an accuracy greater than 0.91.

In this demo we show the functionalities of the Open Source MANO extended with advanced authorization capabilities able to enhance the security support in terms of preservation of virtual resources and slices integrity in a dynamic context of users, services and resources. The presented extension consists of a Usage Control System integrated with Open Source MANO enhancing traditional authorization operations with ongoing usage control on established slices, virtual resources and user behaviour by continuously reconsidering the granting of resources in light of mutable attribute of users, resources and environment (e.g., presence of viruses, set-up of weak passwords).

Human activity recognition is attracting interest from researchers and developers in recent years due to its immense applications in wide area of human endeavors. The main issue in human behaviour modeling is represented by the diverse nature of human activities and the nature in which they are performed by the individual makes them challenging to recognize. In this paper we propose a method aimed to recognize human activities and detect users using features gathered from accelerometer sensors widespread in wearable and mobile devices. We exploit machine learning aimed to build models with the ability to discriminate between a set of user activities: sitting, sitting down, standing, standing up and walking. Furthermore, we demonstrate that the proposed method is able to distinguish between different users and to identify the user genre. Real-world experiment shows the effectiveness of the proposed solution.

Modern decentralized and distributed environments, as typical from IoT or Industry 4.0 architectures, require a more advanced and granular security management than the currently available standard access control methodologies. Obligations, as defined by the Usage Control model, have been introduced to enhance the traditional access control security mechanisms by imposing the execution of policy-determined actions. This paper presents an extension of the architecture of the Usage Control system already existing in literature, which aims at formalizing the management of Obligations. Three additional components, naturally integrated within the Usage Control system, verify and/or ensure the correct enforcement of obligations also allowing their effect to be evaluated in the continuous access decision making process. The proposed extension thus allows to verify complex conditions when evaluating obligation- specific attributes extracted from the domain where obligations are enforced or observed.

SCADA control systems use programmable logic controller to interface with critical machines. SCADA systems are used in critical infrastructures, for instance, to control smart grid, oil pipelines, water distribution and chemical manufacturing plants: an attacker taking control of a SCADA system could cause various damages, both to the infrastructure but also to people (for instance, adding chemical substances into a water distribution systems). In this paper we propose a method to detect attacks targeting SCADA systems. We exploit model checking, in detail we model logs from SCADA systems into a network of timed automata and, through timed temporal logic, we characterize the behaviour of a SCADA system under attack. Experiments performed on a SCADA water distribution system confirmed the effectiveness of the proposed method.

Purpose This paper aims to propose a structured threat information expression (STIX)-based data representation for privacy-preserving data analysis to report format and semantics of specific data types and to represent sticky policies in the format of embedded human-readable data sharing agreements (DSAs). More specifically, the authors exploit and extend the STIX standard to represent in a structured way analysis-ready pieces of data and the attached privacy policies. Design/methodology/approach The whole scheme is designed to be completely compatible with the STIX 2.0 standard for cyber-threat intelligence (CTI) representation. The proposed scheme will be implemented in this work by defining the complete scheme for representing an email, which is more expressive than the standard one defined for STIX, designed specifically for spam email analysis. Findings Moreover, the paper provides a new scheme for general DSA representation that has been practically applied for the process of encoding specific attributes in different CTI reports. Research limitations/implications Because of the chosen approach, the research results may have limitations. Specifically, current practice for entity recognition has the limitation that was discovered during the research. However, its effect on process time was minimized and the way for improvement was proposed. Originality/value This paper has covered the existing gap including the lack of generality in DSA representation for privacy-preserving analysis of structured CTI. Therefore, the new model for DSA representation was introduced, as well as its practical implementation.

With the increasing diffusion of mobile technologies, nowadays mobile devices represent an irreplaceable tool to perform several operations, from posting a status on a social network to transfer money between bank accounts. As a consequence, mobile devices store a huge amount of private and sensitive information and this is the reason why attackers are developing very sophisticated techniques to extort data and money from our devices. This paper presents the design and the implementation of LEILA (formaL tool for idEntifying mobIle maLicious behAviour), a tool targeted at Android malware families detection. LEILA is based on a novel approach that exploits model checking to analyse and verify the Java Bytecode that is produced when the source code is compiled. After a thorough description of the method used for Android malware families detection, we report the experiments we have conducted using LEILA. The experiments demonstrated that the tool is effective in detecting malicious behaviour and, especially, in localizing the payload within the code: we evaluated real-world malware belonging to several widespread families obtaining an accuracy ranging between 0.97 and 1.

Current signature detection mechanisms can be easily evaded by malware writers by applying obfuscation techniques. Employing morphing code techniques, attackers are able to generate several variants of one malicious sample, making the corresponding signature obsolete. Considering that the signature definition is a laborious process manually performed by security analysts, in this paper we propose a method, exploiting static analysis and Machine Learning classification algorithms, to identify whether a mobile application is modified by means of one or more morphing techniques. We perform experiments on a real-world dataset of Android applications (morphed and original), obtaining encouraging results in the obfuscation technique(s) identification.

Considering the widespread diffusion of machine learning techniques to solve several issues, from network security to malware detection, in this paper we propose the adoption of word embeddings aimed to improve the machine learning-based classifiers. Three real-world experiment we perform in order to demonstrate that the proposed method overcomes in terms of performances the mostly used machine-learning algorithms.

Considering the widespread diffusion of mobile applications in many aspects of our life, one of the most required developer's skill is related to mobile applications development, with particular regard to the Android environment. In this paper, we present a framework aimed to quantify students learning ability in mobile applications development. The proposed framework can be useful also to teachers in order to improve their teaching method.

To maximize the probability of successful attacks and reduce the odds of being detected, malware developers implement different versions of the same malicious payloads. As a matter of fact, malware writers often generate new malicious code starting from existing ones, adding small programmed variations, or applying obfuscation mechanisms, that change the code structure, without altering the malicious functionalities. For these reasons phylogenetic analysis is becoming of interest as instrument for malware analysts in order to understand the derivation of a malicious payload, being thus able to reconduct a derived piece of code to its original, known originator. In this poster we describe a framework designed to infer and shape the phylogenetic tree of mobile malicious applications. The framework considers multi-level features with rule-based machine learning algorithm to retrieve antecedents and descendants of malicious samples.

On line games market is vastly growth in the last years thanks to the diffusion of innovative and performant platforms. Game players can be involved in always more convincing environment where they compete, collaborate and change information with other players. This allows game developers to invest a huge amount of resources to ensure game player safeness and satisfaction. According to this, an increasing interest is pointed towards the study of a new approach for the game bots detection since game bots are used by cheater players to obtain personal advantages with a consequent disappointment and reduction of the game appealing. This paper describes an ensemble Fuzzy Logic approach aiming to discriminate between human players and game bots using a set of features describing their behavior in the game environment. The evaluation is performed on a real on-line role player game and gives effective results.

Nowadays mobile devices are widespread. Considering the plethora of private and sensitive information stored in smartphone and tablets, it is easy to understand the reason why attackers develop everyday more and more aggressive malicious payloads with the aim to exfiltrate our data. One of the last trend in mobile malware landascape is represented by the so-called ransomware, a threat capable to lock the user interface and to cipher the data of the mobile device under attack. In this paper we present a method based on structural entropy and fuzzy logic classification algorithms able to identify whether an application exhibits a ransomware behaviour. We obtain encouraging results evaluating a dataset composed of 10,052 (malware and legitimate) real-world Android applications.

The huge diffusion of malware in mobile platform is plaguing users. New malware proliferates at a very fast pace: as a matter of fact, to evade the signature-based mechanism implemented in current antimalware, the application of trivial obfuscation techniques to existing malware is sufficient. In this paper, we show how the application of several morphing techniques affects the effectiveness of two widespread malware detection approaches based on Machine Learning coupled respectively with static and dynamic analysis. We demonstrate experimentally that dynamic analysis-based detection performs equally well in evaluating obfuscated and non-obfuscated malware. On the other hand, static analysis-based detection is more accurate on non-obfuscated samples but is greatly negatively affected by obfuscation: however, we also show that this effect can be mitigated by using obfuscated samples also in the learning phase.

