Mohsen Ali Alawami

The recent increase in deepfake content has significantly increased cyber threats. Although numerous deepfake detection technologies have achieved high accuracy, there are limits to clarifying the rationale behind their detection decisions. To bridge the gap, in our study, we leverage the combination of Explainable Artificial Intelligence (XAI) and Large Language Models (LLMs) to deliver clear, consistent, and understandable interpretations of deepfake detection outcomes. To do that, we integrate XAI and LLMs to visually represent detection rationales and automatically generate coherent natural-language explanations. During the implementation of our method, we developed a multi-task learning framework based on a Convolutional Neural Network (CNN) combined with a Long Short-Term Memory (LSTM) architecture, trained simultaneously for binary classification (real or fake) and multi-class classification (identifying specific deepfake techniques) using the FaceForensics++ dataset. The CNN architecture considered for this model included ResNeXt50-32x4d, EfficientNet-b0, and Xception, with EfficientNet-b0 ultimately selected as the optimal detection model based on superior performance metrics on the FaceForensics++ dataset. EfficientNet-b0 achieved the best performance, with an accuracy of 95.14% for binary classification and 94.29% for multi-class classification. Additionally, a web-based interface was developed to allow intuitive inspection of the detection results, combining visual and textual explanations to enhance interpretability.

The rapid proliferation of digitalization and the growing reliance on internet-based technologies by individuals and organizations have led to a significant escalation in the frequency and sophistication of cyberattacks. As attackers continuously refine their methods to evade conventional defense mechanisms, antivirus solutions, despite their widespread utilization as primary security tools, face increasing challenges in addressing these evolving threats. This study introduces AV-Teller, a novel framework designed for analyzing antivirus behavior through interactions with web browsers. AV-Teller reveals weaknesses in antivirus detection mechanisms by highlighting ways in which web browser interactions may inadvertently expose critical aspects of antivirus operations. The framework provides key insights into the vulnerabilities inherent to these detection processes and their implications for the interplay between antivirus systems and modern web technologies. To assess the efficacy of the AV-Teller in detecting antivirus via web browsers, the framework evaluates three detection scenarios: Document Object Model (DOM) Monitoring-Based Detection, Signature-Based Detection, and Phishing Page-Based Detection. The results revealed performance inconsistencies: 16 products (57%) failed to respond to any tested scenarios, exhibiting deficiencies in threat mitigation capabilities. Of the 12 products (43%) that successfully handled three scenarios, 9 (75%) inadvertently disclosed identifiable antivirus metadata during assessments, thereby enabling attackers to pinpoint specific antivirus solutions and exploit their vulnerabilities. These findings highlight critical gaps in the interaction between antivirus systems and web technologies, exposing systemic flaws in existing security mechanisms. The inadvertent exposure of sensitive antivirus data underscores the necessity for robust data handling protocols, necessitating collaboration between antivirus developers and web technology stakeholders to design secure frameworks. By exposing these risks, the AV-Teller framework elucidates the limitations of current defenses and establishes a foundation for the enhancement of antivirus technologies to address emerging cyber threats effectively.

A user’s location information can be used to identify the user. For example, in Android, we can keep our smartphone unlocked when it is located near a place that was previously registered as a trusted place. However, existing location-based user authentication solutions failed to support fine-grained indoor location registration. In this article, we present a highly accurate identification scheme named location-based identification (LocID) using the smartphone’s physical fingerprints that are sensed at the user’s secure area. Our key idea is to use Wi-Fi signals and the light intensity of smartphones’ fingerprints to accurately identify their locations within adjacent indoor areas. To generate stable and reliable location fingerprints, we develop a novel mathematical location-wise signal signature (LSS) algorithm by minimizing the bias highly affected by various environmental factors. To show the feasibility of LocID, we evaluated the performance using machine learning classifiers with a real-world data set containing Wi-Fi and light fingerprints from 68 locations in a building for five weeks. The experimental results show that LocID achieved an F1-score of 98.3%, false-negative rate (FNR) of 2.9%, and false-positive rate (FPR) of 1.7%, respectively, when LocID was retrained daily. Moreover, LocID achieved an F1-score of 94.4%, FNR of 2.7%, and FPR of 3.7%, respectively, when LocID was trained using the data set during the first week and tested with the remaining four weeks data set. Also, we tested LocID using only one-scan of location fingerprints and achieved 90.6% and 90.8% AUC scores for support vector machine and $K$ -nearest neighbor classifiers, respectively.

Sensor data on a user’s mobile device can often be used to identify the user for improving the security of smartphones in indoor environments. In this paper, we present a novel continuous user identification system called LightLock that collects light sensor data from a user’s smartphone and analyzes them to identify a specific user using a machine learning approach. We develop a multi-model system to extract four different feature vectors: (1) absolute time series (ATS); (2) auto-correlation function (ACF); (3) level crossing rate (LCR); and (4) peak readings detection (PRD). To show the feasibility of LightLock, we implemented an Android application and evaluated the performance of LightLock on the dataset collected during a period of 20 days. LightLock achieves over 98% accuracy in identifying a specific user. LightLock also provides an accurate and cost-less alternative solution to existing approaches that require explicit user-smartphone interaction or the high energy consumption of multiple sensors.