Recent hardware and software advances allow efficient local machine learning inference on edge devices such as smart cameras. This feature addresses users’ privacy concerns, as they no longer need to upload sensitive raw data, such as images and videos, to cloud servers for data analysis. This paper studies potential privacy breaches in this emerging computing paradigm. Specifically, we show that it is possible to manipulate production neural network models to turn them into spyware. The inference results of these models are almost the same as they are expected to be, but can convey information about the raw input content, allowing the curious cloud service provider managing the edge devices to covertly spy on the private information without being noticed. In the end, we discuss possible defense approaches.
Cybersecurity exercises are a common way to train and evaluate the skills of cybersecurity professionals. These exercises also provide a unique opportunity to generate datasets with realistic attack traces on non-sensitive systems. Nevertheless, the collected logs are unlabeled, and deciding which logs are related to pentesters is a difficult problem. In this paper, we present a novel methodology to label efficiently both system and network logs using MITRE ATT&CK techniques. To demonstrate the effectiveness of our approach, we introduce CasinoLimit, a dataset generated from a pentest exercise that has been played by 114 participants where we collected 540 GB of attack data. We apply our methodology to accurately label these logs with a semiautomatic approach: labels are inferred from the shell sessions and propagated to the network sessions, and eventually corrected by a junior analyst. An expert analyst has manually reviewed all the labels that have been computed to ensure the quality of the labeling process. The results of the pentest exercise are deeply discussed. We show the variability of players’ behaviors and that players can be distinguished by their command line habits. In addition, the high level of granularity of labels coupled with the number of participants enables multiple other applications. With this paper, we release the full dataset and the associated labeling tool, Manatee, which can be used to browse the logs and labels. To support the generalization of our approach, we made it possible to load other datasets with this tool.
With the rapid advancement of deepfake technology, its application in multimodal content such as video and audio has posed severe threats to digital information security and privacy protection. Although existing deepfake detection methods have made significant progress, three critical challenges remain: efficient fusion of cross-modal information, precise extraction of fine-grained visual features, and effective discrimination between the distributions of authentic and forged samples. To address these challenges, this paper innovatively proposes FUME, a cross-modal deepfake detection framework integrating facial UV maps with momentum contrastive learning. Specifically, the method introduces a Texture-Aware Video Transformer (TAViT) to achieve deep fusion of facial UV maps and spatiotemporal video features, while employing an Audio Spectrogram Transformer (AST) for multi-scale feature modeling of speech signals. Additionally, we design a momentum contrastive learning based cross-modal alignment mechanism, which achieves semantic-level matching of audiovisual representations through dynamic construction of positive and negative sample pairs, while incorporating a OneClass softmax loss function to enhance generalization capability against unseen deepfake generation techniques. Extensive experiments on datasets including DeepfakeTIMIT, DFDC, and KoDF validate our method's superiority. Notably, on the KoDF dataset, our approach achieves 97.59% accuracy and 98.23% AUC, surpassing the current audio-visual state-of-the-art by 1.91% and 2.99%.
Template engines are software components that enable the creation of reusable HTML elements containing special keywords that can dynamically alter the page's rendering based on the presented data. This technology is widely used in server-side applications and frameworks, and in recent years, it has also gained adoption on the client side through JavaScript frameworks and libraries. Client-Side Template Injection (CSTI) is a vulnerability that occurs when user input is reflected inside a template and rendered as part of it, allowing attackers to inject malicious instructions. This can trick the template engine into executing arbitrary JavaScript code, potentially leading to Cross-Site Scripting (XSS). Despite the widespread adoption of template engines in production websites, a comprehensive study of their characteristics remains absent. In our study, we begin by providing an overview of the main features of template engines, highlighting attributes that play a crucial role in escalating CSTI to XSS. We then use these extracted characteristics to develop a systematic methodology for detecting CSTI vulnerabilities. Based on this methodology, we create an automatic CSTI detection tool, CSTI-Alert. By running CSTI-Alert on the Tranco top 1 million domains, we identify 532 CSTI-vulnerable domains, with 72% directly leading to XSS through GET parameters or CSRF. Finally, we discuss potential approaches to defend against CSTI based on the result of our semi-automatic exploitability analysis.