Malware signature extraction is currently a manual and a time-consuming process. As a matter of fact, security analysts have to manually inspect samples under analysis in order to find the malicious behavior. From research side, current literature is lacking of methods focused on the malicious behavior localization: designed approaches basically mark an entire application as malware or non-malware (i.e., take a binary decision) without knowledge about the malicious behavior localization inside the analysed sample. In this paper, with the twofold aim of assisting the malware analyst in the inspection process and of pushing the research community in malicious behavior localization, we propose VizMal, a tool for visualizing the dynamic trace of an Android application which highlights the portions of the application which look potentially malicious. VizMal performs a detailed analysis of the application activities showing for each second of the execution whether the behavior exhibited is legitimate or malicious. The analyst may hence visualize at a glance when at to which degree an application execution looks malicious.

Despite the development of new technologies, in order to prevent the stealing of cars, the number of car thefts is sharply increasing.With the advent of electronics, new ways to steal cars were found.To avoid auto-theft attacks, in this paper we propose a machine leaning based method to silently e continuously profile the driver by analyzing built-in vehicle sensors.We evaluate the efficiency of the proposed method in driver identification using 10 different drivers.Results are promising, as a matter of fact we obtain a high precision and a recall evaluating a dataset containing data extracted from real vehicle.

In the last years, several safety automotive concepts have been proposed, for instance the cruise control and the automatic brakes systems.The proposed systems are able to take the control of the vehicle when a dangerous situation is detected.Less effort was produced in driver aggressiveness in order to mitigate the dangerous situation.In this paper we propose an approach in order to identify the driver aggressiveness exploring the usage of unsupervised machine learning techniques.A real world case study is performed to evaluate the effectiveness of the proposed method.

The history of data changes can yield information about the nature of the change processes. Often, data evolve according to rules and constraints, making it possible to identify a profile of evolution: the values a data item assumes over time, the frequencies at which it changes, the temporal variation in relation to other data, or other constraints that are directly connected to the reference domain. A violation of these rules could be the signal of different menaces that threat the system, including: attempts of a tampering or a cyber attack, a failure in the operation of the system, a bug in the applications which manage the lifecycle of data. Detecting such violations is not straightforward, as rules could be unknown or hard to extract. In this paper we propose an approach to extract the legal or expected evolution of a database, by observing it in a frame of its lifecycle. The obtained profile of evolution is then used to detect anomalies in the database state evolution. The approach has been validated by an experiment that produced encouraging outcomes about its precision and efficacy.

Phishing is a technique aimed to imitate an official websites of any company such as banks, institutes, etc. The purpose of phishing is to theft private and sensitive credentials of users such as password, username or PIN. Phishing detection is a technique to deal with this kind of malicious activity. In this paper we propose a method able to discriminate between web pages aimed to perform phishing attacks and legitimate ones. We exploit state of the art machine learning algorithms in order to build models using indicators that are able to detect phishing activities.

In the last years, researchers and auto vehicle developers are focusing their attention on the topic of driver identification encouraged by an increasing number of always more sophisticated vehicle sensors able to extract information about the driver. Indeed, driver identification can be very useful to customize and improve driver experience, increase the safety on the road and reduce the global environmental problems. In this work, we propose and explore a set of features (extracted from a car monitoring system) identifying the driver basing on his/her driving behavior. The proposed behavioral features are exploited using a time series classification approach and a multi-layer perceptron (MLP) network is used to evaluate the ability of the proposed features to identify the vehicle driver. The proposed features are tested on a real data set composed of totally 66 observations (each observation consists of a given person driving a given car on a predefined path). The obtained results show that the proposed features have effective driver identification ability.

Mobile users have got used to getting useful information while they are literally on the move. An implication of this habit is that certain live information, such as that for navigation, for dating and for handling emergencies, should be tailored to the user's current location. While this is technically feasible with the current technology, it raises concerns on the user's location privacy. To address the delicate tradeoff between user's location privacy and appropriateness of the information for that location, this paper discusses three information delivery protocols. One is the widely adopted Android's protocol, the other two are the authors' novel ones, termed AL protocol and LBPP protocol respectively. The former conceals the user's location within a geographical area, the latter employs secure two-party computation. Privacy of all protocols is analysed, motivating the choice to implement the LBPP protocol. It is made available as the "Getmewhere" service for the reader to download.

The introduction of new generation ICT systems into vehicles makes them highly connected with the external World. As drawback, vehicle becomes potentially vulnerable to security attacks. Here, we consider a scenario in which Vehicular Networks and a Urban Network work together to realize a defence mechanism based on Reputation Systems. In this way, we are able to identify and isolate possible malicious vehicles acting that could send messages with the aim of reducing the availability of the network. We propose Context Aware Reputation Systems, CARS, able to identify insider attackers and isolate them taking into account contextual conditions derived from sensors spread along the entire urban network. Then, we experimentally evaluate CARS on a real data-set of mobility traces of taxis in Rome to compare the proposed systems with existing ones that do not consider contextual conditions. The preliminary results obtained are promising and show the feasibility and potentiality of CARS.

This paper presents a general framework for constructing any agglomerative hierarchical clustering algorithm over partitioned data. It is assumed that data is distributed between two (or more) parties horizontally, such that for mutual benefits the participated parties are willing to identify the clusters' structure on their data as a whole, but for privacy restrictions, they avoid to share the original datasets. To this end, in this study, we propose general algorithms based on secure scalar product and secure hamming distance computation to securely compute the desired criteria for shaping the clusters' scheme. The proposed approach covers all possible secure agglomerative hierarchical clustering construction when data is distributed between two (or more) parties, including both numerical and categorical data.

The introduction of Information and Communication Technology in modern cities enhances quality, performance, and interactivity of urban services. The ultimate goal is twofold: the reduction of costs and of resource consumption and the increasing number of services offered to citizens. As drawback, smart cities become more vulnerable from the point of view of safety, security, and preservation of citizen privacy. In this paper, we propose a fog-computing based infrastructure to manage the sharing of information among vehicles and smart traffic lights in a urban network, with the aim of improving the safety of end-users of the network. For this purpose, our infrastructure provides to drivers several services to retrieve information in a private and secure way. The services we consider, are mainly four and are oriented to the traffic prediction, incident prevention, managing of emergency, and driver recognition.

Collaborative smart services provide functionalities which exploit data collected from different sources to provide benefits to a community of users. Such data, however, might be privacy sensitive and their disclosure has to be avoided. In this paper, we present a distributed multi-tier framework intended for smart-environment management, based on usage control for policy evaluation and enforcement on devices belonging to different collaborating entities. The proposed framework exploits secure multi-party computation to evaluate policy conditions without disclosing actual value of evaluated attributes, to preserve privacy. As reference example, a smart-grid use case is presented.

The introduction of Information and Communications Technologies (ICT) systems into vehicles make them more prone to cyber-security attacks that may impact of vehicles capability and, consequently, on the safety of drivers, passengers. In this paper, we focus on how to exploit security vulnerabilities affecting user-to-vehicle and intra- vehicle communications to hack the infotainment system to retrieve information about both vehicle and driver. Indeed, we designed and developed CANDY, a set of malicious APP injecting in a genuine Android APP, acting as a Trojan-horse on the Android In-Vehicle infotainment system. It opens a back-door that allows an attacker to remotely access to the infotainment system. We use this back-door to hit the privacy of the driver by recording her voice and collect information circulating on the CAN bus about the vehicle. CANDY is distributed by using social engineering techniques.

Data breaches usually involve financial information such as credit card or bank details. Automated formal verification of safety critical systems has been mostly focused on analysing high-level abstract models which, however, are significantly different from real implementations written in programming languages. In this paper we propose a technique that links model checking verification closer to real implementations, with particular regard to financial environment, in order to identify possible causes of data breaches. A formal model starting from execution traces is retrieved. Thus, the discovered model can be analysed to verify it respects the defined properties. A real safety critical system has been used as a case study to evaluate the proposed methodology.

