Social engineering attacks delivered via email, commonly known as phishing, represent a persistent cybersecurity threat leading to significant organizational incidents and data breaches. Although many organizations train employees on phishing, often mandated by compliance requirements, the real-world effectiveness of this training remains debated. Past work has demonstrated the ineffectiveness of training, but reproduction across different organizations, training approaches, and with a standardized threat assessment will help the generalizability of this phenomenon. To contribute to evidence-based cybersecurity policy, we conducted a large-scale reproduction study (N=12,511) at a US-based financial technology firm. Our design refined prior work by comparing training modalities in operational environments, applying NIST's standardized phishing difficulty measurement, and introducing novel organizational-level temporal resilience metrics. Echoing prior work, training interventions showed no significant main effects on click rates (p=0.450) nor reporting rates (p=0.417), with negligible effect sizes. However, we found that the NIST Phish Scale predicted user behavior, with click rates increasing from 7.0% (easy lures) to 15.0% (hard lures). Our organizational-level resilience result was mixed: 36-55% of campaigns achieved ''inoculation'' patterns where reports preceded clicks, but training did not significantly improve organizational-level temporal protection. Our results confirm the ineffectiveness of current phishing training approaches and offer a refined study design for future work.
论文检索
输入标题、作者或关键词，从 100,903 篇学术成果中精准定位
Malicious agents pose significant threats to the reliability and decision-making capabilities of Multi-Agent Systems (MAS) powered by Large Language Models (LLMs). Existing defenses often fall short due to reactive designs or centralized architectures which may introduce single points of failure. To address these challenges, we propose SentinelNet, the first decentralized framework for proactively detecting and mitigating malicious behaviors in multi-agent collaboration. SentinelNet equips each agent with a credit-based detector trained via contrastive learning on augmented adversarial debate trajectories, enabling autonomous evaluation of message credibility and dynamic neighbor ranking via bottom-k elimination to suppress malicious communications. To overcome the scarcity of attack data, it generates adversarial trajectories simulating diverse threats, ensuring robust training. Experiments on MAS benchmarks show SentinelNet achieves near-perfect detection of malicious agents, close to 100% within two debate rounds, and recovers 95% of system accuracy from compromised baselines. By exhibiting strong generalizability across domains and attack patterns, SentinelNet establishes a novel paradigm for safeguarding collaborative MAS.
The real-time demand for web security makes Security Information and Event Management (SIEM) platforms and their applied security rule an integral part of the intrusion detection life-cycle. However, the heterogeneity of vendor-specific rules (e.g., Splunk SPL, Microsoft KQL, IBM AQL, Google YARA-L, and RSA ESA) makes cross-platform rule reuse extremely difficult, requiring deep domain knowledge for reliable conversion. As a result, an autonomous and accurate rule conversion framework can significantly lead to effort savings, preserving the value of existing rules. In this paper, we propose ARuleCon, an agentic SIEM-rule conversion approach. Using ARuleCon, the security professionals do not need to distill the source rules' logic and re-map it to target vendors, instead, they provide the source rules, the documentation of the target rules and ARuleCon can purposely convert to the target vendors without more intervention. To achieve this, ARuleCon is equipped with intermediate representation (IR) that aligns core detection logic into vendor-neutral layer, agentic RAG pipeline that retrieves authoritative official vendor documentation to address the convension/schema mismatches, and Python-based consistency check that running both source and target rules in controlled test environments to mitigate subtle semantic drifts. We present a comprehensive evaluation of ARuleCon ranging from textual alignment between the source and target rules, and the execution success of target rules, showcasing ARuleCon can convert rules with higher fidelity, outperforming the baseline LLM models by 15% averagely. Finally, we perform a case study and interview with our industry collaborators 1, which showcases that ARuleCon can significantly save the expert's time on understanding the cross-SIEM's documentation and remapping the logic.
