@misc{PodlesnyKayemMeinel2019, author = {Podlesny, Nikolai Jannik and Kayem, Anne V. D. M. and Meinel, Christoph}, title = {Attribute Compartmentation and Greedy UCC Discovery for High-Dimensional Data Anonymisation}, series = {Proceedings of the Ninth ACM Conference on Data and Application Security and Privacy}, journal = {Proceedings of the Ninth ACM Conference on Data and Application Security and Privacy}, publisher = {Association for Computing Machinery}, address = {New York}, isbn = {978-1-4503-6099-9}, doi = {10.1145/3292006.3300019}, pages = {109 -- 119}, year = {2019}, abstract = {High-dimensional data is particularly useful for data analytics research. In the healthcare domain, for instance, high-dimensional data analytics has been used successfully for drug discovery. Yet, in order to adhere to privacy legislation, data analytics service providers must guarantee anonymity for data owners. In the context of high-dimensional data, ensuring privacy is challenging because increased data dimensionality must be matched by an exponential growth in the size of the data to avoid sparse datasets. Syntactically, anonymising sparse datasets with methods that rely of statistical significance, makes obtaining sound and reliable results, a challenge. As such, strong privacy is only achievable at the cost of high information loss, rendering the data unusable for data analytics. In this paper, we make two contributions to addressing this problem from both the privacy and information loss perspectives. First, we show that by identifying dependencies between attribute subsets we can eliminate privacy violating attributes from the anonymised dataset. Second, to minimise information loss, we employ a greedy search algorithm to determine and eliminate maximal partial unique attribute combinations. Thus, one only needs to find the minimal set of identifying attributes to prevent re-identification. Experiments on a health cloud based on the SAP HANA platform using a semi-synthetic medical history dataset comprised of 109 attributes, demonstrate the effectiveness of our approach.}, language = {en} } @misc{SeidelKrentzMeinel2019, author = {Seidel, Felix and Krentz, Konrad-Felix and Meinel, Christoph}, title = {Deep En-Route Filtering of Constrained Application Protocol (CoAP) Messages on 6LoWPAN Border Routers}, series = {2019 IEEE 5th World Forum on Internet of Things (WF-IoT)}, journal = {2019 IEEE 5th World Forum on Internet of Things (WF-IoT)}, publisher = {Institute of Electrical and Electronics Engineers}, address = {New York}, isbn = {978-1-5386-4980-0}, doi = {10.1109/WF-IoT.2019.8767262}, pages = {201 -- 206}, year = {2019}, abstract = {Devices on the Internet of Things (IoT) are usually battery-powered and have limited resources. Hence, energy-efficient and lightweight protocols were designed for IoT devices, such as the popular Constrained Application Protocol (CoAP). Yet, CoAP itself does not include any defenses against denial-of-sleep attacks, which are attacks that aim at depriving victim devices of entering low-power sleep modes. For example, a denial-of-sleep attack against an IoT device that runs a CoAP server is to send plenty of CoAP messages to it, thereby forcing the IoT device to expend energy for receiving and processing these CoAP messages. All current security solutions for CoAP, namely Datagram Transport Layer Security (DTLS), IPsec, and OSCORE, fail to prevent such attacks. To fill this gap, Seitz et al. proposed a method for filtering out inauthentic and replayed CoAP messages "en-route" on 6LoWPAN border routers. In this paper, we expand on Seitz et al.'s proposal in two ways. First, we revise Seitz et al.'s software architecture so that 6LoWPAN border routers can not only check the authenticity and freshness of CoAP messages, but can also perform a wide range of further checks. Second, we propose a couple of such further checks, which, as compared to Seitz et al.'s original checks, more reliably protect IoT devices that run CoAP servers from remote denial-of-sleep attacks, as well as from remote exploits. We prototyped our solution and successfully tested its compatibility with Contiki-NG's CoAP implementation.}, language = {en} } @misc{AlhosseiniAlmodarresiYasinBinTareafNajafietal.2019, author = {Alhosseini Almodarresi Yasin, Seyed Ali and Bin Tareaf, Raad and Najafi, Pejman and Meinel, Christoph}, title = {Detect me if you can}, series = {Companion Proceedings of The 2019 World Wide Web Conference}, journal = {Companion Proceedings of The 2019 World Wide Web Conference}, publisher = {Association for Computing Machinery}, address = {New York}, isbn = {978-1-4503-6675-5}, doi = {10.1145/3308560.3316504}, pages = {148 -- 153}, year = {2019}, abstract = {Spam Bots have become a threat to online social networks with their malicious behavior, posting misinformation messages and influencing online platforms to fulfill their motives. As spam bots have become more