TY - THES A1 - Welearegai, Gebrehiwet Biyane T1 - Precise Detection of Injection Attacks in Real-world Applications N2 - Code injection attacks like the one used in the high-profile 2017 Equifax breach, have become increasingly common, ranking at the top of OWASP’s list of critical web application vulnerabilities. The injection attacks can also target embedded applications running on processors like ARM and Xtensa by exploiting memory bugs and maliciously altering the program’s behavior or even taking full control over a system. Especially, ARM’s support of low power consumption without sacrificing performance is leading the industry to shift towards ARM processors, which advances the attention of injection attacks as well. In this thesis, we are considering web applications and embedded applications (running on ARM and Xtensa processors) as the target of injection attacks. To detect injection attacks in web applications, taint analysis is mostly proposed but the precision, scalability, and runtime overhead of the detection depend on the analysis types (e.g., static vs dynamic, sound vs unsound). Moreover, in the existing dynamic taint tracking approach for Java- based applications, even the most performant can impose a slowdown of at least 10–20% and often far more. On the other hand, considering the embedded applications, while some initial research has tried to detect injection attacks (i.e., ROP and JOP) on ARM, they suffer from high performance or storage overhead. Besides, the Xtensa has been neglected though used in most firmware-based embedded WiFi home automation devices. This thesis aims to provide novel approaches to precisely detect injection attacks on both the web and embedded applications. To that end, we evaluate JavaScript static analysis frameworks to evaluate the security of a hybrid app (JS & native) from an industrial partner, provide RIVULET – a tool that precisely detects injection attacks in Java-based real-world applications, and investigate injection attacks detection on ARM and Xtensa platforms using hardware performance counters (HPCs) and machine learning (ML) techniques. To evaluate the security of the hybrid application, we initially compare the precision, scalability, and code coverage of two widely-used static analysis frameworks—WALA and SAFE. The result of our comparison shows that SAFE provides higher precision and better code coverage at the cost of somewhat lower scalability. Based on these results, we analyze the data flows of the hybrid app via taint analysis by extending the SAFE’s taint analysis and detected a potential for injection attacks of the hybrid application. Similarly, to detect injection attacks in Java-based applications, we provide Rivulet which monitors the execution of developer-written functional tests using dynamic taint tracking. Rivulet uses a white-box test generation technique to re-purpose those functional tests to check if any vulnerable flow could be exploited. We compared Rivulet to the state-of-the-art static vulnerability detector Julia on benchmarks and Rivulet outperformed Julia in both false positives and false negatives. We also used Rivulet to detect new vulnerabilities. Moreover, for applications running on ARM and Xtensa platforms, we investigate ROP1 attack detection by combining HPCs and ML techniques. We collect data exploiting real- world vulnerable applications and small benchmarks to train the ML. For ROP attack detection on ARM, we also implement an online monitor which labels a program’s execution as benign or under attack and stops its execution once the latter is detected. Evaluating our ROP attack detection approach on ARM provides a detection accuracy of 92% for the offline training and 75% for the online monitoring. Similarly, our ROP attack detection on the firmware-only Xtensa processor provides an overall average detection accuracy of 79%. Last but not least, this thesis shows how relevant taint analysis is to precisely detect injection attacks on web applications and the power of HPC combined with machine learning in the control flow injection attacks detection on ARM and Xtensa platforms. Y1 - 2023 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:bvb:739-opus4-12926 ER - TY - JOUR A1 - Ghosh Dastidar, Kanishka A1 - Jurgovsky, Johannes A1 - Siblini, Wissam A1 - Granitzer, Michael T1 - NAG: neural feature aggregation framework for credit card fraud detection JF - Knowledge and Information Systems N2 - The state-of-the-art feature-engineering method for fraud classification of electronic pay-ments uses manually engineered feature aggregates, i.e., descriptive statistics of thetransaction history. However, this approach has limitations, primarily that of being dependenton expensive human expert knowledge. There have been attempts to replace manual aggre-gation through automatic feature extraction approaches. They, however, do not consider thespecific structure of the manual aggregates. In this paper, we define the novel Neural Aggre-gate Generator (NAG), a neural network-based feature extraction module that learns featureaggregates end-to-end on the fraud classification task. In contrast to other automatic featureextraction approaches, the network architecture of the NAG closely mimics the structureof feature aggregates. Furthermore, the NAG extends learnable aggregates over traditionalones through soft feature value matching and relative weighting of the importance of differ-ent feature constraints. We provide a proof to show the modeling capabilities of the NAG.We compare the performance of the NAG to the state-of-the-art approaches on a real-worlddataset with millions of transactions. More precisely, we show that features generated with theNAG lead to improved results over manual aggregates for fraud classification, thus demon-strating its viability to replace them. Moreover, we compare the NAG to other end-to-endapproaches such as the LSTM or a generic CNN. Here we also observe improved results. Weperform a robust evaluation of the NAG through a parameter budget study, an analysis of theimpact of different sequence lengths and also the predictions across days. Unlike the LSTMor the CNN, our approach also provides further interpretability through the inspection of itsparameters. KW - finance KW - credit card fraud KW - representation learning Y1 - 2022 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:101:1-2022060219175235764329 VL - 2022 IS - 64 SP - 831 EP - 858 PB - Springer Nature CY - Berlin ER - TY - JOUR A1 - Schulte, Lukas A1 - Ledel, Benjamin A1 - Herbold, Steffen T1 - Studying the explanations for the automated prediction of bug and non-bug issues using LIME and SHAP JF - Empirical Software Engineering (ISSN: 1573-7616) N2 - Context The identification of bugs within issues reported to an issue tracking system is crucial for triage. Machine learning models have shown promising results for this task. However, we have only limited knowledge of how such models identify bugs. Explainable AI methods like LIME and SHAP can be used to increase this knowledge. Objective We want to understand if explainable AI provides explanations that are reasonable to us as humans and align with our assumptions about the model’s decision-making. We also want to know if the quality of predictions is correlated with the quality of explanations. Methods We conduct a study where we rate LIME and SHAP explanations based on their quality of explaining the outcome of an issue type prediction model. For this, we rate the quality of the explanations, i.e., if they align with our expectations and help us understand the underlying machine learning model. Results We found that both LIME and SHAP give reasonable explanations and that correct predictions are well explained. Further, we found that SHAP outperforms LIME due to a lower ambiguity and a higher contextuality that can be attributed to the ability of the deep SHAP variant to capture sentence fragments. Conclusion We conclude that the model finds explainable signals for both bugs and non-bugs. Also, we recommend that research dealing with the quality of explanations for classification tasks reports and investigates rater agreement, since the rating of explanations is highly subjective. KW - Explainable AI KW - LIME KW - SHAP KW - Issue type prediction Y1 - 2024 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:101:1-2409232103207.812648424894 SN - 1382-3256 SN - 1573-7616 VL - 29 IS - 4 PB - Springer US CY - New York ER - TY - JOUR A1 - Daschner, Stefan A1 - Obermaier, Robert T1 - Algorithm aversion? On the influence of advice accuracy on trust in algorithmic advice JF - Journal of Decision Systems N2 - There is empirical evidence