Mohammad Mehdi Yadollahi, Arash Habibi Lashkari, A. Ghorbani
{"title":"Towards Query-efficient Black-box Adversarial Attack on Text Classification Models","authors":"Mohammad Mehdi Yadollahi, Arash Habibi Lashkari, A. Ghorbani","doi":"10.1109/PST52912.2021.9647846","DOIUrl":"https://doi.org/10.1109/PST52912.2021.9647846","url":null,"abstract":"Recent work has demonstrated that modern text classifiers trained on Deep Neural Networks are vulnerable to adversarial attacks. There is not sufficient study on text data in comparison to the image domain. The lack of investigation originates from the challenges that authors confront in the NLP domain. Despite being extremely prosperous, most adversarial attacks in the text domain ignore the overhead they induced on the victim model. In this paper, we propose a Query-efficient Black-box Adversarial Attack on text data that tries to attack a textual deep neural network by considering the amount of overhead that it may produce. We show that the proposed attack is as powerful as the state-of-the-art adversarial attacks while requiring fewer queries to the victim model. The evaluation of our method proves the promising results.","PeriodicalId":144610,"journal":{"name":"2021 18th International Conference on Privacy, Security and Trust (PST)","volume":"54 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127128094","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Amir Namavar Jahromi, H. Karimipour, A. Dehghantanha
{"title":"Deep Federated Learning-Based Cyber-Attack Detection in Industrial Control Systems","authors":"Amir Namavar Jahromi, H. Karimipour, A. Dehghantanha","doi":"10.1109/PST52912.2021.9647838","DOIUrl":"https://doi.org/10.1109/PST52912.2021.9647838","url":null,"abstract":"Due to the differences between Information Technology (IT) and Industrial Control System (ICS) networks, current IT security solutions are not working effectively on ICS networks. Moreover, due to security and privacy issues, ICS owners usually do not share their network data with third parties to train specific machine learning-based ICS security solutions. To rectify the mentioned issues, a scalable deep federated learning-based method is presented in this paper. In the proposed method, each client trains an unsupervised deep neural network model using local data and shares its parameters with a server. The server aggregates the clients’ parameters, makes a generalized public model, and shares it with all clients. The proposed model is evaluated using a real-world ICS dataset in a water treatment system and compared with two non-federated learning-based methods. Findings show that the proposed method outperformed the other two methods with the same computational complexity as other deep neural network-based methods in the literature.","PeriodicalId":144610,"journal":{"name":"2021 18th International Conference on Privacy, Security and Trust (PST)","volume":"37 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129480081","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Fuyuan Song, Zheng Qin, Jinwen Liang, Pulei Xiong, Xiaodong Lin
{"title":"Traceable and Privacy-Preserving Non-Interactive Data Sharing in Mobile Crowdsensing","authors":"Fuyuan Song, Zheng Qin, Jinwen Liang, Pulei Xiong, Xiaodong Lin","doi":"10.1109/PST52912.2021.9647802","DOIUrl":"https://doi.org/10.1109/PST52912.2021.9647802","url":null,"abstract":"Data sharing is one of the key technologies, which provides the practice of making data collected from a crowd of mobile devices available to others using a cloud infrastructure, known as mobile crowdsensing (MCS). However, the collected data may contain sensitive information, and sharing them in public clouds without proper protection could cause serious security problems, such as privacy leakage, unauthorized access, and secret key abuse. To address the above issues, in this paper, we propose a Traceable and privacy-preserving non-Interactive Data Sharing (TIDS) scheme in mobile crowdsensing. Specifically, to achieve privacy-preserving fine-grained data sharing, an attribute-based access policy is generated by a data owner without interacting with data users in the TIDS. Furthermore, we design a ciphertext conversion mechanism to support flexible data sharing. Also, by utilizing traceable Ciphertext-Policy Attribute-Based Encryption (CP-ABE), TIDS supports a trusted authority to trace malicious users who abuse their secret keys without incurring additional computational overhead. Security analysis demonstrates that TIDS can protect the confidentiality of the outsourced data. Experimental results show that TIDS can achieve efficient data sharing in mobile crowdsensing applications.","PeriodicalId":144610,"journal":{"name":"2021 18th International Conference on Privacy, Security and Trust (PST)","volume":"26 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122262181","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Kathrin Garb, J. Obermaier, Elischa Ferres, Martin Künig