Large web-scale datasets have driven the rapid advancement of pre-trained language models (PLMs), but unauthorized data usage has raised serious copyright concerns. Existing dataset ownership verification (DOV) methods typically assume that watermarks remain stable during inference; however, this assumption often fails under natural noise and adversary-crafted perturbations. We propose the first certified dataset ownership verification method for PLMs under a gray-box setting (i.e., the defender can only query the suspicious model but is aware of its input representation module), based on dual-space smoothing (i.e., DSSmoothing). To address the challenges of text discreteness and semantic sensitivity, DSSmoothing introduces continuous perturbations in the embedding space to capture semantic robustness and applies controlled token reordering in the permutation space to capture sequential robustness. DSSmoothing consists of two stages: in the first stage, triggers are collaboratively embedded in both spaces to generate norm-constrained and robust watermarked datasets; in the second stage, randomized smoothing is applied in both spaces during verification to compute the watermark robustness (WR) of suspicious models and statistically compare it with the principal probability (PP) values of a set of benign models. Theoretically, DSSmoothing provides provable robustness guarantees for dataset ownership verification by ensuring that WR consistently exceeds PP under bounded dual-space perturbations. Extensive experiments on multiple representative web datasets demonstrate that DSSmoothing achieves stable and reliable verification performance and exhibits robustness against potential adaptive attacks. Our code is available at https://github.com/NcepuQiaoTing/DSSmoothing.
Deep neural networks (DNNs) have achieved remarkable success across various domains, but their reliance on large datasets often containing sensitive information raises significant privacy concerns. In response to stringent privacy regulations such as GDPR and CCPA, machine unlearning (MUL) has emerged as a critical technique to remove the influence of specific data samples from trained models. However, existing unlearning methods face two major challenges: privacy deficiencies in the remaining datasets and significant instability of the model after unlearning. To address these issues, we propose DeepUL, a deep unlearning algorithm that leverages model sparsity to enhance both privacy and stability. DeepUL follows a two-step process: first pruning and then unlearning. The pruning step not only sparsifies the model but also decouples the model parameters from the original training data, thereby improving privacy. The unlearning step employs gradient projection to eliminate dependencies on the data to be deleted while maintaining the model stability. Additionally, we introduce a hierarchical weight pruning strategy to achieve differential pruning across network layers, preventing layer collapse and ensuring robustness. Extensive experiments on benchmark datasets demonstrate that DeepUL outperforms existing methods in utility, unlearning efficacy, privacy guarantee, and stability, making it a practical and effective solution for machine unlearning.
WebAssembly (Wasm) enables execution of memory-unsafe languages like C/C++ in the browser, but its monolithic linear memory leaves modules vulnerable to high-impact attacks such as cross-site scripting. Existing defenses are unsuitable for commercial-off-the-shelf (COTS) binaries, requiring either source code, non-standard runtimes, or introduce high-overhead instrumentation. We present Bento, the first static binary rewriter that automatically hardens COTS Wasm modules. Bento uses whole-program pointer analysis to partition memory into logical regions (stack, heap, globals) and rewrites the binary to map each region to an isolated instance using the standard Wasm multi-memory feature. This creates a software-based MMU that provides architectural hardening without adding instructions or costly runtime checks. Our evaluation shows that Bento mitigates real-world exploits in prominent applications, including Libpng and PDFAlto, while preserving program semantics, as confirmed by differential testing. Since our architectural approach adds no new instructions, Bento only induces 3% runtime slowdown and a 1% startup overhead.
The rapid proliferation of large language models (LLMs) in web-scale applications has heightened the need for robust security mechanisms. To address these challenges, various guardrail strategies have been introduced, including input filters, output moderation, and model alignment. Among them, input-side guardrails are commonly adopted as the first line of defense against adversarial prompts. However, we identify a critical architectural weakness: a representation asymmetry between input-side guardrails and the core LLMs, which creates a security gap exploitable by adversaries. Through systematic analysis, we show that guardrails are fragile when facing minor character perturbations, while LLMs remain semantically resilient and can still reconstruct malicious intent from noisy inputs. Exploiting this asymmetry, we propose RepMism, a hybrid adversarial framework that combines character injection with chain-of-thought hijacking, coordinated through hierarchical scheduling and safety continuation. Our extensive empirical evaluation across four commercial LLMs and five state-of-the-art guardrails demonstrates RepMism's strong attack capability, achieving high success rates. Importantly, we identify a ''success interval'' where perturbations effectively bypass guardrail detection yet remain interpretable to target models. These findings expose key flaws in current multi-layer security architectures and offer actionable guidance for building more resilient defenses through perturbation-aware training and cross-layer representation alignment.
