This platform, whose objective is to improve smartphone security and that of other electronic devices, was recently presented in Canada in an international conference on security and privacy on the Internet of Things (Workshop on Security and Privacy on Internet of Things).

This research focuses on “lateral movement attacks,” which happen when “someone tries to take advantage of a circumstance (in this case, any electric current producing a magnetic field) for illicit purposes (in this case, the attacker tries to extract the private password from the encryption, to which he theoretically should not have access),” explained one of the researchers, José María de Fuentes, UC3M Computer Security Lab (COSEC).

Traditionally, they tried to attack the encrypted algorithm, that is, the process to protect data, which normally has a complicated mathematical base. Later, this type of lateral movement attacks have been developed to seek other ways of breaching security without having to “break” the math upon which it is based. “When the devices are on, they use energy and generate electromagnetic fields. We try to capture their traces to obtain the encryption key and at the same time, decipher the data,” explained another of the researchers, Lorena González, who is also from the UC3M COSEC.

Digital vulnerability

“We want to make it known that these type of devices have vulnerabilities, because if an adversary attacks them, that is, if someone calculates the password that you are using on your cell phone, it will make you vulnerable, and your data will no longer be private,” affirmed one of the other researchers, Luis Hernández Encinas. Hernández Encinas is from CSIC’s Instituto de Tecnologías Físicas y de la Información — ITEFI (Institute for Physical and Information Technologies).

The basic aim of this research is to detect and make known the vulnerabilities of electronic devices and that of their chips, so that software and hardware developers can implement appropriate countermeasures to protect user security. “Our work then will be to verify is this has been carried out correctly and try to attack again to check it there is any other type of vulnerabilities,” added Hernández Encinas.

The most relevant aspect of the project, according to the researchers, is that an architecture and work environment is being develop in which this type of lateral movement attacks can continue to be explored. In fact, it is possible to extract encrypted information from other data, such as variations in temperature of the device, the power consumption, and the time it takes a chip to process a calculation.

This research has been carried out in the framework of CIBERDINE (Cybersecurity: Data, Information, Risks), a R+D+i program funded by the Consejería de Educación, Cultura y Deporte (Board of Education, Culture and Sport) of the Madrid Autonomous Region and by Structural Funds from the European Union.. Its main objective is to develop technological tools aimed at making cyberspace a safe, secure and trustworthy environment for public administrations, citizens and companies. For that purpose, this research pursues three broad areas: massive analysis of data networks, cooperative cybersecurity and support systems for decision making in this area.

At the 4th Mobility Forum of RedIRIS (the Spanish academic and research network), Professor Arturo Azcorra, Vice President of 5TONIC, recently presented the work of 5TONIC. The laboratory promotes technological development as well as the early implementation and penetration of 5G communications in the productive environment. 5G is recognized internationally as an engine of economic development and competitiveness.

The conference looked beyond wireless networks to all the technologies that enable users to carry out their academic work in an increasingly mobile environment. Azcorra argued that the ultrafast mobile broadband technology of 5G promises the most profound development in communications this decade. “Not only is 5G a radical technological change providing smarter networks based on virtualization and softwarization, but it will also result in services being delivered in a much more personalized way. We will also witness a change in who uses these technologies, not only ‘end’ users, but also multiple sectors of industry or so-called ‘vertical’ users,” Azcorra explained.

Founded by Telefónica and IMDEA Networks and based in the latter institute, 5TONIC is an open co-creation laboratory in 5G technologies that brings together 5G technological leaders, such as Ericsson, Intel, Carlos III University, Commscope, Artesyn, Cohere and Interdigital. “5TONIC is a Spanish public-private initiative and a global leader in the development of 5G technology, services and pilot studies,” Arturo Azcorra asserted. He also outlined the laboratory’s ongoing activities in the fields of e-Health and the emergency services; AGVs (Automatic Guided Vehicles); industry 4.0; drones for agriculture; fair tourism (IFEMA / FITUR), and the entertainment industry (4K videos for television), among others.