that decision makers show negative behaviours towards algorithmic advice compared to human advice, termed as algorithm aversion. Taking a trust theoretical perspective, this study broadens the quite monolithic view on behaviour to its cognitive antecedent: cognitive trust, i.e. trusting beliefs and trusting intentions. We examine initial trust (cognitive trust and behaviour) as well as its development after performance feedback by conducting an online experiment that asked participants to forecast the expected demand for a product. Advice accuracy was manipulated by ± 5 % relative to the participant’s initial forecasting accuracy determined in a pre-test. Results show that initial behaviour towards algorithmic advice is not influenced by cognitive trust. Furthermore, the decision maker’s initial forecasting accuracy indicates a threshold between near-perfect and bad advice. When advice accuracy is at this threshold, we observe behavioural algorithm appreciation, particularly due to higher trusting integrity beliefs in algorithmic advice. KW - Algorithm appreciation KW - cognitive trust KW - initial trust KW - Perfect Automation Scheme KW - trusting beliefs KW - Advice Accuracy KW - Forecasting Y1 - 2022 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:bvb:739-opus4-19120 VL - 31 (2022) IS - S1 SP - 77 EP - 97 PB - Taylor & Francis CY - London ER - TY - THES A1 - Wendlinger, Lorenz T1 - Structure-aware Deep Learning N2 - Graph structures permeate the digital landscape in explicit and implicit forms. They connect or construct artifacts by combining semantic and structural information. We also observe them in the systems designed to process this data, in their learning algorithms and the very nature of the tasks they solve. At the same time, machine learning methods are extremely data-hungry, requiring petabytes of data for training. Due to their complexity, graphs remain an under-utilized resource in this regard. Many approaches cannot incorporate them due to being fully structurally unaware or not suited to the specific flavour of graphs encountered in some domains. This disconnect is sub-optimal from an effectiveness and efficiency perspective. We present methods that extend the scope of structure-aware deep learning through structural knowledge integration and enrichment, structural performance prediction, and synergistic transfer learning. Knowledge graphs organize information and make it directly available for querying. They provide a structured inference interface for manual and automated inspection, though they can suffer from data quality issues and require careful schema design. We rephrase the reconciliation of knowledge in knowledge graphs as a link prediction task, making it tractable with adapted graph neural networks, while also benefiting conventional link prediction tasks. We further combine textual semantics and structural expression for legal reference prediction via adapted heterogeneous graph neural networks operating on complex meta-information enriched graphs. Additionally, we explore methods for the integration of intermediary expressions in strongly typed heterogeneous graphs, improving prediction via meta-path-based processing. We also develop methods for automated machine learning workflow analysis and performance prediction. This includes the learning of salient representations for management as well as improvement of workflows through automatic suggestion and refinement of components. These are then extended to the prediction of Neural Architecture Search performance prediction, including adaptation to operation-on-edge spaces. Finally, we investigate the transfer capability of pre-trained attention structures for text-based prediction tasks and find it to be both inferior to directly optimized attention masks as well as highly dependent on inherent domain knowledge. We also show that the exploitation of hierarchical task formulation can improve prediction performance through joint learning in diverse learning domains, including link prediction, performance prediction, and specialized and general argumentation mining. The dissertation contains previously published or submitted texts: Wendlinger, L., Hübscher, G., Ekelhart, A., Granitzer, M. (2022). Reconciliation of Mental Concepts with Graph Neural Networks. In: Strauss, C., Cuzzocrea, A., Kotsis, G., Tjoa, A.M., Khalil, I. (eds): Database