Abstract In the context of software engineering, product software quality measures how well a software artifact is designed and coded. Software products must satisfy nonfunctional properties (eg, reliability, usability, understandability, and maintainability), in order to make maintenance and evolution sustainable in the long period. Software evolution is an issue of interest for the malware writers, too, for 2 reasons. First, to evade detection with the minimum effort, malware writers use to produce “variants,” which are obtained by applying little changes to existing malware. Morevoer, recent studies demonstrated that malware is increasingly improving evasion strategies and infection mechanisms and is using more and more complex payloads. This suggests that malware writers are devoting relevant efforts and skills for producing high‐quality software. For this reason, we wonder whether malware writers are devoting effort to improve the structural quality of their code, too, as it happens in the development of goodware. To investigate this question, we (1) characterize a dataset containing about 20 000 Android applications, divided into goodware and malware ones, relying on the Android API version they require, and (2) compute software quality metrics, divided into 4 categories (ie, dimensional, complexity, object‐oriented, and Android‐oriented metrics) for apps belonging to each population. We then identify evolution trends of these metrics in malware and goodware. The results of our study demonstrate that goodware and malicious applications exhibit similar evolution trends for some of the quality indicators, suggesting that malware writers care about the overall quality of their code. Code quality could be considered an indirect measure of how many and how fast variants of existing malware will be released in the wild.

Android users are constantly threatened by an increasing number of malicious applications (apps), generically called malware. Malware constitutes a serious threat to user privacy, money, device and file integrity. In this paper we note that, by studying their actions, we can classify malware into a small number of behavioral classes, each of which performs a limited set of misbehaviors that characterize them. These misbehaviors can be defined by monitoring features belonging to different Android levels. In this paper we present MADAM, a novel host-based malware detection system for Android devices which simultaneously analyzes and correlates features at four levels: kernel, application, user and package, to detect and stop malicious behaviors. MADAM has been specifically designed to take into account those behaviors that are characteristics of almost every real malware which can be found in the wild. MADAM detects and effectively blocks more than 96 percent of malicious apps, which come from three large datasets with about 2,800 apps, by exploiting the cooperation of two parallel classifiers and a behavioral signature-based detector. Extensive experiments, which also includes the analysis of a testbed of 9,804 genuine apps, have been conducted to show the low false alarm rate, the negligible performance overhead and limited battery consumption.

The crucial aim of software security is malware detection. A malware is a program with malicious intents. The predominate anti-malware solutions are signature-based. These detectors compute the signature starting from the syntactic characteristics of the malicious code. Unfortunately, the signature-based techniques are ineffective against the code obfuscations, i.e., trivial transformations that alter the syntax of the code preserving the normal behaviour of the program. To address this limitation, formal methods are used in software security. Formal methods are rigorous techniques used to verify the behaviour of a system. This paper aims to make an overview on behavioural based techniques developed to detect malware programs. The illustrated approaches are based on different formal techniques.

Tor is an anonymous Internet communication system based on the second generation of onion routing network protocol. Using Tor is really difficult to trace the users Internet activity: this is the reason why the usage of Tor is intended in order to protect the privacy of users, their freedom and the ability to conduct confidential communications without being monitored. Tor is even more used by cyber-criminals in order to cover their illegal activities: the Tor community has observed, for instance an alarming increase in the number of malware that abuse of the popular anonymizing network to hide their command and control infrastructures. In this paper we present a technique able to identify whether an host is generating Tor-related traffic. We resort to well-known machine learning algorithms in order to evaluate the effectiveness of the proposed feature set in a real world environment. In addition we demonstrate that the proposed method is able to recognize the kind of activity (e.g., email or P2P applications) the user under analysis is doing on the Tor network.

Android operating system is constantly overwhelmed by new sophisticated threats and new zero-day attacks. While aggressive malware, for instance malicious behaviors able to cipher data files or lock the GUI, are not worried to circumvention users by infection (that can try to disinfect the device), there exist malware with the aim to perform malicious actions stealthy, i.e., trying to not manifest their presence to the users. This kind of malware is less recognizable, because users are not aware of their presence. In this paper we propose FormalDroid, a tool able to detect silent malicious beaviours and to localize the malicious payload in Android application. Evaluating real-world malware samples we obtain an accuracy equal to 0.94.

This paper presents BRIDEMAID, a framework which exploits an approach static and dynamic for accurate detection of Android malware. The static analysis is based on n-grams matching, whilst the dynamic analysis is based on multi-level monitoring of device, app and user behavior. The framework has been tested against 2794 malicious apps reporting a detection accuracy of 99,7% and a negligible false positive rate, tested on a set of 10k genuine apps.

Mobile systems have become essential for communication and productivity but are also becoming target of continuous malware attacks. New malware are often obtained as variants of existing malicious code. This work describes an approach for dynamic malware detection based on the combination of Process Mining (PM) and Fuzzy Logic (FL) techniques. The firsts are used to characterize the behavior of an application identifying some recurring execution expressed as a set of declarative constraints between the system calls. Fuzzy logic is used to classify the analyzed malware applications and verify their relations with the existing malware variants. The combination of the two techniques allows to obtain a fingerprint of an application that is used to verify its maliciousness/trustfulness, establish if it belongs from a known malware family and identify the differences between the detected malware behavior and the other variants of the some malware family. The approach is applied on a dataset of 3000 trusted and malicious applications across twelve malware families and has shown a very good discrimination ability that can be exploited for malware detection and family identification.

Modern vehicles have lots of connectivity, this is the reason why protect in-vehicle network from cyber-attacks becomes an important issue. The Controller Area Network is a de facto standard for the in-vehicle network. However, lack of security features of CAN protocol makes vehicles vulnerable to attacks. The message injection attack is a representative attack type which injects fabricated messages to deceive original Electronic Control Units or to cause malfunctions. In this paper we propose a method able to detect four different type of attacks targeting the CAN protocol adopting fuzzy algorithms. We obtain encouraging results with a precision ranging from 0.85 to 1 using the fuzzy NN algorithm in the identification of attacks targeting CAN protocol.

Text mining is the process to automatically infer relevant information from semantically related text documents. This technique, which has applications from business intelligence to homeland security, terrorism and crime fight, might bring noticeable privacy issues when analyzed documents contain privacy sensitive information. In this paper, we propose a framework for privacy-preserving text analysis, which exploits Homomorphic Encryption, to analyze text documents in a privacy preserving manner. The proposed framework is designed to ensure that there is no disclosure of privacy sensitive information contained in the document to any party, including the analysis engine itself. Furthermore, we present two use cases of analysis based on bag-of-words classification, where the proposed framework manages to obtain good classification results without information disclosure. In particular the two different settings that are considered are: tweet analysis for detection of terrorist Twitter accounts, and out-box email analysis for detection of bot infected devices. Accuracy results with different classifiers, performances and a security analysis of our approach are presented and discussed.

This paper presents a framework for constructing a hierarchical categorical clustering algorithm on horizontal and vertical partitioned dataset. It is assumed that data is distributed between two parties, such that for general benefits both are willing to detect the clusters on whole dataset, but for privacy concerns, they refuse to share the original datasets. To this end, we propose algorithms based on secure weighted average protocol and secure number comparison protocol, to securely compute the desired criteria in constructing clusters' scheme.

In last years smartphone and tablet devices have been handling an increasing variety of sensitive resources. As a matter of fact, these devices store a plethora of information related to our every-day life, from the contact list, the received email, and also our position during the day (using not only the GPS chipset that can be disabled but only the Wi-Fi/mobile connection it is possible to discover the device geolocalization). This is the reason why mobile attackers are producing a large number of malicious applications targeting Android (that is the most diffused mobile operating system), often by modifying existing applications, which results in malware being organized in families, where each application belonging to the same family exhibit the same malicious behaviour. These behaviours are typically information gathering related, for instance a very widespread malicious behaviour in mobile is represented by sending personal information (as examples: the contact list, the received and send SMSs, the browser history) to a remote server managed by the attackers. In this paper, we investigate whether deep learning algorithms are able to discriminate between malicious and legitimate Android samples. To this end, we designed a method based on convolutional neural network applied to syscalls occurrences through dynamic analysis. We experimentally evaluated the built deep learning classifiers on a recent dataset composed of 7100 real-world applications, more than 3000 of which are widespread malware belonging to several different families in order to test the effectiveness of the proposed method, obtaining encouraging results.