During the presentation to members of 44 RedIRIS Working Groups, Azcorra explained the importance of 5G services for the Spanish ICT sector and the benefits of investment and collaboration in ensuring that Spain has an active role in shaping this global technological change. 5G promises new markets for many of the country’s key economic sectors such as energy, health, automotive, entertainment, transport, tourism and manufacturing. This is due, in large part, to the development of radically new services and products and to the substantial improvement to those already commercially available.

To bypass these difficulties, scientists have turned to the field of metagenomics. In metagenomics, researchers use algorithms to piece together DNA from an environmental sample to determine the type and role of bacteria present. Unlike established fields such as chemistry, where researchers evaluate their results against a set of known standards, metagenomics is a relatively young field that lacks such benchmarks.

Mihai Pop, a professor of computer science at the University of Maryland with a joint appointment in the University of Maryland Institute for Advanced Computer Studies, recently helped judge an international challenge called the Critical Assessment of Metagenome Interpretation (CAMI), which benchmarked metagenomics software. The results were published in the journal Nature Methods on October 2, 2017.

“There’s no one algorithm that we can say is the best at everything,” said Pop, who is also co-director of the Center for Health-related Informatics and Bioimaging at UMD. “What we found was that one tool does better in one context, but another does better in another context. It is important for researchers to know that they need to choose software based on the specific questions they are trying to answer.”

The study’s results were not surprising to Pop, because of the many challenges metagenomics software developers face. First, DNA analysis is challenging in metagenomics because the recovered DNA often comes from the field, not a tightly controlled laboratory environment. In addition, DNA from many organisms — some of which may not have known genomes — mingle together in a sample, making it difficult to correctly assemble, or piece together, individual genomes. Moreover, DNA degrades in harsh environments.

“I like to think of metagenomics as a new type of microscope,” Pop said. “In the old days, you would use a microscope to study bacteria. Now we have a much more powerful microscope, which is DNA sequencing coupled with advanced algorithms. Metagenomics holds the promise of helping us understand what bacteria do in the world. But first we need to tune that microscope.”

CAMI’s leader invited Pop to help evaluate the submissions by challenge participants because of his expertise in genome and metagenome assembly. In 2009, Pop helped publish Bowtie, one of the most commonly used software packages for assembling genomes. More recently, he collaborated with the University of Maryland School of Medicine to analyze hundreds of thousands of gene sequences as part of the largest, most comprehensive study of childhood diarrheal diseases ever conducted in developing countries.

“We uncovered new, unknown bacteria that cause diarrheal diseases, and we also found interactions between bacteria that might worsen or improve illness,” Pop said. “I feel that’s one of the most impactful projects I’ve done using metagenomics.”

For the competition, CAMI researchers combined approximately 700 microbial genomes and 600 viral genomes with other DNA sources and simulated how such a collection of DNA might appear in the field. The participants’ task was to reconstruct and analyze the genomes of the simulated DNA pool.

CAMI researchers scored the participants’ submissions in three areas: how well they assembled the fragmented genomes; how well they “binned,” or organized, DNA fragments into related groups to determine the families of organisms in the mixture; and how well they “profiled,” or reconstructed, the identity and relative abundance of the organisms present in the mixture. Pop contributed metrics and software for evaluating the submitted assembled genomes.

Nineteen teams submitted 215 entries using six genome assemblers, nine binners and 10 profilers to tackle this challenge.

The results showed that for assembly, algorithms that pieced together a genome using different lengths of smaller DNA fragments outperformed those that used DNA fragments of a fixed length. However, no assemblers did well at picking apart different, yet similar genomes.

For the binning task, the researchers found tradeoffs in how accurately the software programs identified the group to which a particular DNA fragment belonged, versus how many DNA fragments the software assigned to any groups. This result suggests that researchers need to choose their binning software based on whether accuracy or coverage is more important. In addition, the performance of all binning algorithms decreased when samples included multiple related genomes.

In profiling, software either recovered the relative abundance of bacteria in the sample better or detected organisms better, even at very low quantities. However, the latter algorithms identified the wrong organism more often.

