Recent Topics in IT-Security and Applications of Deep Learning

With the rapid proliferation of Internet of Things (IoT) devices, embedded systems, and Artificial Intelligence (AI)-powered technologies, computing architectures are becoming increasingly complex, raising new security challenges. The volume of information generated by these systems is growing exponentially, and as data complexity increases, so too does the potential for sophisticated attacks. These new attack surfaces necessitate advanced methodologies for detection and security services to counter them. In our highly connected world, security cannot be overlooked. The growing influence of AI and Deep Learning (DL) techniques, which are becoming increasingly powerful, presents a unique opportunity to evolve the methods used to safeguard, monitor, test, and verify these systems. Active monitoring is essential for ensuring system integrity, with Anomaly Detection Systems (ADS) playing a key role in identifying threats in real-time and consequently allowing a reaction in real-time. As computing systems become more advanced, traditional approaches are no longer sufficient. Leveraging the breakthroughs of AI and DL tools significantly enhances the reliability of both large and small systems, enabling fine-grained event analysis and immediate response. Equally important are systems that enforce integrity and security by regulating various aspects of modern systems, such as access, control, and protection. In a rapidly evolving world, where attack surfaces expand quickly, traditional methods (e.g., passwords) are no longer sufficiently effective. This highlights the necessity of developing methodologies that leverage current technologies, such as AI, to build more resilient systems. Moreover, the development of advanced hardware for powering AI systems introduces new challenges in verification, making traditional hardware verification methods obsolete. As a result, hardware fuzzing has emerged as an effective approach for exploring and analyzing computing architectures, ultimately detecting security vulnerabilities in large-scale designs like modern processors. Similarly to anomaly detection and security services, traditional testing methodologies are being enhanced or replaced by recent AI developments. Leveraging cutting-edge deep learning techniques allows for more extensive and thorough testing of complex computing systems. Security is becoming increasingly important. However, in the broader IT landscape, many other topics are emerging and growing at a pace comparable to that of AI. Within this domain, social networks operate at a higher level, serving as major platforms for the exchange of information and social interaction. At a more fundamental level, however, lies the communication infrastructure such as those satellite-based for which are critical to ensure location privacy for content sharers, especially in high-risk or politically sensitive situations. Protecting the anonymity and physical safety of individuals who disseminate information in such contexts is becoming not only a technical challenge, but also a moral imperative in our increasingly interconnected world. This dissertation focuses principally on the applications of Deep Learning to three main areas: first, we investigate advanced anomaly detection approaches based on deep learning in two complex real-world security domains, i.e., software security and IoT networks security. Second, we explore services that ensure the integrity and security of systems, focusing particularly on biometric authentication leveraging deep learning. Lastly, we introduce a novel approach to hardware verification using the potential of recent deep learning advancements, such as Large Language Models (LLMs), aiming to improve vulnerability detection through more efficient test case generation. Finally, we briefly explore two predominant emerging topics in IT. Specifically, we investigate the engagement phenomenon in social networks utilizing machine learning and deep learning techniques, and the field of location privacy for satellite communication. Deep Learning for Anomaly Detection in Complex Security Domains Anomaly Detection Systems (ADS) are techniques used to identify anomalous patterns in data that deviate from a normal baseline. These systems have found applications across a wide range of use cases where even slight variations in the data play a significant role. In particular, they have been successfully employed in healthcare, finance, telecommunications, and cybersecurity. However, in a connected world of complex systems, traditional methods that rely on human experts to verify events after they occur are no longer sufficient. With the increasing pervasiveness of AI and Machine Learning (ML) techniques, driven by their continuous improvement, anomaly detection systems have evolved by integrating these new technologies. ML has proven to be essential in significantly enhancing detection performance and making these systems