by Mila Dalla Preda, Niccolò Marastoni, Federica Paci (University of Verona)

Ensuring software security starts with detecting vulnerabilities in the early stages of development: while traditional rule-based and machine-learning methods require expert input, Large Language Models (LLMs) are emerging as powerful, autonomous alternatives that could transform the approach to vulnerability detection.

 by Zoltán Ságodi (University of Szeged), Péter Hegedűs (University of Szeged), and Rudolf Ferenc (University of Szeged)

As AI-driven language models increasingly demonstrate their ability to generate and repair source code, the role of human developers faces a profound transformation. This paper explores both the potential and challenges of leveraging these models for programming tasks and vulnerability mitigation, highlighting where human expertise remains essential.

by Aayush Garg, Yuejun Guo and Qiang Tang (Luxembourg Institute of Science and Technology)

Artificial Intelligence (AI) is revolutionizing software security within the DevSecOps framework by embedding automated tools for real-time vulnerability detection, patching, and anti-fuzzing into the development pipeline. The LAZARUS project at the Luxembourg Institute of Science and Technology (LIST) is leading this transformation, leveraging advanced AI models to proactively identify and address security threats before they can be exploited.

by Giovanni Ciaramella (IMT School for Advanced Studies Lucca and CNR-IIT), Fabio Martinelli (CNR-IIT), and Francesco Mercaldo (University of Molise and CNR-IIT)

The academic and industrial research community is exploring various machine learning methods to detect malware, particularly ransomware. However, real-world adoption is hindered by privacy concerns, as malware detection typically requires sending applications to a centralised model. To address this, we propose a privacy-preserving ransomware detection method using federated learning, which trains models locally on edge devices without transferring data. Preliminary experiments on a dataset of 15,000 real-world applications confirm the method’s effectiveness.

by Daniel Setó-Rey, Carlos López-Nozal, and José Ignacio Santos-Martín (Universidad de Burgos)

The reuse of software by importing packages from repositories is an efficient way to develop software. However, reusing software in this manner introduces vulnerability risks due to transitive dependencies. These vulnerabilities must be measured to identify risks and propose corrective actions.

by Thomas Sutter (University of Bern and Zurich University of Applied Sciences), Ariane Trammell (Zurich University of Applied Sciences), and Timo Kehrer (University of Bern)

The competitive smartphone market is keen to prevent its intellectual property from being analysed by competitors and the public. As a result, most smartphones are locked when distributed, and anti-reversing techniques are widely used. Consequently, millions of users use smartphones daily without a clear understanding of the software’s functionality and purpose. We developed a novel framework, FirmwareDroid, to analyse the security of mobile device firmware.

by Christophe Ponsard and Jean-François Daune (CETIC)

Digital products have become ubiquitous across all domains for everyday activities of both citizens and companies. Providing secure products is required to ensure the organisations relying on them have a minimal attack surface. This article highlights specific needs and our ongoing work to conduct a cyber security risk analysis for a digital product, which is also increasingly required by regulations such as the EU The Network and Information Security Directive (NIS2) or the upcoming Cyber Resilience Act.

by Peter Kieseberg (St. Pölten UAS), Christoph Kaltenriner (Dataphone GmbH), and Peter Gallistl (Dataphone GmbH)

Drones promise significant benefits for small-and-medium-sized enterprises (SMEs) in warehouse logistics, but integrating them securely into existing systems is a complex challenge. This article explores how SMEs can overcome security risks – including man-at-the-end (MATE) attacks – and operational hurdles to effectively adopt drone technology.

by Ramon Barakat, Sascha Hackel (Fraunhofer FOKUS) and Miltiadis Siavvas (CERTH)

The Design and Operation of Secure Supply Chain (DOSS) project’s Supply Trust Chain idea seeks to truly improve IoT security and trust from design to deployment. The project’s goal is to secure the IoT supply chain throughout its lifecycle, ensuring that stakeholders always have access to security-related information.

by Antonis Louka (University of Cyprus), Andreas Dionysiou (Frederick University), and Elias Athanasopoulos (University of Cyprus)

