Recommendation systems powered by artificial intelligence (AI) are widely used to improve user experience. However, AI inevitably raises privacy leakage and other security issues due to the utilization of extensive user data. Addressing these challenges can protect users' personal information, benefit service providers, and foster service ecosystems. Presently, numerous techniques based on differential privacy have been proposed to solve this problem. However, existing solutions encounter issues such as inadequate data utilization and a tenuous trade-off between privacy protection and recommendation effectiveness. To enhance recommendation accuracy and protect users' private data, we propose ID-SR, a novel privacy-preserving social recommendation scheme for trustworthy AI based on the infinite divisibility of Laplace distribution. We first introduce a novel recommendation method adopted in ID-SR, which is established based on matrix factorization with a newly designed social regularization term for improving recommendation effectiveness. We then propose a differential privacy-preserving scheme tailored to the above method that leverages the Laplace distribution's characteristics to safeguard user data. Theoretical analysis and experimentation evaluation on two publicly available datasets demonstrate that our scheme achieves a superior balance between privacy protection and recommendation effectiveness, ultimately delivering an enhanced user experience.

—With the increasing rates of interconnected Internet of Things (IoT) devices within software-defined networking (SDN) environments, Distributed Denial-of-Service (DDoS) attacks have become increasingly common. As a result of this challenge, novel detection and classification methods must be developed based on the unique characteristics of SDN-supported IoT networks. This article proposes a novel approach to detecting and categorizing DDoS attacks that have been optimized specifically for such environments. As part of our methodology, we integrate convolutional neural networks (CNNs) and long-short-term memory (LSTM) models into a multilevel deep neural network architecture. With this hybrid architecture, complex spatial and temporal patterns can be automatically extracted from raw network traffic data to facilitate comprehensive analysis and accurate identification of DDoS attacks. We validate the efficacy and superiority of our proposed approach over traditional machine learning algorithms by conducting rigorous experiments on real-world data sets. Our findings underscore the potential of the multilevel deep neural network approach as a robust and scalable solution for mitigating DDoS attacks in SDN-supported IoT networks. By improving network security and resilience to evolving threats, our methodology contributes to safeguarding critical infrastructures in the era of interconnected IoT ecosystems.

To mitigate cross-site scripting attacks (XSS), the W3C group recommends web service providers to employ a computer security standard called Content Security Policy (CSP). However, less than 3.7 percent of real-world websites are equipped with CSP according to Google's survey. The low scalability of CSP is incurred by the difficulty of deployment and non-compatibility for state-of-art browsers. To explore the scalability of CSP, in this article, we propose JavaScript based CSP (JSCSP), which is able to support most of real-world browsers but also to generate security policies automatically. Specifically, JSCSP offers a novel self-defined security policy which enforces essential confinements to related items, including JavaScript functions, DOM elements and data access. Meanwhile, JSCSP has an efficient algorithm to automatically generate the policy directives and enforce them in a cascading way, which is more fine-grained and practical than the functionalities provided by CSP. We further implement JSCSP on a Chrome extension, and our evaluation shows that the extension is compatible with popular JavaScript libraries. Our JSCSP extension can detect and block the tested attacking vectors extracted from the prevalent web applications. We state that JSCSP delivers better performance compared to other XSS defense solutions.

Existing approaches to defending Use-After-Free (UAF) exploits are usually done using static or dynamic analysis. However, both static and dynamic analysis suffer from intrinsic deficiencies. The existing static analysis is limited in handling loops, optimization of memory representation. The existing dynamic analysis, which is characterized by lacking the maintenance of pointer information, may lead to flaws that the relationships between pointers and memory cannot be precisely identified. In this work, we propose a new method called UAF-GUARD without the above barriers, in the aim to defending against UAF exploits using fine-grained memory permission management. In particular, we design a key data structure to support the fine-grained memory permission management, which can maintain more information to capture the relationship between pointers and memory. Moreover, we design code instrumentation to enable UAF-GUARD to precisely locate the position of UAF vulnerabilities to further terminate malicious programs when anomalies are detected. We implement UAF-GUARD on a 64-bit Linux system. We carry out experiments to compare UAF-GUARD with the main existing approaches. The experimental results demonstrate that UAF-GUARD is able to effectively and efficiently defend against three types of UAF exploits with acceptable space overhead and time overhead.

Mobile social applications have been widely used by Internet users. Users can efficiently acquire many kinds of information and share their statuses by various social platforms. However, when a user intends to share information through the user's social applications, the user can set the access permission only before the information is posted. Once the information is posted, it is completely beyond the user's control. Specifically, during the recommendation process (for friend or information) in social applications, a user cannot control who can get the recommendation and access his/her information. If one user is accessed by another malicious user, his/her privacy information can be disclosed, and even be further misused for malicious attacks. In this article, we propose Trust2Privacy, a trust-based access control mechanism to protect the personalized privacy of users after posting their information, which can effectively realize the transformation from trust to privacy. First, to represent the relations accurately among users, we define the direction of trust among users according to the user-follow status. Then we combine the similarity, correlation, and interaction among users to calculate the trust values. Considering the fuzzy relationship between the multi-dimensional features and trust levels, we propose a fuzzy comprehensive evaluation algorithm to compute the fuzzy trust. Moreover, for the sake of the high mobility of mobile social networks, we exploit so-called online-to-offline trust evidence to derive the trust value, including taking the location information (e.g., distance, semantics) into consideration. To meet the personalized privacy requirement, we design a filtering algorithm based on the trust relationships and the privacy policy of the target users or posted information, according to which the access requesters can get the list of accessible users or information. This enables achieving the goal of personalized privacy protection. The theoretical analysis and simulation experiment demonstrate that Trust2Privacy is able to achieve personalized privacy protection without bringing negative impact on the availability and usability of mobile social applications.