With the rapid expansion of next-generation networking, Internet of Things (IoT) devices have become central components of federated learning (FL) networks. FL offers a paradigm for distributed training machine learning models while preserving user data privacy. However, existing network security measures often struggle to identify legitimate contributors from opportunistic free riders within these networks. The Free Rider (FR) problem arises when participants seek to benefit from the FL processes without contributing. In particular, free riders are known to exist within or outside of the network, whereas outside free riders can hardly be identified. The Zero Trust model proposes an environment where no entity, including the network itself, is inherently trusted, providing a foundation to counter external threats seeking to exploit the network. This study proposes a novel framework strengthened by the Zero Trust model to identify external free riders in FL networks. Leveraging a Deep Autoencoding Gaussian Mixture Model (DAGMM)-based technique for internal free rider detection, our framework demonstrates superior performance in identifying free riders across various FR scenarios compared to current state-of-the-art solutions. Through our proposed framework and the principles of Zero Trust, we establish a robust security guarantee for FL networks, ensuring the integrity of the learning process.

Over the past few years, the improved detection and processing features of Internet of Things (IoT) devices have opened the doors to several mobile crowdsourcing (MC) applications. Federated learning (FL) is being seen as an attractive framework to address the data privacy concerns of mobile users in the context of crowdsourcing. In FL on a crowdsourcing platform, constructing an effective deep neural network (DNN) is challenging. This is primarily because the quality of the global model depends on the local model quality, which can vary greatly due to differences in the computational resources, data quantity, and data quality provided by each worker. To address these challenges, we propose QARMA-FL: quality-aware robust model aggregation for FL in crowdsourcing applications, where we select the local model for aggregation based on its quality and performance. We also propose a model-quality-aware incentive mechanism to reward workers, based on their contribution to model training. Our model selection and incentive mechanism is capable of detecting free rider (FR) attacks, identifying workers who benefit from others’ contributions without contributing themselves. Most existing evaluations of FL in MC studies are not based on the real-world FL scenarios. Therefore, we evaluate QARMA-FL alongside a baseline FL model in a quantity-skew, non-identically distributed (IID) data setup where different workers contribute varying amounts of data for model training. Our diverse experiments validated QARMA-FL’s performance, demonstrating its ability to efficiently aggregate models in MC scenarios, reaching baseline results with a reduced worker participation by 40% to 60%.

Sri Lanka recently passed its first privacy legislation covering a wide range of sectors, including health. As a precursor for effective stakeholder engagement in the health domain to understand the most effective way to implement legislation in healthcare, we have analyzed 41 popular mobile apps and web portals. We found that 78% of the tested systems have third-party domains receiving sensitive health data with minimal visibility to the consumers. We discuss how this will create potential issues in preparing for the new privacy legislation.

The California Consumer Privacy Act (CCPA) provides California residents with a range of enhanced privacy protections and rights. Our research investigated the extent to which Android app developers comply with the provisions of the CCPA that require them to provide consumers with accurate privacy notices and respond to "verifiable consumer requests" (VCRs) by disclosing personal information that they have collected, used, or shared about consumers for a business or commercial purpose. We compared the actual network traffic of 109 apps that we believe must comply with the CCPA to the data that apps state they collect in their privacy policies and the data contained in responses to "right to know" requests that we submitted to the app's developers. Of the 69 app developers who substantively replied to our requests, all but one provided specific pieces of personal data (as opposed to only categorical information). However, a significant percentage of apps collected information that was not disclosed, including identifiers (55 apps, 80%), geolocation data (21 apps, 30%), and sensory data (18 apps, 26%) among other categories. We discuss improvements to the CCPA that could help app developers comply with "right to know" requests and other related regulations.

We investigate the link sharing behavior of Twitter users following the temporary halt of AstraZeneca COVID-19 vaccine development in September 2020. During this period, we show the presence of malicious and low credibility information sources shared on Twitter messages in multiple languages. The malicious URLs, often in shortened forms, are increasingly hosted in content delivery networks and shared cloud hosting infrastructures not only to improve reach but also to avoid being detected and blocked. There are potential signs of coordination to promote both malicious and low credibility URLs on Twitter. Our findings suggest the need to develop a system that monitors the low-quality URLs shared in times of crisis.

