Nicola Dragoni

This paper examines how often GDPR-relevant dark patterns appear in cookie-consent banners and how often users receive a choice that is free and informed. We use an adapted version of CCrawler to crawl 99 high-traffic websites accessed from Denmark, detect consent interfaces, and extract first-layer choice pathways and settings-layer elements for compliance-risk coding. We then assess detected banners against four GDPR-informed interface-level criteria: first-layer refusal availability, absence of pre-ticked or default-enabled options, relative accept/reject prominence, and non-obstructive presentation. These operational criteria are observable interface proxies rather than final legal determinations of GDPR compliance. Cookie banners were detected on 90 of 99 sites; the nine non-detections are reported separately and are not treated as evidence of non-compliance. The results indicate a structural imbalance: acceptance is usually available on the first layer, while refusal is often placed behind additional steps or settings dialogues. A subset of reachable settings interfaces also contained pre-ticked options. To place these observations in the European context, we compare the two directly comparable first-layer choice indicators with a recent 31-country study. Acceptance availability is close to that study’s Denmark-specific estimate, whereas first-layer rejection in our high-traffic Denmark-accessed sample lies between its Denmark-specific estimate and its 31-country aggregate. These cross-study comparisons are descriptive and are not treated as matched statistical estimates because the sampling frames and measurement procedures differ. The findings provide Denmark-specific, time-bounded evidence that known consent-interface asymmetries remain visible on high-traffic websites, together with a reproducible workflow for future audits.

Cyber-physical-human systems (CPHS) integrate human inputs, behaviors, and interfaces for a more effective utilization of artificial intelligence (AI) assisted cyber and physical systems. However, the growing reliance on Agentic AI , coupled with the inherent variability of human actions, can introduce unforeseen security challenges. Studies have reported that any security compromise can result in catastrophic failures, safety hazards, and data breaches, disrupting the day-to-day operations of CPHS. Given the scale and complexity of typical CPHS, robust security measures are essential. This paper investigates the security requirements of CPHS encompassing confidentiality, integrity, availability, authentication, and authorization, in the context of CPHS. We also emphasize the role of formal verification methods to establish and guarantee the trustworthiness of agents, which are increasingly integral to these systems. Considering the inherent mutual dependency, we systematically categorize and analyze attack vectors across three dimensions: data , agents , and human actors that can impact the security and trustworthiness of CPHS. Using unmanned aerial vehicles (UAVs) in the defense sector as a prototypical CPHS engineering application, we present a typical mission scenario involving a remotely piloted Medium-Altitude, Long-Endurance (MALE) aircraft designed for Intelligence, Surveillance, Target Acquisition, and Reconnaissance (ISTAR) to conduct threat assessments. Our comprehensive analysis illustrates how these attack vectors can compromise each dimension, providing actionable insights for security engineers and system architects to design robust security measures in CPHS.

Artificial Intelligence Chatbots based on Large Language Models are becoming important cornerstones in education, professional, and personal contexts. Users frequently disclose sensitive information without the necessary awareness of how their data is processed, stored, and later used, creating risks of unintended exposure and violation of data protection regulations such as GDPR and the EU AI Act. In this paper, we present a dynamic privacy-by-design framework that introduces a novel privacy-oriented middleware layer between the users and the AI Chatbots. Our framework intercepts user prompts, detects and sanitizes sensitive information, and enables explicit user control over data retention and disclosure through our dedicated Information Manager Dashboard. To develop our framework around real-world needs, we conducted a survey with 83 participants investigating privacy concerns, regulatory awareness, and preferences for transparency and control in conversational AI. Our results indicate that better and more transparent privacy safeguards can be achieved without significantly compromising usability or performance, supporting the development of trustworthy and user-centric AI chatbots. We also evaluate our solution against other state-of-the-art implementations and relevant metrics.

Post-login threats such as device sharing and session takeover motivate continuous authentication with behavioral signals. This paper studies a lightweight keystroke-dynamics pipeline designed for strict cross-session evaluation and browser-side scoring. Using the fixed-text and free-text tracks of the public KeyRecs dataset, we extract compact repetition-level and sliding-window digraph-timing features and train per-user one-vs-rest Logistic Regression verifiers on Session 1 (S1). Thresholds are selected only on S1 and transferred unchanged to Session 2 (S2), preventing test-set tuning and exposing operating-point instability under session drift. Fixed-text achieves S2 AUC mean/median 0.895/0.918 with a half total error rate (HTER) around 0.19, while free-text reaches AUC mean/median 0.884/0.899 with a similar transferred-threshold HTER. Personal thresholds and a pooled-S1 global threshold perform similarly on average, suggesting that global thresholding can simplify deployment without replacing per-user scoring models. A scaler-only warm-up update yields limited and inconsistent gains, showing that mean/variance adaptation alone is insufficient. Finally, compact JSON artifacts and replay-based browser benchmarks demonstrate deterministic client-side scoring with very small per-sample latency. Overall, the results show that useful threshold-free separability does not by itself guarantee stable operating-point transfer under cross-session drift.