advanced over time, creating algorithms to identify bots remains an open challenge. Learning low-dimensional embeddings for nodes in graph structured data has proven to be useful in various domains. In this paper, we propose a model based on graph convolutional neural networks (GCNN) for spam bot detection. Our hypothesis is that to better detect spam bots, in addition to defining a features set, the social graph must also be taken into consideration. GCNNs are able to leverage both the features of a node and aggregate the features of a node's neighborhood. We compare our approach, with two methods that work solely on a features set and on the structure of the graph. To our knowledge, this work is the first attempt of using graph convolutional neural networks in spam bot detection.}, language = {en} } @misc{StaubitzMeinel2019, author = {Staubitz, Thomas and Meinel, Christoph}, title = {Graded Team Assignments in MOOCs}, series = {SCALE}, journal = {SCALE}, publisher = {Association for Computing Machinery}, address = {New York}, isbn = {978-1-4503-6804-9}, doi = {10.1145/3330430.3333619}, pages = {10}, year = {2019}, abstract = {The ability to work in teams is an important skill in today's work environments. In MOOCs, however, team work, team tasks, and graded team-based assignments play only a marginal role. To close this gap, we have been exploring ways to integrate graded team-based assignments in MOOCs. Some goals of our work are to determine simple criteria to match teams in a volatile environment and to enable a frictionless online collaboration for the participants within our MOOC platform. The high dropout rates in MOOCs pose particular challenges for team work in this context. By now, we have conducted 15 MOOCs containing graded team-based assignments in a variety of topics. The paper at hand presents a study that aims to establish a solid understanding of the participants in the team tasks. Furthermore, we attempt to determine which team compositions are particularly successful. Finally, we examine how several modifications to our platform's collaborative toolset have affected the dropout rates and performance of the teams.}, language = {en} } @misc{BockMatysikKrentzetal.2019, author = {Bock, Benedikt and Matysik, Jan-Tobias and Krentz, Konrad-Felix and Meinel, Christoph}, title = {Link Layer Key Revocation and Rekeying for the Adaptive Key Establishment Scheme}, series = {2019 IEEE 5TH World Forum on internet of things (WF-IOT)}, journal = {2019 IEEE 5TH World Forum on internet of things (WF-IOT)}, publisher = {IEEE}, address = {New York}, isbn = {978-1-5386-4980-0}, doi = {10.1109/WF-IoT.2019.8767211}, pages = {374 -- 379}, year = {2019}, abstract = {While the IEEE 802.15.4 radio standard has many features that meet the requirements of Internet of things applications, IEEE 802.15.4 leaves the whole issue of key management unstandardized. To address this gap, Krentz et al. proposed the Adaptive Key Establishment Scheme (AKES), which establishes session keys for use in IEEE 802.15.4 security. Yet, AKES does not cover all aspects of key management. In particular, AKES comprises no means for key revocation and rekeying. Moreover, existing protocols for key revocation and rekeying seem limited in various ways. In this paper, we hence propose a key revocation and rekeying protocol, which is designed to overcome various limitations of current protocols for key revocation and rekeying. For example, our protocol seems unique in that it routes around IEEE 802.15.4 nodes whose keys are being revoked. We successfully implemented and evaluated our protocol using the Contiki-NG operating system and aiocoap.}, language = {en} } @misc{BartzYangBethgeetal.2019, author = {Bartz, Christian and Yang, Haojin and Bethge, Joseph and Meinel, Christoph}, title = {LoANs}, series = {Computer Vision - ACCV 2018 Workshops}, volume = {11367}, journal = {Computer Vision - ACCV 2018 Workshops}, publisher = {Springer}, address = {Cham}, isbn = {978-3-030-21074-8}, issn = {0302-9743}, doi = {10.1007/978-3-030-21074-8_29}, pages = {341 -- 356}, year = {2019}, abstract = {Recently, deep neural networks have achieved remarkable performance on the task of object detection and recognition. The reason for this success is mainly grounded in the availability of large scale, fully annotated datasets, but the creation of such a dataset is a complicated and costly task. In this paper, we propose a novel method for weakly supervised object detection that simplifies the process of gathering data for training an object detector. We train an ensemble of two models that work together in a student-teacher fashion. Our student (localizer) is a model that learns to localize an object, the teacher (assessor) assesses the quality of the localization and provides feedback to the student. The student uses this feedback to learn how to localize objects and is thus entirely supervised by the teacher, as we are using no labels for training the localizer. In our experiments, we show that our model is very robust to noise and reaches competitive performance compared to a state-of-the-art fully supervised approach. We also show the simplicity of creating a new dataset, based on a few videos (e.g. downloaded from YouTube) and artificially generated data.