Open problems in the security of learning

Machine learning has become a valuable tool for detecting and preventing malicious activity. However, as more applications employ machine learning techniques in adversarial decision-making situations, increasingly powerful attacks become possible against machine learning systems. In this paper, we present three broad research directions towards the end of developing truly secure learning. First, we suggest that finding bounds on adversarial influence is important to understand the limits of what an attacker can and cannot do to a learning system. Second, we investigate the value of adversarial capabilities-the success of an attack depends largely on what types of information and influence the attacker has. Finally, we propose directions in technologies for secure learning and suggest lines of investigation into secure techniques for learning in adversarial environments. We intend this paper to foster discussion about the security of machine learning, and we believe that the research directions we propose represent the most important directions to pursue in the quest for secure learning.

Sjuksköterskestudenters skattade upplevelser av lärandemiljön före och efter inrättandet av Kompetenscentrum

Bakgrund: Under senare år har allt fler kliniska träningscentra för färdighetsträning etablerats för att möjliggöra en trygg och säker lärandemiljö med simuleringsmöjligheter för studerande och personal. Klinisk färdighetsträning är en viktig del i sjuksköterskeutbildningen vid Högskolan Dalarna (HDa) där lärandemiljön på Kompetenscentrum (KC) kan bidra till en förbättring av lärandemiljön i den kliniska färdighetsutbildningen. Syfte: Syftet med denna studie var att undersöka sjuksköterskestudenters upplevelser via skattning av lärandemiljön för klinisk färdighetsutbildning före och efter inrättandet av Kompetenscentrum. Metod: Studien genomfördes som en enkätundersökning med kvasiexperimentell design. Enkätens baserades på Saarikoski och Leino-Kilpis mätinstrument CLES där frågeställningar om lärandemiljön modifierades med hjälp av Delphimetoden utifrån de tre olika dimensionerna: utbildningsmiljö, relation och lärarens roll. Mätningen före inrättandet genomfördes under hösten 2010 och mätningen efter inrättandet genomfördes hösten 2011. Totalt ingick 266 sjuksköterskestudenter i studien varav 198 (74 %) besvarade enkäten. Resultat: Sjuksköterskestudenter skattade upplevelsen av lärandemiljön mer positiv efter inrättandet av Kompetenscentrum där resultatet visar en signifikant högre skattning i 8 de av de 16 frågorna. Sjuksköterskestudenterna skattade att de upplever att utbildningsmiljön är mer verklighetstrogen, de är mer nöjda med färdighetsträningen samt att den inspirerar dem till att arbeta som sjuksköterska. Att relationen mellan dem och läraren bygger på respekt och att det är en mer positiv atmosfären under färdighetsträningen. Däremot påvisades ingen signifikant skillnad i studenternas upplevelse av den kliniska lärarens roll. Slutsats: Det är uppenbart att lärandemiljö har betydelse för sjuksköterskestudentens integration av såväl teoretiska som praktiska kunskaper vilket medför att färdigheterna förbättras och ger en bra grund för arbetet som sjuksköterska. Strategier bör vidtas för att vidmakthålla och utveckla lärandemiljön på KC samt fokusera ytterligare på integrering av teori och praktik.

Towards a global carbon integrity system : learning from the GFC and avoiding a GCC

This paper examines some of the central global ethical and governance challenges of climate change and carbon emis-sions reduction in relation to globalization, the “global financial crisis” (GFC), and unsustainable conceptions of the “good life”, and argues in favour of the development of a global carbon “integrity system”. It is argued that a funda-mental driver of our climate problems is the incipient spread of an unsustainable Western version of the “good life”, where resource-intensive, high-carbon western lifestyles, although frequently criticized as unsustainable and deeply unsatisfying, appear to have established an unearned ethical legitimacy. While the ultimate solution to climate change is the development of low carbon lifestyles, the paper argues that it is also important that economic incentives support and stimulate that search: the sustainable versions of the good life provide an ethical pull, whilst the incentives provide an economic push. Yet, if we are going to secure sustainable low carbon lifestyles, it is argued, we need more than the ethical pull and the economic push. Each needs to be institutionalized—built into the governance of global, regional, national, sub-regional, corporate and professional institutions. Where currently weakness in each exacerbates the weaknesses in others, it is argued that governance reform is required in all areas supporting sustainable, low carbon versions of the good life.

