Relation extraction (RE) is a key task in natural language processing (NLP) and a core component of information extraction. It focuses on identifying semantic relations between entities in text. Pretrained language models (PLMs), such as transformer-based models like BERT, XLNet and RoBERTa, have made notable progress in RE. Predictions of relations from these models are provided with varying confidence levels. While high-confidence predictions of relations are generally accurate, low-confidence predictions tend to be less precise and often lead to inaccuracies. The current research question is how to re-evaluate the low confidence predictions to ensure the overall confidence of a PLM. To solve this problem we propose a framework using automatically generated ontology schemas and LLMs. We first propose an algorithm that constructs ontology schemas from the RE datasets (TACRED and ReTACRED). Then we use LLMs to validate these low-confidence predictions through prompting to further improve the precision of final predictions. Experimental results on transformer-based models, GCN and LSTM-based models across two large-scale RE datasets (TACRED and ReTACRED) show significant improvements in precision and overall performance.

Is there a secure way to share cyber threats knowledge among multiple organisations for a collective defense strategy ? Federated Learning (FL) has been introduced to enable collaboration among multiple organizations. In this paper, we propose a privacy-preserving federated learning approach to share cyber threat intelligence. The distributed nature of FL gives rise to different threats, such as inference attacks, poisoning attacks, and identity theft. In this work, we consider inference attacks, where a malicious subset of participant nodes aim to infer the training data of the victim. The attacker may generate and optimize vectors of features values to infer these data. We suggest a Federated Learning Approach Against Inference Attacks and Risks (FLAIR) where nodes collaboratively train models without a centralized server. We measured the data generated by the attacker against the real data of the target victim, and we show that the accuracy of this inference attack is low. We additionally conducted a set of experiments to test the performance and resilience of FLAIR. We then attended a high performance metrics with an accuracy around eighties.

We consider cyber-physical systems equipped with sensors and actuators controlled or monitored by software and communication capabilities. Such use of communication makes sensors and actuators possibly vulnerable to cyberattacks (more briefly: attacks). We consider two approaches to study sensor and actuator attacks. The cryptographic approach is to design each sensor and actuator to be invulnerable to attacks, regardless of the system in which it is deployed. The discrete-event system (DES)-based approach is to study the detection of sensor and actuator attacks by observing the behavior of the whole system, without adding any mechanism to sensors and actuators to make them invulnerable. In this paper, we introduce and compare the two approaches and suggest an efficient way to combine them. A concrete case study is presented.

Multilingual sentiment analysis (MSA) involves the task of comprehending people’s opinions, sentiments, and emotions in multilingual written texts. This task has garnered considerable attention due to its importance in extracting insights for decision-making across diverse fields such as marketing, finance, and politics. Several studies have explored MSA using deep learning methods. Nonetheless, a majority of these studies depend on sequential-based approaches, which focus on capturing short-distance semantics within adjacent word sequences, but they overlook long-distance semantics, which can provide more profound insights for analysis. In this work, we propose an approach for multilingual sentiment analysis, namely MSA-GCN, leveraging a graph convolutional network to effectively capture both short- and long-distance semantics. MSA-GCN involves the comprehensive modeling of the multilingual sentiment analysis corpus through a unified heterogeneous text graph. Subsequently, a slightly deep graph convolutional network is employed to acquire predictive representations for all nodes by encouraging the transfer learning across languages. Extensive experiments are carried out on various language combinations using different benchmark datasets to assess the efficiency of the proposed approach. These datasets include Multilingual Amazon Reviews Corpus (MARC), Internet Movie Database (IMDB), Allociné, and Muchocine. The achieved results reveal that MSA-GCN significantly outperformed all baseline models in almost all datasets with a p-value < 0.05 based on student t-test. In addition, such approach shows prominent results in a variety of language combinations, revealing the robustness of the approach against language variation.

The increasing number of online systems and services has led to a rise in cyber security threats and attacks, making Intrusion Detection Systems (IDS) more crucial than ever. Intrusion Detection Systems (IDS) are designed to detect unauthorized access to computer systems and networks by monitoring network traffic and system activities. Owing to the valuable values provided by IDS, several machine learning-based approaches have been developed. However, most of these approaches rely on feature selection methods to overcome the problem of high-dimensional feature space. These methods may lead to the exclusion of important features or the inclusion of irrelevant ones, which can negatively impact the accuracy of the system. In this work, we propose Trans-IDS (transformer-based intrusion detection system), a transformer-based system for intrusion detection, which does not rely on feature selection methods. Trans-IDS learns efficient contextualized representations for both categorical and numerical features to achieve high prediction performance. Extensive experiments have been conducted on two publicly available datasets, namely UNSW-NB15 and NSL-KDD, and the achieved results show the efficiency of the proposed approach.

