Showing 1–12 of 12 results for author: Rahman, M L

Smishing Dataset I: Phishing SMS Dataset from Smishtank.com

Authors: Daniel Timko, Muhammad Lutfor Rahman

Abstract: While smishing (SMS Phishing) attacks have risen to become one of the most common types of social engineering attacks, there is a lack of relevant smishing datasets. One of the biggest challenges in the domain of smishing prevention is the availability of fresh smishing datasets. Additionally, as time persists, smishing campaigns are shut down and the crucial information related to the attack are… ▽ More While smishing (SMS Phishing) attacks have risen to become one of the most common types of social engineering attacks, there is a lack of relevant smishing datasets. One of the biggest challenges in the domain of smishing prevention is the availability of fresh smishing datasets. Additionally, as time persists, smishing campaigns are shut down and the crucial information related to the attack are lost. With the changing nature of smishing attacks, a consistent flow of new smishing examples is needed by both researchers and engineers to create effective defenses. In this paper, we present the community-sourced smishing datasets from the smishtank.com. It provides a wealth of information relevant to combating smishing attacks through the breakdown and analysis of smishing samples at the point of submission. In the contribution of our work, we provide a corpus of 1090 smishing samples that have been publicly submitted through the site. Each message includes information relating to the sender, message body, and any brands referenced in the message. Additionally, when a URL is found, we provide additional information on the domain, VirusTotal results, and a characterization of the URL. Through the open access of fresh smishing data, we empower academia and industries to create robust defenses against this evolving threat. △ Less

Submitted 28 April, 2024; v1 submitted 28 February, 2024; originally announced February 2024.

A Huffman based short message service compression technique using adjacent distance array

Authors: Pranta Sarker, Mir Lutfur Rahman

Abstract: The short message service (SMS) is a wireless medium of transmission that allows you to send brief text messages. Cell phone devices have an uttermost SMS capacity of 1,120 bits in the traditional system. Moreover, the conventional SMS employs seven bits for each character, allowing the highest 160 characters for an SMS text message to be transmitted. This research demonstrated that an SMS message… ▽ More The short message service (SMS) is a wireless medium of transmission that allows you to send brief text messages. Cell phone devices have an uttermost SMS capacity of 1,120 bits in the traditional system. Moreover, the conventional SMS employs seven bits for each character, allowing the highest 160 characters for an SMS text message to be transmitted. This research demonstrated that an SMS message could contain more than 200 characters by representing around five bits each, introducing a data structure, namely, adjacent distance array (ADA) using the Huffman principle. Allowing the concept of lossless data compression technique, the proposed method of the research generates character's codeword utilising the standard Huffman. However, the ADA encodes the message by putting the ASCII value distances of all characters, and decoding performs by avoiding the whole Huffman tree traverse, which is the pivotal contribution of the research to develop an effective SMS compression technique for personal digital assistants (PDAs). The encoding and decoding processes have been discussed and contrasted with the conventional SMS text message system, where our proposed ADA technique performs outstandingly better from every aspect discovered after evaluating all outcomes. △ Less

Submitted 19 December, 2023; originally announced December 2023.

Comments: 19 pages, 9 figures, peer reviewed, accepted, in press, Journal article

A Quantitative Study of SMS Phishing Detection

Authors: Daniel Timko, Daniel Hernandez Castillo, Muhammad Lutfor Rahman

Abstract: With the booming popularity of smartphones, threats related to these devices are increasingly on the rise. Smishing, a combination of SMS (Short Message Service) and phishing has emerged as a treacherous cyber threat used by malicious actors to deceive users, aiming to steal sensitive information, money or install malware on their mobile devices. Despite the increase in smishing attacks in recent… ▽ More With the booming popularity of smartphones, threats related to these devices are increasingly on the rise. Smishing, a combination of SMS (Short Message Service) and phishing has emerged as a treacherous cyber threat used by malicious actors to deceive users, aiming to steal sensitive information, money or install malware on their mobile devices. Despite the increase in smishing attacks in recent years, there are very few studies aimed at understanding the factors that contribute to a user's ability to differentiate real from fake messages. To address this gap in knowledge, we have conducted an online survey on smishing detection with 187 participants. In this study, we presented them with 16 SMS screenshots and evaluated how different factors affect their decision making process in smishing detection. Next, we conducted a post-survey to garner information on the participants' security attitudes, behavior and knowledge. Our results highlighted that attention and security behavioral scores had a significant impact on participants' accuracy in identifying smishing messages. We found that participants had more difficulty identifying real messages from fake ones, with an accuracy of 67.1% with fake messages and 43.6% with real messages. Our study is crucial in develo** proactive strategies to encounter and mitigate smishing attacks. By understanding what factors influence smishing detection, we aim to bolster users' resilience against such threats and create a safer digital environment for all. △ Less

Submitted 29 May, 2024; v1 submitted 12 November, 2023; originally announced November 2023.