In today’s programming landscape, ensuring software security is more critical than ever. Rust, a relatively new programming language, incorporates safety features that produce secure and efficient machine code without relying on runtime support. In our work, developed at the University of Cyprus, we explore how an attacker might deliberately create vulnerabilities in Rust binaries post-compilation, and the need for code validation for such systems.

by Pierre Lermusiaux and Benoît Montagu (Inria)

Functional programming languages, such as OCaml, take advantage of strong static guarantees provided by their type checkers that ensure that well-typed programs cannot “go wrong”. However many correctness and safety properties escape the scope of the guarantees provided by the type system. In order to provide some additional guarantees, the Salto project leverages static analysis techniques, mainly based on abstract interpretation, to develop tools that help OCaml programmers increase the confidence in their programs. 

by Caroline Lawitschka and Sebastian Schrittwieser (University of Vienna)

We introduce a novel methodology for generating complex and robust Mixed Boolean-Arithmetic (MBA) expressions for various software protection methodologies. Our research specifically focuses on leveraging the concept of equality saturation to create MBA expressions of arbitrary complexity.

by Nuno Saavedra, João F. Ferreira (INESC-ID and University of Lisbon) and Alexandra Mendes (INESC TEC and University of Porto)

GLITCH is a versatile tool designed for detecting code smells in Infrastructure as Code (IaC) scripts across multiple technologies. Developed by researchers from INESC-ID (Lisbon), INESC TEC (Porto), Instituto Superior Técnico / University of Lisbon, and the Faculty of Engineering / University of Porto, GLITCH automates the detection of both security and design flaws in scripts written in Ansible, Chef, Docker, Puppet, and Terraform. By using a technology-agnostic framework, GLITCH aims to improve the consistency and efficiency of code smell detection, making it a valuable resource for DevOps engineers and researchers focused on software quality.

by Patrick Kochberger, Philipp Haindl (St. Pölten University of Applied Sciences), Matteo Battaglin and Patrick Felbauer (University of Vienna)

In this project, we investigate how different tools measure code complexity of software protections, revealing significant variations in their results. While simpler metrics like lines of code (LOC) often produce similar outcomes, more advanced metrics such as cyclomatic complexity (CC) and maintainability index (MI) show major differences across tools. These discrepancies highlight the need for better methodologies when assessing the effectiveness of obfuscation techniques for protecting software.

by Steffen Lüdtke, Roman Kraus and Martin Schneider (Fraunhofer FOKUS)

The growing number and diversity of cybersecurity attacks pose a challenge for developing secure systems, particularly in an age where many systems are connected to the internet. To facilitate early vulnerability detection, we propose an interactive fuzzing technique which employs grammars and supports genetic algorithms to interact with the SUT. This technique can generate inputs for specific attack scenarios, which are useful for finding new vulnerabilities and for assessing the completeness of patches. The proposed technique found zero-day vulnerabilities in established MQTT brokers within a few minutes.

by Sebastian Schrittwieser (University of Vienna)

Software protection has evolved over the past three decades, but ensuring the correctness of protective code transformations remains a challenge. Our novel approach breaks down complex obfuscation techniques into smaller, manageable components and implements them as compiler passes. By using translation validation, the correctness of each transformation is ensured, resulting in more reliable and robust software protections.

by Chenglu Jin (CWI) and Marten van Dijk (CWI and Vrije Universiteit) 

For a long time, process variations in the manufacturing of computer chips has been a big hurdle for producing high-quality products. However, one can turn these imperfections caused by the process variations into something good: into unique random functions that are impossible to clone even by the original manufacturer. At CWI in Amsterdam, we are building a solid foundational understanding of these security primitives and bringing them closer to practice. This could be very interesting for use in computer systems and embedded systems, like cloud servers and controllers in critical infrastructures.

by Radhen Hendarmawan (RISE)

In the rapidly evolving world of embedded systems, ensuring robust software security within System-on-Chip (SoC) environments is essential. At RISE, we explore a heterogeneous approach using Field-Programmable Gate Arrays (FPGAs) and develop toolkits to streamline hardware acceleration, offering software developers powerful solutions to bolster security and performance.

