Seed scheduling, which determines which seed is input to the fuzzer first and the number of mutated test cases that are generated for the input seed, significantly influences crash detection performance in fuzz testing. Even for the same fuzzer, the performance in terms of detecting crashes that cause program failure varies considerably depending on the seed-scheduling method used. Most existing coverage-guided fuzzers use a heuristic seed-scheduling method. These heuristic methods can’t properly determine the seed with a high potential to cause the crash; thus, the fuzzer detects the crash inefficiently. Moreover, the fuzzer’s crash detection performance is affected by the characteristics of target programs. To address this problem, we propose a general-purpose reinforced seed-scheduling method that not only improves the crash detection performance of fuzz testing but also remains unaffected by the characteristics of the target program. The fuzzer with the proposed method detected the most crashes in all but one of the target programs in which crashes were detected in the experimental results conducted on various programs, and showed better crash detection efficiency than the comparison targets overall.

Artificial intelligence (AI) is increasingly being utilized in cybersecurity, particularly for detecting malicious applications. However, the black-box nature of AI models presents a significant challenge. This lack of transparency makes it difficult to understand and trust the results. In order to address this, it is necessary to incorporate explainability into the detection model. There is insufficient research to provide reasons why applications are detected as malicious or explain their behavior. In this paper, we propose a method of a Vision Transformer(ViT)-based malware detection model and malicious behavior extraction using an attention map to achieve high detection accuracy and high interpretability. Malware detection uses a ViT-based model, which takes an image as input. ViT offers a significant advantage for image detection tasks by leveraging attention mechanisms, enabling robust interpretation and understanding of the intricate patterns within the images. The image is converted from an application. An attention map is generated with attention values generated during the detection process. The attention map is used to identify factors that the model deems important. Class and method names are extracted and provided based on the identified factors. The performance of the detection was validated using real-world datasets. The malware detection accuracy was 80.27%, which is a high level of accuracy compared to other models used for image-based malware detection. The interpretability was measured in the same way as the F1-score, resulting in an interpretability score of 0.70. This score is superior to existing interpretable machine learning (ML)-based methods, such as Drebin, LIME, and XMal. By analyzing malicious applications, we also confirmed that the extracted classes and methods are related to malicious behavior. With the proposed method, security experts can understand the reason behind the model's detection and the behavior of malicious applications. Given the growing importance of explainable artificial intelligence in cybersecurity, this method is expected to make a significant contribution to this field.

Fuzzing is an effective approach to discover bugs in programs, especially memory corruption bugs, using randomly generated test cases. However, without prior knowledge of the target program, the fuzzer can generate only a limited number of test cases because of sanity checks. To solve this problem, recent studies have proposed hybrid fuzzers that observe the context of a target program using symbolic execution; these fuzzers generate test cases to bypass the sanity check. While hybrid fuzzers explore “deep” bugs in the target program, they generate many ineffective test cases. In this paper, we propose a concolic execution algorithm that combines deep reinforcement learning with a hybrid fuzzing solution, Dr.PathFinder. When the reinforcement learning agent encounters a branch during concolic execution, it evaluates the state and determines the search path. In this process,“shallow” paths are pruned, and “deep” paths are searched first. This reduces unnecessary exploration, allowing the efficient memory usage and alleviating the state explosion problem. In experiments with the CB-multios dataset for deep bug cases, Dr.PathFinder discovered approximately five times more bugs than AFL and two times more than Driller-AFL. In addition to finding more bugs, Dr.PathFinder generated 19 times fewer test cases and used at least 2% less memory than Driller-AFL. While it performed well in finding bugs located in deep paths, Dr.PathFinder had limitation to find bugs located at shallow paths, which we discussed.

Background: Although the common data model (CDM) has achieved a standardization of medical data and a de-identification of personal patient information, hospitals still store CDM data in an on-premises environment, making it difficult for researchers to access medical data. Objective: In this study, for easy access to CDM data in a multi-institutional participatory CDM research environment and to encourage data-driven research, researchers outside hospital networks securely access and analyze CDM data in the target medical center, analyze it, and respond to the results through a public network. We propose an automated security framework that operates on a public network, such as the Internet. Method: The proposed scheme allows authenticated researchers to securely deliver CDM data analysis codes to a medical institution distributed on the network. The institutional servers automatically execute authenticated codes and return the results to the researcher safely. For this purpose, we designed a scheme based on cryptography. The scheme operates on a group of servers consisting of an authentication process, a signing process, a ticket-granting process, a relaying process, and a data analysis process located at the hospital providing medical CDM data. The scheme consists of four phases for a secure medical data analysis in a distributed environment: authentication, code signing, ticket issuing, and distribution and return. Results: Although the CDM has de-identified patient privacy, the issue still needs to be carefully addressed. Therefore, we established four security objectives to verify that the proposed scheme can be operated safely and formally proved them using BAN logic. Conclusion: As a result of the proof using BAN logic, the proposed scheme was verified to achieve the proposed security goal. Although this scheme was designed solely for CDM, it can be applied to systems with similar environments and functional goals. (C) 2022 Elsevier B.V. All rights reserved.