Commercial Anti-Smishing Tools and Their Comparative Effectiveness Against Modern Threats

Authors: Daniel Timko, Muhammad Lutfor Rahman

Abstract: Smishing, also known as SMS phishing, is a type of fraudulent communication in which an attacker disguises SMS communications to deceive a target into providing their sensitive data. Smishing attacks use a variety of tactics; however, they have a similar goal of stealing money or personally identifying information (PII) from a victim. In response to these attacks, a wide variety of anti-smishing t… ▽ More Smishing, also known as SMS phishing, is a type of fraudulent communication in which an attacker disguises SMS communications to deceive a target into providing their sensitive data. Smishing attacks use a variety of tactics; however, they have a similar goal of stealing money or personally identifying information (PII) from a victim. In response to these attacks, a wide variety of anti-smishing tools have been developed to block or filter these communications. Despite this, the number of phishing attacks continue to rise. In this paper, we developed a test bed for measuring the effectiveness of popular anti-smishing tools against fresh smishing attacks. To collect fresh smishing data, we introduce Smishtank.com, a collaborative online resource for reporting and collecting smishing data sets. The SMS messages were validated by a security expert and an in-depth qualitative analysis was performed on the collected messages to provide further insights. To compare tool effectiveness, we experimented with 20 smishing and benign messages across 3 key segments of the SMS messaging delivery ecosystem. Our results revealed significant room for improvement in all 3 areas against our smishing set. Most anti-phishing apps and bulk messaging services didn't filter smishing messages beyond the carrier blocking. The 2 apps that blocked the most smish also blocked 85-100\% of benign messages. Finally, while carriers did not block any benign messages, they were only able to reach a 25-35\% blocking rate for smishing messages. Our work provides insights into the performance of anti-smishing tools and the roles they play in the message blocking process. This paper would enable the research community and industry to be better informed on the current state of anti-smishing technology on the SMS platform. △ Less

Submitted 28 April, 2024; v1 submitted 14 September, 2023; originally announced September 2023.

Journal ref: Proceedings of the 16th ACM Conference on Security and Privacy in Wireless and Mobile Networks, 1-12, 2023

Are Current CCPA Compliant Banners Conveying User's Desired Opt-Out Decisions? An Empirical Study of Cookie Consent Banners

Authors: Torsha Mazumdar, Daniel Timko, Muhammad Lutfor Rahman

Abstract: The California Consumer Privacy Act (CCPA) secures the right to Opt-Out for consumers in California. However, websites may implement complex consent mechanisms that potentially do not capture the user's true choices. We investigated the user choices in Cookie Consent Banner of US residents, the plurality of whom were from California, through an online experiment of 257 participants and compared th… ▽ More The California Consumer Privacy Act (CCPA) secures the right to Opt-Out for consumers in California. However, websites may implement complex consent mechanisms that potentially do not capture the user's true choices. We investigated the user choices in Cookie Consent Banner of US residents, the plurality of whom were from California, through an online experiment of 257 participants and compared the results with how they perceived to these Cookie Consent Banner. Our results show a contradiction between how often participants self-report their Opt-Out rates and their actual Opt-Out rate when interacting with a complex, CCPA-compliant website. This discrepancy expands the context with which modern websites may implement the CCPA without providing users sufficient information or instruction on how to successfully Opt-Out. We further elaborate on how US residents respond to and perceive the GDPR-like Opt-In model. Our results indicate that even though very few consumers actually exercised their right to Opt-Out, the majority of US consumers desire more transparent privacy policies that the current implementation of CCPA on websites lacks. △ Less

Submitted 1 September, 2023; originally announced September 2023.