Deep learning (DL) based malicious traffic detectors have been widely developed to detect diverse network attacks, yet they are suffering from significant performance degradation due to concept drift. Existing anti-concept drift arts focus on combating the drifting traffic whose features significantly diverge from training traffic. However, they neglect a stealthy yet common situation where the testing traffic has similar features to the training traffic but with opposite ground truth labels. As a result, the DL-based detectors would always make incorrect predictions for the stealthy drifting traffic, insufficient to perform long-term real-world intrusion detection. In this paper, we propose Chameleon, a novel active learning framework that combats stealthy drifting traffic by inferring the conditional distribution of the testing traffic with small manual labeling overhead. Specifically, Chameleon measures the fine-grained correlations between the high-dimensional and heterogeneous testing traffic and selects a small number of highly representative testing traffic samples for manual labeling, to accurately infer other testing samples' labels. With the inferred labels, Chameleon checks the conditional distribution shift from the training to testing traffic to detect concept drift and incrementally trains the DL-based detectors to make them effectively adapt to the shifted distribution. Extensive experiments with six supervised and unsupervised DL-based detectors on three public and four synthetic datasets show that, under stealthy drifting traffic, Chameleon improves the AUT of the DL-based detectors by a range of 18.53% to 23.89%, while the improvement of SOTA baselines is only between 0.06% and 1.86%.
Federated learning decentralizes the training process across clients, allowing clients that do not trust each other to collaboratively train machine learning models without sharing private local data. However, this decentralized approach makes federated learning vulnerable to Poisoning Attacks. Recently, some studies have proposed a new paradigm called Federated Rank Learning (FRL), which uses ranking updates instead of parameter or gradient updates in federated learning. This change transforms the space of updates from continuous to discrete, making the federated learning framework more robust to poisoning attacks.However, we found that some simple and direct poisoning attack methods can easily cause FRL to fail to converge, contrary to the intuition that reducing the update space should limit attackers. This led us to re-examine the security of FRL. We first analyzed the robustness guarantees of FRL and confirmed its vulnerability to poisoning attacks from both theoretical and experimental perspectives. Next, we revisited the impact of changing the update space from continuous to discrete in the framework and found that the advantage of this change does not lie in directly defending against poisoning attacks, but in greatly limiting the attacker’s ability to implement stealthy poisoning attacks. Based on this, we added appropriate defense strategies to FRL, further shrinking the discrete update space into a secure range, and limiting the effectiveness and stealthiness of attacks. Experiments show that this approach significantly improves the ability of FRL to resist poisoning attacks.
Privacy is a subjective concept that depends on human perception and contextual interpretation, based on interaction between subject and object. With the increasing occurrence of privacy leaking incidents, awareness about implicit risks has been evolving. The leakage and misuse of relational information between critical objects emerge as core issues in such security events, defined in this study as “relational privacy”. In images, relational privacy primarily manifests through semantic relations between object pairs. To identify pairs with higher privacy potential, we propose the concept of “semantic heat”. To ensure interpretability and avoid rigid logical judgments, Probabilistic Soft Logic (PSL) is employed to construct semantic heat levels. Scene graph, providing structured semantic representations of image contents, is highly suitable for investigating relational privacy. We utilize panoptic scene graphs to mitigate noise introduced by traditional bounding boxes and leverage contextual information between object pairs. Additionally, a mask crossattention mechanism guided by textual instruction is proposed to extract interactive features between objects effectively. Finally, a two-stage relation decoder based on a Large Multi-modal Model (LMM) is designed to perform open-set relation prediction and strength judgment. Experimental results demonstrated that the proposed method achieved performance close to the state-of-theart and showed certain advantages in recall rate, enabling a more comprehensive detection of relational privacy.
We introduce VIDTOKEN, a transformer-based preinference defense against adversarial video attacks on Video Recognition Systems (VRSs). ViDToken leverages spatial and temporal encoders to tokenize video frames and select a representative frame token (RTS), effectively distinguishing adversarial from clean videos. This approach secures both CNN- and transformer-based VRSs and outperforms existing defenses by neutralizing three advanced attack types across major video classifiers, achieving high detection rates, low false positives, and manageable overhead. To counter adaptive sparse attacks that alter only one frame, we propose a frame-replication countermeasure that significantly improves performance, positioning ViDToken above nearly all defenses. Although this increases inference times, they remain under 1 second-comparable to modern facial recognition authentication systems. This study provides key insights into advancing transformer-based adversarial defenses and calls for further research.
