Wildcard Keyword Searchable Encryption (WKSE) has grown into a ubiquitous tool. It enables clients to search desired files with wildcard expressions. Although promising, previous schemes confront three barriers: (1) An adversary can launch a correlation attack to acquire the similarity between keywords. (2) The WKSE schemes exhibit false positives which can lead to wrong search results. (3) Existing feature extraction strategies limit the flexibility of search expressions. In this paper, we propose a Multi-Character Searchable Encryption scheme (MCSE) that overcomes the aforementioned barriers. To resist correlation attacks, we design the randomize pad model to encrypt the vector. To eradicate false positives, we apply the vector space model and complete feature extraction strategies so that a feature set uniquely identifies a keyword or expression. To enhance search flexibility, we introduce three distinct feature extraction strategies for keyword expressions, wildcard expressions, and logical expressions, enabling effective multi-character search. These strategies enable indexes to accom modate the search of diverse expressions. Finally, we prove that MCSE is indistinguishable against chosen-feature attacks and implement MCSE on two real datasets. Compared with state-of the-art schemes, the experiment results show that MCSE achieves good performance.

This paper presents Hydra, a dynamic BFT protocol that allows replicas to join and leave the system dynamically. It addresses the limitations of traditional static BFTs in managing membership changes and can be used to simplify the implementation of many features in modern blockchain applications. Hydra relies on weaker assumptions to achieve standard properties compared to the existing solution Dyno and introduces a configuration auto-transition protocol to ensure liveness. Through temporary configurations and explicitly defined replica responsibilities for request handling, Hydra pipelines membership requests alongside regular requests and realizes clarity, achieving a more efficient and smoother configuration transitions. It also employs a non-blocking configuration discovery mechanism, enabling new replicas to participate in consensus quickly. We formally prove Hydra's correctness under the dynamic BFT model. Experimental results demonstrate Hydra's ability to maintain throughput fluctuations within 5% during various replica join and leave scenarios, outperforming Dyno and existing BFT system supporting reconfiguration in both stability and efficiency. Hydra effectively manages scenarios that Dyno circumvents with stronger assumptions and quickly restores throughput to normal levels.

Multivariate Time Series (MTS) anomaly detection is critical for various applications. Yet, most existing methods rely on forecasting or reconstruction-based frameworks, which suffer from inherent uncertainties in handling complex MTS data. The recently emerging imputation-based anomaly detection leverages partial observations to reconstruct the masked values, thereby enhancing reconstruction stability and detection performance. However, in existing imputation-based methods, training on the masked data may lead to the omission on the global spatiotemporal distributional features of the MTS. Additionally, multiple masking strategies must be employed to ensure all data points have the opportunity to be reconstructed, resulting in repeated training and significant computational consumption. To address these limitations, this paper proposes ImConDM, a novel anomaly detection framework integrating imputation with conditional diffusion models. It trains a diffusion model on the complete training data and leverages the controllable sampling capabilities of diffusion models to perform conditional imputation guided by observed values, enabling stable and comprehensive MTS feature learning without retraining. Extensive experiments on six real-world MTS datasets demonstrate that ImConDM significantly outperforms eleven state-of-the-art baselines. Notably, compared with the second-best model, it achieves a 20.5% improvement in detection accuracy on high-dimensional datasets and reduces training time by at least 58%. The executable codes of the experiments with datasets and our algorithms are available at https://github.com/Labman-Wangjunjie/ImConDM.

Android operating system restricts access to data by enabling data control flow and permission systems to reduce the risk of information theft. Therefore, attackers are constantly looking for alternative and stealthy approaches to exfiltrate private data from a targeted device. This paper presents CovertPower, a covert channel attack that exfiltrates user data by actively inducing power consumption on Android devices. At the transmitting end, our CovertPower app modulates binary data into a timed resource workload (e.g., processor, write-on-memory), producing power consumption bursts. On the receiving end, we acquire power consumption traces via a low-cost hardware tool that can be easily concealed in USB wall-socket adapters or powerbanks. Therefore, a signal processing-based decoder analyzes such traces and retrieves the exfiltrated information. We demonstrate the feasibility of our attack with a thorough experimental evaluation on 14 mobile devices and various real-world settings such as display state, ongoing activities, and charging technologies. Our attack achieves a transfer speed of up to 10bps with a high bit sequence similarity on most devices and settings considered.