Partial Model-Checking (PMC) is an efficient tool to reduce the combinatorial explosion of a state-space, arising in the verification of loosely-coupled software systems. At the same time, it is useful to consider quantitative temporal-modalities. This allows for checking whether satisfying such a desired modality is too costly, by comparing the final score consisting of how much the system spends to satisfy the policy, to a given threshold. We stir these two ingredients together in order to provide a Quantitative PMC function (QPMC), based on the algebraic structure of semirings. We design a method to extract part of the weight during QPMC, with the purpose to avoid the evaluation of a modality as soon as the threshold is crossed. Moreover, we extend classical heuristics to be quantitative, and we investigate the complexity of QPMC. Keyword: Partial Model Checking, Semirings, Optimisation, Quantitative Modal Logic Quantitative Process Algebra, Quantitative Evaluation of Systems.

Combination of dynamic and static analysis is very effective in detecting malicious Android apps. However, dynamic analysis is hardly practiced on large scale, due to the necessary active interaction with the malicious app, which is reliable only if performed by a user on a real device. In this paper we present a framework for distributed and collaborative analysis of Android suspicious apps, which leverages real users to test the functionality of apps and detect eventual malicious behaviors by exploiting an on-host app for intrusion detection. The paper introduces the architecture, workflow and protocols to handle the report received by participating users, detecting and filtering the malicious ones. Simulative results to assess the performance of the proposed framework are reported and discussed.

Android represents the most widespread mobile environment. This increasing diffusion is the reason why attackers are attracted to develop malware targeting this platform. Malware writers usually use code obfuscation techniques in order to evade the current antimalware detection and to generate new malware variants. These techniques make code programs harder to understand and they change the signature of the application making ineffective the signature extraction work. We propose a method based on formal methods able to identify whether a mobile application is obfuscated. In this preliminary work we identify one of the most widespread obfuscation technique: the code reordering. We test our method on a real-world dataset composed by Android trusted and ransomware samples, obtaining encouraging results.

This paper presents a novel framework for privacy aware collaborative information sharing for data classification. Data holders participating in this information sharing system, for global benefits are interested to model a classifier on whole dataset, but are ready to share their own table of data if a certain amount of privacy is guaranteed. To address this issue, we propose a privacy mechanism based on privacy-utility feature selection, which by eliminating the most irrelevant set of features in terms of accuracy and privacy, guarantees the privacy requirements of data providers, whilst the data remain practically useful for classification. Due to the fact that the proposed trade-off metric is required to be exploited on whole dataset, a distributed secure sum protocol is utilized to protect information leakage in each site. The proposed approach is evaluated and validated through standard Tumor dataset.

Attributes describing the features of subjects, objects and of the environment are used in access and usage control models to determine the right of a subject to use an object in a given environment. Hence, it is crucial for the effective enforcement of access and usage policies that authorization systems are able to promptly retrieve the values of the required attributes from the Attribute Providers. However, sometimes attribute providers could not respond when queried by Authorization systems, because they could be temporary down or unreachable. This could affect the decision processes, causing some requests to be unduly denied or some ongoing accesses to be unduly interrupted. This paper proposes a strategy that can be adopted by an Authorization system to estimate the value of the attributes it requires when the corresponding attribute providers are not responding. This strategy leverages on the collaboration of the other Authorization systems which exploit the same attribute providers, and which could have cached a value for the required attributes. We validate the presented approach through a set of simulative experiments which consider the presence of malicious authorization systems in the cooperative environment.

The use of remote services offered by cloud providers have been popular in the last lustrum. Services allow users to store remote files, or to analyze data for several purposes, like health-care or message analysis. However, when personal data are sent to the Cloud, users may lose privacy on the data-content, and on the other side cloud providers may use those data for their own businesses. In this paper, we present our solution to analyze users health-data directly into the Cloud while preserving users privacy. Our solution makes use of homomorphic encryption to protect users data during the analysis. In particular, we developed a mobile application that offloads users data into the Cloud, and a homomorphic encryption algorithm that processes those data without leaking any information to the Cloud provider. Performed empirical tests show that our HE algorithm is able to evaluate users data in reasonable time proving the feasibility of this emerging way of private-data evaluation.

Android applications (apps) generate a consistent amount of data traffic. A noticeable share of this generated data traffic is used to convey third party advertisement, or to collect information about the user and its phone, generally with the target of profiling users. Such a traffic is not needed to the correct app execution and can be considered unwanted overhead. In this paper we propose Data-Sluice, a framework for Android devices which dynamically controls the connections opened by apps, enforcing fine grained policies designed to stop advertisement from altering the user experience, avoiding private data leakage and removing or strongly reducing the data traffic overhead. We apply Data-Sluice to a set of popular Android apps to analyze the generated traffic and removing the data overhead. Furthermore, we exploit Data-Sluice to successfully stop the action of a set of malicious apps.

The increasing need for physical security in critical environment has led to a widespread of video surveillance systems. Effective video surveillance systems should be able to detect the presence of unauthorized people in the monitored environments while preserving the privacy of authorized ones. To this aim, our paper proposes the adoption of the usage control model in the video surveillance scenario to enforce security policies that continuously control whether a person holds the right to stay in a give space (e.g., a room) from the moment when this person enters that space. In some scenarios, a person is allowed to stay in the room only under some circumstances, which are described by the usage control policy. When the policy is violated an action is taken, e.g., the video camera placed in the room enables the registration. This paper presents the architecture of the proposed framework, provides an example of usage control policy in a real scenario, and describes the main details of our prototype implementation.

Malicious Android applications are currently the biggest threat in the scope of mobile security. To cope with their exponential growth and with their deceptive and hideous behaviors, static analysis signature based approaches are not enough to timely detect and tackle brand new threats such as polymorphic and composition malware. This work presents BRIDEMAID, a novel framework for analysis of Android apps' behavior, which exploits both a static and dynamic approach to detect malicious apps directly on mobile devices. The static analysis is based on n-grams matching to statically recognize malicious app execution patterns. The dynamic analysis is instead based on multi-level monitoring of device, app and user behavior to detect and prevent at runtime malicious behaviors. The framework has been tested against 2794 malicious apps reporting a detection accuracy of 99,7% and a negligible false positive rate, tested on a set of 10k genuine apps.

The reliability of location-based services (LBS) is strongly dependent on the accuracy of the location of the users. However, existing LBS systems are not able to efficiently validate the position of users in large-scale outdoor environments, leading to possible location spoofing attacks by malicious users. To this end, we present an efficient and scalable Location Validation System (LVS) that secures LBS systems from location spoofing attacks. In particular, the user location is verified with the help of mobile WiFi hotspots (MHSs), who are users activating the WiFi hotspot capability of their smartphones and accept connections from nearby users, thereby validating their position inside the sensing area. The system also comprises a novel verification technique called Chains of Sight, which tackles collusion-based attacks effectively. LVS also includes a reputation-based algorithm that rules out sensing reports of location-spoofing users.

Smart Meters belong to the Advanced Metering Infrastructure (AMI) and allow customers to monitor locally and remotely the current usage of energy. Providers query Smart Meters for billing purpose or to establish the amount of energy needed by houses. However, reading details sent from smart meters to the energy provider can be used to violate customers’ privacy. In this paper, our contribution is two-fold: first, we present an architecture to turn traditional energy meters into Smart Meters, and then we illustrate a privacy-preserving solution, which uses Secure Two-party Computation, to preserve customers’ privacy during energy-readings. In particular, we deployed a Smart Meter built upon an existing energy meter available in Italy. Then, we collected and analysed an energy trace of two months, and we tag customers hourly/daily/monthly habits by observing their consumes. Finally, we provide the feasibility of our solution to protect customers’ privacy.

We tackle the problem of locality-aware message spreading in a network composed of smart mobile devices, without resorting to any backbone communication infrastructure. The motivations for our work are two-fold. First, recent smart mobile devices are capable of capturing and storing location information (at a significant granularity) by using, e.g., GPS service and storage capacity available in the devices. Second, recent studies have shown that mobility is positively correlated with the building of new social relationships, which are relatively more likely to occur for people who have visited common places in the past [2], [4], [3]. These two factors together show the importance of building proximity based communication networks, and the need of messages spreading among a targeted set of users in a network. We assume that the participating users move in a large geographic area, and a location inside the area can be uniquely identified by any user, for example, using GPS coordinates. Each user independently builds her mobility profile, called Moby Zone, considering her own past mobility traces. The Moby Zone of a user is the set of her most visited places.