Challenges of Measuring Learning Outcomes for Property Students Engaged in Work Integrated Learning

Work integrated learning (WIL) or professional practice units are recognised as providing learning experiences that help students make successful transitions to professional practice. These units require students to engage in learning in the workplace; to reflect on this learning; and to integrate it with learning at university. However, an analysis of a recent cohort of property economics students at a large urban university provides evidence that there is great variation in work based learning experiences undertaken and that this impacts on students’capacity to respond to assessment tasks which involve critiquing these experiences in the form of reflective reports. This paper highlights the need to recognise the diversity of work based experiences; the impact this has on learning outcomes; and to find more effective and equitable ways of measuring these outcomes. The paper briefly discusses assessing learning outcomes in WIL and then describes the model of WIL in the Faculty of Built Environment and Engineering at the Queensland University of Technology (QUT). The paper elaborates on the diversity of students’ experiences and backgrounds including variations in the length of work experience, placement opportunities and conditions of employment.For example, the analysis shows that students with limited work experience often have difficulty critiquing this work experience and producing high level reflective reports. On the other hand students with extensive, discipline relevant work experience can be frustrated by assessment requirements that do not take their experience into account. Added to this the Global Financial Crisis (GFC) has restricted both part time and full time placement opportunities for some students. These factors affect students’ capacity to a) secure a relevant work experience, b) reflect critically on the work experiences and c) appreciate the impact the overall experience can have on their learning outcomes and future professional opportunities. Our investigation highlights some of the challenges faced in implementing effective and equitable approaches across diverse student cohorts. We suggest that increased flexibility in assessment requirements and increased feedback from industry may help address these challenges.

Examining the Assessment Opportunities for Cultural Connectedness for Student Learning : A Sociocultural Analysis

The disparity that exists between the highest and lowest achievers together with deficit approaches to teaching, learning and assessment raise serious equity issues related to fairness, validity, culture and access, which were analysed in a recent Australian Research Council funded project. This chapter explores the potential that exists for teachers to work with Indigenous Teacher Assistants (ITAs) to secure cultural connectedness in teaching, learning and assessment of Indigenous students. The study was a design experiment, which was conducted in seven Catholic and Independent primary schools in northern Queensland and involved semi-structured focus group interviews with Year 4 and 6 Indigenous students, principals, teachers and Indigenous Teacher Assistants. Classroom observations and document analyses were also conducted. This corpus of data was analysed using a sociocultural theoretical lens. The use of a sociocultural analysis helped to identify cultural influences, Indigenous students’ funds of knowledge and values. The information from this analysis was made explicit to teachers to demonstrate how they could enhance their pedagogic and assessment practices by embracing and extending the cultural spaces for learning and teaching of Indigenous students. The way in which teachers construct their interactions for greater cultural connectedness and enhanced learning would appear to rely on relationship building with Indigenous staff, Indigenous students’ cultural knowledge, and improved understanding of assessment and related equity issues.

Exploring the conditions to support assessment for more equitable learning outcomes

NAPLAN RESULTS HAVE gained socio-political prominence and have been used as indicators of educational outcomes for all students, including Indigenous students. Despite the promise of open and in-depth access to NAPLAN data as a vehicle for intervention, we argue that the use of NAPLAN data as a basis for teachers and schools to reduce variance in learning outcomes is insufficient. NAPLAN tests are designed to show statistical variance at the level of the school and the individual, yet do not factor in the sociocultural and cognitive conditions Indigenous students’ experience when taking the tests. We contend that further understanding of these influences may help teachers understand how to develop their classroom practices to secure better numeracy and literacy outcomes for all students. Empirical research findings demonstrate how teachers can develop their classroom practices from an understanding of the extraneous cognitive load imposed by test taking. We have analysed Indigenous students’ experience of solving mathematical test problems to discover evidence of extraneous cognitive load. We have also explored conditions that are more supportive of learning derived from a classroom intervention which provides an alternative way to both assess and build learning for Indigenous students. We conclude that conditions to support assessment for more equitable learning outcomes require a reduction in cognitive load for Indigenous students while maintaining a high level of expectation and participation in problem solving.

