With the integration of augmented reality (AR) and virtual reality (VR) into industry and daily life, ensuring secure and usable user authentication methods remains a critical challenge. Despite the rise of biometric authentication for mobile devices, this technology is considered auxiliary in the AR/VR space where textual and graphical authentication is still dominant. This study acknowledges the previously researched insecurity of text input on AR/VR and investigates the usability and security of graphical passwords on a HoloLens 2 device. To do this, a combination of user surveys and user trials forms the basis of this research. A test application was designed for the HoloLens 2 which showcases three different graphical password scheme layouts. Initial comparison among three known schemes (created for mobile devices) demonstrates similar risks when ported on the AR/VR space. Whilst the dynamic alternative was less intuitive for users (as it was mainly a new concept), it was predicted to be robust against the simulated attacks for shoulder surfing and not far off being as memorable as known schemes for users. The dynamic grid can be considered as more secure than the others presented as options for AR/VR implementations of graphical passwords. We conclude that implementations of dynamic grid schemes can be considered reliable for user authentication and that they justify a slight downfall in usability for added security.

The rise of social media financial influencers (finfluencers) has transformed how financial information is disseminated to broad and often inexperienced audiences. While these creators may contribute to financial literacy, concerns remain regarding the reliability of their content and the adequacy of risk disclosures. Using data collected through TikTok's Research API, we analyze UK finfluencer content, engagement dynamics, disclaimer practices, audience sentiment, and network structure. The primary dataset comprises 13,215 videos and 104,097 comments posted by 71 UK-based finfluencers between April and September 2024, while a follow-up dataset covering October 2025 to March 2026 enables longitudinal analysis of disclaimer practices, engagement trends, and hashtag usage. Using topic modeling, we identify four dominant themes: Entrepreneurship & Side Hustles, Property Investing, Active Trading, and Saving & Budgeting. Sentiment analysis of audience comments reveals predominantly neutral-to-positive responses, while engagement analysis shows only a negligible association between video duration and engagement rate. Social network analysis indicates a collaborative ecosystem in which mid-tier finfluencers frequently act as bridges between creator groups. Explicit disclaimers and risk-related language remain relatively uncommon overall and are concentrated primarily in trading-related content. The findings highlight challenges related to financial transparency and disclosure practices within short-form financial content ecosystems. We discuss implications for consumer protection and the design of clearer and more standardized financial risk disclosures on social media platforms.

Recommender systems (RSs) are extensively utilized in e-commerce to predict users' future preferences for unseen items based on historical user-item interactions. These systems, however, are vulnerable to manipulations by malicious actors, such as unsolicited users or vendors, through various shilling attacks. Such attacks intentionally skew recommendations by injecting biased data to promote or demote certain products or services. To address this issue, we propose a generative model called Diff-WassGAN, designed to mitigate the impact of shilling attacks within an adversarial learning framework. Diff-WassGAN uses a combination of Diffusion model (DiffRec) and a GAN framework (CFGAN) to leverage the adversarial advantages of GAN and the personalization advantages of DiffRec. We employ a diffusion model as the generator to process the inherently noisy and sparse historical user-item interactions. The discriminator is a multi-layer perceptron that employs Wasserstein distance as its loss function. We conducted preliminary experiments using four well-known evaluation datasets: MovieLens 100K, MovieLens 1M, Amazon-apps, and Yelp. By simulating various attack scenarios by integrating fake interactions in the dataset, we demonstrate that our Diff-WassGAN model outperforms baseline models across most datasets and attack types, showing better resistance against shilling attacks.

The rise of social media financial influencers (finfluencers) has significantly transformed the personal finance landscape, making financial advice and insights more accessible to a broader and younger audience. By leveraging digital platforms, these influencers have contributed to the democratization of financial literacy. However, the line between education and promotion is often blurred, as many finfluencers lack formal financial qualifications, raising concerns about the accuracy and reliability of the information they share. This study investigates the patterns and behaviours of finfluencers in the UK on TikTok, focusing not on individual actions but on broader trends and the interactions between influencers and their followers. The aim is to identify common engagement patterns and propose guidelines that can help protect the public from potential financial harm. Specifically, the paper contributes a detailed analysis of finfluencer content categorization, sentiment trends, and the prevalence and role of disclaimers, offering empirical insights that inform recommendations for safer and more transparent financial communication on social media.