}, language = {en} } @misc{StaubitzTeusnerMeinel2019, author = {Staubitz, Thomas and Teusner, Ralf and Meinel, Christoph}, title = {MOOCs in Secondary Education}, series = {2019 IEEE Global Engineering Education Conference (EDUCON)}, journal = {2019 IEEE Global Engineering Education Conference (EDUCON)}, publisher = {IEEE}, address = {New York}, isbn = {978-1-5386-9506-7}, issn = {2165-9567}, doi = {10.1109/EDUCON.2019.8725138}, pages = {173 -- 182}, year = {2019}, abstract = {Computer science education in German schools is often less than optimal. It is only mandatory in a few of the federal states and there is a lack of qualified teachers. As a MOOC (Massive Open Online Course) provider with a German background, we developed the idea to implement a MOOC addressing pupils in secondary schools to fill this gap. The course targeted high school pupils and enabled them to learn the Python programming language. In 2014, we successfully conducted the first iteration of this MOOC with more than 7000 participants. However, the share of pupils in the course was not quite satisfactory. So we conducted several workshops with teachers to find out why they had not used the course to the extent that we had imagined. The paper at hand explores and discusses the steps we have taken in the following years as a result of these workshops.}, language = {en} } @misc{SianiparSukmanaMeinel2019, author = {Sianipar, Johannes Harungguan and Sukmana, Muhammad Ihsan Haikal and Meinel, Christoph}, title = {Moving sensitive data against live memory dumping, spectre and meltdown attacks}, series = {26th International Conference on Systems Engineering (ICSEng)}, journal = {26th International Conference on Systems Engineering (ICSEng)}, publisher = {IEEE}, address = {New York}, isbn = {978-1-5386-7834-3}, pages = {8}, year = {2019}, abstract = {The emergence of cloud computing allows users to easily host their Virtual Machines with no up-front investment and the guarantee of always available anytime anywhere. But with the Virtual Machine (VM) is hosted outside of user's premise, the user loses the physical control of the VM as it could be running on untrusted host machines in the cloud. Malicious host administrator could launch live memory dumping, Spectre, or Meltdown attacks in order to extract sensitive information from the VM's memory, e.g. passwords or cryptographic keys of applications running in the VM. In this paper, inspired by the moving target defense (MTD) scheme, we propose a novel approach to increase the security of application's sensitive data in the VM by continuously moving the sensitive data among several memory allocations (blocks) in Random Access Memory (RAM). A movement function is added into the application source code in order for the function to be running concurrently with the application's main function. Our approach could reduce the possibility of VM's sensitive data in the memory to be leaked into memory dump file by 2 5\% and secure the sensitive data from Spectre and Meltdown attacks. Our approach's overhead depends on the number and the size of the sensitive data.}, language = {en} } @misc{BinTareafBergerHennigetal.2019, author = {Bin Tareaf, Raad and Berger, Philipp and Hennig, Patrick and Meinel, Christoph}, title = {Personality exploration system for online social networks}, series = {2018 IEEE/WIC/ACM International Conference on Web Intelligence (WI)}, journal = {2018 IEEE/WIC/ACM International Conference on Web Intelligence (WI)}, publisher = {IEEE}, address = {New York}, isbn = {978-1-5386-7325-6}, doi = {10.1109/WI.2018.00-76}, pages = {301 -- 309}, year = {2019}, abstract = {User-generated content on social media platforms is a rich source of latent information about individual variables. Crawling and analyzing this content provides a new approach for enterprises to personalize services and put forward product recommendations. In the past few years, brands made a gradual appearance on social media platforms for advertisement, customers support and public relation purposes and by now it became a necessity throughout all branches. This online identity can be represented as a brand personality that reflects how a brand is perceived by its customers. We exploited recent research in text analysis and personality detection to build an automatic brand personality prediction model on top of the (Five-Factor Model) and (Linguistic Inquiry and Word Count) features extracted from publicly available benchmarks. The proposed model reported significant accuracy in predicting specific personality traits form brands. For evaluating our prediction results on actual brands, we crawled the Facebook API for 100k posts from the most valuable brands' pages in the USA and we visualize exemplars of comparison results and present suggestions for future directions.