Moving forwards with the aim of going backwards fast : high performance rowing as a learning environment

Background and Purpose: - This paper focuses on the learning culture within the high performance levels of rowing. In doing so, we explore the case of an individual’s learning as he moves across athletic, coaching and administrative functions. This exploration draws on a cultural learning framework and complementary theorisings related to reflexivity. Method - This study makes use of an intellectually, morally and collaboratively challenging approach whereby one member of the research team was also the sole participant of this study. The participant’s careers as a high performance athlete, coach and administrator, coupled with his experience in conducting empirical research presented a rare opportunity to engage in collaborative research (involving degrees of insider and outsider status for each of the research team). We acknowledge that others have looked to combine roles of coach / athlete / administrator with that of researcher however few (if any) have attempted to combine them all in one project. Moreover, coupled with the approach to reflexivity adopted in this study and the authorship contributions we consider this scholarly direction uncommon. Data were comprised of recorded research conversations, a subsequently constructed learning narrative, reflections on the narrative, a stimulated reflective piece from the participant, and a final (re)construction of the participant’s story. Accordingly, data were integrated through an iterative process of thematic analysis. Results - The cultural (i.e., the ways things get done) and structural (e.g., the rules and regulations) properties of high performance rowing were found to shape both the opportunities to be present (e.g., secure a place in the crew) and to learn (e.g., learn the skills required to perform at an Olympic level). However, the individual’s personal properties were brought to bear on re-shaping the constraints such that many limitations could be overcome. In keeping with the theory of learning cultures, the culture of rowing was found to position individuals (a coxswain in this case) differentially. In a similar manner, a range of structural features was found to be important in shaping the cultural and personal elements in performance contexts. For example, the ‘field of play’ was found to be important as a structural feature (i.e., inability of coach to communicate with athletes) in shaping the cultural and personal elements of learning in competition (e.g., positioning the coxswain as an in-boat coach and trusted crewmate). Finally, the cultural and structural elements in rowing appeared to be activated by the participant’s personal elements, most notably his orientation towards quality performance. Conclusion - The participant in this study was found to be driven by the project that he cares about most and at each turn he has bent his understanding of his sport back on itself to see if he can find opportunities to learn and subsequently explore ways to improve performance. The story here emphasises the importance of learner agency, and this is an aspect that has often been missing in recent theorising about learning. In this study, we find an agent using his ‘personal emergent powers to activate the resources in the culture and structure of his sport in an attempt to improve performance. We conclude from this account that this particular high performance rowing culture is one that provided support but nonetheless encouraged those involved, to ‘figure things out’ for themselves – be it as athletes, coaches and/or administrators.

Post-quantum key exchange for the TLS protocol from the ring learning with errors problem

Lattice-based cryptographic primitives are believed to offer resilience against attacks by quantum computers. We demonstrate the practicality of post-quantum key exchange by constructing cipher suites for the Transport Layer Security (TLS) protocol that provide key exchange based on the ring learning with errors (R-LWE) problem, we accompany these cipher suites with a rigorous proof of security. Our approach ties lattice-based key exchange together with traditional authentication using RSA or elliptic curve digital signatures: the post-quantum key exchange provides forward secrecy against future quantum attackers, while authentication can be provided using RSA keys that are issued by today's commercial certificate authorities, smoothing the path to adoption. Our cryptographically secure implementation, aimed at the 128-bit security level, reveals that the performance price when switching from non-quantum-safe key exchange is not too high. With our R-LWE cipher suites integrated into the Open SSL library and using the Apache web server on a 2-core desktop computer, we could serve 506 RLWE-ECDSA-AES128-GCM-SHA256 HTTPS connections per second for a 10 KiB payload. Compared to elliptic curve Diffie-Hellman, this means an 8 KiB increased handshake size and a reduction in throughput of only 21%. This demonstrates that provably secure post-quantum key-exchange can already be considered practical.

