Opin vísindi

 

Nýlega bætt við

Verk
SoK : The Impact of Unlabelled Data in Cyberthreat Detection
(Institute of Electrical and Electronics Engineers Inc., 2022) Apruzzese, Giovanni; Laskov, Pavel; Tastemirova, Aliya; Department of Computer Science
Machine learning (ML) has become an important paradigm for cyberthreat detection (CTD) in the recent years. A substantial research effort has been invested in the development of specialized algorithms for CTD tasks. From the operational perspective, however, the progress of ML-based CTD is hindered by the difficulty in obtaining the large sets of labelled data to train ML detectors. A potential solution to this problem are semisupervised learning (SsL) methods, which combine small labelled datasets with large amounts of unlabelled data. This paper is aimed at systematization of existing work on SsL for CTD and, in particular, on understanding the utility of unlabelled data in such systems. To this end, we analyze the cost of labelling in various CTD tasks and develop a formal cost model for SsL in this context. Building on this foundation, we formalize a set of requirements for evaluation of SsL methods, which elucidates the contribution of unlabelled data. We review the state-of-the-art and observe that no previous work meets such requirements. To address this problem, we propose a framework for assessing the benefits of unlabelled data in SsL. We showcase an application of this framework by performing the first benchmark evaluation that highlights the tradeoffs of 9 existing SsL methods on 9 public datasets. Our findings verify that, in some cases, unlabelled data provides a small, but statistically significant, performance gain. This paper highlights that SsL in CTD has a lot of room for improvement, which should stimulate future research in this field.
Verk
SoK : On the Offensive Potential of AI
(Institute of Electrical and Electronics Engineers Inc., 2025) Schroer, Saskia Laura; Apruzzese, Giovanni; Human, Soheil; Laskov, Pavel; Anderson, Hyrum S.; Bernroider, Edward W.N.; Fass, Aurore; Nassi, Ben; Rimmer, Vera; Roli, Fabio; Salam, Samer; Ashley Shen, Chi En; Sunyaev, Ali; Wadhwa-Brown, Tim; Wagner, Isabel; Wang, Gang; Department of Computer Science
Our society increasingly benefits from Artificial Intelligence (AI). Unfortunately, more and more evidence shows that AI is also used for offensive purposes. Prior works have revealed various examples of use cases in which the deployment of AI can lead to violation of security and privacy objectives. No extant work, however, has been able to draw a holistic picture of the offensive potential of AI. In this SoK paper we seek to lay the ground for a systematic analysis of the heterogeneous capabilities of offensive AI. In particular we (i) account for AI risks to both humans and systems while (ii) consolidating and distilling knowledge from academic literature, expert opinions, industrial venues, as well as laypeople - all of which being valuable sources of information on offensive AI. To enable alignment of such diverse sources of knowledge, we devise a common set of criteria reflecting essential technological factors related to offensive AI. With the help of such criteria, we systematically analyze: 95 research papers; 38 InfoSec briefings (from, e.g., BlackHat); the responses of a user study (N=549) entailing individuals with diverse backgrounds and expertise; and the opinion of 12 experts. Our contributions not only reveal concerning ways (some of which overlooked by prior work) in which AI can be offensively used today, but also represent a foothold to address this threat in the years to come.
Verk
Scalable architecture for online prioritisation of cyber threats
(NATO CCD COE Publications, 2017-12-26) Pierazzi, Fabio; Apruzzese, Giovanni; Colajanni, Michele; Guido, Alessandro; Marchetti, Mirco; Jakschis, Raik; Minarik, Tomas; Lindstrom, Lauri; Roigas, Henry; Department of Computer Science
Detecting advanced attacks is increasingly complex and no single solution can work. Defenders can leverage logs and alarms produced by network and security devices, but big data analytics solutions are necessary to transform huge volumes of raw data into useful information. Existing anomaly detection frameworks either work offline or aim to mark a host as compromised, with high risk of false alarms. We propose a novel online approach that monitors the behaviour of each internal host, detects suspicious activities possibly related to advanced attacks, and correlates these anomaly indicators to produce a list of the most likely compromised hosts. Due to the huge number of devices and traffic logs, we make scalability one of our top priorities. Therefore, most computations are independent of the number of hosts and can be naively parallelised. A large set of experiments demonstrates that our proposal can pave the way to novel forms of detection of advanced malware.
Verk
Reproducibility Companion Paper : Swarical: An Integrated Hierarchical Approach to Localizing Flying Light Specks
(Association for Computing Machinery, Inc, 2025-10-27) Alimohammadzadeh, Hamed; Ghandeharizadeh, Shahram; Cunico, Federico; Springer, Joshua; Department of Computer Science
This companion paper provides artifacts and instructions on replicating the experiments in the ACM Multimedia 2024 paper entitled ''Swarical: An Integrated Hierarchical Approach to Localizing Flying Light Specks.'' Swarm-based hierarchical, Swarical, is a localization technique that enables miniature drones, Flying Light Specks (FLSs), to accurately and efficiently localize and illuminate complex 2D and 3D shapes. It consists of two components, an offline planner and an online localization technique that executes on an FLS. The offline planner uses the FLS sensor specification for positioning to convert mesh files into swarms of FLSs. Some FLSs are dark and used only for localization. We reported the online localization technique to be fast and highly accurate. We describe how to reproduce this finding using our artifacts.
Verk
On the Evaluation of Sequential Machine Learning for Network Intrusion Detection
(Association for Computing Machinery, 2021-08-17) Corsini, Andrea; Yang, Shanchieh Jay; Apruzzese, Giovanni; Department of Computer Science
Recent advances in deep learning renewed the research interests in machine learning for Network Intrusion Detection Systems (NIDS). Specifically, attention has been given to sequential learning models, due to their ability to extract the temporal characteristics of network traffic flows (NetFlows), and use them for NIDS tasks. However, the applications of these sequential models often consist of transferring and adapting methodologies directly from other fields, without an in-depth investigation on how to leverage the specific circumstances of cybersecurity scenarios; moreover, there is a lack of comprehensive studies on sequential models that rely on NetFlow data, which presents significant advantages over traditional full packet captures. We tackle this problem in this paper. We propose a detailed methodology to extract temporal sequences of NetFlows that denote patterns of malicious activities. Then, we apply this methodology to compare the efficacy of sequential learning models against traditional static learning models. In particular, we perform a fair comparison of a ĝ€sequential' Long Short-Term Memory (LSTM) against a ĝ€static' Feedforward Neural Networks (FNN) in distinct environments represented by two well-known datasets for NIDS: the CICIDS2017 and the CTU13. Our results highlight that LSTM achieves comparable performance to FNN in the CICIDS2017 with over 99.5% F1-score; while obtaining superior performance in the CTU13, with 95.7% F1-score against 91.5%. This paper thus paves the way to future applications of sequential learning models for NIDS.

Flokkar í Opnum vísindum

Veldu flokk til að skoða.

Niðurstöður 1 - 9 af 9