Argumentation has been proved as a simple yet powerful approach to manage conflicts in reasoning with the purpose to find subsets of “surviving” arguments. Our intent is to exploit such form of resolution to support the administration of security in complex systems, e.g., in case threat countermeasures are in conflict with non-functional requirements. The proposed formalisation is able to find the required security controls and explicitly provide arguments supporting this selection. Therefore, an explanation automatically comes as part of the suggested solution, facilitating human comprehension.

Summary Repackaged applications are based on genuine applications, but they subtlety include some modifications. In particular, trojanized applications are one of the most dangerous threats for smartphones. Malware code may be hidden inside applications to access private data or to leak user credit. In this paper, we propose a contract‐based approach to detect such repackaged applications, where a contract specifies the set of legal actions that can be performed by an application. Current methods to generate contracts lack information from real usage scenarios, thus being inaccurate and too coarse‐grained. This may result either in generating too many false positives or in missing misbehaviors when verifying the compliance between the application and the contract. In the proposed framework, application contracts are generated dynamically by a central server merging execution traces collected and shared continuously by collaborative users executing the application. More precisely, quantitative information extracted from execution traces is used to define a contract describing the expected application behavior, which is deployed to the cooperating users. Then, every user can use the received contract to check whether the related application is either genuine or repackaged. Such a verification is based on an enforcement mechanism that monitors the application execution at run‐time and compares it against the contract through statistical tests. Copyright © 2014 John Wiley & Sons, Ltd.

This paper presents a formal framework for run-time enforcement mechanisms, or monitors, based on probabilistic input/output automata [Task-structured probabilistic I/O automata, Technical Report MIT-CSAIL-TR-2006-060, 2006; Proceedings of the 8th International Workshop on Discrete Event Systems , 2006, pp. 207–214], which allows for the modeling of complex and interactive systems. We associate with each trace of a monitored system (i.e., a monitor interposed between a system and an environment) a probability and a real number that represents the cost that the actions appearing on the trace incur on the monitored system. This allows us to calculate the probabilistic (expected) cost of the monitor and the monitored system, which we use to classify monitors, not only in the typical sense, as sound and transparent [ ACM Transactions on Information and System Security 12 (3) (2009), 1–41], but also at a more fine-grained level, as cost-optimal or cost-efficient. We show how a cost-optimal monitor can be built using information about cost and the probabilistic future behavior of the system and the environment, showing how deeper knowledge of a system can lead to construction of more efficient security mechanisms.

In this paper we show how deductive and abductive reasoning in distributed authorisation can be efficiently ported to Android. Such logical-inference processes prove to be important tools due to the intrinsic autonomic-nature of these mobile devices. Both deduction and abduction are represented by using Constraint Handling Rules (CHR), a high-level declarative constraint programming-language, and implemented in JCHR (CHR embedded into Java). To represent credentials we elaborate on RTW, a weighted Role-based Trust-management family of languages: CHR programs are developed after such languages. In general, having weights associated with credentials leads to a more informative reasoning, for instance, access can be granted only if the total uncertainty is less than 20%.

Social Web Services (SWSs) constitute a novel paradigm of service-oriented computing, where Web services, just like humans, sign up in social networks that guarantee, e.g., better service discovery for users and faster replacement in case of service failures. In past work, composition of SWSs was mainly supported by specialised social networks of competitor services and cooperating ones. In this work, we continue this line of research, by proposing a novel SWSs composition procedure driven by the SWSs reputation. Making use of a well-known formal language and associated tools, we specify the composition steps and we prove that such reputation-driven approach assures better results in terms of the overall quality of service of the compositions, with respect to randomly selecting SWSs.

Cloud Federation is a promising approach to enhance cross-cloud application execution. Nevertheless, such approach emphasizes open challenges in Cloud Computing, such as revoking long-lasting authorization on resources as soon as conditions granting the access right are no longer valid. To tackle this kind of issues, we built a prototype of Cloud Federation that leverages the concept of Usage Control (UCON), by continuously monitoring and reassessing the users right on resources. We exploited an extension of the XACML standard and measured the overhead caused by different security policies and distributions of requests. Results suggest that the UCON model can be effectively applied in Cloud Federations and its performance is sustainable when applied to the relevant actions of the lifecycle of applications.

In this paper, we introduce the notion of mobility-cast in opportunistic networks, according to which a message sent by a node S is delivered to nodes with a mobility pattern similar to that of S - collectively named place-friends. The motivation for delivering a message to place-friends stems from the fact that current social acquaintances are likely to be place-friends. Most importantly, it has been recently found that a large fraction of new social contacts comes from place-friends.

Many mobile social networking applications are based on a “friend proximity detection” step, according to which two mobile users try to jointly estimate whether they have friends in common, or share similar interests, etc. Performing “friend proximity detection” in a privacy-preserving way is fundamental to achieve widespread acceptance of mobile social networking applications. However, the need of privacy preservation is often at odds with application-level performance of the mobile social networking application, since only obfuscated information about the other user's profile is available for optimizing performance. In this paper, we study for the first time the fundamental tradeoff between privacy preservation and application-level performance in mobile social networks. More specifically, we consider a mobile social networking application for opportunistic networks called interest-casting. In the interest-casting model, a user wants to deliver a piece of information to other users sharing similar interests (“friends”), possibly through multi-hop forwarding. In this paper, we propose a privacy-preserving friend proximity detection scheme based on a protocol for solving the Yao's “Millionaire's Problem”, and we introduce three interest-casting protocols achieving different tradeoffs between privacy and accuracy of the information forwarding process. The privacy versus accuracy tradeoff is analyzed both theoretically, and through simulations based on a real-world mobility trace. The results of our study demonstrate for the first time that privacy preservation is at odds with forwarding accuracy, and that the best tradeoff between these two conflicting goals should be identified based on the application-level requirements.

We describe a formal methodology for the automatic synthesis of a secure orchestrator for a set of BPMN processes. The synthesized orchestrator is able to guarantee that all the processes that are started reach their end, and the resulting orchestrator process is secure, that is, it does not allow discloure of certain secret messages. In this work we present an implementation of a forth and back translation from BPMN to crypto-CCS, in such a way to exploit the PaMoChSA tool for synthesizing orchestrators. Furthermore, we study the problem of ranking orchestrators based on quantitative valuations of a process, and on the temporal evolution of such valuations and their security, as a function of the knowledge of the attacker.

We propose PICARD (ProbabIlistic Contract on Android), a framework to generate probabilistic contracts to detect repackaged applications for Android smart phones. A contract describes the sequences of actions that an application is allowed to perform at run-time, i.e. its legal behavior. In PICARD, contracts are generated from the set of traces that represent the usage profile of the application. Both the contract and the application's run-time behavior are represented through clustered probabilistic automata. At run-time, the PICARD monitoring system verifies the compliance of the application trace with the contract. This approach is useful in detecting repackaged applications, whose behavior is strongly similar to the original application but it differs only from small paths in the traces. In this paper, we discuss the framework of PICARD for describing and generating contracts through probabilistic automata and introduce the notion of Action Node, a cluster of related system calls, used to represent high level operations. Then, we present a first set of preliminary experiments on repackaged applications, to evaluate the viability of the proposed approach.

Single Sign-On (SSO) is an authentication procedure that allows users to adopt the same credentials to access multiple services. On the other hand, OAuth 2.0 is a protocol that enables authorized applications to access data that are stored in a resource server. A practical example of the adoption of SSO with OAuth 2.0 is given by all the websites or applications that use the “Log in with Facebook” procedure to authenticate users already registered with Facebook. In this paper, we propose a mechanism that exploits a weakness of OAuth 2.0 and a missing control of the website to show how it is possible to register a user by reducing the number of scopes that the website requires with the “Log in with Facebook” procedure. Finally, we illustrate two examples that exploit the proposed mechanism and provide a solution to address the problem.

The Bring Your Own Device (BYOD) paradigm is becoming extremely popular across all kind of organizations. In fact, employees are continually trying to incorporate their personal devices, e.g. smartphones and tablets, into the office to perform some of their work or simply to access the Internet with a device they trust or they are more familiar with. Unfortunately, several security issues may arise from all these external devices accessing the corporate network. To address these issues, in this paper we propose a framework that enforces on-the-fly instantiated policies inside organizations using trusted BYOD technologies. The proposed framework implements a role-based access control system based upon user identity and her current context. To this end, each user receives a specific policy from a server based upon the current role and context. The effective user identity is confirmed using OAuth 2.0, while the device integrity and policy enforcement is ensured by means of a on-device root-of-trust and an enforcer running on each device.