{"title":"FORTRESS: FORtified Tamper-Resistant Envelope with Embedded Security Sensor","authors":"Kathrin Garb, J. Obermaier, Elischa Ferres, Martin Künig","doi":"10.1109/PST52912.2021.9647783","DOIUrl":"https://doi.org/10.1109/PST52912.2021.9647783","url":null,"abstract":"Protecting security modules from attacks on the hardware level presents a very challenging endeavor since the attacker can manipulate the device directly through physical access. To address this issue, different physical security enclosures have been developed with the goal to cover entire hardware modules and, hence, protect them from external manipulation.Novel concepts are battery-less and based on Physical Unclonable Functions (PUFs), aiming at overcoming the most severe drawbacks of past devices; the need for active monitoring and, thus, limited battery life-time. Although some progress has already been made for certain aspects of PUF-based enclosures, the combination and integration of all required components and the creation of a corresponding architecture for Hardware Security Modules (HSMs) is still an open issue. In this paper, we present FORTRESS, a PUF-based HSM that integrates the tamper-sensitive capacitive PUF-based envelope and its embedded security sensor IC into a secure architecture. Our concept proposes a secure life cycle concept including shipment aspects, a full key generation scheme with re-enrollment capabilities, and ourthe next generation Embedded Key Management System. With FORTRESS, we take the next step towards the productive operation of PUF-based HSMs.","PeriodicalId":144610,"journal":{"name":"2021 18th International Conference on Privacy, Security and Trust (PST)","volume":"66 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133223410","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Gaining Location Privacy from Service Flexibility: A Bayesian Game Theoretic Approach","authors":"Shu Hong, Lingjie Duan, Jianwei Huang","doi":"10.1109/PST52912.2021.9647853","DOIUrl":"https://doi.org/10.1109/PST52912.2021.9647853","url":null,"abstract":"When using location-based services (LBSs), a user obtains points-of-interest $(text{P}text{o}text{I})$ information by providing the LBS platform with his current geo-location. Such a search also leads to potential privacy leakage if an adversary has access to his geo-data. Traditional k-anonymity mechanisms instruct a user to bear the overhead to report his current location together with k-1 dummy locations to confuse the adversary, which only work well given a large number k. Aware of the common practices that a user is actually flexible in service requirement (e.g., as long as the searched PoIs are within his walking distance), we propose a novel approach to help the user gain location privacy from service flexibility for the case of a small number k. By analyzing the strategic interaction between the user and the adversary in a Bayesian game, we prove that the user with service flexibility should never report his real location for searching PoIs nearby. Instead, he should jointly use all k dummy locations to confuse the adversary’s inference of his real location. Take $k=2$ for example, we manage to show that if the adversary is not likely to access both dummy geo-data, the user should report the two dummy locations at two opposite directions of his real location, and otherwise at the same direction. Perhaps surprisingly, our approach may enable the user to benefit from the adversary’s access to more geo-data. Finally, extensive simulations using some real data show that our mechanism obviously outperforms k anonymity mechanism especially under a small number k.","PeriodicalId":144610,"journal":{"name":"2021 18th International Conference on Privacy, Security and Trust (PST)","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115607119","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Detection of Demand Manipulation Attacks on a Power Grid","authors":"Srinidhi Madabhushi, Rinku Dewri","doi":"10.1109/PST52912.2021.9647758","DOIUrl":"https://doi.org/10.1109/PST52912.2021.9647758","url":null,"abstract":"An increased usage in IoT devices across the globe has posed a threat to the power grid. When an attacker has access to multiple IoT devices within the same geographical location, they can possibly disrupt the power grid by regulating a botnet of high-wattage IoT devices. Anomaly detection comes handy to inform the power operator of an anomalous behavior during such an attack. However, it is difficult to detect anomalies when attacks take place obscurely and for prolonged time periods. To effectively detect such attacks, we propose a novel dynamic thresholding mechanism that is used with prediction-based anomaly score techniques. We compare our detection rates to predefined thresholding mechanisms and commercial detection methods and observe that our method improves the detection rate up to 97% across different attacks that we generate.","PeriodicalId":144610,"journal":{"name":"2021 18th International Conference on Privacy, Security and Trust (PST)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129983823","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
T. Ashrafi, Abdul Serwadda, Isaac Griswold-Steiner, Richard Matovu