and Expert Systems Applications. DEXA 2022. Lecture Notes in Computer Science, vol 13427, p 133-146. Springer, Cham. https://doi.org/10.1007/978-3-031-12426-6_11; Wendlinger, L., Granitzer M. (2024). Informed Heterogeneous Attention Networks for Metapath Based Learning. In: SAC '24: Proceedings of the 39th ACM/SIGAPP Symposium on Applied Computing, p 458-465, ACM, New York. https://doi.org/10.1145/3605098.3635890; Wendlinger, L., Nonn, S.A., Al Zubaer, A., Granitzer, M. (2026). The Missing Link: Joint Legal Citation Prediction Using Heterogeneous Graph Enrichment. In: Wrembel, R., Kotsis, G., Tjoa, A.M., Khalil, I. (eds) Database and Expert Systems Applications. DEXA 2025. Lecture Notes in Computer Science, vol 16047, p 197-211. Springer, Cham. https://doi.org/10.1007/978-3-032-02088-8_14; Wendlinger, L., Stier, J., Granitzer, M. (2021). Evofficient: Reproducing a Cartesian Genetic Programming Method. In: Hu, T., Lourenço, N., Medvet, E. (eds) Genetic Programming. EuroGP 2021. Lecture Notes in Computer Science, vol 12691, p 162-178. Springer, Cham. https://doi.org/10.1007/978-3-030-72812-0_11; Wendlinger, L., Berndl, E., Granitzer, M. (2021). Methods for Automatic Machine-Learning Workflow Analysis. In: Dong, Y., Kourtellis, N., Hammer, B., Lozano, J.A. (eds) Machine Learning and Knowledge Discovery in Databases. Applied Data Science Track. ECML PKDD 2021. Lecture Notes in Computer Science, vol 12979, p 52-67. Springer, Cham. https://doi.org/10.1007/978-3-030-86517-7_4; Wendlinger, L., Granitzer, M., Fellicious, C. (2023). Pooling Graph Convolutional Networks for Structural Performance Prediction. In: Nicosia, G., et al. (eds) Machine Learning, Optimization, and Data Science. LOD 2022. Lecture Notes in Computer Science, vol 13811, p 1-16. Springer, Cham. https://doi.org/10.1007/978-3-031-25891-6_1; Wendlinger, L., Braun, C., Zubaer, A., Nonn, S., Großkopf, S., Fellicious, C., Granitzer, M.: On the Suitability of pre-trained foundational LLMs for Analysis in German Legal Education, submitted to the proceedings of the International Conference on Machine Learning, Optimization, and Data Science 2025, preprint published: https://doi.org/10.48550/arXiv.2412.15902; Wendlinger, L., Kuhn, R., Mitrovic, J., Granitzer, M. (2025). Joint Learning for Efficient German Argument Mining. In: 2025 IEEE 37th International Conference on Tools with Artificial Intelligence (ICTAI), Athens, Greece, 2025, p 770-777. IEEE, Los Alamitos. https://doi.org/10.1109/ICTAI66417.2025.00111. N2 - Graphenstrukturen durchdringen die digitale Landschaft in expliziten und impliziten Formen. Sie verbinden oder konstruieren Artefakte, indem sie semantische und strukturelle Informationen kombinieren. Wir beobachten sie auch in den Systemen, die zur Verarbeitung dieser Daten entwickelt wurden, in ihren Lernalgorithmen und in der Art der Aufgaben, die sie lösen. Gleichzeitig sind die Methoden des maschinellen Lernens extrem datenhungrig und benötigen Petabytes an Daten für das Training. Aufgrund ihrer Komplexität bleiben Graphen in dieser Hinsicht eine unzureichend genutzte Ressource. Viele Ansätze können sie nicht einbeziehen, weil sie die Struktur der Graphen nicht kennen oder nicht für die spezielle Art von Graphen geeignet sind, die in einigen Bereichen vorkommen. Diese Trennung ist aus Sicht der Effektivität und Effizienz suboptimal. Wir stellen Methoden vor, die den Anwendungsbereich des strukturbewussten Deep Learning durch strukturelle Wissensintegration und -anreicherung, strukturelle Leistungsvorhersage und synergetisches Transferlernen erweitern. Wissensgraphen organisieren Informationen und machen sie direkt für Abfragen verfügbar. Sie bieten eine strukturierte Inferenzschnittstelle für die manuelle und automatische Überprüfung, obwohl sie unter Problemen der Datenqualität leiden können und ein sorgfältiges Schemadesign erfordern. Wir formulieren den Abgleich von Wissen in Wissensgraphen als eine Aufgabe der Kantenvorhersage um, die mit angepassten neuronalen Netzen für Graphen durchführbar ist und auch konventionellen Kantenvorhersageaufgaben zugute kommt. Darüber hinaus kombinieren wir Textsemantik und strukturelle Ausdrücke für die Vorhersage rechtlicher Verweise mit Hilfe angepasster heterogener Graph neuronaler Netze, die auf komplexen, mit Metainformationen angereicherten