Saudi Arabian Perspective of Security, Privacy, and Attitude of Using Facial Recognition Technology

Authors: Amani Mohammed Alqarni, Daniel Timko, Muhammad Lutfor Rahman

Abstract: Facial Recognition Technology (FRT) is a pioneering field of mass surveillance that sparks privacy concerns and is considered a growing threat in the modern world. FRT has been widely adopted in the Kingdom of Saudi Arabia to improve public services and surveillance. Accordingly, the following study aims to understand the privacy and security concerns, trust, and acceptance of FRT in Saudi Arabia.… ▽ More Facial Recognition Technology (FRT) is a pioneering field of mass surveillance that sparks privacy concerns and is considered a growing threat in the modern world. FRT has been widely adopted in the Kingdom of Saudi Arabia to improve public services and surveillance. Accordingly, the following study aims to understand the privacy and security concerns, trust, and acceptance of FRT in Saudi Arabia. Validated Privacy Concerns (IUIPC-8), Security Attitudes (SA-6), and Security Behavior (SeBIS) scales are used along with replicate studies from Pew Research Center trust questions and government trust questions. In addition, we examine potential differences between Saudis and Americans. To gain insights into these concerns, we conducted an online survey involving 53 Saudi Arabia citizens who are residing in the USA. We have collected data in the US instead of Saudi Arabia to avoid the regulatory challenges of the Saudi Data & Artificial Intelligence Authority (SDAIA). Responses from closed-ended questions revealed that Saudis score much lower than Americans when it comes to security attitudes, whereas they score lower when it comes to privacy concerns. We found no significant difference between Saudis' and Americans' acceptance of the use of FRT in different scenarios, but we found that Saudis trust advertisers more than Americans. Additionally, Saudis are more likely than Americans to agree that the government should strictly limit the use of FRT. △ Less

Submitted 14 July, 2023; originally announced July 2023.

Users really do respond to smishing

Authors: Muhammad Lutfor Rahman, Daniel Timko, Hamid Wali, Ajaya Neupane

Abstract: Text phish messages, referred to as Smishing is a type of social engineering attack where fake text messages are created, and used to lure users into responding to those messages. These messages aim to obtain user credentials, install malware on the phones, or launch smishing attacks. They ask users to reply to their message, click on a URL that redirects them to a phishing website, or call the pr… ▽ More Text phish messages, referred to as Smishing is a type of social engineering attack where fake text messages are created, and used to lure users into responding to those messages. These messages aim to obtain user credentials, install malware on the phones, or launch smishing attacks. They ask users to reply to their message, click on a URL that redirects them to a phishing website, or call the provided number. Thousands of mobile users are affected by smishing attacks daily. Drawing inspiration by the works of Tu et al. (USENIX Security, 2019) on Robocalls and Tischer et al. (IEEE Symposium on Security and Privacy, 2016) on USB drives, this paper investigates why smishing works. Accordingly, we designed smishing experiments and sent phishing SMSes to 265 users to measure the efficacy of smishing attacks. We sent eight fake text messages to participants and recorded their CLICK, REPLY, and CALL responses along with their feedback in a post-test survey. Our results reveal that 16.92% of our participants had potentially fallen for our smishing attack. To test repeat phishing, we subjected a set of randomly selected participants to a second round of smishing attacks with a different message than the one they received in the first round. As a result, we observed that 12.82% potentially fell for the attack again. Using logistic regression, we observed that a combination of user REPLY and CLICK actions increased the odds that a user would respond to our smishing message when compared to CLICK. Additionally, we found a similar statistically significant increase when comparing Facebook and Walmart entity scenario to our IRS baseline. △ Less

Submitted 26 December, 2022; originally announced December 2022.

Comments: CODASPY'23

Erdős-Selfridge Theorem for Nonmonotone CNFs

Authors: Md Lutfar Rahman, Thomas Watson

Abstract: In an influential paper, Erdős and Selfridge introduced the Maker-Breaker game played on a hypergraph, or equivalently, on a monotone CNF. The players take turns assigning values to variables of their choosing, and Breaker's goal is to satisfy the CNF, while Maker's goal is to falsify it. The Erdős-Selfridge Theorem says that the least number of clauses in any monotone CNF with $k$ literals per cl… ▽ More In an influential paper, Erdős and Selfridge introduced the Maker-Breaker game played on a hypergraph, or equivalently, on a monotone CNF. The players take turns assigning values to variables of their choosing, and Breaker's goal is to satisfy the CNF, while Maker's goal is to falsify it. The Erdős-Selfridge Theorem says that the least number of clauses in any monotone CNF with $k$ literals per clause where Maker has a winning strategy is $Θ(2^k)$. We study the analogous question when the CNF is not necessarily monotone. We prove bounds of $Θ(\sqrt{2}\,^k)$ when Maker plays last, and $Ω(1.5^k)$ and $O(r^k)$ when Breaker plays last, where $r=(1+\sqrt{5})/2\approx 1.618$ is the golden ratio. △ Less

Submitted 3 January, 2022; originally announced January 2022.