Going forward, Pop said the CAMI group will continue to run new challenges with different data sets and new evaluations aimed at more specific aspects of software performance. Pop is excited to see scientists use the benchmarks to address research questions in the laboratory and the clinic.

“The field of metagenomics needs standards to ensure that results are correct, well validated and follow best practices,” Pop said. “For instance, if a doctor is going to stage an intervention based on results from metagenomic software, it’s essential that those results be correct. Our work provides a roadmap for choosing appropriate software.”

“Most software programs rely, in part, on code in external ‘libraries’ to perform some of their functions,” says Chris Parnin, an assistant professor of computer science at North Carolina State University and senior author of a paper on the work. “If those external libraries are modified to address flaws, programmers need to update their internal code to account for the changes. This is called ‘upgrading an out-of-date dependency.’ However, for various reasons, many programmers procrastinate, putting off the needed upgrades.

“This is what happened at Equifax,” Parnin says. “An external library they relied on had made public that it contained a security flaw. And while the external library was patched, Equifax never got around to updating its internal code. So months after the problem was identified, Equifax was still vulnerable and got hacked.

“Our goal with this project was to assess tools designed to get more programmers to upgrade their out-of-date dependencies. Could they help prevent another Equifax?”

For this study, the researchers looked at thousands of open-source projects on GitHub, an online programming community that fosters collaboration on open-source software projects. Specifically, the researchers looked at different means projects used to incentivize or facilitate upgrades and whether those incentives made any difference.

One group consisted of 2,578 projects that utilized automated pull requests, which notified project owners of needed upgrades to out-of-date dependencies, proposed potential code changes, and ran a small battery of tests to determine if the replacement code was viable. These project owners were still required to approve the changes or modify updated code if it failed initial viability tests.

A second group consisted of 1,273 projects that did not utilize incentives to upgrade out-of-date dependencies.

The researchers found that projects with automated pull requests made 60 percent more of the necessary upgrades than projects that didn’t use incentives.

“We also found that the majority of automated pull request projects were using the most up-to-date versions of dependent software, whereas the unincentivized projects were all over the map,” Parnin says. “The take-home message here is that we have automated tools that can help programmers keep up with upgrades. These tools can’t replace good programmers, but they can make a significant difference. However, it’s still up to programmers to put these tools in place and make use of them.”

The paper, “Can Automated Pull Requests Encourage Software Developers to Upgrade Out-of-Date Dependencies?,” will be presented at the IEEE/ACM International Conference on Automated Software Engineering, Oct. 30-Nov. 3 at the University of Illinois at Urbana-Champaign, Ill. Lead author of the paper is Samim Mirhosseini, an undergraduate at NC State. Mirhosseini’s work on the project was supported by a Research Experience for Undergraduates grant from the National Science Foundation.

A new study published in the open-access journal Frontiers in Robotics and AI finds that the wearable technology can recognize conversational prompts and provide the user with suitable responses in return. Moreover, children find it easy to operate and enjoy using it.

ASD is a life-long condition that affects 1 in 68 people. A defining feature of ASD is difficulties with social communication — which can include initiating and maintaining conversations with others.

“We developed software for a wearable system that helps coach children with autism spectrum disorder in everyday social interactions,” says Azadeh Kushki, an Assistant Professor at the Institute of Biomaterials and Biomedical Engineering at the University of Toronto, and Scientist at the Bloorview Research Institute, Toronto, Canada. “In this study, we show that children are able to use this new technology and they enjoy interacting with it.”

Children with autism spectrum disorder are often drawn to technological devices and find them highly motivating tools for delivering interventions designed to help them. The problem with existing technology, however, is that using human-to-computer interaction to teach social skills can have the opposite effect to its goal, in that the user becomes socially isolated.

“The interesting thing about our new technology is that we are not trying to replace human-to-human interactions; instead, we use this app to coach children who are communicating with people in real-world situations,” explains Professor Kushki. “Children can practice their skills outside of their normal therapy sessions and it can provide them with increased independence in everyday interactions.”