Usage Control (UCON) enhances traditional access control introducing mutable attributes and continuous policy enforcement. UCON addresses security requirements of dynamic computer environments like Grid and Cloud, but also raises new challenges. This paper considers two problems of usage control. The first problem arises when a value of a mutable attribute required for an access decision is uncertain. The second problem questions when to retrieve fresh values of mutable attributes and to trigger the access reevaluation during the continuous control. We propose quantitative risk-based methods to tackle these problems. The authorisation system grants the access if the security policy is satisfied and the risk level is acceptable. The authorisation system retrieves fresh attribute values following the strategy which minimises the risk of the usage sessions. We integrate the authorisation system based on the U-XACML language with quantitative methods for risk evaluation. We present the architecture, the implementation, and the evaluation of the overhead posed by the risk computation.

The paper concerns lattice triangulations, i.e., triangulations of the integer points in a polygon in R2 whose vertices are also integer points. Lattice triangulations have been studied extensively both as geometric objects in their own right and by virtue of applications in algebraic geometry. Our focus is on random triangulations in which a triangulation σ has weight λ|σ|, where λ is a positive real parameter and |σ| is the total length of the edges in σ. Empirically, this model exhibits a "phase transition" at λ=1 (corresponding to the uniform distribution): for λ<1 distant edges behave essentially independently, while for λ>1 very large regions of aligned edges appear. We substantiate this picture as follows. For λ<1 sufficiently small, we show that correlations between edges decay exponentially with distance (suitably defined), and also that the Glauber dynamics (a local Markov chain based on flipping edges) is rapidly mixing (in time polynomial in the number of edges). This dynamics has been proposed by several authors as an algorithm for generating random triangulations. By contrast, for λ>1 we show that the mixing time is exponential. These are apparently the first rigorous quantitative results on spatial mixing properties and dynamics of random lattice triangulations.

This paper presents a novel access control framework reducing the access control problem to a traditional decision problem, thus allowing a policy designer to reuse tools and techniques from the decision theory. We propose here to express, within a single framework, the notion of utility of an access, decisions beyond the traditional allowing/denying of an access, the uncertainty over the effect of executing a given decision, the uncertainty over the current state of the system, and to optimize this process for a (probabilistic) sequence of requests. We show that an access control mechanism including these different concepts can be specified as a (Partially Observable) Markov Decision Process, and we illustrate this framework with a running example, which includes notions of conflict, critical resource, mitigation and auditing decisions, and we show that for a given sequence of requests, it is possible to calculate an optimal policy different from the naive one. This optimization is still possible even for several probable sequences of requests.

For this demo, we present an implementation of the FairPlay framework for secure two-party function computation on Android smartphones, which we call MobileFairPlay. MobileFairPlay allows high-level programming of several secure two-party protocols, including protocols for the Millionaire problem, set intersection, etc. All these functions are useful in the context of mobile social networks and opportunistic networks, where parties are often requested to exchange sensitive information (list of contacts, interest profiles, etc.) to optimise network operation.

The Session Initiation Protocol (SIP) is a signaling protocol for the creation, modification and termination of multimedia sessions with one or more participants. While SIP operates in highly dynamic environments such as Next Generation Networks, in current deployments its access control support is based on traditional access control models. The main problem these models face is that under certain circumstances they tend to be inadequate in current highly dynamic environments. Usage Control is an access control model that supports the same functionalities as traditional models do, but further introduce novel ones. In a previous work, an architecture supporting continuous authorization on SIP based on the Usage Control model was presented. Here this architecture is further elaborated, described in more detail and experimentally evaluated.

In this paper, we present an implementation of the FairPlay framework for secure two-party function computation on Android smartphones, which we call MobileFairPlay. Mobile-FairPlay allows high-level programming of several secure two-party protocols, including protocols for the Millionaire problem, set intersection, computation of Jaccard similarity coefficient, etc. All these functions are useful in the context of mobile social networks and opportunistic networks, where parties are often requested to exchange sensitive information (list of contacts, interest profiles, etc.) to optimize network operation. To demonstrate the feasibility of MobileFairPlay, we present an application to privacy-preserving interest-casting in opportunistic networks, implementing a recently proposed protocol. We tested running times of the implemented protocol on several Android phones, obtaining very reasonable (up to 5sec) running times. These results clearly promote MobileFairPlay as a feasible security framework for mobile environments.

Broadcast authentication is an important security mechanism for resource constrained devices, like Wireless Sensor Networks (WSNs). In this paper we revise how broadcast authentication has been enforced in this context, and we show that most of the current implementations (generally based on lightweight hash chain implementing time limited validity of the authentication property) leave open the possibility of a dreadful attack. We detail such an attack, and propose three different protocols to cope with it: PASS, TASS, and PTASS. We further analyze the overhead introduced by these protocols in terms of set-up, transmission overhead, and on device verification.

Message forwarding is a fundamental brick to spread information among users in opportunistic networks. In this paper, we consider the recently proposed interest-casting networking primitive for opportunistic networks, according to which a packet generated by a sender should be delivered to all users in the network - potentially unknown to the sender - sharing similar interests. However, the current implementation of interest-casting assume users exchange their interest profiles to take forwarding decisions, thus revealing very sensitive information to strangers. In this work, we approach for the first time the problem of designing an interest-casting protocol while not revealing sensitive information during the forwarding and message delivery process. In particular, we present a privacy-preserving mechanism based on the well-known Millionaires' problem allowing users to discover whether they have similar interests without disclosing private information. Based on this mechanism, we propose four different privacy-preserving forwarding protocols to realise interest-casting in opportunistic networks, and we compare their performance on a real-world mobility trace.

Service Oriented Computing (SOC) is a programming paradigm aiming at characterising Service Networks. Services are entities waiting for requests from clients and they often result from the composition of many (sub-)services. We address here the probl

SUMMARY This paper concerns the study, the development and the synthesis of mechanisms for guaranteeing the security of complex systems, i.e. systems composed of several interacting components. A complex system under analysis is described as an open system, i.e. a system in which an unspecified component (a component whose behaviour is not fixed in advance) interacts with the known part of the system. Within this formal approach, we propose techniques that aim at synthesize controller programs able to guarantee that, for all possible behaviours of the unspecified component, the system should work properly, e.g. it should be able to satisfy a certain property. For performing this task, we first need to identify the set of necessary and sufficient conditions that the unspecified component has to satisfy in order to ensure that the whole system is secure. Hence, by exploiting the satisfiability procedures for temporal logic, we automatically synthesize an appropriate controller program that forces the unspecified component to meet these conditions. This will ensure the security of the whole system. In particular, we contribute within the area of the enforcement of security properties by proposing a flexible and automated framework that goes beyond the definition of how a system should behave to work properly. Indeed, while the majority of the related work focuses on the definition of monitoring mechanisms, we also address the synthesis problem. Moreover, we describe a tool for the synthesis of secure systems which is able to generate appropriate controller programs. This tool is also able to translate the synthesized controller programs into the ConSpec language. ConSpec programs can be actually deployed for enforcing security policies on mobile Java applications by using the run‐time framework developed in the ambit of the European Project S3MS. Copyright © 2010 John Wiley & Sons, Ltd.

In Usage CONtrol (UCON) access decisions rely on mutable attributes. A reference monitor should re-evaluate security policies each time when attributes change their values. Catching timely all attribute changes is a challenging issue, especially if the attribute provider and the reference monitor reside in different security domains. Some attribute changes might be missed, corrupted, and delayed. As a result, the reference monitor may erroneously grant the access to malicious users and forbid it for eligible users. This paper proposes a set of policy enforcement models which help to tolerate uncertainties associated with mutable attributes. In our model the reference monitor as usually evaluates logical predicates over attributes and additionally makes some estimates on how much observed attribute values differ from the real state of the world. The final access decision counts both factors. We assign monetary outcomes for granting and revoking access to legitimate and malicious users and compare the proposed policy enforcement models in terms of cost-efficiency.