Given the widespread prevalence of vulnerabilities, remediation is a critical phase that every software project has to go through. When comparing the studies on understanding the security vulnerabilities in software, such as vulnerability discovery and patterns, there is a lack of studies on the vulnerability remediation phase. To address this, we have done a timeline analysis for 130 of the most dependent upon open source projects written in JavaScript language, hosted on GitHub to understand the nature and the lifetime of the vulnerabilities in those projects. We used a static code analyzer on 501K commits from the repositories to identify commits that introduced new vulnerabilities to the code and fixed existing vulnerabilities in the code. In 90% of the projects, we identified that a commit that fixed an existing vulnerability had introduced one or more new vulnerabilities into the code. On average, 16% of the commits intended to fix vulnerabilities have introduced one or more new vulnerabilities from the analyzed projects. We also found that 18% of the total vulnerabilities found in those projects have originated from a commit meant to fix an existing vulnerability, and 78% of those vulnerabilities could have been avoided of introduction if the developers were to use proper internal testing. Here, we demonstrate Sequza, a visualization tool to help organizations detect such instances at the earliest possible.

Video Surveillance Systems (VSS) that are used to provide physical protection to assets and personnel of organizations open up new information channels, but they are often not considered an integral part of the organization's information system. Therefore, more often than not, VSS is not considered when designing and evaluating organizations' information security. Hence, a VSS may weaken the information security of an organization while strengthening physical security. We present such a threat that the VSS used in ATM kiosks of Sri Lankan banks can severely weaken the ATM PIN security due to the ad hoc placement of cameras. While we have observed that in some installations, the video camera directly captures the PIN-pad, we show that forearm movements' visibility is sufficient to infer PINs with a significant level of accuracy. We used a mock-up of an ATM kiosk for our analysis, and we show that a human observer can guess a PIN with 22.5% accuracy within 3 attempts without the PIN Pad's visuals. A computer can infer the PIN using the same footages with an accuracy of 50% using a straightforward algorithm. Critical processes in the banks, such as authentication, are built around the assumption of the confidentiality of the PIN thus invest heavily in the PIN generation process. This well-protected PIN is exposed to the VSS when entering the PIN, thus violating a crucial assumption. However, this violation has hitherto gone unnoticed by the banks' security audits because VSS is not considered an inalienable component of the information system.

—The California Consumer Privacy Act (CCPA) pro- vides California residents with a range of enhanced privacy protections and rights. Our proposed project aims to investigate the extent to which Android app developers comply with the provisions of the California Consumer Privacy Act (CCPA) that require them to provide consumers with accurate privacy notices and respond to consumers’ “request to know” by disclosing personal information that they have collected, used or shared about them for a business or commercial purpose. In doing so, we aim to understand whether the information provided by developers in privacy notices and in response to “right to know” requests is complete and accurate, and whether the response accurately explains how this data has been collected, used, and shared.

Mobile app developers often include third-party Software Development Kits (SDKs) in their software to externalize services and features, or monetize their apps through advertisements. Unfortunately, these development practices often come at a privacy cost to the end user. In this paper, we discuss the privacy damage that third-party SDKs can cause to end users due to limitations present in today’s mobile permission models, and the overall lack of transparency in the ecosystem. We combine static, dynamic and manual analysis of the SDKs embedded in the top 50 Google Play store’s applications to develop a taxonomy of hird-party libraries. We also provide insights about their data collection, and transparency issues. We also discuss different ways to tackle current challenges, like increasing developer’s awareness or changing the permission model of mobile phone to clearly state the purpose of permissions and to separate permissions requested by the app itself and third-party libraries, as well as mechanisms to ease certification and regulatory enforcement efforts.

