Kubernetes supports multi-tenancy by allowing multiple users to share physical infrastructure. However, this design leads to co-location attacks, where an attacker deploys attack pods onto the same node as victim pods to exploit shared hardware resources. While previous work demonstrates the feasibility of such attacks, it assumes that the attacker has sufficient knowledge of the victim pod’s configuration. This paper presents PodBeater, a novel co-location attack that exploits Kubernetes’s multi-value affinity feature to steer the scheduler’s pod placement decisions. Unlike previous work, PodBeater is designed to operate even under a realistic threat model where the attacker lacks knowledge of the victim pod’s configuration. We evaluate PodBeater on both a small-scale cluster with 20 nodes and 350 pods and a large-scale cluster with 40 nodes and 800 pods, demonstrating its effectiveness under both previous and more realistic threat models. Our results show that PodBeater achieves co-location with fewer attack pods compared to previous works.
Generative AI is a technology that automatically generates various forms of content, such as text, images, and code, and is rapidly spreading with the recent popularization of services such as ChatGPT. While these technologies have greatly improved productivity and convenience, they are also emerging as a security threat, with reports of them being used to commit cybercrime, such as ransomware creation and writing phishing emails. Nevertheless, digital forensic analysis of generative AI usage has been largely limited to mobile application environments, and there is a lack of research on Web browser-based usage traces, which are most commonly utilized by real-world users. This study aims to analyze digital artifacts generated in Web browser usage environments, with a focus on ChatGPT, and to present user activity data that can be utilized in investigations.
Malicious JavaScript remains a significant cybersecurity threat. The challenge is that the detection rate of unknown malicious JavaScript is low. On the other hand, large language models (LLMs), which excel in the ability to explain codes, are expected to be effective in the detection field. However, quantitative evaluation and detailed analysis in the detection of malicious JavaScript using LLMs is still insufficient. This study proposes an offline-based LLMs approach for malicious JavaScript detection, specifically evaluating LLaMA2, LLaMA3, and the code-specialized CodeLLaMA. Our results show CodeLLaMA achieved a high F-measure of 0.89. Furthermore, we thoroughly analyzed the impact of individual tokens on detection using both gradient-based and attention-based methods. This analysis revealed that the gradient-based approach offers more explainable features for malicious tokens. These findings highlight the strong potential of LLMs, particularly code-specialized models, for effective malicious JavaScript detection and improve the interpretability of their decisions.
The number and complexity of cyber attacks are increasing, making it very important to teach people of all ages and skill levels about cybersecurity. To address this issue, teaching methods are changing to include both basic ideas and practical, hands-on activities. Following well-known guidelines like CAE-C, REWIRE, and CSEC2017, we created a hands-on course that helps trainees learn practical skills, such as analyzing network data, finding website weaknesses, detecting attacks, making systems stronger, analyzing malware, and doing digital forensics. In this paper, we introduce a simple and organized way to teach beginner-level cybersecurity using open-source tools. We developed a portable and easy-to-use practice system called TALOS, which helps people learn important topics in operating systems and network security. TALOS was used in 19 training sessions with 367 participants, including university students and the general public. Survey results showed that most trainees were very satisfied, with 81.7
Evaluating machine learning models in cybersecurity often involves datasets with an equal ratio of benign and malicious samples. Previous studies employing conventional evaluation methods have assessed performance at a single, fixed class ratio. However, this evaluation approach has a critical flaw. It fails to show how its performance degrades when the class imbalance becomes severe. This issue causes a mismatch when deploying the model in a real environment. Therefore, we propose a new evaluation methodology: the Real Environment Tolerance Curve (RETC). RETC is a systematic method to assess model robustness under varying degrees of class imbalance. It involves generating test datasets with an increasing proportion of benign data and plotting key performance metrics against the imbalance ratio. The resulting visualization, the RETC plot, enables a quantitative evaluation of the ability of a model to maintain performance in benign-dominated environments. In this study, we first establish the theoretical foundation of the RETC method through mathematical analysis, clarifying how each metric behaves as class ratios change. Next, empirical experiments on network traffic and URL datasets demonstrate that RETC reveals critical performance differences missed by conventional single-ratio evaluations. Experiments with URL datasets revealed a model whose false positive rate surged by more than three times (2.5
