user account
Social-Sensor Identity Cloning Detection Using Weakly Supervised Deep Forest and Cryptographic Authentication
Alharbi, Ahmed, Dong, Hai, Yi, Xun
Recent years have witnessed a rising trend in social-sensor cloud identity cloning incidents. However, existing approaches suffer from unsatisfactory performance, a lack of solutions for detecting duplicated accounts, and a lack of large-scale evaluations on real-world datasets. We introduce a novel method for detecting identity cloning in social-sensor cloud service providers. Our proposed technique consists of two primary components: 1) a similar identity detection method and 2) a cryptography-based authentication protocol. Initially, we developed a weakly supervised deep forest model to identify similar identities using non-privacy-sensitive user profile features provided by the service. Subsequently, we designed a cryptography-based authentication protocol to verify whether similar identities were generated by the same provider. Our extensive experiments on a large real-world dataset demonstrate the feasibility and superior performance of our technique compared to current state-of-the-art identity clone detection methods.
When AI Defeats Password Deception! A Deep Learning Framework to Distinguish Passwords and Honeywords
Dani, Jimmy, McCulloh, Brandon, Saxena, Nitesh
"Honeywords" have emerged as a promising defense mechanism for detecting data breaches and foiling offline dictionary attacks (ODA) by deceiving attackers with false passwords. In this paper, we propose PassFilter, a novel deep learning (DL) based attack framework, fundamental in its ability to identify passwords from a set of sweetwords associated with a user account, effectively challenging a variety of honeywords generation techniques (HGTs). The DL model in PassFilter is trained with a set of previously collected or adversarially generated passwords and honeywords, and carefully orchestrated to predict whether a sweetword is the password or a honeyword. Our model can compromise the security of state-of-the-art, heuristics-based, and representation learning-based HGTs proposed by Dionysiou et al. Specifically, our analysis with nine publicly available password datasets shows that PassFilter significantly outperforms the baseline random guessing success rate of 5%, achieving 6.10% to 52.78% on the 1st guessing attempt, considering 20 sweetwords per account. This success rate rapidly increases with additional login attempts before account lock-outs, often allowed on many real-world online services to maintain reasonable usability. For example, it ranges from 41.78% to 96.80% for five attempts, and from 72.87% to 99.00% for ten attempts, compared to 25% and 50% random guessing, respectively. We also examined PassFilter against general-purpose language models used for honeyword generation, like those proposed by Yu et al. These honeywords also proved vulnerable to our attack, with success rates of 14.19% for 1st guessing attempt, increasing to 30.23%, 41.70%, and 63.10% after 3rd, 5th, and 10th guessing attempts, respectively. Our findings demonstrate the effectiveness of DL model deployed in PassFilter in breaching state-of-the-art HGTs and compromising password security based on ODA.
Strategic Behavior and AI Training Data
Peukert, Christian, Abeillon, Florian, Haese, Jรฉrรฉmie, Kaiser, Franziska, Staub, Alexander
Human-created works represent critical data inputs to artificial intelligence (AI). Strategic behavior can play a major role for AI training datasets, be it in limiting access to existing works or in deciding which types of new works to create or whether to create new works at all. We examine creators' behavioral change when their works become training data for AI. Specifically, we focus on contributors on Unsplash, a popular stock image platform with about 6 million high-quality photos and illustrations. In the summer of 2020, Unsplash launched an AI research program by releasing a dataset of 25,000 images for commercial use. We study contributors' reactions, comparing contributors whose works were included in this dataset to contributors whose works were not included. Our results suggest that treated contributors left the platform at a higher-than-usual rate and substantially slowed down the rate of new uploads. Professional and more successful photographers react stronger than amateurs and less successful photographers. We also show that affected users changed the variety and novelty of contributions to the platform, with long-run implications for the stock of works potentially available for AI training. Taken together, our findings highlight the trade-off between interests of rightsholders and promoting innovation at the technological frontier. We discuss implications for copyright and AI policy.
