1,721,026 research outputs found
On the Robustness of Rating Aggregators Against Injection Attacks
No full textFor a decade now, Academia has been researching refined techniques to detect fake reviews. In this article, rather than proposing a new detection methodology, we propose to contain the consequences of an attack launched by a fake reviewer who attaches arbitrary scores to the review target. We demonstrate that, by simply changing the score aggregator, the review site can withstands smart and targeted attacks, even carried out for an extended period of time. While experimentation is carried on on real data from a popular e-advice website, our approach is general enough to be applied in any other information service where voting and ratings need to be aggregated
TRAP: using TaRgeted Ads to unveil Google personal Profiles
Full text linkIn the last decade, the advertisement market spread significantly in the web and mobile app system. Its effectiveness is also due thanks to the possibility to target the advertisement on the specific interests of the actual user, other than on the content of the website hosting the advertisement. In this scenario, became of great value services that collect and hence can provide information about the browsing user, like Facebook and Google. In this paper, we show how to maliciously exploit the Google Targeted Advertising system to infer personal information in Google user profiles. In particular, the attack we consider is external from Google and relies on combining data from Google AdWords with other data collected from a website of the Google Display Network. We validate the effectiveness of our proposed attack, also discussing possible application scenarios. The result of our research shows a significant practical privacy issue behind such type of targeted advertising service, and call for further investigation and the design of more privacy-aware solutions, possibly without impeding ?the current business model involved in online advertisement.
RoK: a Robust Key Pre-distribution Protocol for Multi-Phase Wireless Sensor Networks
No full textWireless sensor networks are usually deployed to operate for a long period of time. Because nodes are batteryoperated, they eventually run out of power and new nodes need to be periodically deployed to assure network connectivity. This type of networks is referred to as Multi-phase WSN in the literature[1]. Current key pre-distribution schemes, such as[2] and[3], are not adapted to multi-stage WSN. With these schemes, the security of the WSN degrades with time, since the proportion of corrupted links gradually increases. In this paper, we propose a new pre-distribution scheme adapted to multi-phase WSN. In the proposed scheme, the pre-distributed keys have limited lifetimes and are refreshed periodically. As a result, a network that is temporarily attacked (i.e. the attacker is active only during a limited amount of time) automatically self-heals, i.e. recovers its initial state when the attack stops. In contrast, with existing schemes, an attacker that corrupts a certain amount of nodes compromises a given fraction of the total number of secure channels. This ratio remains constant until the end of the network, even if the attacker stops its action. Furthermore, with our scheme, a network that is constantly attacked (i.e. the attacker regularly corrupts nodes of the network, without stopping) is much less impacted than a network that uses existing key pre-distribution protocols. With these schemes, the number of compromised links constantly increases until all the links are compromised. With our proposal, the proportion of compromised links is limited and constant
Mind the tracker you wear:a security analysis of wearable health trackers
No full textWearable tracking devices have gained widespread usage and popularity because of the valuable services they offer, monitoring human's health parameters and, in general, assisting persons to take a better care of themselves. Nevertheless, the security risks associated with such devices can represent a concern among consumers, because of the sensitive information these devices deal with, like sleeping patterns, eating habits, heart rate and so on. In this paper, we analyse the key security and privacy features of two entry level health trackers from leading vendors (Jawbone and Fitbit), exploring possible attack vectors and vulnerabilities at several system levels. The results of the analysis show how these devices are vulnerable to several attacks (perpetrated with consumer-level devices equipped with just bluetooth and Wi-Fi) that can compromise users' data privacy and security, and eventually call the tracker vendors to raise the stakes against such attacks
Analysis and evaluation of SafeDroid v2.0, a framework for detecting malicious Android applications
Full text linkAndroid smartphones have become a vital component of the daily routine of millions of people, running a plethora of applications available in the official and alternative marketplaces. Although there are many security mechanisms to scan and filter malicious applications, malware is still able to reach the devices of many end-users. In this paper, we introduce the SafeDroid v2.0 framework, that is a flexible, robust, and versatile open-source solution for statically analysing Android applications, based on machine learning techniques. The main goal of our work, besides the automated production of fully sufficient prediction and classification models in terms of maximum accuracy scores and minimum negative errors, is to offer an out-of-the-box framework that can be employed by the Android security researchers to efficiently experiment to find effective solutions: the SafeDroid v2.0 framework makes it possible to test many different combinations of machine learning classifiers, with a high degree of freedom and flexibility in the choice of features to consider, such as dataset balance and dataset selection. The framework also provides a server, for generating experiment reports, and an Android application, for the verification of the produced models in real-life scenarios. An extensive campaign of experiments is also presented to show how it is possible to efficiently find competitive solutions: the results of our experiments confirm that SafeDroid v2.0 can reach very good performances, even with highly unbalanced dataset inputs and always with a very limited overhead
A Formal Framework for the performance analysis of P2P networks protocols
No full textIn this paper we propose a formal framework based on the Markov Chains to prove the performance of P2P protocols. Despite the proposal of several protocols for P2P networks, sometimes there is a lack of a formal demonstration of their performance: experimental simulations are the most used method to evaluate their performance, such as the average length of a lookup. In this paper we introduce a versatile model for the analysis of P2P protocols. We employ this model to formally prove which is the average lookup length for two sample protocols: BaRT and Koorde. We verify the effectiveness of the proposed framework also via extensive simulations. © 2006 IEEE
Adversarial machine learning for protecting against online manipulation
No full textAdversarial examples are inputs to a machine learning system that result in an incorrect output from that system. Attacks launched through this type of input can cause severe consequences: for example, in the field of image recognition, a stop signal can be misclassified as a speed limit indication. However, adversarial examples also represent the fuel for a flurry of research directions in different domains and applications. Here, we give an overview of how they can be profitably exploited as powerful tools to build stronger learning models, capable of better-withstanding attacks, for two crucial tasks: fake news and social bot detection
Replication schemes in Unattended Wireless Sensor Networks
No full textUnattended Wireless Sensor Networks (UWSNs) are networks that operate without on-line data collection entities (Sink Collectors). This configuration enriches their flexibility but, at the same time, introduces new security issues. A challenging issue is data survival: in absence of the sink, in fact, data sensed by network sensors cannot be kept clear from the adversary. Cryptographic schemes, moreover, cannot be easily implemented: cryptographic material as well as sensed data are continuously exposed to the activity of a smart adversary [6]. Several strategies were proposed in literature which collectively attempt to mitigate this challenge. In this paper we investigate the use of replication as a mean to enhance the survival probability of collected data. We propose a scheme that deterministically grants data survival against a focused mobile adversary. We analyze the behavior of our proposal and study its security and efficiency properties to prove its suitability for UWSNs
SafeDroid: A Distributed Malware Detection Service for Android
Full text linkAndroid platform has become a primary target for malware. In this paper we present SafeDroid, an open source distributed service to detect malicious apps on Android by combining static analysis and machine learning techniques. It is composed by three micro-services, working together, combining static analysis and machine learning techniques. SafeDroid has been designed as a user friendly service, providing detailed feedback in case of malware detection. The detection service is optimized to be lightweight and easily updated. The feature set on which the micro-service of detection relies on on has been selected and optimized in order to focus only on the most distinguishing characteristics of the Android apps. We present a prototype to show the effectiveness of the detection mechanism service and the feasibility of the approach
- …