Design and implementation of robust systems for secure malware detection

Malicious software (malware) have significantly increased in terms of number and effectiveness during the past years. Until 2006, such software were mostly used to disrupt network infrastructures or to show coders’ skills. Nowadays, malware constitute a very important source of economical profit, and are very difficult to detect. Thousands of novel variants are released every day, and modern obfuscation techniques are used to ensure that signature-based anti-malware systems are not able to detect such threats. This tendency has also appeared on mobile devices, with Android being the most targeted platform. To counteract this phenomenon, a lot of approaches have been developed by the scientific community that attempt to increase the resilience of anti-malware systems. Most of these approaches rely on machine learning, and have become very popular also in commercial applications. However, attackers are now knowledgeable about these systems, and have started preparing their countermeasures. This has lead to an arms race between attackers and developers. Novel systems are progressively built to tackle the attacks that get more and more sophisticated. For this reason, a necessity grows for the developers to anticipate the attackers’ moves. This means that defense systems should be built proactively, i.e., by introducing some security design principles in their development. The main goal of this work is showing that such proactive approach can be employed on a number of case studies. To do so, I adopted a global methodology that can be divided in two steps. First, understanding what are the vulnerabilities of current state-of-the-art systems (this anticipates the attacker’s moves). Then, developing novel systems that are robust to these attacks, or suggesting research guidelines with which current systems can be improved. This work presents two main case studies, concerning the detection of PDF and Android malware. The idea is showing that a proactive approach can be applied both on the X86 and mobile world. The contributions provided on this two case studies are multifolded. With respect to PDF files, I first develop novel attacks that can empirically and optimally evade current state-of-the-art detectors. Then, I propose possible solutions with which it is possible to increase the robustness of such detectors against known and novel attacks. With respect to the Android case study, I first show how current signature-based tools and academically developed systems are weak against empirical obfuscation attacks, which can be easily employed without particular knowledge of the targeted systems. Then, I examine a possible strategy to build a machine learning detector that is robust against both empirical obfuscation and optimal attacks. Finally, I will show how proactive approaches can be also employed to develop systems that are not aimed at detecting malware, such as mobile fingerprinting systems. In particular, I propose a methodology to build a powerful mobile fingerprinting system, and examine possible attacks with which users might be able to evade it, thus preserving their privacy. To provide the aforementioned contributions, I co-developed (with the cooperation of the researchers at PRALab and Ruhr-Universität Bochum) various systems: a library to perform optimal attacks against machine learning systems (AdversariaLib), a framework for automatically obfuscating Android applications, a system to the robust detection of Javascript malware inside PDF files (LuxOR), a robust machine learning system to the detection of Android malware, and a system to fingerprint mobile devices. I also contributed to develop Android PRAGuard, a dataset containing a lot of empirical obfuscation attacks against the Android platform. Finally, I entirely developed Slayer NEO, an evolution of a previous system to the detection of PDF malware. The results attained by using the aforementioned tools show that it is possible to proactively build systems that predict possible evasion attacks. This suggests that a proactive approach is crucial to build systems that provide concrete security against general and evasion attacks.

"Practise what we preach": a social constructivist approach to blended learning

This presentation reports on the formal evaluation, through questionnaires, of a new Level 1 undergraduate course, for 130 student teachers, that uses blended learning. The course design seeks to radicalise the department’s approach to teaching, learning and assessment and use students as change agents. Its structure and content, model social constructivist approaches to learning. Building on the student’s experiences of and, reflections on, previous learning, promotes further learning through the support of “able others” (Vygotsky 1978), facilitating and nurturing a secure community of practice for students new to higher education. The course’s design incorporates individual, paired, small and large group activities and exploits online video, audio and text materials. Course units begin and end with face-to-face tutor-led activities. Online elements, including discussions and formative submissions, are tutor-mediated. Students work together face-to-face and online to read articles, write reflections, develop presentations, research and share experiences and resources. Summative joint assignments and peer assessments emphasise the value of collaboration and teamwork for academic, personal and professional development. Initial informal findings are positive, indicating that students have engaged readily with course content and structure, with few reporting difficulties accessing or using technology. Students have welcomed the opportunity to work together to tackle readings in a new genre, pilot presentation skills and receive and give constructive feedback to peers. Course tutors have indicated that depth and quality of study are evident, with regular online formative submissions enabling tutors to identify and engage directly with student’s needs, provide feedback and develop appropriately designed distance and face-to-face teaching materials. Pastoral tutors have indicated that students have reported non-engagement of peers, leading to the rapid application of academic or personal support. Outcomes of the formal evaluation will inform the development of Level 2 and 3 courses and influence the department’s use of blended learning.