Defend Data Poisoning Attacks on Voice Authentication
Li, Ke, Baird, Cameron, Lin, Dan
With the advances in deep learning, speaker verification has achieved very high accuracy and is gaining popularity as a type of biometric authentication option in many scenes of our daily life, especially the growing market of web services. Compared to traditional passwords, "vocal passwords" are much more convenient as they relieve people from memorizing different passwords. However, new machine learning attacks are putting these voice authentication systems at risk. Without a strong security guarantee, attackers could access legitimate users' web accounts by fooling the deep neural network (DNN) based voice recognition models. In this paper, we demonstrate an easy-to-implement data poisoning attack to the voice authentication system, which can hardly be captured by existing defense mechanisms. Thus, we propose a more robust defense method, called Guardian, which is a convolutional neural network-based discriminator. The Guardian discriminator integrates a series of novel techniques including bias reduction, input augmentation, and ensemble learning. Our approach is able to distinguish about 95% of attacked accounts from normal accounts, which is much more effective than existing approaches with only 60% accuracy.
The Many Advantages of Using AI to Improve Network Security
The goal of artificial intelligence (AI) is to mimic the same intelligence that humans display. While it has many uses, it could be a highly effective way to improve cybersecurity. If AI systems are used in the right way, they could potentially identify new threats, send alerts, and ensure that sensitize data is properly protected. A report from TechRepublic found that it's normal for a midsized company to receive approximately 200,000 cybersecurity alerts a day. This makes it difficult for security teams to effectively manage all threats.
BotSpot: Deep Learning Classification of Bot Accounts within Twitter
Braker, Christopher, Shiaeles, Stavros, Bendiab, Gueltoum, Savage, Nick, Limniotis, Konstantinos
The openness feature of Twitter allows programs to generate and control Twitter accounts automatically via the Twitter API. These accounts, which are known as bots, can automatically perform actions such as tweeting, re-tweeting, following, unfollowing, or direct messaging other accounts, just like real people. They can also conduct malicious tasks such as spreading of fake news, spams, malicious software and other cyber-crimes. In this paper, we introduce a novel bot detection approach using deep learning, with the Multi-layer Perceptron Neural Networks and nine features of a bot account. A web crawler is developed to automatically collect data from public Twitter accounts and build the testing and training datasets, with 860 samples of human and bot accounts. After the initial training is done, the Multilayer Perceptron Neural Networks achieved an overall accuracy rate of 92%, which proves the performance of the proposed approach.
Detection of Fake Users in SMPs Using NLP and Graph Embeddings
Chakraborty, Manojit, Das, Shubham, Mamidi, Radhika
Daouadi et al. [5] used deep learning methods on features based on the amount of interaction to and from each Social Media Platforms (SMPs) like Facebook, Twitter, Instagram Twitter account along with other set of features used previously, etc. have large user base all around the world that generates huge for fake user detection. Abu-El-Rub and Mueen [1] used trending amount of data every second. This includes a lot of posts by fake hashtags to detect bots interested in political trends. Graph based and spam users, typically used by many organisations around the techniques are used to cluster the collected bots and those are fed globe to have competitive edge over others. In this work, we aim to supervised learning to detect user's agreement/disagreement to at detecting such user accounts in Twitter using a novel approach.
OKCupid security flaws could have given hackers access to user accounts
The data contained in dating apps is both very personal and valuable to hackers, who can use it to make highly convincing cyberattacks. So it's always disturbing to learn about dating app security flaws. In a report released today, security research firm CheckPoint Research announced that it found several security vulnerabilities in OKCupid's website and mobile apps. The flaws could have allowed hackers to access users' full profile details, private messages, personal addresses and more. Hackers could even send messages from their victims' profiles.
Facial recognition firm Clearview AI reveals intruders stole its client list
The controversial facial-recognition company that contracts with law-enforcement agencies announced that attackers have gained unauthorized access to its entire client list. The company already informed its customers of the security breach. The startup came under scrutiny after media reported that it had scraped more than 3 billion photos from social media (Facebook, YouTube, and Twitter) for facial recognition purposes. The company has been hit with class-action lawsuits by American citizens, but the company refused any accusation remarking that it was authorized by the First Amendment to scrape public data. "In the notification, which The Daily Beast reviewed, the startup Clearview AI disclosed to its customers that an intruder "gained unauthorized access" to its list of customers, to the number of user accounts those customers had set up, and to the number of searches its customers have conducted."