Study of Different Deep Learning Approach with Explainable AI for Screening Patients with COVID-19 Symptoms: Using CT Scan and Chest X-ray Image Dataset

Authors: Md Manjurul Ahsan, Kishor Datta Gupta, Mohammad Maminur Islam, Sajib Sen, Md. Lutfar Rahman, Mohammad Shakhawat Hossain

Abstract: The outbreak of COVID-19 disease caused more than 100,000 deaths so far in the USA alone. It is necessary to conduct an initial screening of patients with the symptoms of COVID-19 disease to control the spread of the disease. However, it is becoming laborious to conduct the tests with the available testing kits due to the growing number of patients. Some studies proposed CT scan or chest X-ray ima… ▽ More The outbreak of COVID-19 disease caused more than 100,000 deaths so far in the USA alone. It is necessary to conduct an initial screening of patients with the symptoms of COVID-19 disease to control the spread of the disease. However, it is becoming laborious to conduct the tests with the available testing kits due to the growing number of patients. Some studies proposed CT scan or chest X-ray images as an alternative solution. Therefore, it is essential to use every available resource, instead of either a CT scan or chest X-ray to conduct a large number of tests simultaneously. As a result, this study aims to develop a deep learning-based model that can detect COVID-19 patients with better accuracy both on CT scan and chest X-ray image dataset. In this work, eight different deep learning approaches such as VGG16, InceptionResNetV2, ResNet50, DenseNet201, VGG19, MobilenetV2, NasNetMobile, and ResNet15V2 have been tested on two dataset-one dataset includes 400 CT scan images, and another dataset includes 400 chest X-ray images studied. Besides, Local Interpretable Model-agnostic Explanations (LIME) is used to explain the model's interpretability. Using LIME, test results demonstrate that it is conceivable to interpret top features that should have worked to build a trust AI framework to distinguish between patients with COVID-19 symptoms with other patients. △ Less

Submitted 24 July, 2020; originally announced July 2020.

Comments: This is a work in progress, it should not be relied upon without context to guide clinical practice or health-related behavior and should not be reported in news media as established information without consulting multiple experts in the field

Enabling Joint Communication and Radar Sensing in Mobile Networks -- A Survey

Authors: J. Andrew Zhang, Md Lushanur Rahman, Kai Wu, Xiao**g Huang, Y. Jay Guo, Shanzhi Chen, **hong Yuan

Abstract: Mobile network is evolving from a communication-only network towards one with joint communication and radar/radio sensing (JCAS) capabilities, that we call perceptive mobile network (PMN). In PMNs, JCAS integrates sensing into communications, sharing a majority of system modules and the same transmitted signals. The PMN is expected to provide a ubiquitous radio sensing platform and enable a vast n… ▽ More Mobile network is evolving from a communication-only network towards one with joint communication and radar/radio sensing (JCAS) capabilities, that we call perceptive mobile network (PMN). In PMNs, JCAS integrates sensing into communications, sharing a majority of system modules and the same transmitted signals. The PMN is expected to provide a ubiquitous radio sensing platform and enable a vast number of novel smart applications, whilst providing non-compromised communications. In this paper, we present a broad picture of the motivation, methodologies, challenges, and research opportunities of realizing PMN, by providing a comprehensive survey for systems and technologies developed mainly in the last ten years. Beginning by reviewing the work on coexisting communication and radar systems, we highlight their limits on addressing the interference problem, and then introduce the JCAS technology. We then set up JCAS in the mobile network context and envisage its potential applications. We continue to provide a brief review of three types of JCAS systems, with particular attention to their differences in design philosophy. We then introduce a framework of PMN, including the system platform and infrastructure, three types of sensing operations, and signals usable for sensing. Subsequently, we discuss required system modifications to enable sensing on current communication-only infrastructure. Within the context of PMN, we review stimulating research problems and potential solutions, organized under nine topics: performance bounds, waveform optimization, antenna array design, clutter suppression, sensing parameter estimation, resolution of sensing ambiguity, pattern analysis, networked sensing under cellular topology, and sensing-assisted communications. We conclude the paper by listing key open research problems for the aforementioned topics and sharing some lessons that we have learned. △ Less

Submitted 20 October, 2021; v1 submitted 13 June, 2020; originally announced June 2020.

