Identifying visitors to a website is beneficial for achieving improved security, and more effective bot and fraud detection. While browser fingerprinting can also be used for intrusive tracking, raising legitimate privacy concerns, it remains a valuable tool when deployed for benign purposes such as authentication and fraud prevention. Browser fingerprinting is a relatively recent technique that enables websites to identify visitors based on a set of attributes derived from the configuration of their browser instance. Since these configurations can change over time, the fingerprints previously used to identify a user may become outdated. However, if a changed fingerprint can be detected as an evolved version of a previously observed one, the two can be linked, allowing the user to be recognized once again. Accurately linking evolved fingerprints leads to improved tracking time, meaning that visitors can be tracked over a longer period of time. In this paper, multiple heuristic mechanisms are proposed for use in browser fingerprint linking. These mechanisms were developed by computing the entropies and pairwise joint entropies of the fingerprint attributes in a volunteer dataset collected over a 2.5-month period and incorporating them numerically into the linking heuristics. The proposed heuristics achieve average tracking times comparable to or exceeding that of ThresholdFP, a recent heuristic method for fingerprint linking, with the best-performing trade-off-optimal variant achieving 52.1 days with 80.8% precision. Although precision can be improved through threshold selection, with a precision-optimal variant achieving 98.6% and approaching ThresholdFP’s 99.5%, the heuristics yield lower precision in their tracking time-optimal and trade-off-optimal configurations. These results suggest that entropy-based scoring is a promising and previously unexplored direction for fingerprint linking, though further work is needed to simultaneously achieve high precision and long tracking durations.

The Open Radio Access Network (O-RAN) paradigm fosters multi-vendor interoperability, allowing modules from different vendors to cooperatively handle network functions, such as temporary data processing or sensor data collection for network operations optimization. However, this integration agility introduces the risk of selecting suboptimal or adversarial modules, leading to moral hazard. Traditional Moral Hazard testing approaches typically rely on a benchmarking data set in addition to historical performance score. However, they deemed impractical, as vendor-supplied modules may not reveal their outputs before deployment, and the network may lack direct access to reference results for validation. This challenge is further compounded by the dynamic nature of network elements and AI-driven models, whose performance can degrade over time due to malicious tampering, obsolescence, or device deterioration, making historical quality assessments ineffective. In this paper, we address the challenge of identifying legitimate vendor-supplied modules among adversarial ones, with respect to a given network functionality/operation, in the absence of benchmarks. We propose a benchmark-free test framework that detects and eliminates adversarial modules using a methodology inspired by the WereWolf game, combined with zero-knowledge proof techniques. Monte Carlo simulations demonstrate that our approach effectively removes adversarial entities while preserving the privacy of legitimate modules.

Browser fingerprinting is a powerful tool for user identification in financial and other security-critical applications that require strong authentication. However, due to the instability of browser attributes, fingerprints often change rapidly, reducing their lifespan and negatively impacting user convenience. We propose, a novel linking algorithm designed to extend the durability of browser fingerprints without compromising precision. Instead of replacing the fingerprint after even a small change, computes a difference score between fingerprints and tolerates variations as long as they stay within a predefined threshold. To ensure realistic performance evaluation, we collected and utilized two real-world datasets. Comparative results show that the fingerprints generated by are significantly more persistent than those produced by existing methods, while maintaining near-perfect precision. Notably, our approach achieves an improvement in average tracking duration ranging from 24.33% to 106.30% compared to rival schemes in the literature.