}, language = {en} } @misc{RenzMeinel2019, author = {Renz, Jan and Meinel, Christoph}, title = {The "Bachelor Project"}, series = {2019 IEEE Global Engineering Education Conference (EDUCON)}, journal = {2019 IEEE Global Engineering Education Conference (EDUCON)}, publisher = {IEEE}, address = {New York}, isbn = {978-1-5386-9506-7}, issn = {2165-9567}, doi = {10.1109/EDUCON.2019.8725140}, pages = {580 -- 587}, year = {2019}, abstract = {One of the challenges of educating the next generation of computer scientists is to teach them to become team players, that are able to communicate and interact not only with different IT systems, but also with coworkers and customers with a non-it background. The "bachelor project" is a project based on team work and a close collaboration with selected industry partners. The authors hosted some of the teams since spring term 2014/15. In the paper at hand we explain and discuss this concept and evaluate its success based on students' evaluation and reports. Furthermore, the technology-stack that has been used by the teams is evaluated to understand how self-organized students in IT-related projects work. We will show that and why the bachelor is the most successful educational format in the perception of the students and how this positive results can be improved by the mentors.}, language = {en} } @misc{SukmanaTorkuraGraupneretal.2019, author = {Sukmana, Muhammad Ihsan Haikal and Torkura, Kennedy A. and Graupner, Hendrik and Cheng, Feng and Meinel, Christoph}, title = {Unified Cloud Access Control Model for Cloud Storage Broker}, series = {33rd International Conference on Information Networking (ICOIN 2019)}, journal = {33rd International Conference on Information Networking (ICOIN 2019)}, publisher = {IEEE}, address = {Los Alamitos}, isbn = {978-1-5386-8350-7}, issn = {1976-7684}, doi = {10.1109/ICOIN.2019.8717982}, pages = {60 -- 65}, year = {2019}, abstract = {Cloud Storage Broker (CSB) provides value-added cloud storage service for enterprise usage by leveraging multi-cloud storage architecture. However, it raises several challenges for managing resources and its access control in multiple Cloud Service Providers (CSPs) for authorized CSB stakeholders. In this paper we propose unified cloud access control model that provides the abstraction of CSP's services for centralized and automated cloud resource and access control management in multiple CSPs. Our proposal offers role-based access control for CSB stakeholders to access cloud resources by assigning necessary privileges and access control list for cloud resources and CSB stakeholders, respectively, following privilege separation concept and least privilege principle. We implement our unified model in a CSB system called CloudRAID for Business (CfB) with the evaluation result shows it provides system-and-cloud level security service for cfB and centralized resource and access control management in multiple CSPs.}, language = {en} } @misc{SianiparWillemsMeinel2019, author = {Sianipar, Johannes Harungguan and Willems, Christian and Meinel, Christoph}, title = {Virtual machine integrity verification in Crowd-Resourcing Virtual Laboratory}, series = {2018 IEEE 11th Conference on Service-Oriented Computing and Applications (SOCA)}, journal = {2018 IEEE 11th Conference on Service-Oriented Computing and Applications (SOCA)}, publisher = {IEEE}, address = {New York}, isbn = {978-1-5386-9133-5}, issn = {2163-2871}, doi = {10.1109/SOCA.2018.00032}, pages = {169 -- 176}, year = {2019}, abstract = {In cloud computing, users are able to use their own operating system (OS) image to run a virtual machine (VM) on a remote host. The virtual machine OS is started by the user using some interfaces provided by a cloud provider in public or private cloud. In peer to peer cloud, the VM is started by the host admin. After the VM is running, the user could get a remote access to the VM to install, configure, and run services. For the security reasons, the user needs to verify the integrity of the running VM, because a malicious host admin could modify the image or even replace the image with a similar image, to be able to get sensitive data from the VM. We propose an approach to verify the integrity of a running VM on a remote host, without using any specific hardware such as Trusted Platform Module (TPM). Our approach is implemented on a Linux platform where the kernel files (vmlinuz and initrd) could be replaced with new files, while the VM is running. kexec is used to reboot the VM with the new kernel files. The new kernel has secret codes that will be used to verify whether the VM was started using the new kernel files. The new kernel is used to further measuring the integrity of the running VM.}, language = {en} }