In this paper, we explore the challenges of ensuring security and privacy for
users from diverse demographic backgrounds. We propose a threat modeling
approach to identify potential risks and countermeasures for product inclusion
in security and privacy. We discuss various factors that can affect a user's
ability to achieve a high level of security and privacy, including low-income
demographics, poor connectivity, shared device usage, ML fairness, etc. We
present results from a global security and privacy user experience survey and
discuss the implications for product developers. Our work highlights the need
for a more inclusive approach to security and privacy and provides a framework
for researchers and practitioners to consider when designing products and
services for a diverse range of users.

我们探讨了确保来自不同人口背景的用户的安全和隐私的挑战，并提出了一种威胁建模方法，以识别产品安全和隐私的潜在风险和对策。我们讨论了影响用户实现高水平安全和隐私的各种因素，包括低收入人口、连接质量差、共用设备使用、ML 公平性等。我们展示了一项全球安全和隐私用户体验调查的结果，并讨论了对产品开发者的影响。我们的工作突出了安全和隐私需要更具包容性的方法，并为研究人员和从业者设计面向各类用户的产品和服务提供了一个框架。

安全和隐私产品融入

Security and Privacy Product Inclusion

For a long time threat modeling was treated as a manual, complicated process.
However modern agile development methodologies and cloud computing technologies
require adding automatic threat modeling approaches. This work considers two
challenges: creating a set of machine-readable data flow diagrams that
represent real cloud based applications; and usage domain specific knowledge
for automatic analysis of the security aspects of such applications. The set of
180 semantic diagrams (ontologies and knowledge graphs) is created based on
cloud configurations (Docker Compose); the set includes a manual taxonomy that
allows to define the design and functional aspects of the web based and data
processing applications; the set can be used for various research in the threat
modeling field. This work also evaluates how ontologies and knowledge graphs
can be used to automatically recognize patterns (mapped to security threats) in
diagrams. A pattern represents features of a diagram in form of a request to a
knowledge base, what enables its recognition in a semantic representation of a
diagram. In an experiment four groups of the patterns are created (web
applications, data processing, network, and docker specific), and the diagrams
are examined by the patterns. Automatic results, received for the web
applications and data processing patterns, are compared with the manual
taxonomy in order to study challenges of automatic threat modeling.

本文提出一种基于知识图谱和本体的自动化方式来分析云计算系统的安全威胁模型，并探讨该方法在现代敏捷开发环境中的应用挑战。通过使用包含 180 个语义图的本体，建立了基于 Docker Compose 的云配置数据流程图，并评估本体和知识图谱用于自动识别图谱中的安全威胁。

基于本体论和知识图谱的语义数据流程图集及其安全分析

A set of semantic data flow diagrams and its security analysis based on ontologies and knowledge graphs

Recent progress in natural language generation has raised dual-use concerns.
While applications like summarization and translation are positive, the
underlying technology also might enable adversaries to generate neural fake
news: targeted propaganda that closely mimics the style of real news.
Modern computer security relies on careful threat modeling: identifying
potential threats and vulnerabilities from an adversary's point of view, and
exploring potential mitigations to these threats. Likewise, developing robust
defenses against neural fake news requires us first to carefully investigate
and characterize the risks of these models. We thus present a model for
controllable text generation called Grover. Given a headline like `Link Found
Between Vaccines and Autism,' Grover can generate the rest of the article;
humans find these generations to be more trustworthy than human-written
disinformation.
Developing robust verification techniques against generators like Grover is
critical. We find that best current discriminators can classify neural fake
news from real, human-written, news with 73% accuracy, assuming access to a
moderate level of training data. Counterintuitively, the best defense against
Grover turns out to be Grover itself, with 92% accuracy, demonstrating the
importance of public release of strong generators. We investigate these results
further, showing that exposure bias -- and sampling strategies that alleviate
its effects -- both leave artifacts that similar discriminators can pick up on.
We conclude by discussing ethical issues regarding the technology, and plan to
release Grover publicly, helping pave the way for better detection of neural
fake news.

该研究呈现了一种名为 Grover 的可控文本生成模型，该模型可生成逼真的假新闻，但通过使用 Grover 模型自身进行验证，可提高检测真假信息的准确性。同时，该研究强调在探索和应对类似 Grover 模型可能带来的风险时，需关注其中的道德问题。