OnionBots: Subverting Privacy Infrastructure for Cyber Attacks

Over the last decade botnets survived by adopting a sequence of increasingly sophisticated strategies to evade detection and take overs, and to monetize their infrastructure. At the same time, the success of privacy infrastructures such as Tor opened the door to illegal activities, including botnets, ransomware, and a marketplace for drugs and contraband. We contend that the next waves of botnets will extensively subvert privacy infrastructure and cryptographic mechanisms. In this work we propose to preemptively investigate the design and mitigation of such botnets. We first, introduce OnionBots, what we believe will be the next generation of resilient, stealthy botnets. OnionBots use privacy infrastructures for cyber attacks by completely decoupling their operation from the infected host IP address and by carrying traffic that does not leak information about its source, destination, and nature. Such bots live symbiotically within the privacy infrastructures to evade detection, measurement, scale estimation, observation, and in general all IP-based current mitigation techniques. Furthermore, we show that with an adequate self-healing network maintenance scheme, that is simple to implement, OnionBots achieve a low diameter and a low degree and are robust to partitioning under node deletions. We developed a mitigation technique, called SOAP, that neutralizes the nodes of the basic OnionBots. We also outline and discuss a set of techniques that can enable subsequent waves of Super OnionBots. In light of the potential of such botnets, we believe that the research community should proactively develop detection and mitigation methods to thwart OnionBots, potentially making adjustments to privacy infrastructure.Comment: 12 pages, 8 figure

Impact in networks and ecosystems: building case studies that make a difference

open accessThis toolkit aims to support the building up of case studies that show the impact of project activities aiming to promote innovation and entrepreneurship. The case studies respond to the challenge of understanding what kinds of interventions work in the Southern African region, where, and why. The toolkit has a specific focus on entrepreneurial ecosystems and proposes a method of mapping out the actors and their relationships over time. The aim is to understand the changes that take place in the ecosystems. These changes are seen to be indicators of impact as increased connectivity and activity in ecosystems are key enablers of innovation. Innovations usually happen together with matching social and institutional adjustments, facilitating the translation of inventions into new or improved products and services. Similarly, the processes supporting entrepreneurship are guided by policies implemented in the common framework provided by innovation systems. Overall, policies related to systems of innovation are by nature networking policies applied throughout the socioeconomic framework of society to pool scarce resources and make various sectors work in coordination with each other. Most participating SAIS countries already have some kinds of identifiable systems of innovation in place both on national and regional levels, but the lack of appropriate institutions, policies, financial instruments, human resources, and support systems, together with underdeveloped markets, create inefficiencies and gaps in systemic cooperation and collaboration. In other words, we do not always know what works and what does not. On another level, engaging users and intermediaries at the local level and driving the development of local innovation ecosystems within which local culture, especially in urban settings, has evident impact on how collaboration and competition is both seen and done. In this complex environment, organisations supporting entrepreneurship and innovation often find it difficult to create or apply relevant knowledge and appropriate networking tools, approaches, and methods needed to put their processes to work for broader developmental goals. To further enable these organisations’ work, it is necessary to understand what works and why in a given environment. Enhanced local and regional cooperation promoted by SAIS Innovation Fund projects can generate new data on this little-explored area in Southern Africa. Data-driven knowledge on entrepreneurship and innovation support best practices as well as effective and efficient management of entrepreneurial ecosystems can support replication and inform policymaking, leading thus to a wider impact than just that of the immediate reported projects and initiatives

