The Cybersecurity Struggle

Cybersecurity issues are a constant source of worry for organizations of all sizes. In its 2021 State of Cybersecurity Resilience report, global company Accenture noted that security attacks increased 31% from 2020 to 2021, while earlier this year Cisco/Cybersecurity Ventures predicted that the cost of cybercrime will reach $10.5 trillion by 2025. Compounding the problem, for every advance by the "good guys," criminals develop increasingly complex ways to counter security measures—a never-ending game of cat-and-mouse.

Enter The University of Texas at Arlington's computer science and engineering faculty. These researchers are hard at work finding ways to strengthen security measures in hardware, software, and online privacy.

Hardware Security

Mohammad Islam has focused on hardware security for several years. After working to make large data centers more efficient, he realized that in doing so, he was ultimately making them less secure. Squeezing as much power as possible from a system makes it vulnerable to overloads, which causes it to slow down. Attackers exploit heavy usage to access systems when security measures aren't at full strength.

They do this by exploiting side channels—essentially systems that can talk to each other using unconventional means such as audio and heat—that give away information without users' knowledge, similar to a third party surreptitiously recording a conversation.

"Hardware security is important because when most people think of cybersecurity, they think of software and privacy," Dr. Islam says. "However, once they install antivirus software in a system and create a strong password, they don't consider flaws in the hardware that could break those security measures. When we build a system, we must build it in ways that assist security software."

A growing vulnerability is Internet-of-Things (IoT) devices, such as smart speakers, televisions, and refrigerators. Recent news reports have covered one of the prominent examples of the security issues found with smart speakers, where strangers hack in and talk to children or listen in on conversations. But attackers can also insert inaudible noise into the system that fools the smart speaker into thinking that a person is talking to it so the attacker can then access information or take over the system.

"There are more and more connected devices in our homes because they make our lives more convenient," Islam says. "Companies spend a lot of time making IoT devices more secure, but the bottom line is, they often cannot put standard security into devices because they're so small and have limited computing capabilities."

Smart appliances are a big target as well. There are many manufacturers building them, and the people in charge of design aren't necessarily security experts. Even if the system is built with security in mind, it isn't easy to install security updates, and consumers don't consider that their appliances may be a security risk, so they don't pay attention to potential issues.

Islam is also exploring how to transfer data from one computer to another without using a network. One way is to look at encryption keys that are very difficult to guess, but such keys are also very difficult to generate. Islam, however, has found that an antenna placed close to a computer will pick up electromagnetic signals that are random and can be used as encryption keys.

Another way to transfer data is to send information between two computers that are near each other through the power supply. Unfortunately, attackers may still be able to exploit the power delivery network to send data.

"We want people to think of adversarial scenarios when they design hardware security, but some proposed methods may also make them more vulnerable," Islam says. There is always potential for improved security, but we must think about how attackers might exploit the system."

Online Abuse and Safety

Preventing online abuse such as phishing, hate speech, and misinformation is a key part of Shirin Nilizadeh's research. She and her team are working to detect phishing websites and the people creating them, a difficult task because automated systems have to evaluate the entire internet to find them, and the websites constantly modify their strategies to avoid detection.

There are many anti-phishing software options and multiple open-source databases listing web addresses for phishing sites. Dr. Nilizadeh has been creating her own database, one that includes phishing websites that are harder to detect and not listed in other resources. She also established a data exchange with the Anti-Phishing Working Group to access and contribute to worldwide data.

"We identified online social media platforms as a new source for obtaining phishing reports," Nilizadeh says. "We noticed that people were report phishing websites on social media, so we started collecting these reports and had crawlers go through Twitter, Facebook, and Instagram to identify potential phishing websites. We also noticed that these reports provide rich information about phishing attacks. Thus, we used natural language processing to extract information, such as IP addresses, house domains, target domains, and screenshots of the pages."

This information is now helping the team create a much richer database.

"No one had used this resource previously," Nilizadeh adds. "The cybersecurity community can use this database to study techniques used by phishing websites and develop more robust algorithms for detecting them, so it's exciting."

The robustness of machine learning-based systems is another focus of her research. With Gautam Das, Nilizadeh is helping to identify biases in anti-abuse systems used by collaborative content sites like Yelp, YouTube, and Twitter. She will study bias in detecting and removing abusive content—for example, fake reviews, malicious content, and hate speech.

"Anti-abusive systems are closed systems," Nilizadeh says. "While trying to understand the behavior of anti-abusive systems, we focus on problematic features that might bias the function toward a particular group of users."

For instance, evidence shows that malicious users often create fake accounts pretending to be women, so anti-abuse systems may use gender as a feature in their algorithms.

"As a result, a benign message sent by a female account might have a higher probability of getting detected as malicious," Nilizadeh explains.

A third project involves looking at how adversaries try to trick machine-learning-based algorithms and mislead them. These algorithms are built to learn from large amounts of data, usually from the internet—for example, what anti-phishing or anti-abuse systems collect and analyze from the internet or social media. This data can be poisoned by the attacker with false information, with the aim of decreasing the performance of these systems. The attacker can also learn about the detection systems, find vulnerabilities, and create content that will avoid being detected in the future.

Nilizadeh has proposed methods for detecting poisoned data and identifying vulnerabilities of machine-learning-based systems to increase their adversarial robustness, such as an algorithm that verifies phishing reports.

Software Security

Software is everywhere, embedded in desktop machines, laptops, phones, and multiple other platforms. Because of this, there are myriad attacking surfaces for adversaries to breach. These adversaries often develop malware and ransomware that will run on top of installed software or systems so they can take over entire systems, costing billions in lost productivity and retrieval of lost information.

"It is a longstanding discussion in security that there is no 'silver bullet' to protect systems," says Assistant Professor Jiang Ming. "Every solution has a tradeoff, and when one side comes up with a new attack the other side comes up with a new solution, over and over."

He is creating virtual "sandbox" environments that allow computer security professionals to analyze Android malware without being detected by the code or its creators. The container-based virtualization architecture would allow him to isolate potential malware on up to eight virtual phones in a secure environment for analysis. The goal is to thwart malware that's capable of detecting sandboxes and shutting itself down to prevent analysis.

Dr. Ming is developing a design to ensure all virtualization activities run outside of the virtual phone. Currently, Android emulators and bare-metal machines are two major controlled environments for malware analysis. Android emulators enable fast and economic malware analysis, but their underlying virtualization techniques are fundamentally different from real devices and are detectable by malware. Bare-metal machines, meanwhile, only produce limited analysis.

"Security professionals may know a piece of code is suspicious and want to collect its characteristics and signature, so they put it in a box where it will exhibit its actual behaviors," Ming says. "This allows them to act upon the malware and prevent it from doing any damage. Container-based virtualization fools malware into thinking that it's in a real environment so it continues to run and show those characteristics."

Future trends in software security may include blending low-level hardware features and operating systems to design security.

"We need to continue to work in an interdisciplinary fashion to design more robust security solutions," Ming says. "If our solution works on software, we're on the same level as malware. However, if it works on the hardware, it will be much harder to detect and give us the advantage."