Comments: 41 pages, 15 figures, 17 tables, journal paper. IEEE Communications Surveys and Tutorials (Accepted for publication, Oct. 2021)

SynFuzz: Efficient Concolic Execution via Branch Condition Synthesis

Authors: Wookhyun Han, Md Lutfor Rahman, Yuxuan Chen, Chengyu Song, Byoungyoung Lee, Insik Shin

Abstract: Concolic execution is a powerful program analysis technique for exploring execution paths in a systematic manner. Compare to random-mutation-based fuzzing, concolic execution is especially good at exploring paths that are guarded by complex and tight branch predicates (e.g., (a*b) == 0xdeadbeef). The drawback, however, is that concolic execution engines are much slower than native execution. One m… ▽ More Concolic execution is a powerful program analysis technique for exploring execution paths in a systematic manner. Compare to random-mutation-based fuzzing, concolic execution is especially good at exploring paths that are guarded by complex and tight branch predicates (e.g., (a*b) == 0xdeadbeef). The drawback, however, is that concolic execution engines are much slower than native execution. One major source of the slowness is that concolic execution engines have to the interpret instructions to maintain the symbolic expression of program variables. In this work, we propose SynFuzz, a novel approach to perform scalable concolic execution. SynFuzz achieves this goal by replacing interpretation with dynamic taint analysis and program synthesis. In particular, to flip a conditional branch, SynFuzz first uses operation-aware taint analysis to record a partial expression (i.e., a sketch) of its branch predicate. Then it uses oracle-guided program synthesis to reconstruct the symbolic expression based on input-output pairs. The last step is the same as traditional concolic execution - SynFuzz consults a SMT solver to generate an input that can flip the target branch. By doing so, SynFuzz can achieve an execution speed that is close to fuzzing while retain concolic execution's capability of flip** complex branch predicates. We have implemented a prototype of SynFuzz and evaluated it with three sets of programs: real-world applications, the LAVA-M benchmark, and the Google Fuzzer Test Suite (FTS). The evaluation results showed that SynFuzz was much more scalable than traditional concolic execution engines, was able to find more bugs in LAVA-M than most state-of-the-art concolic execution engine (QSYM), and achieved better code coverage on real-world applications and FTS. △ Less

Submitted 23 May, 2019; originally announced May 2019.

Framework for a Perceptive Mobile Network using Joint Communication and Radar Sensing

Authors: Md. Lushanur Rahman, J. Andrew Zhang, Xiao**g Huang, Y. Jay Guo, Robert W. Heath Jr

Abstract: In this paper, we develop a framework for a novel perceptive mobile/cellular network that integrates radar sensing function into the mobile communication network. We propose a unified system platform that enables downlink and uplink sensing, sharing the same transmitted signals with communications. We aim to tackle the fundamental sensing parameter estimation problem in perceptive mobile networks,… ▽ More In this paper, we develop a framework for a novel perceptive mobile/cellular network that integrates radar sensing function into the mobile communication network. We propose a unified system platform that enables downlink and uplink sensing, sharing the same transmitted signals with communications. We aim to tackle the fundamental sensing parameter estimation problem in perceptive mobile networks, by addressing two key challenges associated with sophisticated mobile signals and rich multipath in mobile networks. To extract sensing parameters from orthogonal frequency division multiple access (OFDMA) and spatial division multiple access (SDMA) communication signals, we propose two approaches to formulate it to problems that can be solved by compressive sensing techniques. Most sensing algorithms have limits on the number of multipath signals for their inputs. To reduce the multipath signals, as well as removing unwanted clutter signals, we propose a background subtraction method based on simple recursive computation, and provide a closed-form expression for performance characterization. The effectiveness of these methods is validated in simulations. △ Less

Submitted 16 January, 2019; originally announced January 2019.

Comments: 14 pages, 12 figures, Journal paper