We analyze the mixing time of a natural local Markov Chain (Gibbs sampler) for two commonly studied models of random surfaces: (i) discrete monotone surfaces with "almost planar" boundary conditions and(ii) the one-dimensional discrete Solid-on-Solid (SOS)model. In both cases we prove the first almost optimal bounds. Our proof is inspired by the so-called "meancurvature" heuristic: on a large scale, the dynamics should approximate a deterministic motion in which each point of the surface moves according to a drift proportional to the local inverse mean curvature radius. Key technical ingredients are monotonicity, coupling and an argument due to D. Wilson [17] in the framework of lozenge tiling Markov Chains. The novelty of our approach with respect to previous results consists in proving that, with high probability, the dynamics is dominated by a deterministic evolution which follows the mean curvature prescription. Our method works equally well for both models despite the fact that their equilibrium maximal deviations from the average height profile occur on very different scales.

The classical hard core model from statistical physics, with activity [Formula: see text] and capacity [Formula: see text], on a graph [Formula: see text], concerns a probability measure on the set [Formula: see text] of independent sets of [Formula: see text], with the measure of each independent set [Formula: see text] being proportional to [Formula: see text]. Ramanan et al. [K. Ramanan, A. Sengupta, I. Ziedins and P. Mitra, Adv. Appl. Probab., 34 (2002), pp. 1–27] proposed a generalization of the hard core model as an idealized model of multicasting in communication networks. In this generalization, the multistate hard core model, the capacity [Formula: see text] is allowed to be a positive integer, and a configuration in the model is an assignment of states from [Formula: see text] to [Formula: see text] (the set of nodes of [Formula: see text]) subject to the constraint that the states of adjacent nodes may not sum to more than [Formula: see text]. The activity associated to state [Formula: see text] is [Formula: see text], so that the probability of a configuration [Formula: see text] is proportional to [Formula: see text]. In this work, we consider this generalization when [Formula: see text] is an infinite rooted [Formula: see text]-ary tree and prove rigorously some of the conjectures made by Ramanan et al. In particular, we show that the [Formula: see text] model exhibits a (first-order) phase transition at a larger value of [Formula: see text] than the [Formula: see text] model exhibits its (second-order) phase transition. In addition, for large [Formula: see text] we identify a short interval of values for [Formula: see text] above which the model exhibits phase coexistence and below which there is phase uniqueness. For odd [Formula: see text], this transition occurs in the region of [Formula: see text], while for even [Formula: see text], it occurs around [Formula: see text]. In the latter case, the transition is first-order.

Security-by-Contract (S×C) is a paradigm providing security assurances for mobile applications. In this work, we present an extension of S×C enriched with an automatic trust management infrastructure. Indeed, we enhance the already existing architecture by adding new modules and configurations for contracts managing. At deploy-time, our system decides the run-time configuration depending on the credentials of contract provider. Roughly, the run-time environment can both enforce a security policy and monitor the declared contract. According to the actual behaviour of the running program our architecture updates the trust level associated with the contract provider. The main advantage of this method is an automatic management of the level of trust of software and contract releasers.

In Service Oriented Architecture (SOA) data belonging to a client (data provider) is often processed by a provider (data consumer). During this processing the data can be compromised. A client wants to be sure that its data is used in the least risky way while is under provider's control. The risk level should be low when access to the data is granted and should remain low during the whole interaction and, maybe, some time after. Therefore, a client has to consider closely various providers and decide which one provides the service with the smallest risk. More importantly, the risk has to be constantly recomputed after granting the access to the data, i.e., usage of data must be controlled. In this work we propose a method to empower usage control with a risk-based decision making process for more efficient and flexible control of access to data. Employing this idea we show how to select a service provider using risk, re-evaluate the risk level when some changes have happened and how to improve an infrastructure in order to reduce the risk level.

In this paper we describe our general framework for usage control (UCON) enforcement on GRID systems. It allows both GRID services level enforcement of UCON as well as fine-grained one at the level of local GRID node resources. In addition, next to the classical checks for usage control: checks of conditions, authorizations, and obligations, the framework also includes trust and risk management functionalities. Indeed, we show how trust and risk issues naturally arise when considering usage control in GRID systems and services and how our architecture is flexible enough to accommodate both notions in a pretty uniform way. These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

This paper introduces a formal model, an architecture and a prototype implementation for usage control on GRID systems. The usage control model (UCON) is a new access control paradigm proposed by Park and Sandhu that encompasses and extends several existing models (e.g. MAC, DAC, Bell-Lapadula, RBAC, etc.). Its main novelty is based on continuity of the access monitoring and mutability of attributes of subjects and objects. We identified this model as a perfect candidate for managing access/usage control in GRID systems due to their peculiarities, where continuity of control is a central issue. Here we adapt the original UCON model to develop a full model for usage control in GRID systems. We use as policy specification language a process description language and show how this is suitable to model the usage policy models of the original UCON model. We also describe a possible architecture to implement the usage control model. Moreover, we describe a prototype implementation for usage control of GRID computational services, and we show how our language can be used to define a security policy that regulates the usage of network communications to protect the local computational service from the applications that are executed on behalf of remote GRID users.

There is an increasing interest and uptake of technologies that allow cooperation among entities that may act collectively. Advancements in information and communication technologies at the end of the 20th and the beginning of the 21st century have enabled entities of different kinds to form dynamic coalitions. Crowds of users walking on the streets with advanced context aware converged telecommunication devices. A group of robots, manned and unmanned vehicles equipped with processors, sensors, smart-phones, etc. interacting with each other, with their environment, and with a command or a control node, such as the command and control site of a defence coalition or a civil traffic control. A set of organizations (possibly virtual) sharing resources, infrastructure and collectively contributing provision of a service to a user community. Projects and processes that use resources and services offered by a collection of business partners in a value network. Web 2.0 mash-ups and composite Web Services that are composed of services and applications offered by different service providers over a public network or any other shared communications infrastructure. These dynamic coalitions involve several technologies as peer-to-peer systems (P2P), mobile ad hoc networks (MANETs) and service oriented architectures (SOA) and their information system architectures that are often realized using cloud computing, grid computing and web services frameworks. This special issue covers research results and innovation case studies on security and trust management for dynamic coalitions. We selected the following papers among the many that were submitted. identity federation; distributed usage and access management; context-aware secure messaging, routing and transformation; SOA security governance. It analyses common security requirements for IT infrastructures underpinning business collaborations and it proposes an architecture comprising realizations of SOA security design patterns and a security governance framework that address these challenges. A case study illustrates the operation of a partial implementation of the proposed architecture's security capabilities that was built for the practical validation of the proposed architectural concepts. The paper Secure Information Sharing for Grid Computing proposes a novel mechanism for controlling information sharing between members in a virtual organization. Content can be shared between members of a virtual organization subject to the virtual organization's policy and the content owner organization's policy. The virtual organization managers and collaborating organizations administrators, however, can decide which device can access content. The paper proposes mechanisms aimed at preventing uncontrolled content leakage. These include mechanisms for ensuring that a member in a virtual organization, who is authorized to access content, cannot transfer that content, or the means of accessing it, accidentally or deliberately to others. They also include mechanisms for ensuring that resources and users who leave the virtual organization the resource/user cannot access anymore information shared within the virtual organization. The paper A Guide to Trust in Mobile Ad Hoc Networks examines issues of trust and reputation in Mobile Ad Hoc Networks. It analyses a number of the trust and reputation models that have been proposed and highlights open problems in this area. The paper Secure and Robust Threshold Key Management (SRKM) Scheme for Ad Hoc Networks proposes a secure, robust and fully distributed scheme for public-key certificate management in Mobile Ad Hoc Networks. This scheme, based on threshold cryptography, ensures that the private key of the certificate authority will not be revealed to an adversary, even if the number of compromised shareholders exceeds the threshold of vulnerability, thereby thwarting mobile-adversary attacks. The paper Identity Crisis: On the Problem of Namespace Design for ID-PKC and MANETs explores a relationship between identity-based public key cryptography (ID-PKC) and mobile ad hoc networks (MANETs). In particular it examines the problem of naming and namespace design in an identity-based key infrastructure (IKI), and assesses the potential impact that different types of identifiers may have on the utility of ad hoc networks where an IKI provides the underlying key infrastructure. It also highlights a number of open problems inherent in extending namespaces to allow inter-operability amongst heterogeneous trust domains. The paper Reputation Management in Collaborative Computing Systems focuses in the area of trust for collaborative computing systems. The contributions of this paper include a survey on the main reputation-based systems that fulfil the trust requirements for collaborative systems, including reputation systems designed for e-commerce, agent-based environments, peer-to-peer computing and grid-based systems. Beyond the analysis, this paper also proposes a model for reputation management for Grid Virtual Organizations that is based on concepts from the utility computing paradigm that can be used to rate users according to their resource usage and resources and their providers according to the quality of service they deliver. This paper also presents the results of Grid simulations in order to show how the model can be used for improving completion and welfare in Virtual Organizations. The paper Interoperable Semantic Access Control for Highly Dynamic Coalitions presents a platform-driven approach to highly dynamic coalitions (HDC). The paper proposes an access control model that builds on a formalization of the life cycle of HDC formation and takes advantage of semantic interpretations of partners' requirements in order to provide interoperable access control to resources shared in a coalition. Coalition partners can achieve a high level of service interoperation by enhancing their access control requirements with semantics of usage, and interlinking their semantics using class relations based on a standard ontology. The paper Semiring-Based Frameworks for Trust Propagation in Small-World Networks and Coalition Formation Criteria provides an algebraic approach to encoding trust metrics and reasoning about trust between principals that consider forming a coalition. In this approach, trust propagation and aggregation are specified in terms of a semiring and the degree of trust between principals in a trust network is modelled as a (semiring based) soft-constraint satisfaction problem. The flexibility of this approach makes it well suited to modelling trust within coalitions and analysing the impact in trust of changes in membership and structure of the coalition. We would like to express our gratitude to the Editor-in-Chief, Dr Hsiao-Hwa Chen for his advice, patience, and encouragements since the beginning until the final stage. We thank all anonymous reviewers who spent much of their precious time reviewing in depth all the papers over several iterations. Their timely and accurate reviews and comments greatly helped us select the best papers in this special issue. We also thank all authors who have submitted their papers for consideration for this issue.