by Frédéric Besson, Célia Le Du (Inria), and Pierre Wilke (Centrale Supélec Rennes)

Hardware and software solutions for protectecting against timing side-channel attacks are effective in securing sensitive data, but significantly impact the performance of the programs they protect. The SCRATCHS project, which stands for Side-Channel Resistant Applications through Co-designed Hardware/Software, aims to combine security and execution speed by developing a new hybrid protection solution based on hardware and software co-design.

by Mario de la Haba Navarro (Decentralized Security), Pablo Sánchez-Serrano (University of Malaga), and Isaac Agudo (Decentralized Security and University of Malaga)

A recurring security issue in software is protecting cryptographic material, especially for cloud-hosted or internet-facing applications, where the risk of key compromise is higher. One solution is using a Hardware Security Module (HSM), which secures keys and performs cryptographic operations without exposing them. However, HSMs are typically closed source, making security evaluations difficult, and may not support the latest cryptographic methods. For over three years, we've been developing an open-source modular platform to build an HSM for Ethereum clients, a crucial part of the blockchain infrastructure.

by Katharina Flicker (EOSC Support Office Austria, SBA Research, TU Wien), Stefan Hanslik (BMBWF), Tereza Kalová (Vienna University Library, University of Vienna)

In 2015, the vision of a European federated and open multi-disciplinary environment, known as the European Open Science Cloud (EOSC), was born. EOSC represents a significant leap towards more integrated and accessible scientific resources across Europe. In this context, the EOSC Support Office Austria (EOSC SOA) was launched to coordinate Austria’s contributions to EOSC’s implementation. If you are interested in exploring how EOSC and EOSC SOA are shaping the future of research and why they are crucial for the ERCIM community, continue reading.

by Rafael Kupsa, Amin Anjomshoaa and Markus Tauber (Research Studios Austria)

The EDEN project is at the forefront of sustainable agriculture, integrating Industry 5.0 technologies to improve upon aquaponics systems. This article explores how the project is developing innovative frameworks to maximise resource efficiency, optimise food production, and foster community engagement securely.

by Yasin Ghafourian (Research Studios Austria), Markus Tauber (Research Studios Austria), Germar Schneider, and Andrea Bannert (Infineon Technologies Dresden GmbH & Co. KG), Olga Kattan (Philips), and Erwin Schoitsch (Austrian Institute of Technology)

To promote AI adoption in industrial cyber-physical systems (CPS) within Industry 4.0 and 5.0, it’s crucial to develop tools that support the AI lifecycle and address knowledge gaps in standards among developers. Tailored guidance is needed to ensure AI solutions in safety-critical industries are trustworthy and ethically compliant. Given the fragmented standardisation landscape for CPS, this paper proposes an ethical compliance checklist and a self-assessment tool using large language models (LLMs) to help users navigate standards, close knowledge gaps, and ensure human-centred, legally compliant AI applications.

by Luca Caviglione (CNR-IMATI), Gianluigi   (CNR-ICAR), Massimo Guarascio (CNR-ICAR), and Paolo Zicari (CNR-ICAR)

Modern Man-At-The-End (MATE) attacks can take advantage of Language Models to produce deceptive information or malware variations. Fortunately, they can also be used to implement advanced defensive techniques. In this vein, we present the use of Small Language Models to reveal fraudulent communications or to automatically generate test cases for preventing the exfiltration of data through tampered MQTT brokers.

by Mehdi Akbari Gurabi, Lasse Nitz, Charukeshi Mayuresh Joglekar, and Avikarsha Mandal (Fraunhofer FIT)

As cyberattacks evolve and become more complex, defenders require advanced tools for effective incident response. In the H2020 projects, SAPPAN and CyberSEAS, we conducted research to develop a cybersecurity playbook management system that provides a robust framework for creating, maintaining, and sharing standardised incident response procedures. The pilot validation shows how the system can be streamlined into current cybersecurity operations, towards compliance with the latest security recommendations and directives.