Professor Kushki and her colleagues developed the app, named Holli, to be used with wearable technology such as Google Glass — a head-mounted display in the shape of eyeglasses. It listens to conversations and prompts the user with an appropriate reply.

For example, if the user is greeted by a person who says ‘Welcome’, Holli will provide various responses to choose from, such as ‘Hey’, ‘Hello’ or ‘Afternoon’. When Holli recognizes the user’s response, the prompts disappear and Holli waits for the next exchange in conversation.

To assess the usability of the prototype software, the researchers asked 15 children with ASD to be guided by Holli when interacting socially. They saw that Holli could complete most conversations without error, and that children could follow the prompts to carry on a social interaction. In fact, Holli was often able to understand what the user was saying before/he she finished saying it, which helped the conversation to flow naturally. As well as demonstrating its feasibility, the children also said how much they liked using it; they enjoyed the prompts and found it easy to use.

“This study shows the potential of technology-based intervention to help children with ASD,” says Professor Kushki. “These systems can be used in everyday settings, such as home and school, to reinforce techniques learned in therapeutic settings.”

It is hoped that further developments will allow customization for individual users, such as changing prompt location, size and medium, to cater to each child’s unique preference and ability. In addition, more work is needed to improve Holli’s ability to deal with speech differences that can affect those with autism spectrum disorder.

Crucially, the system is able to translate between “data representations” used by the donor and recipient programs. An image-processing program, for instance, needs to be able to handle files in a range of formats, such as jpeg, tiff, or png. But internally, it will represent all such images using a single standardized scheme. Different programs, however, may use different internal schemes. The CSAIL researchers’ system automatically maps the donor program’s scheme onto that of the recipient, to import code seamlessly.

The researchers presented the new system, dubbed CodeCarbonCopy, at the Association for Computing Machinery’s Symposium on the Foundations of Software Engineering.

“CodeCarbonCopy enables one of the holy grails of software engineering: automatic code reuse,” says Stelios Sidiroglou-Douskos, a research scientist at CSAIL and first author on the paper. “It’s another step toward automating the human away from the development cycle. Our view is that perhaps we have written most of the software that we’ll ever need — we now just need to reuse it.”

The researchers conducted eight experiments in which they used CodeCarbonCopy to transplant code between six popular open-source image-processing programs. Seven of the eight transplants were successful, with the recipient program properly executing the new functionality.

Joining Sidiroglou-Douskos on the paper are Martin Rinard, a professor of electrical engineering and computer science; Fan Long, an MIT graduate student in electrical engineering and computer science; and Eric Lahtinen and Anthony Eden, who were contract programmers at MIT when the work was done.

Mutatis mutandis

With CodeCarbonCopy, the first step in transplanting code from one program to another is to feed both of them the same input file. The system then compares how the two programs process the file.

If, for instance, the donor program performs a series of operations on a particular piece of data and loads the result into a variable named “mem_clip->width,” and the recipient performs the same operations on the same piece of data and loads the result into a variable named “picture.width,” the system will infer that the variables are playing the same roles in their respective programs.

Once it has identified correspondences between variables, CodeCarbonCopy presents them to the user. It also presents all the variables in the donor for which it could not find matches in the recipient, together with those variables’ initial definitions. Frequently, those variables are playing some role in the donor that’s irrelevant to the recipient. The user can flag those variables as unnecessary, and CodeCarbonCopy will automatically excise any operations that make use of them from the transplanted code.

New order

To map the data representations from one program onto those of the other, CodeCarbonCopy looks at the precise values that both programs store in memory. Every pixel in a digital image, for instance, is governed by three color values: red, green, and blue. Some programs, however, store those triplets of values in the order red, green, blue, and others store them in the order blue, green, red.

If CodeCarbonCopy finds a systematic relationship between the values stored by one program and those stored by the other, it generates a set of operations for translating between representations.

CodeCarbonCopy works well with file formats, such as images, whose data is rigidly organized, and with programs, such as image processors, that store data representations in arrays, which are essentially rows of identically sized memory units. In ongoing work, the researchers are looking to generalize their approach to file formats that permit more flexible data organization and programs that use data structures other than arrays, such as trees or linked lists.