Multilingual sentiment analysis refers to the process of sentiment scoring while gathering insights from data in different languages. Many research studies have been conducted to perform multilingual sentiment analysis. However, most of these studies focus on the short-distance semantics which consists in modeling local consecutive word sequences. In this work, we consider the global word co-occurrence in the whole corpus, which capture both short- and long-distance semantics, to convey more meaningful insights for the analysis. We propose an approach called MSA-GCN (Multilingual Sentiment Analysis based on Graph Convolutional Network) while supporting both short- and long-distance semantics. We build a single heterogeneous text graph for a multilingual corpus based on sequential, semantic, and statistical information. Then, a slightly deep graph convolutional network learns embeddings for all nodes in a semi-supervised manner. Extensive experiments are carried out on various datasets, and the results demonstrate the effectiveness of the proposed approach.

Threat intelligence is the process of collecting and analyzing information about potential cyber threats. Several approaches have been conducted for cyber threat detection based on the federated learning method. These approaches aim to establish a collaborative threat intelligence sharing between the participants, in order to reinforce their security defense systems. However, these approaches face scalability limitations and raise security and privacy issues: availability, inference attacks, poisoning attacks. To address these issues, we propose a peer-to-peer federated graph neural network (FGNN) approach for threat intelligence. The approach incorporates techniques to ensure data security and privacy. It includes secure aggregation methods and a decentralized sampling technique to reduce the number of exchanged messages. This approach includes also a reputation scoring technique to detect and prevent poisoning attacks, which makes it resilient in the presence of malicious participants.

The success of most recent end-to-end encrypted messaging applications (such as whatsApp, signal, etc … ) is due to the fact that they rely on sound cryptographic primitives and protocols to provide a high level of data protection. The massive use of these applications leads to an abundance of encrypted messages that need to be stored and retrieved upon user requests. This leads to a heavy burden on mobile phones storage resources which could be solved by using a server store. However, the server store could not be trusted, and message encryption is not enough to ensure privacy protection. Indeed, even if the content is encrypted, the underlying metadata (such as the number of which a keyword has been searched, Timestamps, which user searched for which keyword) can reveal private and confidential information which can be exploited against the user will. In this work, we suggest an approach using the private information retrieval technique widely used in the area of information retrieval. Private Information Retrieval (PIR) provides a way to retrieve encrypted content from a server. Initially, an encrypted search query is sent to the server. Then, the server replies without knowing neither the keyword to be searched for, nor the identity of the user conducting the search. Thus, we adapt PIR technique to provide an algorithm for searching encrypted messages without revealing Metadata.

Cloud storage represents a primordial component in most information technology infrastructures. Using cloud instead of on-premise storage raises several security issues, especially when secret keys are stored on the cloud. In such a setting, a robust cloud key management system is a must. Using traditional key management systems (KMS) in the cloud suffers from performance and scalability limitations. This paper, proposes an efficient and secure cloud KMS based on Trusted Execution Environment, precisely Intel SGX. The suggested system (KMSGX), while being deployed on the cloud, is fully controlled by the end-user. Therefore, KMSGX allows running on-premise software key management securely on the cloud provider side, protecting the exchanged and stored data. The security properties of the suggested design have been formalized using the Applied Pi Calculus and proved with ProVerif. The experimental results have demonstrated the system’s high performance in terms of the upload and download durations and the limited overhead compared to the plain

The CAP Theorem shows that (strong) consistency, availability, and partition tolerance are impossible to be ensured together. Causal consistency is one of the weak consistency models that can be implemented to ensure availability and partition tolerance in distributed systems. In this work, we propose a tool to check automatically the conformance of distributed/concurrent systems executions to causal consistency models. Our approach consists in reducing the problem of checking if an execution is causally consistent to solving datalog queries. The reduction is based on complete characterizations of the executions violating causal consistency in terms of the existence of cycles in suitably defined relations between the operations occurring in these executions. We have implemented the reduction in a testing tool for distributed databases, and carried out several experiments on real case studies, showing the efficiency of the suggested approach.