by Hamidreza Yaghoubi, Navtaj Randhawa (University of Applied Sciences Burgenland), and Igor Ivkić (University of Applied Sciences Burgenland and Lancaster University, UK)

Traditional access control systems, such as key cards, PIN pads, and physical keys, face challenges in scalability, security, and user experience in today’s digital world. We present a cloud-based entry system using Raspberry Pi hardware and Amazon Web Services (AWS) technologies like Lambda, Simple Storage Service (S3), and Rekognition. This solution (AWSecure Entry System) enhances security, streamlines authentication, and increases operational efficiency.

by Panagiotis Konstantinopoulos, Vasileios Loukopoulos, Dionysia Mylona, Maria Veneri, and Konstantinos Bastas (Patras Science Park S.A.)

The Greek experience from operation of Science and Technology Parks (STPs) has demonstrated that the most important factors affecting operation of an STP are capacity building, and lack of funding for support of a wide range of services. A novel mechanism that will act as a Distributed Local Cluster is proposed for application in Balkan and Southern European countries.

by Simone Onofri (W3C)

Digital Identities have been in development for decades. As governments increasingly consider becoming providers and consumers of these technologies, they now more than ever have the potential to change the web and the concept of identity as we know it.

Nicola's research is distinguished by its high quality, interdisciplinary approach, and significant impact. His work spans across multiple domains, including Artificial Intelligence, Computer Vision, Deep Learning, and Multimedia Information Retrieval. He has made substantial contributions to both the theoretical and applied aspects of these fields, with measurable scientific and practical outcomes.

by Behçet Uğur Töreyin (İTÜ), Maria Trocan (ISEP) and Davide Moroni (CNR-ISTI)

Approximately forty researchers attended the International Workshop on Computational Intelligence for Multimedia Understanding (IWCIM), organized annually by the ERCIM Working Group Multimedia Understanding through Semantics, Computation and Learning (MUSCLE). The workshop took place as a satellite event of IEEE ISCAS 2024 held in Singapore on 21 May 2024. 

by Maurice ter Beek (CNR-ISTI)

The yearly conference of the ERCIM Working Group on Formal Methods for Industrial Critical Systems, FMICS [L1], the key conference at the intersection of industrial applications and formal methods, reached its 29th edition. This year the participants met in Milan, Italy, during 9-11 September 2024.

It is with deep sadness that we announce the passing of Prof. Matthias Jarke, a visionary computer scientist who made lasting contributions to both the Fraunhofer-Gesellschaft and ERCIM. His work left a significant impact on applied research in information systems, data management, and digital innovation.

Schloss Dagstuhl – Leibniz-Zentrum für Informatik is accepting proposals for scientific seminars/workshops in all areas of computer science, in particular also in connection with other fields. 

Generative AI is in a revolutionary phase of development. This has and will continue to have profound impact on society as well as science. It serves as enabler but also presents inherent challenges. It is important to develop a realistic understanding on the transformative nature of generative AI for the sciences and society, and how to responsibly use  this revolutionary technology.  As a network of European centres of excellence in digital technology, the ERCIM institutes are well positioned to contribute to this discussion within a national and European context. 

The first of October 2024 marked the 30th anniversary of the World Wide Web Consortium (W3C). To mark this milestone, W3C hosted W3C@30, aligning it with the TPAC 2024 conference in Anaheim, CA, USA, where the web standards community gathered.

Special Issue on Offensive and Defensive Techniques in the Context of Man At The End (MATE) Attacks

Guest Editors:

• Michele Ianni, University of Calabria, Italy, This email address is being protected from spambots. You need JavaScript enabled to view it.
• Sebastian Schrittwieser, University of Vienna, Austria, This email address is being protected from spambots. You need JavaScript enabled to view it.

MATE (Man-At-The-End) is an attacker model where an adversary has access to the target software or hardwareenvironment of his victim and the ability to observe and modify it in order to extract secrets such as cryptographickeys or sensitive information, possibly with the subsequent goal of altering code integrity or inserting backdoors,among others. A typical example of such a scenario is the case of an attack on a stolen smartphone or againstsoftware leveraging protection to hide sensitive data or intellectual property.