Graphen arbeiten. Darüber hinaus erforschen wir Methoden zur Integration von intermediären Ausdrücken in stark typisierten heterogenen Graphen und verbessern die Vorhersage durch metapfadbasierte Verarbeitung. Wir entwickeln auch Methoden für die automatische Analyse von Prozessbeschreibungen und Leistungsvorhersagen für maschinelles Lernen. Dies beinhaltet das Lernen von bedeutungsvollen Repräsentationen für das Management sowie die Verbesserung von Prozessbeschreibungen durch automatische Vorschläge und Verfeinerung von Komponenten. Diese Methoden werden dann auf die Leistungsvorhersage der neuronalen Architektursuche ausgeweitet, einschließlich der Anpassung an die Operation-on-Edge-Räume. Schließlich untersuchen wir die Transferfähigkeit von vortrainierten Aufmerksamkeitsstrukturen für textbasierte Vorhersageaufgaben und stellen fest, dass diese sowohl den direkt optimierten Aufmerksamkeitsmasken unterlegen sind als auch in hohem Maße vom inhärenten Domänenwissen abhängen. Wir zeigen auch, dass die Ausnutzung hierarchischer Aufgabenformulierung die Vorhersageleistung durch gemeinsames Lernen in verschiedenen Lernbereichen verbessern kann, einschließlich Kantenvorhersage, Leistungsvorhersage und spezialisierter und allgemeiner Argumentationsanalyse. Die Dissertation beinhaltet bereits veröffentlichte oder zur Veröffentlichung vorgesehene Texte: Wendlinger, L., Hübscher, G., Ekelhart, A., Granitzer, M. (2022). Reconciliation of Mental Concepts with Graph Neural Networks. In: Strauss, C., Cuzzocrea, A., Kotsis, G., Tjoa, A.M., Khalil, I. (Hgg.): Database and Expert Systems Applications. DEXA 2022. Lecture Notes in Computer Science, vol 13427, S. 133-146. Springer, Cham. https://doi.org/10.1007/978-3-031-12426-6_11; Wendlinger, L., Granitzer M. (2024). Informed Heterogeneous Attention Networks for Metapath Based Learning. In: SAC '24: Proceedings of the 39th ACM/SIGAPP Symposium on Applied Computing, S. 458-465, ACM, New York. https://doi.org/10.1145/3605098.3635890; Wendlinger, L., Nonn, S.A., Al Zubaer, A., Granitzer, M. (2026). The Missing Link: Joint Legal Citation Prediction Using Heterogeneous Graph Enrichment. In: Wrembel, R., Kotsis, G., Tjoa, A.M., Khalil, I. (Hgg.) Database and Expert Systems Applications. DEXA 2025. Lecture Notes in Computer Science, vol 16047, S. 197-211. Springer, Cham. https://doi.org/10.1007/978-3-032-02088-8_14; Wendlinger, L., Stier, J., Granitzer, M. (2021). Evofficient: Reproducing a Cartesian Genetic Programming Method. In: Hu, T., Lourenço, N., Medvet, E. (Hgg.) Genetic Programming. EuroGP 2021. Lecture Notes in Computer Science, vol 12691, S. 162-178. Springer, Cham. https://doi.org/10.1007/978-3-030-72812-0_11; Wendlinger, L., Berndl, E., Granitzer, M. (2021). Methods for Automatic Machine-Learning Workflow Analysis. In: Dong, Y., Kourtellis, N., Hammer, B., Lozano, J.A. (Hgg.) Machine Learning and Knowledge Discovery in Databases. Applied Data Science Track. ECML PKDD 2021. Lecture Notes in Computer Science, vol 12979, S. 52-67. Springer, Cham. https://doi.org/10.1007/978-3-030-86517-7_4; Wendlinger, L., Granitzer, M., Fellicious, C. (2023). Pooling Graph Convolutional Networks for Structural Performance Prediction. In: Nicosia, G., et al. Machine Learning, Optimization, and Data Science. LOD 2022. Lecture Notes in Computer Science, vol 13811, S. 1-16. Springer, Cham. https://doi.org/10.1007/978-3-031-25891-6_1; Wendlinger, L., Braun, C., Zubaer, A., Nonn, S., Großkopf, S., Fellicious, C., Granitzer, M.: On the Suitability of pre-trained foundational LLMs for Analysis in German Legal Education, eingereicht für die Proceedings der International Conference on Machine Learning, Optimization, and Data Science 2025, vorab veröffentlicht: https://doi.org/10.48550/arXiv.2412.15902; Wendlinger, L., Kuhn, R., Mitrovic, J., Granitzer, M. (2025). Joint Learning for Efficient German Argument Mining. In: 2025 IEEE 37th International Conference on Tools with Artificial Intelligence (ICTAI), Athens, Greece, 2025, S. 770-777. IEEE, Los Alamitos. https://doi.org/10.1109/ICTAI66417.2025.00111. KW - graph neural networks KW - knowledge graphs KW - structural knowledge integration KW - structural performance prediction KW - synergistic transfer learning KW - link prediction tasks Y1 - 2026 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:bvb:739-opus4-19892 ER -