This study provides an in-depth analysis of a Twitter dataset around AstraZeneca COVID vaccine development released as a part of Grand Challenge, North American Social Network Conference, 2021. In brief, we show: i) the presence of malicious and low credibility information sources shared on Twitter messages in multiple languages, ii) the malicious URLs, often in shortened forms, are increasingly hosted in content delivery networks and shared cloud hosting infrastructures not only to improve reach but also to avoid being detected and blocked, iii) potential signs of coordination to promote both malicious and low credibility URLs on Twitter. We use a null model and several statistical tests to identify meaningful coordination behavior.

It is common to find multiple network interfaces connected to different Internet Service Providers (ISPs) in devices such as smartphones. Multipath TCP (MPTCP) enables TCP connections to use all these network interfaces in a single TCP connection in an application transparent manner. MPTCP schedules traffic of one TCP connection over subflows created over these network interfaces. It is evident that this requires some scheduling policy. There have been some attempts to allow applications to decide on the scheduling policy. However, this violates the application transparency of MPTCP, and applications do not have all the information required to decide on such a policy. In addition, this allows the applications to monopolize the network connection thus posing a security threat as well. We argue that only the owner of the device (the user) has the right to make that policy decision and only the user can make an informed decision on the scheduling policy. For example, the user has the information on the monetary cost of the connections through different interfaces. In this paper we present a mechanism that allows the user to provide hints to the TCP scheduler to alter its scheduling policy. While this is not a mechanism to implement generic scheduling policies, it demonstrates how a user can guide the scheduling policies. As a proof of the concept, we demonstrate how MPTCP scheduler can be influenced to select a less stable and lossy path over a stable path based on a user preference.

The possibility of retrieving colours relevant to musical emotions is an emerging multidisciplinary research concept. It can be considered as the initial starting point for music visualization. But due to the novice nature of previous findings and limited availability of emotionally annotated musical databases, obtaining accurate colours for emotions is a computationally challenging task. The purpose of this research is to obtain the most suitable emotional colour for a given song segment considering Russell's Circumplex Emotional Model. MediaEval Database for Emotional Analysis of Music (DEAM data-set) has been annotated in previous studies considering the aforementioned emotional model. In this research, a linear regression approach was used with the WEKA machine learning tool for the DEAM data-set. Effectiveness of the results compared with several linear regression models available in WEKA. Then the predicted emotion can use with Itten's colour model to obtain relevant colour for the emotion. According to the above comparison, the random forest linear regression approach provided the most reliable results compared to other models (accuracy of 81% for arousal and 61% for valence). This study unveiled that Russell's Circumplex model and Itten's colour model can effectively sync emotions in music and colours in arts. Therefore, it can be used to obtain effective music visualizations and musically synced artistic patterns considering emotions.

Traditionally routing is an IP layer functionality. Multipath TCP creates multiple flows within a single TCP connection, and it has the luxury of selecting a path based on some criteria. This essentially pushes some routing functionality (not hop by hop, but end to end) to the TCP layer. Now TCP has to do flow control, etc., with "routing." However, TCP may not be able to discover all the metrics required for the right path selection. There are metrics available only to the user (not even to the application). A case in point is the monetary cost of different paths based on the different ISPs. The user may have a policy to select the paths based on these metrics. In this work, we used MPTCP over two paths with different costs from the user; A path over an ad-hoc WiFi network and another path through a fixed infrastructure based network. The user policy dictates that the path over the ad-hoc network is preferred. We devised a mechanism to pass this preference/policy as a hint to the kernel's TCP/IP stack. We show that the user can influence the kernel on the path selection with a minimal or non-negligible cost. We argue that the proposed research has a lots of security implications.