In The Optical Society (OSA) journal Biomedical Optics Express, the researchers report that their new software combined with a low-cost thermal camera performed well when analyzing breathing rate during tests simulating real-world movement and temperature changes.

“As thermal cameras continue to get smaller and less expensive, we expect that phones, computers and augmented reality devices will one day incorporate thermal cameras that can be used for various applications,” said Nadia Bianchi-Berthouze from University College London, (UK) and leader of the research team. “By using low-cost thermal cameras, our work is a first step toward bringing thermal imaging into people’s everyday lives. This approach can be used in places other sensors might not work or would cause concern.”

In addition to detecting breathing problems, the new approach could one day allow the camera on your computer to detect subtle breathing irregularities associated with pain or stress and then send prompts that help you relax and regulate breathing. Although traditional video cameras can be used to track breathing, they don’t work well in low-light situations and can cause privacy concerns when used for monitoring in nursing homes, for example.

“Thermal cameras can detect breathing at night and during the day without requiring the person to wear any type of sensor,” said Youngjun Cho, first author of the paper. “Compared to a traditional video camera, a thermal camera is more private because it is more difficult to identify the person.”

Personal thermal cameras

Thermal cameras, which use infrared wavelengths to reveal the temperature of an object or scene, have been used in a variety of monitoring applications for some time. Recently, their price and size have dropped enough to make them practical for personal use, with small thermal cameras that connect to mobile phones now available for around $200.

“Large, expensive thermal imaging systems have been used to measure breathing by monitoring temperature changes inside the nostrils under controlled settings,” said Cho. “We wanted to use the new portable systems to do the same thing by creating a smart-phone based respiratory tracking method that could be used in almost any environment or activity. However, we found that in real-world situations this type of mobile thermal imaging was affected by changes in air temperature and body movement.”

To solve these problems, the researchers developed algorithms that can be used with any thermal camera to compensate for ambient temperature changes and accurately track the nostrils while the person is moving. In addition, the new algorithms improve the way breathing signals are processed. Instead of averaging the temperature readings from 2D pixels around the nostrils, as has been done in the past, Cho developed a way to treat the area as a 3D surface to create a more refined measurement of temperature in the nostrils.

Testing in real-world situations

In addition to indoor laboratory tests, the researchers used the mobile thermal imaging approach to measure the breathing of volunteers in a scenario that involved breathing exercises with changes in ambient temperature and in a fully unconstrained test where volunteers walked around inside and outside of a building. During the walking tests, the thermal camera was placed between 20 and 30 centimeters from a person’s face using a rig that attached the camera to a hat. A cord then connected the camera with a mobile phone carried by study volunteers. It is also possible to hold a smartphone with an imaging camera about 50 centimeters from the face to measure breathing.

“For all three types of studies, the algorithms showed significantly better performance in tracking the nostril area than other state-of-the-art methods,” said Cho. “In terms of estimating the breathing rate, the tests outside the laboratory showed the best results when compared with the latest algorithms. Although the results were comparable to the traditional breathing belt sensor, for mobile situations our approach seems to be more stable because the belt tends to get loose.”

Because the new approach is more stable than standard chest belt respiratory sensors, the method could potentially be used to optimize an athlete’s performance by providing more reliable and accurate feedback on breathing patterns during exercise.

The researchers took their work one step further by inferring a person’s mental load or stress through automatic breathing analysis. They used their thermal imaging software to track the breathing of people who were free to move around while performing various types of tasks, and the results aligned well with findings from studies that used much more sophisticated equipment, indicating the portable thermal-camera based approach could be a useful tool for apps that help people relax.

“By using mobile thermal imaging to monitor only breathing, we obtained results very comparable to what other studies had found,” said Bianchi-Berthouze. “However, those studies used complex, state-of-the-art techniques that involved multiple sensors monitoring not just breathing but also heart rate.”

The current version of the software doesn’t estimate the breathing rate in real time, but the researchers are working to incorporate this capability and to test their algorithms in more real-life situations.