Hidden web interfaces in Internet of Things (IoT) devices pose significant security threats by unintentionally exposing inadequately protected functionalities, enabling attackers to bypass authentication, alter configurations, leak sensitive data, or execute arbitrary commands. Despite recent advancements, current detection approaches suffer from two critical challenges: 1) inadequately model the complex internal routing mechanisms of IoT firmware, leading to incomplete interface enumeration and substantial false negatives; and 2) inefficiently generate probing requests and verify unauthorized access due to limited semantic understanding of interface communication protocols. To overcome these challenges, we introduce FalconScope, a novel system combining precise firmware routing modeling and Large Language Model (LLM)-driven semantic analysis to detect hidden web interfaces effectively and efficiently. FalconScope achieves this through two key innovations: 1) a static analysis technique precisely reconstructs the device's internal routing mechanisms, enabling comprehensive enumeration of Routing Unique Identifiers and their corresponding backend handlers; and 2) an LLM-powered semantic engine automatically generates syntactically and semantically valid HTTP requests to efficiently trigger backend logic, coupled with semantic validation of device responses to accurately confirm unauthorized access. Evaluations on 11 real-world IoT devices from four major vendors demonstrate that FalconScope significantly surpasses existing state-of-the-art tools, detecting 620 hidden web interfaces—103 times more than IoTScope—while consuming only 3.6% of its analysis time. Following responsible disclosure, 50 issues have been assigned CVE IDs.
Decentralized identity (DID) is a key infrastructure for Web3, granting users sovereign control over their private identity data. While existing DID systems like FADID-TT (WWW'25) realize anonymity and traceability within a single domain, the Web3 ecosystem is a multiverse of independent domains like DeFi, GameFi, and DAO. This multi-domain reality presents critical issues for current DID solutions. First, most existing solutions are built on the monolithic committee architecture, facing severe scalability bottlenecks as the committee size grows. Second, most existing solutions cannot offer strong cross-domain anonymity, where frequent cross-domain interaction inevitably exposes the user's privacy. Third, existing methods for tracing the identities of malicious users are inefficient. To address these issues, we propose ShadowClone, a DID system that offers strong scalability, cross-domain anonymity, and efficient accountable traceability. Firstly, we introduce a sharding architecture that partitions the global system into multiple independent domain committees, enhancing system scalability. Moreover, we realize strong cross-domain anonymity, a new and stronger privacy guarantee for multi-domain DID systems. We design a domain-hiding presentation protocol based on an accountable ring signature scheme. A user can prove membership in a trusted set of domains without revealing home domain, preventing profiling based on domain affiliation. Furthermore, we design a hierarchical cross-domain tracing mechanism to ensure efficient accountable traceability. An opening committee first identifies the user's home domain and the home domain committee efficiently traces user identity within a smaller scope. Notably, the entire tracing process is distributed and publicly verifiable. Lastly, we conduct extensive experiments. The evaluation results demonstrate that ShadowClone realizes only the 10.4% and 20% registration and tracing latency compared with FADID-TT, respectively, showcasing high scalability and tracing efficiency compared with FADID-TT while providing strong cross-domain anonymity and decentralization for Web3.
Federated Unlearning (FU) has emerged as a promising paradigm for effectively removing the influence of specific data of clients from the global model in federated learning. It can further enhance personal data privacy for individual clients and eliminate the impact of malicious attacks like poisoning. Due to these benefits, many FU methods have been analyzed and proposed. Yet, they largely overlook external threats against FU systems, such as gradient inversion attacks that reconstruct client data from shared gradients, posing serious privacy risks to other participating clients. Motivated by this, we propose DIARY, a Differential prIvacy IntegrAted fedeRated recoverY framework to address these dual threats. DIARY presents a privacy budget allocation method, whose insight lies in adaptively assigning appropriate privacy budgets to various training and recovery phases to fully utilize the global privacy budget of each client, balancing the trade-off between privacy and utility. Furthermore, DIARY introduces a novel Federated noise-Immune aNomaly Detection (FIND) module. The deep integration of FIND with two-level selective storage and model rollback mechanisms contributes to model recovery, while significantly reducing the associated overhead. Finally, both rigorous theoretical analysis and extensive simulations compared with state-of-the-art methods are conducted to validate the effectiveness of DIARY.