Passwordless authentication is a trending theme in cyber security, while biometrics gradually replace knowledge-based schemes. However, Personal Identification Numbers, passcodes, and graphical passwords are still considered as the primary means for authentication. Passwords must be memorable to be usable; therefore, users tend to choose easy to guess secrets, compromising security. The Android Pattern Unlock is a popular graphical password scheme that can be easily attacked by exploiting human behavioristic traits. Despite its vulnerabilities, the popularity of the scheme has led researchers to propose adjustments and variations that enhance security but maintain its familiar user interface. Nevertheless, prior work demonstrated that improving security while preserving usability remains frequently a hard task. In this paper we propose a novel graphical password scheme built on the foundations of the well-accepted Android Pattern Unlock method, which is usable, inclusive, universal, and robust against shoulder surfing and (basically) smudge attacks. Our scheme, named Bu-Dash, features a dynamic user interface that mutates every time a user swipes the screen. Our pilot studies illustrate that Bu-Dash attracts positive user acceptance rates, it is secure, and maintains high usability levels. We define complexity metrics that can be used to further diversify user input, and we conduct complexity and security assessments.

Machine learning is key for automated detection of malicious network activity to ensure that computer networks and organizations are protected against cyber security attacks. Recently, there has been growing interest in the domain of adversarial machine learning, which explores how a machine learning model can be compromised by an adversary, resulting in misclassified output. Whilst to date, most focus has been given to visual domains, the challenge is present in all applications of machine learning where a malicious attacker would want to cause unintended functionality, including cyber security and network traffic analysis. We first present a study on conducting adversarial attacks against a well-trained network traffic classification model. We show how well-crafted adversarial examples can be constructed so that known attack types are misclassified by the model as benign activity. To combat this, we present a novel defensive strategy based on hierarchical learning to help reduce the attack surface that an adversarial example can exploit within the constraints of the parameter space of the intended attack. Our results show that our defensive learning model can withstand crafted adversarial attacks and can achieve classification accuracy in line with our original model when not under attack.

The study seeks to understand how the AI ecosystem might be implicated in a form of knowledge production which reifies particular kinds of epistemologies over others. Using text mining and thematic analysis, this paper offers a horizon scan of the key themes that have emerged over the past few years during the AIEd debate. We begin with a discussion of the tools we used to experiment with digital methods for data collection and analysis. This paper then examines how AI in education systems are being conceived, hyped, and potentially deployed into global education contexts. Findings are categorised into three themes in the discourse: (1) geopolitical dominance through education and technological innovation; (2) creation and expansion of market niches, and (3) managing narratives, perceptions, and norms.

Machine learning has become widely adopted as a strategy for dealing with a variety of cybersecurity issues, ranging from insider threat detection to intrusion and malware detection. However, by their very nature, machine learning systems can introduce vulnerabilities to a security defence whereby a learnt model is unaware of so-called adversarial examples that may intentionally result in mis-classification and therefore bypass a system. Adversarial machine learning has been a research topic for over a decade and is now an accepted but open problem. Much of the early research on adversarial examples has addressed issues related to computer vision, yet as machine learning continues to be adopted in other domains, then likewise it is important to assess the potential vulnerabilities that may occur. A key part of transferring to new domains relates to functionality-preservation, such that any crafted attack can still execute the original intended functionality when inspected by a human and/or a machine. In this literature survey, our main objective is to address the domain of adversarial machine learning attacks and examine the robustness of machine learning models in the cybersecurity and intrusion detection domains. We identify the key trends in current work observed in the literature, and explore how these relate to the research challenges that remain open for future works. Inclusion criteria were: articles related to functionality-preservation in adversarial machine learning for cybersecurity or intrusion detection with insight into robust classification. Generally, we excluded works that are not yet peer-reviewed; however, we included some significant papers that make a clear contribution to the domain. There is a risk of subjective bias in the selection of non-peer reviewed articles; however, this was mitigated by co-author review. We selected the following databases with a sizeable computer science element to search and retrieve literature: IEEE Xplore, ACM Digital Library, ScienceDirect, Scopus, SpringerLink, and Google Scholar. The literature search was conducted up to January 2022. We have striven to ensure a comprehensive coverage of the domain to the best of our knowledge. We have performed systematic searches of the literature, noting our search terms and results, and following up on all materials that appear relevant and fit within the topic domains of this review. This research was funded by the Partnership PhD scheme at the University of the West of England in collaboration with Techmodal Ltd.