The technology employs machine-learning software to analyze images of skin lesions and provide doctors with objective data on telltale biomarkers of melanoma, which is deadly if detected too late, but highly treatable if caught early.

The AI system — trained using tens of thousands of skin images and their corresponding eumelanin and hemoglobin levels — could initially reduce the number of unnecessary biopsies, a significant health-care cost. It gives doctors objective information on lesion characteristics to help them rule out melanoma before taking more invasive action.

The technology could be available to doctors as early as next year.

“This could be a very powerful tool for skin cancer clinical decision support,” said Alexander Wong, a professor of systems design engineering at Waterloo. “The more interpretable information there is, the better the decisions are.”

Currently, dermatologists largely rely on subjective visual examinations of skin lesions such as moles to decide if patients should undergo biopsies to diagnose the disease.

The new system deciphers levels of biomarker substances in lesions, adding consistent, quantitative information to assessments currently based on appearance alone. In particular, changes in the concentration and distribution of eumelanin, a chemical that gives skin its colour, and hemoglobin, a protein in red blood cells, are strong indicators of melanoma.

“There can be a huge lag time before doctors even figure out what is going on with the patient,” said Wong who is also the Canada Research Chair in Medical Imaging Systems. “Our goal is to shorten that process.”

Wong developed the technology in collaboration with Daniel Cho, a former PhD student at Waterloo, David Clausi, a professor of systems design engineering professor at Waterloo, and Farzad Khalvati, an adjunct professor at Waterloo and scientist at Sunnybrook.

The research was recently presented at the 14th International Conference on Image Analysis and Recognition in Montreal.

Professor Alexandra Meliou in the College of Information and Computer Sciences says, “The increased role of software and the potential impact it has on people’s lives makes software fairness a critical property. Data-driven software has the ability to shape human behavior: it affects the products we view and purchase, the news articles we read, the social interactions we engage in, and, ultimately, the opinions we form.”

Meliou with professor Yuriy Brun and Ph.D. student Sainyam Galhotra, have developed a new technique they call “Themis,” to automatically test software for discrimination. They hope Themis will empower stakeholders to better understand software behavior, judge when unwanted bias is present, and, ultimately improve the software.

Brun says, “Unchecked, biases in data and software run the risk of perpetuating biases in society. For example, prior work has demonstrated that racial bias exists in online advertising delivery systems, where online searches for traditionally-minority names were more likely to yield ads related to arrest records. Such software behavior can contribute to racial stereotypes and other grave societal consequences.”

The researchers’ paper describing this research, published in pre-conference materials for the European Software Engineering Conference (ESEC/FSE 2017) before its September meeting in Paderborn, Germany, has won an Association of Computing Machinery Special Interest Group on Software Engineering (ACM SIGSOFT) Distinguished Paper Award. The work is supported by the National Science Foundation.

Brun explains that while earlier research has considered discrimination in software, Themis focuses on measuring causality in discrimination. Software testing allows Themis to perform hypothesis testing, to ask such questions as whether changing a person’s race affects whether the software recommends giving that person a loan, he says.

“Our approach measures discrimination more accurately than prior work that focused on identifying differences in software output distributions, correlations or mutual information between inputs and outputs. Themis can identify bias in software whether that bias is intentional or unintentional, and can be applied to software that relies on machine learning, which can inject biases from data without the developers’ knowledge,” he adds.

When evaluated on public software systems from GitHub, Themis found that discrimination can sneak in even when the software is explicitly designed to be fair. State-of-the-art techniques for removing discrimination from algorithms fail in many situations, in part because prior definitions of discrimination failed to capture causality, the researchers point out.

For example, Themis found that a decision-tree-based machine learning approach specifically designed not to discriminate against gender was actually discriminating more than 11 percent of the time. That is, more than 11 percent of the individuals saw the software output affected just by altering their gender.

Themis also found that designing the software to avoid discrimination against one attribute may increase discrimination against others. For example, the same decision-tree-based software trained not to discriminate on gender discriminated against race 38 percent of the time