Website Fingerprinting (WF) is an emerging traffic analysis technique that enables a passive adversary to infer which websites a user visits. However, most existing studies, whether in single-tab or multi-tab settings, rely on the unrealistic assumption that users only access website homepages, diverging significantly from real-world browsing behavior. Even recent works extending WF to subpages primarily focus on website-level identification, without distinguishing which specific subpages are visited, thereby limiting the attack's granularity and scope. In this paper, we propose HiFi-WF (Hierarchical Fine-grained Website Fingerprinting), a novel framework that breaks the homepage-only assumption and extends WF to multi-tab recognition and fine-grained subpage identification. We formulate the task as a hierarchical multi-label classification problem, jointly modeling the distinctions and correlations between homepages and subpages. To this end, HiFi-WF integrates a unified CNN-based extractor and layered encoder with a Feature Interaction Module based on multi-head cross-attention to capture inter-level dependencies. An Enhanced SubHead enforces hierarchical constraints to suppress invalid subpage predictions, while a cascaded channel–spatial attention mechanism refines discriminative features for precise hierarchical identification. Experimental results demonstrate that HiFi-WF achieves state-of-the-art performance at both hierarchical levels, attaining F1-scores of 92.1% (homepage) and 81.9% (subpage), thereby validating its effectiveness in advancing WF attacks toward realistic, fine-grained, and multi-tab browsing scenarios. Related codes and datasets can be found in https://github.com/wusongyang02-blip/HiFi-WF.
While Tor's strong anonymity shields users' privacy, it also enables malicious activities, motivating attacks that bypass its protections. Website Fingerprinting (WF) has emerged as a primary threat in this domain. However, existing WF methods struggle with realistic multi-tab browsing scenarios, often relying on prior knowledge of the number of open tabs and lacking robustness against network noise and defenses. To address these challenges, we propose Forge, a robust WF attack framework inspired by the classic cocktail party problem. Specifically, Forge reframes multi-tab WF as a task of Blind Source Separation(BSS), decomposing mixed traffic into individual signals without requiring a predefined number of concurrent tabs. A robust website identifier then classifies separated components using a dual-domain attention mechanism across time and frequency, allowing Forge to effectively resist WF defenses and network noise. We evaluate our model on a comprehensive collection of datasets covering open-world, defense-enabled, and dynamic scenarios. The results demonstrate that Forge can improve Mean Average Precision by 78.6% over the state-of-the-art average in the challenging multi-tab open-world scenario.
Web browsers store cookies to save a user's authentication status. Sharing these authentication cookies across subdomains, a common practice for user convenience, creates a critical session hijacking vulnerability. When cookies for a parent domain are sent to all subdomains, an attacker who compromises any single subdomain can intercept them. Using these stolen cookies, the attacker can impersonate users across all other services hosted on the domain. We conduct the first ethical, large-scale evaluation of authentication cookie leakage to compromised subdomains caused by insecure cookie scoping, a vulnerability we call ''CookieDrift''. We develop a novel, non-intrusive, and ethical method to detect CookieDrift by simulating a hijacked subdomain and recording all leaked cookies. From a list of over 2,500 popular domains with accounts, 57.98% (1,472) are vulnerable to cookie theft. Of these, 45.45% (669 domains) are immediately exploitable through subdomain takeover attacks. We find evidence of active, real-world hijacks affecting 186 domains and discover authentication cookies from these domains in darknet leaks using ''CookieDelta'', a new filtering technique we developed to isolate authentication-relevant cookie names. We investigate root causes of insecure cookie sharing by reviewing RFCs and major authentication frameworks and conclude: Defaults are secure, but examples encourage excessive cookie sharing caused by limitations in RFC 6265. We propose countermeasures that preserve backward-compatibility and ease-of-use while enabling finer-grained control over cookie propagation. We include two key artifacts: a locally running web application, ''DeltaInterceptor'', for testing any website's vulnerability to CookieDrift as well as computing CookieDelta, and a sanitized dataset of all recorded cookies.