Whilst machine learning has been widely adopted for various domains, it is important to consider how such techniques may be susceptible to malicious users through adversarial attacks. Given a trained classifier, a malicious attack may attempt to craft a data observation whereby the data features purposefully trigger the classifier to yield incorrect responses. This has been observed in various image classification tasks, including falsifying road sign detection and facial recognition, which could have severe consequences in real-world deployment. In this work, we investigate how these attacks could impact on network traffic analysis, and how a system could perform misclassification of common network attacks such as DDoS attacks. Using the CICIDS2017 data, we examine how vulnerable the data features used for intrusion detection are to perturbation attacks using FGSM adversarial examples. As a result, our method provides a defensive approach for assessing feature robustness that seeks to balance between classification accuracy whilst minimising the attack surface of the feature space.

The Android ecosystem is dynamic and diverse. Controls have been set in place to allow mobile device users to regulate exchanged data and restrict apps from accessing sensitive personal information and system resources. Modern versions of the operating system implement the run-time permission model which prompts users to allow access to protected resources the moment an app attempts to utilize them. It is assumed that, in general, the run-time permission model, compared to its predecessor, enhances users’ security awareness. In this paper we show that installed apps on Android devices are able to employ the systems’ public assets and extract users’ permission settings. Then we utilize permission data from 71 Android devices to create privacy profiles based on users’ interaction with permission dialogues initiated by the system during run-time. Therefore, we demonstrate that any installed app that runs on the foreground can perform an endemic live digital forensic analysis on the device and derive similar privacy profiles of the user. Moreover, focusing on the human factors of security, we show that although in theory users can control the resources they make accessible to apps, they eventually fail to successfully recall these settings, even for the apps that they regularly use. Finally, we briefly discuss our findings derived from a pen-and-paper exercise showcasing that users are more likely to allow apps to access their location data on contemporary mobile devices (running version Android 10).

The rise in popularity of the Android platform has resulted in an explosion of malware threats targeting it. As both Android malware and the operating system itself constantly evolve, it is very challenging to design robust malware mitigation techniques that can operate for long periods of time without the need for modifications or costly re-training. In this paper, we present MaMaDroid, an Android malware detection system that relies on app behavior. MaMaDroid builds a behavioral model, in the form of a Markov chain, from the sequence of abstracted API calls performed by an app, and uses it to extract features and perform classification. By abstracting calls to their packages or families, MaMaDroid maintains resilience to API changes and keeps the feature set size manageable. We evaluate its accuracy on a dataset of 8.5K benign and 35.5K malicious apps collected over a period of six years, showing that it not only effectively detects malware (with up to 99% F-measure), but also that the model built by the system keeps its detection capabilities for long periods of time (on average, 86% and 75% F-measure, respectively, one and two years after training). Finally, we compare against DroidAPIMiner, a state-of-the-art system that relies on the frequency of API calls performed by apps, showing that MaMaDroid significantly outperforms it.

In the harsh environmental conditions of cyber-physical systems (CPSs), the consensus problem seems to be one of the central topics that affect the performance of consensus-based applications, such as events detection, estimation, tracking, blockchain, etc. In this paper, we investigate the events detection based on consensus problem of CPS by means of compressed sensing (CS) for applications such as attack detection, industrial process monitoring, automatic alert system, and prediction for potentially dangerous events in CPS. The edge devices in a CPS are able to calculate a log-likelihood ratio (LLR) from local observation for one or more events via a consensus approach to iteratively optimize the consensus LLRs for the whole CPS system. The information-exchange topologies are considered as a collection of jointly connected networks and an iterative distributed consensus algorithm is proposed to optimize the LLRs to form a global optimal decision. Each active device in the CPS first detects the local region and obtains a local LLR, which then exchanges with its active neighbors. Compressed data collection is enforced by a reliable cluster partitioning scheme, which conserves sensing energy and prolongs network lifetime. Then the LLR estimations are improved iteratively until a global optimum is reached. The proposed distributed consensus algorithm can converge fast and hence improve the reliability with lower transmission burden and computation costs in CPS. Simulation results demonstrated the effectiveness of the proposed approach.