Federated Learning is an approach that enables multiple devices to collectively train a shared model without sharing raw data, thereby preserving data privacy. However, federated learning systems are vulnerable to data-poisoning attacks during the training and updating stages. Three data-poisoning attacks-label flipping, feature poisoning, and VagueGAN-are tested on FL models across one out of ten clients using the CIC and UNSW datasets. For label flipping, we randomly modify labels of benign data; for feature poisoning, we alter highly influential features identified by the Random Forest technique; and for VagueGAN, we generate adversarial examples using Generative Adversarial Networks. Adversarial samples constitute a small portion of each dataset. In this study, we vary the percentages by which adversaries can modify datasets to observe their impact on the Client and Server sides. Experimental findings indicate that label flipping and VagueGAN attacks do not significantly affect server accuracy, as they are easily detectable by the Server. In contrast, feature poisoning attacks subtly undermine model performance while maintaining high accuracy and attack success rates, highlighting their subtlety and effectiveness. Therefore, feature poisoning attacks manipulate the server without causing a significant decrease in model accuracy, underscoring the vulnerability of federated learning systems to such sophisticated attacks. To mitigate these vulnerabilities, we explore a recent defensive approach known as Random Deep Feature Selection, which randomizes server features with varying sizes (e.g., 50 and 400) during training. This strategy has proven highly effective in minimizing the impact of such attacks, particularly on feature poisoning.

Membership Inference Attacks (MIAs) infer whether a data point is in the training data of a machine learning model, posing privacy risks to sensitive data like medical records or financial data. Intuitively, data points that MIA accurately detects are vulnerable. Those data points may exist in the data of different target models, each susceptible to multiple MIAs. As such, the vulnerability of data points under multiple MIAs and target models represents a significant challenge. This article defines several metrics reflecting data points’ vulnerability and capturing vulnerable data points under multiple MIAs and target models. We implement 77 MIAs, with an average attack accuracy over target models ranging from 0.5 to 0.9, to support our analysis with our scalable and flexible platform, Various Membership Inference Attacks Platform (VMIAP). Based on the results, we observe that MIA has an inference tendency to some data points despite a low overall inference performance. Furthermore, previous approaches are unsuitable for finding vulnerable data points under multiple MIAs and target models. Finally, we explore the impact of retraining target, shadow, and attack models separately on the vulnerability of data points.

Over the past three decades, standardizing organizations (e.g., the National Institute of Standards and Technology and Internet Engineering Task Force) have investigated the efficiency of cryptographic algorithms and provided (technical) guidelines for practitioners. For example, the (Datagram) Transport Layer Security “(D)TLS” 1.2/1.3 was designed to help industries implement and integrate such methods through underpinning infrastructures of Internet of Everything (IoE) environments with efficiency and efficacy in mind. The main goal underpinning such protocols is to protect the Internet connections between IoE machines from malicious activities such as unauthorized eavesdropping, monitoring, and tampering with messages. In theory, these protocols are supposed to be secure. Still, most existing implementations partially follow the standard features of (D)TLS 1.2/3, leaving them vulnerable to risks such as side-channel and network attacks. In this paper, we critically review the standard protocols deployed for the security management of data and connected machines, and also examine the recently discovered vulnerabilities that lead to successful zero-day attacks in IoE environments. Then, we discuss various potential countermeasures in the form of organizational policy enforcement strategies and mitigation approaches that can be used by cybersecurity practitioners, decision- and policy-makers. Finally, we identify both proactive and reactive solutions for further consideration and study, as well as propose alternative mechanisms and e-governance policies for standardizing organizations and engineers in future solution designs.

Leader-based BFT systems face potential disruption and performance degradation from malicious leaders, with current solutions often lacking scalability or greatly increasing complexity. In this paper, we introduce ABSE, an Adaptive Baseline Score-based Election approach to mitigate the negative impact of malicious leaders on leader-based BFT systems. ABSE is fully localized and proposes to accumulate scores for processes based on their contribution to consensus advancement, aiming to bypass less reliable participants when electing leaders. We present a formal treatment of ABSE, addressing the primary design and implementation challenges, defining its generic components and rules for adherence to ensure global consistency. We also apply ABSE to two different BFT protocols, demonstrating its scalability and negligible impact on protocol complexity. Finally, by building a system prototype and conducting experiments on it, we demonstrate that ABSE-enhanced protocols can effectively minimize the disruptions caused by malicious leaders, whilst incurring minimal additional resource overhead and maintaining base performance.

The Internet of Medical Things (IoMT) is getting extreme attraction as it motivates unprecedented growth in the healthcare industry. Security breaches in IoMT can lead to threatening patients’ lives. For IoMT, existing medical remote attestation techniques (EMRATs) have limitations such as neglecting operational symptoms of compromised systems, like inconsistent medical sensor readings. Moreover, EMRATs do not enable medical-forensic-based attestation history and are inefficient for mutual attestation between a doctor network and a sensor network monitoring a patient. This mutual attestation guarantees safe remote surgeries. In this paper for IoMT, we present a novel remote attestation protocol, BDMFA (Blockchain-supported and Deep learning Medical Forensic-enabling Attestation), to overcome the limitations of EMRATs. BDMFA utilizes deep learning and Blockchain to learn from sensor readings and store attestation history. We prove that BDMFA is resilient to a higher number of attacks than that resisted by EMRATs. Moreover, we present a proof-of-concept implementation for BDMFA using SMART (Secure and Minimal Architecture for Root of Trust). We proved the practical feasibility of BDMFA by implementing it using Omnetpp equipped with Castalia. For a system with 50 patient-sensors and 25 doctor-terminals, BDMFA needed only 2.6 s to complete attestation and less communication cost than that needed for related state-of-the-art protocols by 28.4%. For larger systems, we carried comparative analysis confirming that our proposed protocol BDMFA requires less cost and is more scalable and efficient than related protocols.