Kubernetes has emerged as the de facto standard for container orchestration. However, existing container scheduling strategies prioritize QoS, leading to the co-location of pods with varying permission levels on the same node. This not only introduces risks of privilege escalation but also facilitates the spread of pods with risky permissions across the cluster, exacerbating the potential for attackers to elevate their privileges. In this work, our goal is to mitigate permission disparity among pods on each node, thereby reducing the risk of privilege escalation from co-location attack and curbing the spread of high-risk permissions across the cluster. We introduce a novel metric, Extraneous Risk Privileges (ERP), to quantify additional privileges derived from the combination of RBAC permissions and cluster parameters that are utilized by other pods on the node but not by the target pod itself. The RBAClock scheduling framework is designed to minimize ERP increase during pod placement, prioritizing the aggregation of pods with similar risk profiles and isolation of those with divergent privileges. Experimental evaluations across 24 CNCF applications demonstrate that, compared to the default scheduler, RBAClock alone achieves an average reduction of 41.46% in aggregated privileges in cluster, 64.63% in privilege escalation risk, and 34.59% in high-privilege nodes proportion, with an 8% performance tradeoff. Notably, our investigation uncovered privilege escalation risks in the Kubernetes services of two major cloud providers, Alibaba Cloud and Tencent Cloud, and demonstrated that RBAClock can effectively mitigate these threats.
In this study, we present a 532-day longitudinal analysis of LockBit 3.0's leak site. We track 1,856 victims across multiple states-countdown, data publication, deletion, and relisting-and reconstruct a structured, three-stage extortion lifecycle: (1) pre-listing negotiation, (2) countdown negotiation, and (3) post-leak monetization. We find that 8.5% of countdown-state victims are deleted before their data is published, suggesting private settlements. In the post-leak phase, victims with price tags exhibit significantly more variable deletion timing compared to those without, despite sharing the same median exposure. This indicates that LockBit actively manages some listings after data publication, potentially extending monetization or negotiation efforts. We also measure the operational impact of law enforcement actions-including Operation Cronos and affiliate arrests-on LockBit's infrastructure and victim activity. While the group rapidly restored services after takedowns, we observe a sustained decline in new victim onboarding, reduced infrastructure redundancy, and delayed payment behavior, suggesting long-term weakening. To our knowledge, this is the first empirical study to model a ransomware extortion lifecycle based on continuous monitoring of leak site behavior. Our findings provide actionable insights into ransomware monetization tactics, negotiation patterns, and post-takedown adaptation.
The operating system kernel manages system resources and makes them available to user-space programs through system calls (syscalls). Vulnerabilities in this syscall handling code could allow user-space programs to exploit the kernel, leading to information leaks or privilege escalation. Finding and patching kernel bugs is therefore critical for system security. Coverage-guided kernel fuzzers such as Syzkaller have proven to be quite effective at discovering kernel bugs through mutation and generation of syscall sequences. Recent fuzzers have integrated techniques for learning dependency relations between syscalls in order to increase the efficacy of fuzzing. Our tool, SyzGrapher, extends this vein of research, aiming to capture the semantics of syscalls to construct test cases that reach deep, interesting code. We focus specifically on improving handling of kernel resources, such as file descriptors and sockets. We design and implement an analysis to learn fine-grained, resource-based dependencies between syscalls and integrate these learned dependencies into a fork of Syzkaller with resource-centric, graph-based mutations. Our evaluation demonstrates that SyzGrapher achieves more code coverage and finds more bugs than state-of-the-art tools. Additionally, in a 7-day fuzz campaign, SyzGrapher found 38 new vulnerabilities across 4 versions of the Linux kernel, 16 within the first day of fuzzing.
Containers benefit software developers, aiding them with increased portability, scalability, and consistency across different environments. From a security point of view, containers incentivize the conversion of monolithic software into microservices which then can be isolated from each other, better lending themselves to least-privilege deployments. In this paper, we shed light to the unexplored issue of remote dependencies in Docker images and containers. Unless a Docker image is fully self-contained, every dependence to the outside world is an opportunity for attackers to hijack these dependencies and conduct supply-chain attacks against these images. To do so, we curate a dataset of 200 K Docker images and design DockerGym, a dynamic analysis system which automatically installs, executes, and stimulates running containers, while monitoring their network communications. We discuss multiple approaches for activating the images in our dataset and the types of remote dependencies that we were able to discover. Among others, we observe that 13% of evaluated Docker images have some form of remote dependencies, with approximately 10 K images resolving public domain names. We observe the use of unencrypted protocols (such as HTTP) and a range of other issues that could be straightforwardly exploited by attackers in the context of supply-chain attacks.