Privacy has become a significant concern as the processing, storage, and sharing of collected data expands. In order to take precautions against this increasing issue, countries and different government entities have enacted laws for the protection of privacy, and articles regarding acquiring consent from the user to collect data (i.e., via cookies) have been regulated such as the right of one to be informed and to manage their preferences. Even though there are many regulations, still many websites do not transparently provide their users with their privacy practices and cookie consent notices, and restrict one's rights or make it difficult to set/choose their privacy preferences. The main objective of this study is to analyze whether websites from around the world inform their users about the collection of their data and to identify how easy or difficult for users to set their privacy preferences in practice. While observing the differences between countries, we also aim to examine whether there is an effect of geographical location on privacy approaches and whether the applications and interpretations of countries that follow and comply with the same laws are similar. For this purpose, we have developed an automated tool to scan the privacy notices on the 500 most popular websites in different countries around the world. Our extensive analysis indicates that in some countries users are rarely informed and even in countries with high cookie consent notifications, offering the option to refuse is still very low despite the fact that it is part of their regulations. The highest rate of reject buttons on cookie banners in the countries studied is 35%. Overall, although the law gives the user the right to refuse consent and be informed, we have concluded that this does not apply in practice in most countries. Moreover, in many cases, the implementations are convoluted and not user-friendly at all.

Authentication and blacklisting mechanisms have a key role for service providers to deliver the service to correct users through digital channels. Nevertheless, there always have been concerns about privacy of the users against such mechanisms. The conditional anonymity concept is proposed as a remedy to these concerns. A recent approach in the literature for conditional anonymity is blacklistable anonymous credentials, which allows service providers to blacklist users for an authentication session without identifying the user. In this paper, we improve user anonymity in conditionally anonymous schemes using two complementary mechanisms. First, we define whitelisting property for blacklistable anonymous credentials and give a construction of this scheme. The whitelisting property can be used to unlink an honestly behaved authentication session from the user. Second, we propose an extension of this scheme for a particular use case, sharing economy services. This scheme allows a service provider to blacklist a user only if the user have not returned the shared asset in due time. We benchmark the performance of our schemes by comparing them with the rival schemes. Our experiments show that both of our scheme have comparable performance to previous works.

Wide adoption of Internet of Things (IoT) devices and their limitations in terms of hardware cause them to be easy targets for attackers. This, in turn, requires monitoring such systems using intrusion detection systems and take mitigative actions against insider and outsider attackers. Recent studies have explored that machine learning based intrusion detection systems are quite successful in detecting different types of cyber threats targeting IoT systems. However, the proposed systems in these studies incurred limitations in terms of the characteristics of their datasets and detection models. Specifically, a big proportion of the proposed models were developed using simulation-based data generated through specific simulators. Some of these studies also used previously published testbed data that contain the samples of outdated IoT attacks and vulnerabilities. Furthermore, they focused on a lower attack variety and proposed binary classifiers which do not scale in multi-attack scenarios. In this study, we propose a machine learning based multi-class classifier that can classify 6 attack types together with the benign traffic. Our node based feature extraction and detection methodology allows locating the network addresses of the attackers, rather than a rough network level attack existence information, by modeling their traffic characteristics over a sliding time window. For training and testing our models, we also propose an intrusion detection dataset generated using the traffic data collected from real IoT devices running with 6LoWPAN and RPL protocols. Besides having RPL routing attacks in the dataset, we leverage Mirai botnet, employed frequently to target IoT devices. The results show that the proposed intrusion detection system can detect 6 attack types with high recall scores ranging from 79% to 100%. We also illustrate the practicality of the developed model via deployment in a proof of concept implementation over a testbed.

Bitcoin is one of the best-known cryptocurrencies, which captivated researchers with its innovative blockchain structure. Examinations of this public blockchain resulted in many proposals for improvement in terms of anonymity and privacy. Generally used methods for improvement include mixing protocols, ring signatures, zero-knowledge proofs, homomorphic commitments, and off-chain storage systems. To the best of our knowledge, in the literature, there is no study examining Bitcoin in terms of differential privacy, which is a privacy notion coming up with some mechanisms that enable running useful statistical queries without identifying any personal information. In this paper, we provide a theoretical examination of differential privacy in Bitcoin. Our motivation arises from the idea that the Bitcoin public blockchain structure can benefit from differential privacy mechanisms for improved privacy, both making anonymization and privacy breaches by direct queries impossible, and preserving the checkability of the integrity of the blockchain. We first examine the current Bitcoin implementation for four query functions using the differential privacy formulation. Then, we present the feasibility of the utilization of two differential privacy mechanisms in Bitcoin; the noise addition to the transaction amounts and the user graph perturbation. We show that these mechanisms decrease the fraction of the cases violating differential privacy, therefore they can be used for improving anonymity and privacy in Bitcoin. Moreover, we showcase the noise addition to transaction amounts by using IBM Differential Privacy Library. We compare four differential privacy mechanisms for varying privacy parameter values and determine the feasible mechanisms and the parameters.