Hospitals have their own database structures and maintain their data in a closed manner. For this reason, it is difficult for researchers outside of institutions to access multi-center data. Therefore, if the data maintained by all hospitals follow a commonly shared format, researchers can analyze multi-center data using the same method. To safely analyze data using a common data model (CDM) in a distributed multi-center network environment, the objective of this study is to propose and implement the processes for distribution, executing the analysis codes, and returning the results. A secure CDM-based data analysis platform (SCAP) consists of a certificate authority (CA), authentication server (AS), code signer (CS), ticket-granting server (TGS), relaying server (RS), and service server (SS). The AS, CS, TGS, and RS form the central server group of the platform. An SS is stored on a hospital server as an agent for communication with the server group. We designed the functionalities and communication protocols among servers. To safely conduct the intended functions, the proposed protocol was implemented based on a cryptographic algorithm. An SCAP was developed as a web application running on this protocol. Users accessed the platform through a web-based interface.

This paper presents a novel malware-detection model with a convolutional recurrent neural network using opcode sequences. Statistically, an executable file is considered as a set of consecutive machine codes. First, the theoretical foundation on which opcode sequences can be used to detect malware has been discussed. Next, an algorithm for extracting opcode sequences from executables and a deep learning-based malware-detection method that uses the opcode sequences as input have been presented. The proposed model comprises an opcode-level convolutional autoencoder that transforms a long opcode sequence to a relatively short compressed sequence at the front end and a dynamic recurrent neural network classifier that performs a prediction task using the codes generated by the opcode-level convolutional autoencoder at the rear end. Experimentally, the proposed model provided a malware-detection accuracy of 96%, receiver operating characteristic-area under the curve of 0.99, and true positive rate (TPR) of 95%. The highest accuracy and TPR achieved by existing malware-detection methods using opcode sequences were 97% and 82%, respectively. Compared with this method, the proposed model delivered a slightly lower accuracy of 96% but a considerably larger TPR of 95%. Therefore, the proposed model is capable of more reliable malware detection.

Common data model (CDM) is a data representation standard that unifies the observational database scheme for each medical institution and allows an analysis using the same tools. Although the analysis for CDM data does not directly examine a medical institution’s original data, it is essential to establish a policy that considers the CDM database operating environment because privacy issues cannot be avoided. The observational medical outcomes partnership common data model (OMOP CDM) defined by Observational Health Data Sciences and Informatics, a nonprofit organization, eliminates most personal information when constructing the database by design principles. When transforming the database of the medical institution to the OMOP CDM structure, the original data “source_value” is maintained to minimize information loss, which may cause the re-identification of the individual. This review presents a de-identification strategy for the original data, which can be considered when operating a CDM database in a public computing environment such as cloud computing. Furthermore, we evaluate the re-identification risk to the CDM database based on the proposed strategy using privacy models such as k-anonymity, l-diversity, and t-closeness. The analysis shows that the CDM database is highly anonymized on average (the highest re-identification record ration is 11.3 %), but every table in the CDM database contains one or more re-identifiable records. It has been confirmed that the risk of re-identification is reduced significantly by applying a de-identification strategy.

Text-based passwords are a fundamental and popular means of authentication. Password authentication can be simply implemented because it does not require any equipment, unlike biometric authentication, and it relies only on the users’ memory. This reliance on memory is a weakness of passwords, and people therefore usually use easy-to-remember passwords, such as “iloveyou1234”. However, these sample passwords are not difficult to crack. The default passwords of IoT also are text-based passwords and are easy to crack. This weakness enables free password cracking tools such as Hashcat and JtR to execute millions of cracking attempts per second. Finally, this weakness creates a security hole in networks by giving hackers access to an IoT device easily. Research has been conducted to better exploit weak passwords to improve password-cracking performance. The Markov model and probabilistic context-free-grammar (PCFG) are representative research results, and PassGAN, which uses generative adversarial networks (GANs), was recently introduced. These advanced password cracking techniques contribute to the development of better password strength checkers. We studied some methods of improving the performance of PassGAN, and developed two approaches for better password cracking: the first was changing the convolutional neural network (CNN)-based improved Wasserstein GAN (IWGAN) cost function to an RNN-based cost function; the second was employing the dual-discriminator GAN structure. In the password cracking performance experiments, our models showed 10–15% better performance than PassGAN. Through additional performance experiments with PCFG, we identified the cracking performance advantages of PassGAN and our models over PCFG. Finally, we prove that our models enhanced password strength estimation through a comparison with zxcvbn.