Code datasets are invaluable for training neural vulnerability detectors, a promising area within software engineering. Unfortunately, both proprietary and public datasets face the threat of unauthorized exploitation. Moreover, the opaque nature of neural models presents a challenge for external auditing of training datasets, exacerbating the risk of potential misuse. Although watermarking techniques have proven effective in protecting image and natural language datasets, their applicability to code datasets is limited by domain specificity. Current endeavours to preserve the copyrights of code datasets frequently neglect essential control and data dependency information, treating code as a flat structure. To address these gaps, we propose VulCodeMark, a pioneering method that incorporates data and control flow information into code dataset watermarking. VulCodeMark employs two transformations (. Syntactic Transformation;. Semantic Transformation) to generate watermarks, ensuring the preservation of the original program's functionality while maintaining context-adaptive stealthiness. Experiments have demonstrated that VulCodeMark fulfils essential properties of practical watermarks-including harmlessness, effectiveness, imperceptibility, and robustness. Besides, VulCodeMark additionally supports preliminary probing of model architecture configurations, furnishing valuable forensic evidence in cases of intellectual property infringement.
Malware and Vulnerability analysis are integral components of Cybersecurity. Malware authors employ code obfuscation techniques such as Control-flow flattening and Virtualization to escape detection from antivirus tools. Also, vulnerable code analysis gets complicated when the code is optimized using compiler flags. This paper proposes a binary function similarity detection (BFSD) framework that combines traditional Graph Neural Networks and relatively more recent Large Language Models using ensemble techniques to break code obfuscation and code optimization problems. The framework projects different facets of a binary program, such as control-flow graphs and assembly codes, into different Neural Network architectures, such as GNN and LLM, synchronizes their training process by maintaining the same testing and training data, and finally combines the predictions using ensemble techniques. The diverse features employed by the machine learning models expose unique subsets of functions, and the ensemble takes advantage of this. Experiments show state-of-the-art accuracy in breaking both code obfuscation and code optimization. We use two transformations for code obfuscation: Control-flow Flattening and Virtualization. We use three compiler flags for code optimization: $O_{1}, O_{2}$, and $O_{3}$. We also evaluate the robustness of the framework by cascadingMixed-Boolean Arithmetic with Flatten.
Machine learning-based network intrusion detection(NID) systems often face concept drift in two forms: unknown class emergence due to the arising of previously unseen classes and feature distribution shifts due to the shifts in existing classes. While current approaches, such as drift detection and model retraining, can effectively address the challenge of unknown categories, they struggle to cope with shifts in feature distributions. Our preliminary analysis reveals that features like packet length vary considerably across different network configurations, resulting in unstable representations and degraded model performance. In this paper, we propose NIDP, a novel approach based on neural pruning designed to improve the robustness of NID models against changes in feature distribution. The NIDP method comprises three key components: 1) Dynamic Drift Anchoring (DDA), which detects drift samples with variant features; 2) Dual-Guided Feature Sculpting (DGFS), which leverages patterns identified by DDA to prune fluctuating features selectively; and 3) Contrastive Representation Forging (CRF), which retrains the model to embed samples from the same category more cohesively. Together, these components improve the model's adaptability to dynamic network environments. NIDP is evaluated on two widely used NID benchmarks, Kyoto2016 and CIC-IDS2017&2018, as well as two synthetic variants with amplified feature distribution shifts. Compared to state-of-the-art methods, it achieves F1 score improvements of 7.04% and 40.00% on the real-world datasets, and demonstrates the fastest performance recovery on the synthetic ones, highlighting its adaptability and robustness.
This work explores how to physically watermark images generated by CMOS cameras using deliberately injected radio-frequency signals. CMOS camera imaging is ubiquitous in embedded systems such as smartphones, AR/VR headsets, drones, and other IoT platforms to capture photos and videos. In restricted environments, a property owner may wish to prevent unauthorized camera recordings depending on spatio-temporal context. Indelible watermarks can deter unauthorized recording. A key research challenge is how to find a reasonably general mechanism to surreptitiously inject watermarks without access to the camera. Existing methods typically rely on software-based watermarking or metadata generation, assuming cooperation from camera owners. However, adversaries can trivially disable metadata or watermarking functions to evade forensic analysis. To address this gap, our work explores an unconventional approach of watermarking non-cooperative cameras by injecting radio-frequency interference in the environment to affect the analog sensing process and inject defender-controlled patterns in the image output. Our analysis explains how the rolling shutter and Bayer filter hardware convert radio-frequency signals into color stripes with variable widths. Building upon model-based simulation, our prototype design encodes and extracts imperceptible watermarks with a bandwidth of up to 50 bits per image. Proof-of-concept evaluations in lab environments show that the proposed technique could support watermarking images with diverse background scenes and reveal future challenges of improving watermark bandwidth and injection distance.