Lawful evidence management by law enforcement agencies during the Digital Forensics (DF) investigation is of supreme importance since it convicts suspects of crimes. Therefore, a secure and efficient evidence management system should have certain features such as tamper-resistant, traceability, auditability, privacy preservation, and fine-grained access control. Unfortunately, the state-of-the-art DF is facing new challenges due to the recent technological advancements in various areas, such as the Internet of Things (IoT), Cyber-Physical Systems (CPS), communication technologies, and cloud computing, which are heavily being used in our daily lives. These technologies are also the primary sources for evidence extraction in most crimes. Hence, forensic experts need novel tools and methodologies to keep pace with these new technologies. The inherent properties of blockchain, such as transparency, immutability, secure anonymity, and auditability, make it a suitable solution to address DF’s new challenges. To this end, we provide a compact survey on state-of-the-art blockchain-based DF investigation techniques along with their advantages and disadvantages. We will discuss all critical issues and challenges involved in forensic investigations and evidence management systems, focusing on security and privacy challenges. Moreover, blockchain-based solutions that target specific service areas such as IoT and cloud computing forensics will be discussed in detail due to their usage in many application domains. Finally, we will present the challenges that existing blockchain-based forensics solutions face, along with possible ways of addressing them.

In the Internet of Things era, the Internet demands extremely high-speed communication and data transformation. To this end, the tactile Internet has been proposed as a medium that provides the sense of touch ability, facilitating data transferability with extra-low latency in various applications ranging from industry, robotics, and healthcare to road traffic, education, and culture. Here, programmable networks are role players in approaching the tactile Internet's low latency (≈ 1ms) pillar. Several functionalities - including security - are offloaded onto the network core employing programmable in-network pipelines. From the security perspective, Artificial Intelligence (AI) is another role player that enables the line-rate inference on the core network without involving the control plane. However, integrating AI-based security solutions in programmable devices is challenging mainly because of their constrained anatomy. Furthermore, such solutions inherit well-known adversarial AI vulnerabilities, representing an additional threat to programmable networks. Considering the above, this article discusses AI-based security solutions in programmable networks, focusing on the explored modalities of integrating AI models in programmable constrained network devices. Moreover, we elaborate on the challenges and risks of relying on AI for such mechanisms. Lastly, the article brings a visionary glimpse for future trends in this regard, raising some essential questions on the indispensability of AI for security functionalities and providing some alternative solutions.

Acoustic Side-Channel Attacks (ASCAs) extract sensitive information by using audio emitted from a computing devices and their peripherals. Attacks targeting keyboards are popular and have been explored in the literature. However, similar attacks targeting other human-interface peripherals, such as computer mice, are under-explored. To this end, this paper considers security leakage via acoustic signals emanating from normal mouse usage. We first confirm feasibility of such attacks by showing a proof-of-concept attack that classifies four mouse movements with 97% accuracy in a controlled environment. We then evolve the attack towards discerning twelve unique mouse movements using a smartphone to record the experiment. Using Machine Learning (ML) techniques, the model is trained on an experiment with six participants to be generalizable and discern among twelve movements with 94% accuracy. In addition, we experiment with an attack that detects a user action of closing a full-screen window on a laptop. Achieving an accuracy of 91%, this experiment highlights exploiting audio leakage from computer mouse movements in a realistic scenario.

Digital forensics is crucial to fight crimes around the world. Decentralized Digital Forensics (DDF) promotes it to another level by channeling the power of blockchain into digital investigations. In this work, we focus on the privacy and security of DDF. Our motivations arise from (1) how to track an anonymous- and-malicious data user who leaks only a part of the previously requested data, (2) how to achieve access control while protecting data from untrusted data centers, and (3) how to enable efficient and secure search on the blockchain. To address these issues, we propose Themis: an anonymous and secure DDF scheme with traceable anonymity, private access control, and efficient search. Our framework is boosted by establishing a Trusted Execution Environment in each authority (blockchain node) for securing the uploading, requesting, and searching. To instantiate the framework, we design a secure and robust watermarking scheme in conjunction with decentralized anonymous authentication, a private and fine-grained access control scheme, and an efficient and secure search scheme based on a dynamically updated data structure. We formally define and prove the privacy and security of Themis. We build a prototype with Ethereum and Intel SGX2 to evaluate its performance, which supports processing data from a considerable number of data providers and investigators.