Background De-identifying personal information is critical when using personal health data for secondary research. The Observational Medical Outcomes Partnership Common Data Model (CDM), defined by the nonprofit organization Observational Health Data Sciences and Informatics, has been gaining attention for its use in the analysis of patient-level clinical data obtained from various medical institutions. When analyzing such data in a public environment such as a cloud-computing system, an appropriate de-identification strategy is required to protect patient privacy. Objective This study proposes and evaluates a de-identification strategy that is comprised of several rules along with privacy models such as k-anonymity, l-diversity, and t-closeness. The proposed strategy was evaluated using the actual CDM database. Methods The CDM database used in this study was constructed by the Anam Hospital of Korea University. Analysis and evaluation were performed using the ARX anonymizing framework in combination with the k-anonymity, l-diversity, and t-closeness privacy models. Results The CDM database, which was constructed according to the rules established by Observational Health Data Sciences and Informatics, exhibited a low risk of re-identification: The highest re-identifiable record rate (11.3%) in the dataset was exhibited by the DRUG_EXPOSURE table, with a re-identification success rate of 0.03%. However, because all tables include at least one “highest risk” value of 100%, suitable anonymizing techniques are required; moreover, the CDM database preserves the “source values” (raw data), a combination of which could increase the risk of re-identification. Therefore, this study proposes an enhanced strategy to de-identify the source values to significantly reduce not only the highest risk in the k-anonymity, l-diversity, and t-closeness privacy models but also the overall possibility of re-identification. Conclusions Our proposed de-identification strategy effectively enhanced the privacy of the CDM database, thereby encouraging clinical research involving multiple centers.

With the recent development of hardware performance and artificial intelligence technology, sophisticated fake videos that are difficult to distinguish with the human’s eye are increasing. Face synthesis technology using artificial intelligence is called Deepfake

Owing to the generality and importance of the password as a means of authentication, many studies have addressed password-strength evaluation methods and password cracking methods. Recently, the generative adversarial networks approach to enhance password guessing (PassGAN) has been proposed as a password cracking method in research that is based on generative adversarial networks (GAN). The results of this study have received substantial attention. In this paper, we propose the use of a recurrent neural networks-based (RNN) GAN, which comprises the use of the improved Wasserstein GAN (IWGAN) cost function. These models that combine the RNN with IWGAN perform better than PassGAN. We have conducted experiments to compare the performance of our proposed model with that of PassGAN and analyzed the results. Using these analyses, we confirmed that our proposed models exhibited a password cracking performance improvement of 5–10% more than that of PassGAN.

Despite their well-known weaknesses, passwords are still the de-facto authentication method for most online systems. Due to its importance, password cracking has been vibrantly researched both for offensive and defensive purposes. Hashcat and John the Ripper are the most popular cracking tools, allowing users to crack millions of passwords in a short time. However, their rule-based cracking has an explicit limitation of depending on password-cracking experts to come up with creative rules. To overcome this limitation, a recent trend has been to apply machine learning techniques to research on password cracking. For instance, state-of-the-art password guessing studies such as PassGAN and rPassGAN adopted a Generative Adversarial Network (GAN) and used it to generate high-quality password guesses without knowledge of password structures. However, compared with the probabilistic context-free grammar (PCFG), rPassGAN shows inferior password cracking performance in some cases. It was also observed that each password cracker has its own cracking space that does not overlap with other models. This observation led us to realize that an optimized candidate dictionary can be made by combining the password candidates generated by multiple password generation models. In this paper, we suggest a deep learning-based approach called REDPACK that addresses the weakness of the cutting-edge cracking tools based on GAN. To this end, REDPACK combines multiple password candidate generator models in an effective way. Our approach uses the discriminator of rPassGAN as the password selector. Then, by collecting passwords selectively, our model achieves a more realistic password candidate dictionary. Also, REDPACK improves password cracking performance by incorporating both the generator and the discriminator of GAN. We evaluated our system on various datasets with password candidates composed of symbols, digits, upper and lowercase letters. The results clearly show that our approach outperforms all existing approaches, including rule-based Hashcat, GAN-based PassGAN, and probability-based PCFG. The proposed model was also able to reduce the number of password candidates by up to 65%, with only 20% cracking performance loss compared to the union set of passwords cracked by multiple-generation models.