In recent years, ransomware has been one of the most notorious malware targeting end-users, governments, and business organizations. It has become a very profitable business for cybercriminals with revenues of millions of dollars, and a very serious threat to organizations with financial losses of billions of dollars. Numerous studies were proposed to address the ransomware threat, including surveys that cover certain aspects of ransomware research. However, no study exists in the literature that gives the complete picture on ransomware and ransomware defense research with respect to the diversity of targeted platforms. Since ransomware is already prevalent in PCs/workstations/desktops/laptops, and is becoming more prevalent in mobile devices, and has already hit IoT/CPS recently, and will likely grow further in the IoT/CPS domain very soon, understanding ransomware and analyzing defense mechanisms with respect to target platforms is becoming more imperative. In order to fill this gap and motivate further research, in this paper, we present a comprehensive survey on ransomware and ransomware defense research with respect to PCs/workstations, mobile devices, and IoT/CPS platforms. Specifically, covering 137 studies over the period of 1990-2020, we give a detailed overview of ransomware evolution, comprehensively analyze the key building blocks of ransomware, present a taxonomy of notable ransomware families, and provide an extensive overview of ransomware defense research (i.e., analysis, detection, and recovery) with respect to platforms of PCs/workstations, mobile devices, and IoT/CPS. Moreover, we derive an extensive list of open issues for future ransomware research. We believe this survey will motivate further research by giving a complete picture on state-of-the-art ransomware research.

Private function evaluation aims to securely compute a function f(x(1), ..., x(n)) without leaking any information other than what is revealed by the output, where f is a private input of one of the parties (say Party(1)) and x(i) is a private input of the ith party Party(i). In this article, we propose a novel and secure two-party private function evaluation (2PFE) scheme based on the DDH assumption. Our scheme introduces a reusability feature that significantly improves the state-of-the-art. Accordingly, our scheme has two variants, one is utilized in the initial execution of the function f, and the other is utilized in its subsequent evaluations. To the best of our knowledge, this is the first and most efficient 2PFE scheme that enjoys a reusablity feature. Our protocols achieve linear communication and computation complexities and a constant number of rounds which is at most three.

Internet of Things (IoT) applications have become widely popular for academic and industrial purposes in recent years. One of the most important applications in IoT is Home Automation Systems. Home Automation Systems consist of a number of devices in the home network that allow the homeowners to monitor and control their home from anywhere. However, connectivity to the internet and the simplicity of such devices raise a number of security and privacy concerns. In this paper, we propose a privacy preserving and secure identification and authentication model for Home Automation Systems. In our model, a trusted middleware-layer is developed to ensure a secure and scalable communication platform and provide privacy for the users. We propose a zero knowledge mutual verification and authentication protocol. Meanwhile, for privacy preservation we introduce a communication model by implementing fake proofs with the aim of hiding the identity of the IoT devices. Furthermore, the communication over MQTT is obfuscated by the Home Management System to avoid intrusions and to prevent third parties from tracing the communication. Experiments are conducted for different communication scenarios and the se-curity analysis for the protocol is presented.

The spread of smart home technologies not only brings convenience but also creates various security and privacy concerns among users. Electricity consumption data collected by smart meters is one of the sources of these concerns. The electricity consumption of the appliances working at home made it possible to have information about the private life of the household. This study is aimed to reveal a classification model by using the electricity consumption data obtained as a result of the study conducted in Ireland and the results of the survey study conducted with the households. While the first method in the study aims to access information about private life directly with electricity consumption data, the second method uses the predictions of one private information to improve the results of the prediction of another related information. As a result, it has been concluded that electricity consumption data can be used in the process of obtaining information about private life, and that the use of relationship between two information leads to an improvement in model performance. This study shows one of the obstacles that may occur in the spread of smart houses and has prepared the environment for studies that can be done on the subject of solution.