Blindspot: Indistinguishable Anonymous Communications

Communication anonymity is a key requirement for individuals under targeted surveillance. Practical anonymous communications also require indistinguishability - an adversary should be unable to distinguish between anonymised and non-anonymised traffic for a given user. We propose Blindspot, a design for high-latency anonymous communications that offers indistinguishability and unobservability under a (qualified) global active adversary. Blindspot creates anonymous routes between sender-receiver pairs by subliminally encoding messages within the pre-existing communication behaviour of users within a social network. Specifically, the organic image sharing behaviour of users. Thus channel bandwidth depends on the intensity of image sharing behaviour of users along a route. A major challenge we successfully overcome is that routing must be accomplished in the face of significant restrictions - channel bandwidth is stochastic. We show that conventional social network routing strategies do not work. To solve this problem, we propose a novel routing algorithm. We evaluate Blindspot using a real-world dataset. We find that it delivers reasonable results for applications requiring low-volume unobservable communication.Comment: 13 Page

AI for Social Impact: Learning and Planning in the Data-to-Deployment Pipeline

With the maturing of AI and multiagent systems research, we have a tremendous opportunity to direct these advances towards addressing complex societal problems. In pursuit of this goal of AI for Social Impact, we as AI researchers must go beyond improvements in computational methodology; it is important to step out in the field to demonstrate social impact. To this end, we focus on the problems of public safety and security, wildlife conservation, and public health in low-resource communities, and present research advances in multiagent systems to address one key cross-cutting challenge: how to effectively deploy our limited intervention resources in these problem domains. We present case studies from our deployments around the world as well as lessons learned that we hope are of use to researchers who are interested in AI for Social Impact. In pushing this research agenda, we believe AI can indeed play an important role in fighting social injustice and improving society.Comment: To appear, AI Magazin

Integrating Problem Structuring Methods And Concept-Knowledge Theory For An Advanced Policy Design: Lessons From A Case Study In Cyprus

Evidence suggests that policies frequently fail due, on the one side, to a simplification of the uncertainty and complexity associated with stakeholders’ problem-understanding and, on the other side, due to the lack of methodologies for innovative generation of policy alternatives. This work describes a methodology based on the integration of Problem Structuring Methods and Concept-Knowledge Theory as a mean to transform ambiguity in problem-framing from a barrier to an enabling factor in collaborative settings. This methodology supports the generative design process for innovative and consensual policies. The methodology was implemented for a case of designing water management policy in the Republic of Cyprus

Artificial intelligence for social impact: Learning and planning in the data-to-deployment pipeline

With the maturing of artificial intelligence (AI) and multiagent systems research, we have a tremendous opportunity to direct these advances toward addressing complex societal problems. In pursuit of this goal of AI for social impact, we as AI researchers must go beyond improvements in computational methodology; it is important to step out in the field to demonstrate social impact. To this end, we focus on the problems of public safety and security, wildlife conservation, and public health in low-resource communities, and present research advances in multiagent systems to address one key cross-cutting challenge: how to effectively deploy our limited intervention resources in these problem domains. We present case studies from our deployments around the world as well as lessons learned that we hope are of use to researchers who are interested in AI for social impact. In pushing this research agenda, we believe AI can indeed play an important role in fighting social injustice and improving society

Post-automation: report from an international workshop

The purpose of this report is to share lessons from an international research workshop dedicated to post- automation. Twenty-seven researchers from eleven different countries in Africa, Asia, Latin America and Europe, met at the Science Policy Research Unit at Sussex University on 11-13 September 2019, where we discussed empirical research papers and explored post-automation in group activities. We write this report primarily for researchers, but also for activists and policy advisors looking for more imaginative approaches to governing technology, work and sustainability in society, compared to those dominant agendas adapting automatically to the interests behind automation. The report is structured as follows. Section two introduces the workshop topic and papers presented, and which leads into two related areas that became a focus for discussion. First, some challenges in the foundations of automation theory (section three). And second, post-automation as a more constructive proposition to the challenges of automation, and that is happening right now (section four). Section five summarises some key points arising from the workshop, based on empirical observations from the margins of digital technology development, and that give both a flavour of the workshop and help elaborate the post-automation proposition. Some analytical and strategic themes are discussed in section six. We conclude in section seven with proposals for a post-automation agenda