ATM transactions are verified using two-factor authentication. The PIN is one of the factors (something you know) and the ATM Card is the other factor (something you have). Therefore, banks make significant investments on PIN Mailers and HSMs to preserve the security and confidentiality in the generation, validation, management and the delivery of the PIN to their customers. Moreover, banks install surveillance cameras inside ATM cubicles as a physical security measure to prevent fraud and theft. However, in some cases, ATM PIN-Pad and the PIN entering process get revealed through the surveillance camera footage itself. We demonstrate that visibility of forearm movements is sufficient to infer PINs with a significant level of accuracy. Video footage of the PIN entry process simulated in an experimental setup was analyzed using two approaches. The human observer-based approach shows that a PIN can be guessed with a 30% of accuracy within 3 attempts whilst the computer-assisted analysis of footage gave an accuracy of 50%. The results confirm that ad-hoc installation of surveillance cameras can weaken ATM PIN security significantly by potentially exposing one factor of a two-factor authentication system. Our investigation also revealed that there are no guidelines, standards or regulations governing the placement of surveillance cameras inside ATM cubicles in Sri Lanka.

Organizational security teams have begun to specialize, and as a result, the existence of red, blue, and purple teams have been used as signals for an organization’s security maturity. There is also now a rise in the use of third-party contractors who offer services such as incident response or penetration testing. Additionally, bug bounty programs are not only gaining popularity, but also are perceived as cost-effective replacements for internal security teams. Due to the many strategies to secure organizations, determining which strategy is best suited for a given situation may be a difficult task. To understand how these varying strategies are applied in practice and to understand non-technical challenges faced by professionals, we conducted 53 interviews with security practitioners in technical and managerial roles tasked with vulnerability discovery or management. We found that organizations often struggle with vulnerability remediation and that vulnerability discovery efforts are hindered by significant trust, communication, funding, and staffing issues. Based on our findings, we offer recommendations for how organizations can better apply these strategies.

While there is a large body of work on understanding vulnerabilities in the wild, little has been done to understand the dynamics of the remediation phase of the development cycle. To this end, we have done a timeline analysis on 118K commits from 53 of the most used JavaScript projects from GitHub to understand the provenance and prevalence of vulnerabilities in those projects. We used a vulnerability detector (CodeQL) to filter commits that introduced vulnerabilities and the commits that fixed a prior vulnerability. We found that in 82% of the projects, a commit fixing a prior vulnerability, in turn, introduced one or more new vulnerabilities. Among those projects, on average, 18% of the commits intended to fix vulnerabilities, in turn, introduced one or more new vulnerabilities. We also found that 50% of the total vulnerabilities found in those projects originated from a commit meant to fix a prior vulnerability, and 78% of those vulnerabilities could have been avoided if they were to use proper internal testing. We provide critical insights into how proper internal testing can avoid a significant portion of vulnerabilities, increasing organizations’ security posture.

Cybercriminals exploit cryptocurrencies to carry out illicit activities. In this paper, we focus on Ponzi schemes that operate on Bitcoin and perform an in-depth analysis of MMM, one of the oldest and most popular Ponzi schemes. Based on 423K transactions involving 16K addresses, we show that: (1) Starting Sep 2014, the scheme goes through three phases over three years. At its peak, MMM circulated more than 150M dollars a day, after which it collapsed by the end of Jun 2016. (2) There is a high income inequality between MMM members, with the daily Gini index reaching more than 0.9. The scheme also exhibits a zero-sum investment model, in which one member's loss is another member's gain. The percentage of victims who never made any profit has grown from 0% to 41% in five months, during which the top-earning scammer has made 765K dollars in profit. (3) The scheme has a global reach with 80 different member countries but a highly-asymmetrical flow of money between them. While India and Indonesia have the largest pairwise flow in MMM, members in Indonesia have received 12x more money than they have sent to their counterparts in India.

With the explosive growth of social networks, the modern society has found itself in the midst of a transformation from pre-social network age to a new world where social networks influence everything from democratic processes such as elections to the mental health of the members of the society. While arguing the net cost and benefits of social networks are out of the scope of this case study, we will argue that social networks have introduced a new threat surface that challenges the current status quo on legal protection and investigative techniques on citizens. These challenges equally affect citizens who request justice and protection, and people who are hiding and avoiding law enforcement. From the perspective of a developing nation, especially a nation that does not host any technical infrastructure for any leading social network companies, this work presents challenges Sri Lanka could face and discuss their impact on law enforcement investigations. We believe this case study will open up discussions on the proper legal framework to support future investigations.