Fuzzing is an important automated testing technique for discovering vulnerabilities and abnormal software behavior, but conventional and pre-LLM learning-based approaches often struggle with strict validity constraints, limited semantic understanding, and poor adaptability across targets. Recent advances in large language models (LLMs) create new opportunities for fuzzing by supplying semantic guidance from source code, documentation, traces, and execution feedback. As the literature on LLM-based fuzzing has grown rapidly, a systematic synthesis is needed. This paper presents a literature review on the integration of LLMs into fuzzing workflows. We review how LLMs are applied across the fuzzing workflow, compare these approaches with earlier deep learning-based fuzzing, and summarize the main patterns in task coverage, application strategies, targets, testing modes, and model choices. The survey shows that current work is concentrated in test case generation, while defect detection and post-processing remain less represented, and broader workflow integration is uneven. Based on these findings, we identify four main directions for future research as follows: broader coverage of the fuzzing workflow, stronger context construction and workflow engineering, richer reasoning for fuzzing control, and shared evaluation standards and benchmarks.

Face recognition technologies are increasingly deployed in transport infrastructures to improve efficiency and security, but they raise significant privacy and data protection concerns. This study reviews how privacy-preserving face recognition techniques can address these challenges in real-world settings. Using a systematic literature review approach, the paper analyses research across technical, operational, and governance perspectives. The findings show that while advanced methods such as encryption, federated learning, and de-identification can reduce data exposure, they are rarely implemented in operational systems, which tend to prioritize performance and scalability. At the same time, governance-focused studies emphasize issues such as proportionality, accountability, and fundamental rights, often without clear links to technical solutions. Overall, the review highlights a fragmented landscape and a gap between research and practice, underscoring the need for integrated approaches that align privacy-preserving techniques with practical deployment constraints and regulatory requirements.

Honeypot fingerprinting poses a significant threat in cybersecurity, as attackers who are able to identify honeypot systems can successfully evade them, thereby greatly reducing their overall effectiveness as defensive and intelligence-gathering tools. Over the years, numerous studies have proposed a variety of analytical techniques and countermeasures to minimize honeypot fingerprinting and improve honeypot stealth. This paper presents a comprehensive examination of the methods and strategies that attackers employ to detect and fingerprint honeypot systems, including behavioural, network-based, and system-level indicators. In addition, this paper analyzes common vulnerabilities inherent in both low-interaction and high-interaction honeypots that facilitate successful fingerprinting. Existing anti-detection and obfuscation techniques are evaluated for their effectiveness and limitations. Specifically, this paper offers a structured analysis of honeypot fingerprinting techniques, examines attackers’ probing strategies, evaluates the most vulnerable protocol artifacts, and outlines mitigation strategies to reduce the likelihood of honeypot detection. Finally, this paper discusses how emerging technologies and increasingly complex computing environments, such as cloud infrastructure and virtualization, impact honeypot deployment, and it highlights open challenges and promising future research directions in the field of honeypot anti-fingerprinting.

Biometric authentication on smartphones has advanced rapidly in recent years, with face recognition becoming the dominant modality due to its convenience and easy integration with modern mobile hardware. However, despite these developments, smartphone-based facial recognition systems remain vulnerable to a broad spectrum of attacks. This survey provides an updated and comprehensive examination of the evolving attack landscape and corresponding defense mechanisms, incorporating recent advances up to 2025. A key contribution of this work is a structured taxonomy of attack types targeting smartphone facial recognition systems, encompassing (i) 2D and 3D presentation attacks; (ii) digital attacks; and (iii) dynamic attack patterns that exploit acquisition conditions. We analyze how these increasingly realistic and condition-dependent attacks challenge the robustness and generalization capabilities of modern face anti-spoofing (FAS) systems. On the defense side, the paper reviews recent progress in liveness detection, deep-learning- and transformer-based approaches, quality-aware and domain-generalizable models, and emerging unified frameworks capable of handling both physical and digital spoofing. Hardware-assisted methods and multi-modal techniques are also examined, with specific attention to their applicability in mobile environments. Furthermore, we provide a systematic overview of commonly used datasets, evaluation metrics, and cross-domain testing protocols, identifying limitations related to demographic bias, dataset variability, and controlled laboratory conditions. Finally, the survey outlines key research challenges and future directions, including the need for mobile-efficient anti-spoofing models, standardized in-the-wild evaluation protocols, and defenses robust to unseen and AI-generated spoof types. Collectively, this work offers an integrated view of current trends and emerging paradigms in smartphone-based face anti-spoofing, supporting the development of more secure and resilient biometric authentication systems.