We analyze the mixing time of a natural local Markov chain (the Glauber dynamics) on configurations of the solid-on-solid model of statistical physics. This model has been proposed, among other things, as an idealization of the behavior of contours in the Ising model at low temperatures. Our main result is an upper bound on the mixing time of O~(n3.5), which is tight within a factor of O~(√n). The proof, which in addition gives insight into the actual evolution of the contours, requires the introduction of several novel analytical techniques that we conjecture will have other applications.

We extend the Datalog language (we call it Datalogw) in order to deal with weights on ground facts and to consequently compute a feedback result for the goal satisfaction. The weights are chosen from a proper c-semiring. As a second step, in order to show the usefulness of the language, we use Datalogwas the basis to give a uniform semantics to declarative RTW (Trust Management) language family, in order to represent trust levels based on c-semirings. In this way it is possible to manage a score corresponding to a preference or cost associated to the revealed credentials, instead of a plain "yes or no" authorization result. Clearly, such a solution is more informative and allows us to treat uncertainty of facts and rules application, or different preferences for the entity roles. Trust can be then derived by choosing the best chain. The approach is rather generic and could be applied to other trust management languages.

In this paper we present a framework based on contexts theory and logic to study how, given a partially specified system, i.e., a system in which there are some unspecified/ unknown components, i.e., potential attackers, it is possible to enforce a global security property by controlling all the unspecified parts of the given system. We propose two methods to control them: A centralized method, in which there is a unique controller program that controls all the unspecified components, and a decentralized one in which each unspecified component is monitored by a controller program that forces it to behave correctly, i.e., according to a local requirement found by a reduction of the global one. In both cases we show how to synthesize controller programs that solve the problem.

We propose a mobile implementation of an e-voting protocol. We also provide a formal analysis to validate a security property of our system.

The spreading of multicast technology enables the development of group communication and so dealing with digital streams becomes more and more common over the Internet. Given the flourishing of security threats, the distribution of streamed data must be equipped with sufficient security guarantees. To this aim, some architectures have been proposed, to supply the distribution of the stream with guarantees of, e.g. , authenticity, integrity, and confidentiality of the digital contents. This paper shows a formal capability of capturing some features of secure multicast protocols. In particular, both the modeling and the analysis of some case studies are shown, starting from basic schemes for signing digital streams, passing through protocols dealing with packet loss and time-synchronization requirements, concluding with a secure distribution of a secret key. A process-algebraic framework will be exploited, equipped with schemata for analysing security properties and compositional principles for evaluating if a property is satisfied over a system with more than two components.

This paper describes and formally analyses two communication protocols that manage the secure emission of digital certificates. The formal analysis is carried out by means of a software tool for the automatic verification of cryptographic protocols with finite behaviour. The tool is able to discover, at a conceptual level, attacks against security procedures. The methodology is general enough to be applied to several kinds of cryptographic procedures and protocols. It is the opinion of the authors that this approach contributes towards a better understanding of the structure and aims of a protocol, for developers, analysers and final users. Copyright © 2005 John Wiley & Sons, Ltd.

When formalizing security protocols, different specification languages support very different reasoning methodologies, whose results are not directly or easily comparable. Therefore, establishing clear mappings among different frameworks is highly de

We give the first comprehensive analysis of the effect of boundary conditions on the mixing time of the Glauber dynamics for the Ising model. Specifically, we show that the mixing time on an n-vertex regular tree with (+) boundary remains O(n log n) at all temperatures (in contrast to the free boundary case, where the mixing time is not bounded by any fixed polynomial at low temperatures). We also show that this bound continues to hold in the presence of an arbitrary external field. Our results are actually stronger, and provide tight bounds on the log-Sobolev constant and the spectral gap of the dynamics. In addition, our methods yield simpler proofs and stronger results for the mixing time in the regime where it is insensitive to the boundary condition. Our techniques also apply to a much wider class of models, including those with hard constraints like the antiferromagnetic Potts model at zero temperature (colorings) and the hard-core model (independent sets).

In previous work, we studied some noninterference properties for information flow analysis in computer systems on classic (possibilistic) labeled transition systems. In this paper, some of these properties, notably bisimulation-based nondeducibility on compositions (BNDC), are reformulated in a real-time setting. This is done by first enhancing the security process algebra proposed by two of the authors with some extra constructs to model real-time systems (in a discrete time setting), and then by studying the natural extension of these properties in this enriched setting. We prove essentially the same results known for the untimed case: ordering relation among properties, compositionality aspects, partial model checking techniques. Finally, we illustrate the approach through two case studies, where in both cases the untimed specification is secure, while the timed specification may show up interesting timing covert channels.

We propose a methodology for the formal analysis of security protocols. This originates from the observation that the verification of security protocols can be conveniently treated as the verification of open systems, i.e. systems which may have unspecified components. These might be used to represent a hostile environment wherein the protocol runs and whose behavior cannot be predicted a priori. We define a language for the description of security protocols, namely Crypto-CCS, and a logical language for expressing their properties. We provide an effective verification method for security protocols which is based on a suitable extension of partial model checking. Indeed, we obtain a decidability result for the secrecy analysis of protocols with a finite number of sessions, bounded message size and new nonce generation.

Some of the non-interference properties studied in (Focardi, 1998; Focardi and Gorrieri, 1995) for information flow analysis in computer systems, notably BNDC, are reformulated in a real-time setting. This is done by enhancing the Security Process Algebra of (Focardi and Gorrieri, 1997; Focardi and Martinelli, 1999) with some extra constructs to model real-time systems (in a discrete time setting); and then by studying the natural extensions of those properties in this enriched setting. We prove essentially the same results known for the untimed case: ordering relation among properties, compositionality aspects, partial model checking techniques. Finally, we illustrate a case study of a system that presents no information flows when analyzed without considering timing constraints. When the specification is refined with time, some interesting information flows are detected.

The author presents a methodology based on known techniques in concurrency and process logics theory for ensuring information flow security properties, similar to the ones proposed by Focardi and Gorrieri (1995, 1997). Recently, they have shown that concepts from information flow theory can be used in the analysis of authentication protocols. This kind of problem may be tackled by his methodology. This has been implemented over mudiv, a tool for partial model checking.