We tackle the problem where a server owns a trained Machine Learning (ML) model and a client/user has an unclassified query that he wishes to classify in secure and private fashion using the server’s model. During the process the server learns nothing, while the user learns only his final classification and nothing else. Since several ML classification algorithms, such as deep neural networks, support vector machines-SVM (and hyperplane decisions in general), Logistic Regression, Naïve Bayes, etc., can be expressed in terms of matrix operations, initially we propose novel secure matrix operations as our building blocks. On top of them we build our secure and private ML classification algorithms under strict security and privacy requirements. As our underlying cryptographic primitives are shown to be resilient to quantum computer attacks, our algorithms are also suitable for the post-quantum world. Our theoretical analysis and extensive experimental evaluations show that our secure matrix operations, hence our secure ML algorithms build on top of them as well, outperform the state of the art schemes in terms of computation and communication costs. This makes our algorithms suitable for devices with limited resources that are often found in Industrial IoT (Internet of Things)

Nowadays different entities (such as hospitals, cyber security companies, banks, etc.) collect data of the same nature but often with different statistical properties.It has been shown that if these entities combine their privately collected datasets to train a machine learning model, they would end up with a trained model that often outperforms the human experts of the corresponding field(s) in terms of classification accuracy.However, due to judicial, privacy and cost reasons, no entity is willing to share their data with others.We have the same problem during the classification (inference) stage.Namely, the user doesn't want to reveal any information about his query or its' final classification, while the owner of the trained model wants to keep this model private.In this article we overcome these drawbacks by firstly introducing novel efficient secure building blocks for general purpose, which can also be used to build privacy preserving machine learning algorithms for both training and classification (inference) purposes under strict privacy and security requirements.Our theoretical analysis and experimentation results show that our building blocks (hence also our privacy preserving algorithms which are built on top of them) are more efficient than most (if not all) of the state-of-the-art schemes in terms of computation and communication cost, as well as security characteristics in the semi-honest model.Furthermore, and to the best of our knowledge, for the Naïve Bayes model we extend this efficiency for the first time to also deal with active malicious users, which arbitrarily deviate from the protocol.

The Internet of Things (IoT) technology has entered our lives with industry and smart home technologies, and today it has started to be used in fields such as health, finance, transportation, energy and space research. Existing security solutions for IoT devices with limited hardware capacity do not provide integrated protection. In this study, it is aimed to increase the security of the IoT devices in the local network and the confidentiality of the data produced within the system by supporting the multiple SSID feature of the routers with the controller application placed on the gateway. Wireless communication security and packet transmission performance at the physical, network and application layers of the proposed architecture have been tested in real world conditions. Another contribution of the presented study is to limit the communication of devices with other devices in their own networks and with the external network in the light of the information defined by the manufacturer on a device basis. The results show that the proposed system offers a secure and performance efficient solution for protecting IoT environments in the local network.

The pervasive and resource-constrained nature of Internet of Things (IoT) devices makes them attractive to be targeted by different means of cyber threats. There are a vast amount of botnets being deployed every day that aim to increase their presence on the Internet for realizing malicious activities with the help of the compromised interconnected devices. Therefore, monitoring IoT networks using intrusion detection systems is one of the major countermeasures against such threats. In this work, we present a machine learning based Wi-Fi intrusion detection system developed specifically for IoT devices. We show that a single multi-class classifier, which operates on the encrypted data collected from the wireless data link layer, is able to detect the benign traffic and six types of IoT attacks with an overall accuracy of 96.85%. Our model is a scalable one since there is no need to train different classifiers for different IoT devices. We also present an alternative attack classifier that outperforms the attack classification model which has been developed in an existing study using the same dataset.