Botnets often employ Domain Generation Algorithms (DGAs) to evade detection and maintain communication with their Command and Control (C2) servers. Despite extensive efforts to contain individual botnets and take down their C2 infrastructure, a significant knowledge gap remains regarding the extent to which their associated DGA-generated domains continue to be registered by malicious actors, posing a latent threat. In this paper, we close this gap through a comprehensive measurement study in which we quantify the threats posed by botnets, including both active botnets and those that have been subject to previous takedown operations, by analyzing the daily registered domain names included in 1165 DNS zone files, covering 80.62% of all 1445 currently valid Top-Level Domains (TLDs), over a period of 13 months. During our study, we observe a decade-old botnet being reactivated by new actors, allowing them to receive incoming connections from previous dormant infections and take over a number of machines. In total, we uncover malicious activities associated with 7058 domains generated by 58 different known DGAs, at least 17 of which are used by botnets that have been the target of previous takedown operations. To improve the status quo, we discuss approaches that could have prevented the malicious acts and highlight the potential of recently proposed Machine Learning (ML) techniques to uncover yet unknown DGAs, enabling a more proactive approach to threat detection.
Increased cloud adoption in healthcare has amplified ransomware and malware threats, accounting for 19% of global breaches in 2024. Despite this surge, the behavior of attackers exploiting healthcare systems remains under-explored in academic literature. This paper bridges that gap by deploying a scalable and stealthy deception network specifically designed for healthcare environments. The network comprises 30 real-world vulnerable healthcare web applications, mimicking domain-specific workflows across multi-cloud infrastructures, such as patient registration and billing. We leveraged ATTACK-BERT to generate semantic embeddings and applied co-regularized spectral clustering with normalized cuts to analyze multi-protocol attack traffic. Our analysis revealed nuanced attacker behaviors, including regional and protocol-specific variations, exploitation of healthcare protocols like HL7, and the use of encryption to bypass detection. A comparative sub-study further showed that attackers deliberately engage with vulnerable systems, highlighting the strategic value of deception-based defenses. By focusing on behavioral insights within healthcare-specific settings, this work lays the groundwork for integrating deception into the broader security posture of critical infrastructures.
With the rapid ubiquity of Internet of Things (IoT) technology, a growing number of devices are being connected to the Internet, thereby increasing the potential for cyberattacks. For instance, due to firmware compatibility issues and release delays, N-day vulnerabilities pose significant threats to IoT devices that run outdated firmware versions. Consequently, accurately and efficiently identifying firmware versions of devices is crucial for detecting device vulnerabilities and enhancing the security of IoT ecosystems. In this work, we present DeepFW, which utilizes a Fusion Feature Attention Network (FFAN) to extract subtle differences in embedded web interfaces within the firmware, facilitating the identification of firmware versions in online IoT devices. To address the challenge of high similarity between versions caused by firmware homogeneity in the supply chain, we propose a novel metric loss, namely the Hard Mining Cosine Triplet-Center Loss (HCTCL), to improve intraclass compactness and inter-class separability. To validate the effectiveness of our method, we collected 4,442 firmware images and obtained 130,445 valid embedded web pages. Experimental results show that DeepFW outperforms the state-of-the-art approaches by over 25% on average in both precision and recall. Furthermore, DeepFW revealed that only 2.28% of devices in our dataset were running the latest firmware version. Our evaluation also indicates that 6,684 devices (approximately 61.26%) with outdated firmware versions remain vulnerable to known exploits.
Endpoint Detection & Response (EDR) products detect threats by pattern matching endpoint telemetry against behavioral rules that describe potentially malicious behavior. However, EDR can suffer from high false positives that distract from actual attacks, leading to an "alert fatigue" problem. While provenance-based alert triage techniques have shown promise, historical provenance analysis is prohibitively slow when applied to the stream-based event processing pipelines that dominate industry today; provenance-based systems may take over a minute to inspect a single alert, while individual EDR customers can face tens of millions of alerts per day. At present, these approaches cannot scale to production environments. We present Carbon Filter, an automated alert triage mechanism that reduces false alerts by upwards of 82% and is already in use by thousands of Carbon Black EDR customers today. Our key insight is that the vast majority false alerts are triggered by programs that share a common initiation context, and thus the specific false alerts associated with an initiation context can be identified. However, rather than turning to costly provenance analysis, we hypothesize that it is sufficient to use the command line arguments of alert-triggering processes as the initiation context. Through prioritizing speed for similarity-preserving hashing, clustering, and search, we demonstrate that our approach scales to millions of alerts per hour (>5K/sec). In evaluations customer alert data, we demonstrate that Carbon Filter can identify 82% of false alerts nearly a 6-fold improvement in signal-to-noise ratio. Further, when comparing to provenancebased approaches, we show that Carbon Filter (AUC=0.94) actually outperforms NoDoze (AUC=0.60) and RapSheet (AUC=0.90) while reducing analysis time by 5,064x and 26,723x, respectively.