{"title":"A Wearables-Driven Attack on Examination Proctoring","authors":"T. Ashrafi, Abdul Serwadda, Isaac Griswold-Steiner, Richard Matovu","doi":"10.1109/PST52912.2021.9647760","DOIUrl":"https://doi.org/10.1109/PST52912.2021.9647760","url":null,"abstract":"Multiple choice questions are at the heart of many standardized tests and examinations at academic institutions allover the world. In this paper, we argue that recent advancements in sensing and human-computer interaction expose these types of questions to highly effective attacks that today’s proctor’s are simply not equipped to detect. We design one such attack based on a protocol of carefully orchestrated wrist movements combined with haptic and visual feedback mechanisms designed for stealthiness. The attack is done through collaboration between a knowledgeable student (i.e., a mercenary) and a weak student (i.e., the beneficiary) who depends on the mercenary for solutions. Through a combination of experiments and theoretical modeling, we show the attack to be highly effective. The paper makes the case for an outright ban on all tech gadgets inside examination rooms, irrespective of whether their usage appears benign to the plain eye.","PeriodicalId":144610,"journal":{"name":"2021 18th International Conference on Privacy, Security and Trust (PST)","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128762399","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A Practical Oblivious Cloud Storage System based on TEE and Client Gateway","authors":"Wensheng Zhang","doi":"10.1109/PST52912.2021.9647827","DOIUrl":"https://doi.org/10.1109/PST52912.2021.9647827","url":null,"abstract":"In this paper, we propose a new oblivious cloud storage system, which is more efficient and scalable than existing schemes due to the combined leverage of SGX-based trusted execution environment (TEE) at the cloud server side and the moderate storage space at the client side. The TEE is employed to securely implement functionalities of ORAM model in the server without tightly involving the clients. Meanwhile, the storage at the client side is utilized to store metadata and recently/frequently accessed data, which facilitates the client to remotely determine the strategies for data query/eviction and to reduce the frequency of directly accessing data from the server. The evaluation results show that, when the size of outsourced data is 1-20 GB and the block size is 1-8KB, the data access throughput between 320 KB/s and 640 KB/s can be attained, and the average query latency for each block is only 2.26–12.80 ms.","PeriodicalId":144610,"journal":{"name":"2021 18th International Conference on Privacy, Security and Trust (PST)","volume":"12 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125275949","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"LibBlock - Towards Decentralized Library System based on Blockchain and IPFS","authors":"Wei-Yang Chiu, W. Meng, Wenjuan Li","doi":"10.1109/PST52912.2021.9647821","DOIUrl":"https://doi.org/10.1109/PST52912.2021.9647821","url":null,"abstract":"In modern times, the definition and the library’s expected functionality did not change much as before. It is still a place for us to hold massive collections of information. Traditionally, libraries require physical storage space for writings and publications, but storing and managing costs can be tremendous. Although the aid of digital promises and computers allows a super high density of information storage, it does not lower the library’s complexity. As our main source of information is moving away from physical writings toward digital, the new digital library (i.e., state-run library) faces the challenges of records’ integrity and storage efficiency. Focused on this issue, we learn the demands from the Royal Library in Denmark and try to explore the use of blockchain technology. We introduce a system named LibBlock, by integrating with both smart contract and IPFS in order to provide a robust, decentralized, flexible, and adaptive e-Library, which enables the ease of scalability and rigid record keeping. In the evaluation, we investigate the initial performance of LibBlock with Ethereum and show its viability and efficiency.","PeriodicalId":144610,"journal":{"name":"2021 18th International Conference on Privacy, Security and Trust (PST)","volume":"147 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115540590","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Data Privacy in Multi-Cloud: An Enhanced Data Fragmentation Framework","authors":"Randolph Loh, V. Thing","doi":"10.1109/PST52912.2021.9647746","DOIUrl":"https://doi.org/10.1109/PST52912.2021.9647746","url":null,"abstract":"Data splitting preserves privacy by partitioning data into various fragments to be stored remotely and shared. It supports most data operations because data can be stored in clear as opposed to methods that rely on cryptography. However, majority of existing data splitting techniques do not consider data already in the multi-cloud. This leads to unnecessary use of resources to re-split data into fragments. This work proposes a data splitting framework that leverages on existing data in the multi-cloud. It improves data splitting mechanisms by reducing the number of splitting operations and resulting fragments. Therefore, decreasing the number of storage locations a data owner manages. Broadcasts queries locate third-party data fragments to avoid costly operations when splitting data. This work examines considerations for the use of third-party fragments and application to existing data splitting techniques. The proposed framework was also applied to an existing data splitting mechanism to complement its capabilities.","PeriodicalId":144610,"journal":{"name":"2021 18th International Conference on Privacy, Security and Trust (PST)","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115697787","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}