In recent years, the Internet of Things has been widely used for academic and industrial purposes. One of the applications in the field of IoT is Home Automation Systems (HAS). Home automation systems are devices that allow homeowners to monitor and control their home from remote locations. However, smart home systems raise security and privacy concerns. In this paper, we propose a privacy-aware secure identification and authentication model. In our scheme, a middleware-layer design is adapted to build a secure and efficient intercommunication platform and provide a high protection for the users. In order to provide mutual authentication, we proposed a double verification protocol. Meanwhile, for privacy reasons, we introduce a communication model by generating fake proofs in order to hide the identity of the IoT devices. The experiments are conducted for different communication scenarios. The outcomes of experiments are promising that the proposed model can readily be implemented for home automation systems.

With the help of technological advancements in the last decade, it has become much easier to extensively and remotely observe medical conditions of the patients through wearable biosensors that act as connected nodes on Body Area Networks (BANs). Sensitive nature of the critical data captured and communicated via wireless medium makes it extremely important to process it as securely as possible. In this regard, lightweight security mechanisms are needed to overcome the hardware resource restrictions of biosensors. Random and secure cryptographic key generation and agreement among the biosensors take place at the core of these security mechanisms. In this paper, we propose the SKA-PSAR (Augmented Randomness for Secure Key Agreement using Physiological Signals) system to produce highly random cryptographic keys for the biosensors to secure communication in BANs. Similar to its predecessor SKA-PS protocol by Karaoglan Altop et al., SKA-PSAR also employs physiological signals, such as heart rate and blood pressure, as inputs for the keys and utilizes the set reconciliation mechanism as basic building block. Novel quantization and binarization methods of the proposed SKA-PSAR system distinguish it from SKA-PS by increasing the randomness of the generated keys. Additionally, SKA-PSAR generated cryptographic keys have distinctive and time variant characteristics as well as long enough bit sizes that provides resistance against cryptographic attacks. Moreover, correct key generation rate is above 98% with respect to most of the system parameters, and false key generation rate of 0% have been obtained for all system parameters.

Today, social media and the Internet have become a major part of people's daily lives. As a result, most users post personal information such as birthdays, interests and family members' names on social media. Since users often use their personal information when creating their password, their personal information published on social media can be used to find out users' passwords. Based on this idea, we investigate how many people have disclosed their password or part of their password in their social media account. Using the social media profiles of the individuals, a list of candidate passwords has been created, followed by matching the candidate passwords with the existing password in the database using different metrics.

In the realm of mobile devices, malicious applications pose considerable threats to individuals, companies and governments. Cyber security researchers are in a constant race against malware developers and analyze their new methods to exploit them for better detection. In this paper, we present TRAPDROID, a dynamic malware analysis framework mostly focused on capturing unified behavior profiles of applications by analyzing them on physical devices in real-time. Our framework processes events, which are collected from system calls, binder communications, process stats, and hardware performance counters and combines them into a simple, yet meaningful behavior format. We evaluated our framework's detection rate and performance by analyzing an up-to-date malware dataset, which also contains specially crafted applications with malicious intent. The framework is easy to use, fast and providing high accuracy in malware detection with relatively low overhead.

In this paper, we propose SKA-PS, a novel Secure Key Agreement protocol using Physiological Signals, for Body Area Networks (BANs). Our protocol generates symmetric cryptographic keys using the physiological parameters derived from the physiological signals of the users, such as electrocardiogram, photoplethysmogram and blood pressure. In our construction, we reduce the problem of secure key agreement into the problem of set reconciliation by representing the physiological parameter sequences generated from the physiological signals of the BAN users with appropriate sets. When properly selected parameters are applied, biosensors of the same BAN user can agree on symmetric cryptographic keys with remarkably high true match and low false match rates (as much as 100% and 0.46% for pairwise execution, and 100% and 0.26% for group execution, respectively), and low communication, computational and storage costs. We implemented our model in an embedded system, thus the results show real implementation outcomes. Moreover, we comparatively analyze the performance of SKA-PS with two existing bio-cryptographic key agreement protocols and show that SKA-PS outperforms both in all performance metrics.