Recent research indicates that a considerable amount of content on social media is generated by automated accounts. The automata present sophisticated behavior mimicking humans- aiming at evading traditional detection methods. In this paper, we present a supervised approach to detect automated accounts on Twitter using mainly content-based features. We performed our experiments using four datasets that contain tweets from almost 20K malicious and benign accounts. Our methodology is lightweight and employs users' metadata, content and sentiment features. It performs well on unseen data (0.95 F1-score) reaching 95% precision and recall. This work also demonstrates that sentiment characteristics can add value to social spambot detection algorithms when combined with known features.

The advent of the sixth Android version brought a significant security and privacy advancement to its users. The platform's security model has changed dramatically, allowing users to grant or deny access to resources when requested by applications during run-time. This improvement changed the traditional coarse-grained permission system and it was anticipated for a long time by privacy-aware users. In this paper, we present a pilot study that aims to analyze how Android users adapted to the run-time permission model. We gathered anonymous data from 52 participants, who downloaded an application we developed and answered questions related to the run-time permission model. Their answers suggest that most of them positively accepted the new model. We also collected data that describe users' permission settings for each installed application on their devices. Our analysis shows that individuals make consistent choices regarding the resources they allow to various applications to access. In addition, the results of this pilot study showcase that on a second data collection round (occurred one month after the first phase of our experiments), 50% of the respondents did not change a single permission on their devices and only 2.26% of installed applications (on average) presented altered permission settings.

Android users recently were given the ability to selectively grant access to sensitive resources of their mobile devices when apps request them at runtime. The Android fine-grained runtime permission model has been gracefully accepted by the majority of users, who also seem to be consistent regarding their privacy and security preferences. In this paper we analyse permission data collected by Android devices that were utilising the runtime permission model. The reconstructed data represent apps' settings snapshots. We compare behavioural insights extracted from the acquired data with users' privacy preferences reported in our previous work. In addition, compared with the responses received from another group of mobile device users, users' privacy settings seem to be affected by the functionality of apps. Furthermore, we advise visual schemata that describe users' privacy settings and point out a usability issue regarding the installation process of Android apps under the runtime permission model.

Information privacy is constantly negotiated when people interact with enterprises and government agencies via the Internet. In this context, all relevant stakeholders take privacy-related decisions. Individuals, either as consumers buying online products and services or citizens using e-government services, face decisions with regard to the use of online services, the disclosure of personal information, and the use of privacy enhancing technologies. Enterprises make decisions regarding their investments on policies and technologies for privacy protection. Governments also decide on privacy regulations, as well as on the development of e-government services that store and process citizens' personal information. Motivated by the aforementioned issues and challenges, we focus on aspects of privacy decision-making in the digital era and address issues of individuals' privacy behavior. We further discuss issues of strategic privacy decision-making for online service providers and e-government service providers.

There are many different types of mobile device users, but most of them do not seek to expand the functionality of their smartphones and prefer to interact with them using predefined user profiles and settings. However, "power users" are always seeking opportunities to gain absolute control of their devices and expand their capabilities. For this reason, power users attempt to obtain "super user" privileges (root) or jailbreak their devices. Meanwhile, the "bring your own device" (BYOD) trend in the workplace and increased numbers of high profile users who demand enhanced data privacy and protection are changing the mobile device landscape. This chapter discusses variations of the Android operating system that attempt to bypass the limitations imposed by the previous Android permission model (up to version 5.1) and highlights the fact that forensic analysts will encounter devices with altered characteristics. Also, the chapter discusses the Android permission model introduced in the latest operating system (version M or 6.0) that will likely change the way users interact with apps.

Social media networks are becoming increasingly popular because they can satisfy diverse needs of individuals (both personal and professional). Modern mobile devices are empowered with increased capabilities, taking advantage of the technological progress that makes them smarter than their predecessors. Thus, a smartphone user is not only the phone owner, but also an entity that may have different facets and roles in various social media networks. We believe that these roles can be aggregated in a single social ecosystem, which can be derived by the smartphone. In this paper, we present our concept of the social ecosystem in contemporary devices and we attempt to distinguish the different communities that occur from the integration of social networking in our lives. In addition, we propose techniques to highlight major actors within the ecosystem. Moreover, we demonstrate our suggested visualization scheme, which illustrates the linking of entities that live in separate communities using data taken from the smartphone. Finally, we extend our concept to include various parallel ecosystems during potentially large investigations and we link influential entities in a vertical fashion. We particularly examine cases where data aggregation is performed by specific applications, producing volumes of textual data that can be analyzed with text mining methods. Our analysis demonstrates the risks of the rising "bring your own device" trend in enterprise environments.