Typically, a security audit is conducted to detect and track inappropriate activities, such as security policy misconfigurations and attacks. Practically, an audit can be done through the analysis and assessment of data in logs registering traces of queries according to predefined policies. In this paper, we present an auditing approach that detects and resolves efficiently conflicting rules of a security policy. Such efficiency translates into a reduction in the time it takes to detect and resolve conflicts. Such efficiency is a consequence of the fact that conflict detection is executed only among suspicious pairs of rules, instead of all pairs of rules. The idea of using suspicious pairs of rules has recently been applied to reduce the execution time of previous detection methods. The present study goes further by applying the idea not only for conflict detection, but also for reducing the resolution time of the detected conflicts. We present experimental results that illustrate the efficiency of the suggested method.

We address the problem of checking that an execution of a shared memory concurrent program is sequentially consistent (SC). This problem is NP-hard due to the necessity of finding a total order between the write operations that induces an acyclic happen-before relation. We propose an approach allowing to avoid falling systematically in the worst case, and to check SCness in polynomial-time in most cases in practice. The approach is based on a simple yet powerful saturation-based procedure for computing write constraints that must hold for SCness, allowing on one hand fast detection of SC violations, and on the other hand reducing drastically the search space for a total order witnessing SCness.

Logs record the events and actions performed within an organization’s systems and networks. Usually, log data should conform with the security policy in use. However, access logs may show the occurrence of unauthorized accesses which may be due to security breaches, such as intrusions or conflicting rules in security policies. Due to the huge amount of log data generated every day and presumed to grow over time, analyzing access logs becomes a hard task that requires enormous computational resources. In this paper, we suggest a method that analyses an access log, and uses the obtained results to determine whether an Attribute-Based Access Control (ABAC) security policy contains conflicting rules. This access log-based approach allows to obtain an efficient conflict detection method, since conflicts are searched among suspicious rules, instead of all the rules of the policy. Those suspicious rules are identified by analyzing the access log. To improve efficiency even more, the access log is decomposed into clusters which are analyzed separately. Furthermore, cluster representatives make the proposed approach scalable for continuous access log case. The scalability is confirmed by experiment results, and our approach effectively identifies conflicts with an average recall of 95.65%.

Cloud Computing is the most suitable environment for the collaboration of multiple organizations via its multi-tenancy architecture. However, due to the distributed management of policies within these collaborations, they may contain several anomalies, such as conflicts and redundancies, which may lead to both safety and availability problems. On the other hand, current cloud computing solutions do not offer verification tools to manage access control policies. In this paper, we propose a cloud policy verification service (CPVS), that facilitates to users the management of there own security policies within Openstack cloud environment. Specifically, the proposed cloud service offers a policy verification approach to dynamically choose the adequate policy using Aspect-Oriented Finite State Machines (AO-FSM), where pointcuts and advices are used to adopt Domain-Specific Language (DSL) state machine artifacts. The pointcuts define states' patterns representing anomalies (e.g., conflicts) that may occur in a security policy, while the advices define the actions applied at the selected pointcuts to remove the anomalies. In order to demonstrate the efficiency of our approach, we provide time and space complexities. The approach was implemented as middleware service within Openstack cloud environment. The implementation results show that the middleware can detect and resolve different policy anomalies in an efficient manner.

We address the problem of checking that computations of a shared memory implementation (with write and read operations) adheres to some given consistency model. It is known that checking conformance to Sequential Consistency (SC) for a given computation is NP-hard, and the same holds for checking Total Store Order (TSO) conformance. This poses a serious issue for the design of scalable verification or testing techniques for these important memory models. In this paper, we tackle this issue by providing an approach that avoids hitting systematically the worst-case complexity. The idea is to consider, as an intermediary step, the problem of checking weaker criteria that are as strong as possible while they are still checkable in polynomial time (in the size of the computation). The criteria we consider are new variations of causal consistency suitably defined for our purpose. The advantage of our approach is that in many cases (1) it can catch violations of SC/TSO early using these weaker criteria that are efficiently checkable, and (2) when a computation is causally consistent (according to our newly defined criteria), the work done for establishing this fact simplifies significantly the work required for checking SC/TSO conformance. We have implemented our algorithms and carried out several experiments on realistic cache-coherence protocols showing the efficiency of our approach.

A firewall is the core of a well defined network security policy. This paper presents an automata-based method to study firewall security policies. We first propose a procedure that synthesizes an automaton that describes a security policy given as a table of rules. The synthesis procedure is then used to develop procedures to detect: incompleteness, anomalies and discrepancies in security policies. A method is developed to represent the automaton by a policy qualified as mixable and that has practical utilities, such as ease to determine the whitelist and the blacklist of the policy. The developed procedures have been deeply evaluated in terms of time and space complexities. Then, a real case study has been investigated. The obtained results confirm that the developed procedures have reasonable complexities and that their actual execution times are of the order of seconds. Finally, proofs of all results are provided.