The Domain Name System (DNS) plays a crucial role in modern web applications; however, manipulations such as hijacking, tampering, and censorship can disrupt domain resolution, posing significant privacy and security risks. While such manipulations are prevalent across global DNS infrastructures, their scope and mechanisms remain poorly understood. Existing studies focus on country-level censorship or rely on authoritative data and passive traffic from selected domains, which prevents a comprehensive understanding. Moreover, the dynamic nature of modern DNS resolution, in which a single domain may resolve to thousands of edge servers, further complicates the detection of manipulated responses. In this work, we propose a novel approach for measuring DNS manipulations based on resolution path analysis. Our method leverages CNAME chains and attributes of intermediate nodes in the DNS resolution process to link dynamic resolution results, enabling accurate detection of manipulation in highly dynamic DNS environments. We conduct large-scale measurements for 2,283 popular domains across global open DNS infrastructures. Measurement results reveal critical insights into DNS manipulation, uncovering the strategies and preferences of malicious manipulation operators and demonstrating how specific domains are exploited.
While the literature features a number of proposals to defend against transaction manipulation attacks, existing proposals are still not integrated within large blockchains, such as Bitcoin, Ethereum, and Cardano. Instead, the user community opted to rely on more practical but ad-hoc solutions (such as Mempool.space) that aim at detecting censorship and transaction displacement attacks by auditing discrepancies in the mempools of so-called observers. In this paper, we precisely analyze, for the first time, the interplay between mempool auditing and the ability to detect censorship and transaction displacement attacks by malicious miners in Bitcoin and Ethereum. Our analysis shows that mempool auditing can result in mis-accusations against miners with a probability larger than 25% in some settings. On a positive note, however, we show that mempool auditing schemes can successfully audit the execution of any two transactions (with an overwhelming probability of 99.9%) if they are consistently received by all observers and sent at least 30 seconds apart from each other. As a direct consequence, our findings show, for the first time, that batch-order fair-ordering schemes can offer only strong fairness guarantees for a limited subset of transactions in real-world deployments.
LLM-powered agents are evolving from passive recommenders into autonomous executors, leveraging tools via the Model Context Protocol (MCP) for web automation. However, this paradigm introduces a new vulnerability: tool poisoning attacks that manipulate the MCP context can corrupt an agent's reasoning. Existing methods focus on anomaly detection and lack autonomous correction mechanisms, hindering their real-world deployment. In this paper, we introduce MCPFixGen, to the best of our knowledge, the first framework to provide automated anomaly detection and correction. We tackle three fundamental challenges: (1) when to initiate anomaly inspection with minimal overhead, (2) what features effectively characterize abnormality, and (3) how to automatically execute remedial actions. MCPFixGen achieves this through a novel multi-checkpoint rollback mechanism for anomaly management. MCPFixGen proposes a multi-checkpoint rollback anomaly management mechanism. Strategically places checkpoints at high-risk operations based on the tools-calling risk distribution. Then it identifies unanticipated tool behaviors by leveraging the correlation between attention activation values and tool calls. Finally, it introduces an attention-mask-based backtracking and correction mechanism. By masking the root cause of the anomaly, the LLM is prompted to re-infer, facilitating efficient and low-cost anomaly resolution. Our evaluation on real-world datasets demonstrates that MCPFixGen reduces interruptions caused by anomalies to below 13%, decreases the success rate of tool poisoning attacks to less than 0.3%, and significantly improves the robustness, computational efficiency, and task completion rate of web intelligence applications compared to existing approaches.