A video-based biometric authentication for e-learning web applications

In the last years there was an exponential growth in the offering of Web-enabled distance courses and in the number of enrolments in corporate and higher education using this modality. However, the lack of efficient mechanisms that assures user authentication in this sort of environment, in the system login as well as throughout his session, has been pointed out as a serious deficiency. Some studies have been led about possible biometric applications for web authentication. However, password based authentication still prevails. With the popularization of biometric enabled devices and resultant fall of prices for the collection of biometric traits, biometrics is reconsidered as a secure remote authentication form for web applications. In this work, the face recognition accuracy, captured on-line by a webcam in Internet environment, is investigated, simulating the natural interaction of a person in the context of a distance course environment. Partial results show that this technique can be successfully applied to confirm the presence of users throughout the course attendance in an educational distance course. An efficient client/server architecture is also proposed. © 2009 Springer Berlin Heidelberg.

Autenticação biométrica de usuários em sistemas de E-learning baseada em reconhecimento de faces a partir de vídeo

Pós-graduação em Ciência da Computação - IBILCE

Rahmenwerk für zielgruppenorientiertes Blended E-Learning im MINT-Bereich im Kontext des Lebenslangen Lernens

Das heutige Leben der Menschen ist vom Internet durchdrungen, kaum etwas ist nicht „vernetzt“ oder „elektronisch verfügbar“. Die Welt befindet sich im Wandel, die „Informationsgesellschaft“ konsumiert in Echtzeit Informationen auf mobilen Endgeräten, unabhängig von Zeit und Ort. Dies gilt teilweise auch für den Aus- und Weiterbildungssektor: Unter „E-Learning“ versteht man die elektronische Unterstützung des Lernens. Gelernt wird „online“; Inhalte sind digital verfügbar. Zudem hat sich die Lebenssituation der sogenannten „Digital Natives“, der jungen Individuen in der Informationsgesellschaft, verändert. Sie fordern zeitlich und räumlich flexible Ausbildungssysteme, erwarten von Bildungsinstitutionen umfassende digitale Verfügbarkeit von Informationen und möchten ihr Leben nicht mehr Lehr- und Zeitplänen unterordnen – das Lernen soll zum eigenen Leben passen, lebensbegleitend stattfinden. Neue „Lernszenarien“, z.B. für alleinerziehende Teilzeitstudierende oder Berufstätige, sollen problemlos möglich werden. Dies soll ein von der europäischen Union erarbeitetes Paradigma leisten, das unter dem Terminus „Lebenslanges Lernen“ zusammengefasst ist. Sowohl E-Learning, als auch Lebenslanges Lernen gewinnen an Bedeutung, denn die (deutsche) Wirtschaft thematisiert den „Fachkräftemangel“. Die Nachfrage nach speziell ausgebildeten Ingenieuren im MINT-Bereich soll schnellstmöglich befriedigt, die „Mitarbeiterlücke“ geschlossen werden, um so weiterhin das Wachstum und den Wohlstand zu sichern. Spezielle E-Learning-Lösungen für den MINT-Bereich haben das Potential, eine schnelle sowie flexible Aus- und Weiterbildung für Ingenieure zu bieten, in der Fachwissen bezogen auf konkrete Anforderungen der Industrie vermittelt wird. Momentan gibt es solche Systeme allerdings noch nicht. Wie sehen die Anforderungen im MINT-Bereich an eine solche E-Learning-Anwendung aus? Sie muss neben neuen Technologien vor allem den funktionalen Anforderungen des MINTBereichs, den verschiedenen Zielgruppen (wie z.B. Bildungsinstitutionen, Lerner oder „Digital Natives“, Industrie) und dem Paradigma des Lebenslangen Lernens gerecht werden, d.h. technische und konzeptuelle Anforderungen zusammenführen. Vor diesem Hintergrund legt die vorliegende Arbeit ein Rahmenwerk für die Erstellung einer solchen Lösung vor. Die praktischen Ergebnisse beruhen auf dem Blended E-Learning-System des Projekts „Technische Informatik Online“ (VHN-TIO).