more scalable and capable of handling much more considerable amounts of interdependent data. Furthermore, from a business perspective, machine learningbased anomaly detection also represents a more cost-effective solution, as once deployed, it does not require particular user interaction. In this thesis, we discuss two applications of anomaly detection systems in the context of cybersecurity. Firstly, in the software domain, we tackle the problem of Control-Flow Attestation (CFA) by introducing a deep learning system that enhances the real-world applicability of CFA under realistic assumptions. Specifically, we design an anomaly detection framework based on Graph Neural Networks (GNN), capable of detecting control and non-control data attacks such as Return-Oriented Programming (ROP) and Data-Oriented Programming (DOP) attacks. Secondly, in the setting of IoT smart homes, we present an anomaly detection system based on modelling users’ behavior through a deep learning approach based on a Recurrent Autoencoder (RAE), capable of recognizing control-plane exploitation attacks, as well as unknown stealthy attacks that aim to compromise the smart home or harm the users. Specifically, this part of the thesis is based on the following publications: [CMO+24] M. CHILESE, R. MITEV, M. ORENBACH, R. THORBURN, A. ATAMLI, A.-R. SADEGHI. “One for All and All for One: GNN-based Control-Flow Attestation for Embedded Devices”. In: Symposium on Security and Privacy (S&P). IEEE Computer Society, 2024. CORE Rank: A* [RCM+23] P. RIEGER, M. CHILESE, R. MOHAMED, M. MIETTINEN, H. FEREIDOONI, A.-R. SADEGHI. “ARGUS: Context-Based Detection of Stealthy IoT Infiltration Attacks”. In: USENIX Security Symposium. USENIX Association, 2023. CORE Rank: A*. Deep Learning for System Integrity and Security Security services such as access control, authorization, and authentication are fundamental in safeguarding computing systems in today’s digital landscape. However, as systems evolve rapidly, ensuring system integrity has become more critical than ever. Traditional security services, though essential, face limitations in addressing modern threats. Monitoring systems using machine learning play a vital role in detecting breaches, but they must be supplemented with proactive measures to prevent malicious activities. Key services like access control, authorization, and authentication remain crucial for protecting sensitive data and ensuring privacy in dynamic environments. Among these services, authentication is particularly important, as it is the frontline defence against unauthorized users. Traditionally reliant on passwords to verify user identity, authentication faces challenges due to the vulnerability of passwords to hacking and the risk of weak or reused credentials, which can lead to security risks like identity theft. To address these concerns, biometric authentication has emerged as a more robust alternative, leveraging the high complexity of cloning or mimicking biometric patterns. In this thesis, we present a novel continuous behavioral biometric authentication scheme that leverages a deep learning solution, specifically a Siamese Neural Networks (SNNs) trained utilizing a few-shot learning paradigm, to provide an efficient, scalable and dynamic solution for user authentication, leveraging smartphones motion sensor data to model users’ behavior while interacting with a security-critical application, such as a home banking application. Specifically, this part of the thesis is based on the following publication: [FKR+23] H. FEREIDOONI, J. KÖNIG, P. RIEGER, M. CHILESE, B. GÖKBAKAN, M. FINKE, A. DMITRIENKO, A.-R. SADEGHI. “AuthentiSense: A Scalable Behavioral Biometrics Authentication Scheme Using Few-Shot Learning for Mobile Platforms”. In: Network and Distributed System Security Symposium (NDSS). The Internet Society, 2023. CORE Rank: A*. Deep Learning for Hardware Verification Hardware verification is a crucial process for ensuring that every component of a hardware system operates correctly and meets specified requirements. This multifaceted process involves evaluating various aspects of a system, such as performance, functionality, and security characteristics. As the complexity of hardware design in modern processing units increases, thorough verification becomes critical. Business-wise, verifying hardware before production (i.e., pre-silicon) plays a crucial role in the hardware development cycle, as being able to verify the integrity of a design could prevent future consistent losses for amending a flawed design. Thus, hardware fuzzing has emerged as a practical methodology for efficiently verifying hardware that is continuously increasing in complexity. However, exploring modern designs presents intrinsic challenges. The progress of AI and generative AI is now beginning to play a role in optimizing this process, particularly by generating more effective tests that enable faster and more efficient testing, allowing a deeper understanding of the Design Under