The emergence of Large Language Model-enhanced Search Engines (LLMSEs) has revolutionized information retrieval by integrating web-scale search capabilities with AI-powered summarization. While these systems demonstrate improved efficiency over traditional search engines, their security implications against well-established black-hat Search Engine Optimization (SEO) attacks remain unexplored. In this paper, we present the first systematic study of SEO attacks targeting LLMSEs. Specifically, we examine ten representative LLMSE products (e.g., ChatGPT, Gemini) and construct SEO-Bench, a benchmark comprising 1,000 real-world black-hat SEO websites, to evaluate both open- and closed-source LLMSEs. Our measurements show that LLMSEs mitigate over 99.78% of traditional SEO attacks, with the phase of retrieval serving as the primary filter, intercepting the vast majority of malicious queries. We further propose and evaluate seven LLMSEO attack strategies, demonstrating that off-the-shelf LLMSEs are vulnerable to LLMSEO attacks, i.e., rewritten-query stuffing and segmented texts double the manipulation rate compared to the baseline. This work offers the first in-depth security analysis of the LLMSE ecosystem, providing practical insights for building more resilient AI-driven search systems. We have responsibly reported the identified issues to major vendors.
Privacy leakage on Web-based platform has become a critical challenge as users continually share personal information through online social networks, health tracking platforms, and other Web services. Information recipients and third-party can progressively aggregate shared content across the Web, enabling increasingly accurate profiling of individuals. However, existing studies typically treat each disclosure as independent, overlooking the cumulative privacy risks that arise in continual information sharing. In addition, the subjective cognition of both users and adversaries in Web environments, where users and adversaries can dynamically adapt based on observable actions, remains underexplored. To address these challenges, we propose a dynamic Stackelberg game model for continual information sharing scenarios, where user's sequential privacy decisions are optimized to balance privacy protection and data utility. The model explicitly captures the cognitive behaviors of both the user and the adversary, allowing their subjective perceptions to shape the Stackelberg equilibrium. Building on this formulation, we develop a reinforcement learning-based algorithm to derive approximately optimal strategies for mitigating privacy leakage in the context of continual information sharing. Experiments on real-world datasets demonstrate that our method significantly reduces cumulative privacy risks while preserving the utility of shared content. The proposed model further provides actionable insights for the design of privacy-enhancing technologies and web platform policies.
Graph unlearning (GU), which removes nodes, edges, or features from trained graph neural networks (GNNs), is crucial in Web applications where graph data may contain sensitive, mislabeled, or malicious information. However, existing GU methods lack a clear understanding of the key factors that determine unlearning effectiveness, leading to three fundamental limitations: (1) impractical and inaccurate GU difficulty assessment due to test-access requirements and invalid assumptions, (2) ineffectiveness on hard-to-unlearn tasks, and (3) misaligned evaluation protocols that overemphasize easy tasks and fail to capture true forgetting capability. To address these issues, we establish GNN memorization as a new perspective for understanding graph unlearning and propose MGU, a Memorization-guided Graph Unlearning framework. MGU achieves three key advances: it provides accurate and practical difficulty assessment across different GU tasks, develops an adaptive strategy that dynamically adjusts unlearning objectives based on difficulty levels, and establishes a comprehensive evaluation protocol that aligns with practical requirements. Extensive experiments on ten real-world graphs demonstrate that MGU consistently outperforms state-of-the-art baselines in forgetting quality, computational efficiency, and utility preservation.
Network intrusion detection systems (NIDS) are essential for web security by identifying and dropping malicious traffic. Existing in-network NIDS leverage the Tbps-level packet processing capability of programmable switches to achieve high-speed flow classification. They translate complex trained machine learning models to decision trees (DTs), where DTs are deployed on programmable switches via single-DT or multiple-DT deployment. However, they face a fundamental trade-off: single-DT deployment suffers from low classification accuracy due to over-pruning of trees, while multiple-DT deployment suffers from high overhead due to deploying multiple tree replicas. In this paper, we propose Proteus, an in-network malicious traffic detection system that achieves both high classification accuracy and low overhead. Its key idea is to split the original DT into critical and normal sub-trees, where these sub-trees have different impacts on overall accuracy. More precisely, Proteus first splits a DT into one critical and several normal sub-trees for adapting to the accuracy requirement and switch resource budgets. Second, it minimizes coordination overhead between sub-trees while ensuring full flow coverage via mixed-integer linear programming. Third, it dynamically reallocates or migrates sub-trees to adapt to changing resources by monitoring both classification accuracy and switch resource changes. Testbed experiments with 12.8 Tbps programmable switches show that Proteus improves classification accuracy, reduces switch resource consumption, and reduces classification latency.