MD JAFRIN HOSSAIN / RESEARCH

Agentic AI Security · PhD Applicant

Md Jafrin Hossain

AI agents are trusted because the harmful step looks far away. My work shows that distance is usually an illusion — then measures it, formalises it, and closes it.

UWA · CSSE Florida International University NJIT · MTSU collab. BRAC University
Two versions of the same agent trajectory. On the left, a sequential graph in which an injection node reaches a sink node after a distance D-T. On the right, an influence graph in which state and provenance nodes create a much shorter path D-I between the same two nodes.
Fig. 1 — The same trajectory, drawn twice. Left: the sequential graph, where the injection reaches the sink only after D_T steps. Right: the influence graph, where state and provenance edges connect those same two nodes in D_I hops. The difference between them is the safety margin that step-counting invents. Across 454 injection–sink pairs the two disagree for 96.9% of cases, with a median gap of 9 hops. — from W1, Figure 1.
15

Papers — 9 journal, 6 conference

12

As first author

6

Published · 9 under review

4

Research tracks, one common spine

ProgrammeFive stages

From mapping the field to blocking the attack.

Each stage hands the next a concrete artefact. Nothing stops at a survey.

  1. 01

    Map

    What is actually broken

    743 → 85 studies 3.9:1 attack-to-defense action layer 4.7%
    J2 · ACM CSUR →

    hands on a four-layer taxonomy

  2. 02

    Formalise

    Why it breaks, provably

    5 verified theorems 6 containment principles
    J3 · IEEE TDSC →

    hands on six principles

  3. 03

    Audit

    What deployed frameworks guarantee

    3 frameworks, 0 compliant memory integrity absent in all wrongful denials to 88.9%
    W2 · ICML AI4Good →

    hands on an audit instrument

  4. 04

    Measure

    How exposed a running agent is

    454 injection–sink pairs gap > 0 for 96.9% median gap 9 hops
    W1 · NeurIPS AI in the Wild →

    hands on influence distance

  5. 05

    Enforce

    Closing the gap at runtime

    attack success 100% → 0.8% overhead < 1 ms/call false positives 3.3%
    J3 · W2 →
PortfolioFour tracks

The same question asked of four different systems

Where does trust get placed without evidence, and what does it cost when that trust is wrong? The agentic-security spine is the main line; the other three tracks are where the method was built — measuring real deployments, quantifying uncertainty, and taking seriously what non-expert users actually experience.

Agentic AI security & containment

Formal foundations, framework audits, provenance measurement and runtime enforcement for LLM agents that hold memory, call tools and act over long horizons.

J2J3W1W2

Networked, edge & cyber-physical security

Threat models and defences where the constraint is the network: LLMs on IoT and edge tiers, graph-based DDoS detection, quantum key routing over LEO constellations, and signed telemetry for islanded microgrids.

J4J5W3C2

Trustworthy ML, privacy & uncertainty

Systems that state how confident they are and hold that guarantee under drift, missing data and privacy budgets — conformal prediction in federated biometrics, and trust calibration in explainable AI.

J9J7

Human factors, adoption & education

Large-N empirical work on what people do with these systems: trust and friction in consumer generative AI, digital behaviour and well-being, and career-pathway outcomes for lower-income computing students.

J6J1J8C1C3
PeopleEight supervisors · two mentors

Who I have worked under

Six institutions across three continents.

1 New Mexico 2 Murfreesboro 3 Miami 4 Newark 5 Dhaka 6 Perth
Where the work happened. Six institutions across three continents; arcs radiate from Perth, where I am now. Tap or click a marker to see who I worked with there; numbered markers key to the roster below.
  1. 1
    New Mexico, USAStephen Secules
  2. 2
    MTSU · Murfreesboro, TNMohammad Arif Hossain
  3. 3
    FIU · Miami, FLArif Sarwat, Mohd Tariqmentors · Juan F. Mancilla-Caceres, Agoritsa Polyzou
  4. 4
    NJIT · Newark, NJNirwan Ansari
  5. 5
    BRAC University · DhakaMunima Haque, Annajiat Alim Rasel
  6. 6
    UWA · PerthNur Al Hasan Haldar
Record15 items · 2022–2026

Publications

Each entry links to the paper — arXiv, the publisher, or a shared copy — and reproduces one figure from it. Author position is marked, and status distinguishes published work from manuscripts under review.

Track
Type
W1 · 2026 Preprint · under review First author

Structurally Close, Temporally Distant: Measuring Security Exposure in Long-Horizon LLM Agents

Md Jafrin Hossain, Nur Al Hasan Haldar

NeurIPS Workshop on AI in the Wild · The University of Western Australia

Security analyses of LLM agents routinely characterise an attack by how many execution steps sit between the malicious input and the harmful action. This paper shows that temporal remoteness systematically overstates separation: on a provenance-aware execution graph, influence distance D_I is the shortest structural path from an untrusted source to a sensitive sink, and the gap G = D_T − D_I quantifies how much apparent safety is fictitious.

A two-panel scatter plot of influence distance against sequence distance for each injection-sink pair, with most points falling well below the identity line in both the full and conservative provenance graphs.
Fig. — Structural decoupling, measured. Influence distance plotted against sequence distance for every injection–sink pair. Points below the dashed identity line are pairs whose real exposure is shorter than their step count implies: 95% decouple on the full provenance graph, and 85% still decouple on the conservative graph that keeps only the most defensible edges. Step count is not a conservative proxy — it is an optimistic one. — from W1, Figure 2.
  • Separates temporal remoteness, structural exposure and exploitability as three distinct properties — step count is a reliable proxy for none of them
  • Influence distance is computed deterministically from logs alone, with no model in the loop
  • Across 454 injection–sink pairs from 360 AgentDojo trajectories (GPT-4o-mini, GPT-4o, Claude Haiku 4.5, Sonnet 4.6), 96.9% of pairs decouple, median gap 9 hops
  • A D_I-based pre-execution gate blocks five attack sinks a sequence-only gate misses, with no additional benign blocking
arXiv provenance graphs · prompt injection · runtime intervention
J3 · 2026 Under review First author

Containment-Based Security for Agentic Large Language Model Systems: Formal Foundations, Framework Audit, and Empirical Validation

Md Jafrin Hossain, Mohammad Arif Hossain (Member, IEEE), Nirwan Ansari (Life Fellow, IEEE)

IEEE Transactions on Dependable and Secure Computing · extends the ICML 2026 AI4Good workshop paper

Models an agentic LLM system as a tuple G = (P, B, E, U, I) and isolates three structural mechanisms of insecurity — cross-layer escalation, failure amplification, and autonomy without containment — each made quantitative. A concealment theorem shows that aggregate-accuracy monitoring provably cannot detect targeted subgroup poisoning below a mass threshold, which is exactly the regime a real attacker would choose.

A vertical four-layer agent architecture — perception, reasoning, execution and memory update — separated by diamond-shaped containment gates and enclosed by a dashed runtime monitoring boundary.
Fig. — Where the gates go. The agent as four composed layers — perception, reasoning, execution, memory update — with containment gates G1–G3 on the transitions between them and runtime monitoring enclosing the cycle. Each principle attaches to a specific transition rather than to the model. — from J3, Fig. 1.
  • Five numerically verified theorems, and six operator-level containment principles with a worked YAML policy specification
  • Two-rater audit (Cohen's κ = 0.81) of LangChain, AutoGPT and the OpenAI Agents SDK: zero native compliance, memory integrity absent from all three
  • Prototype enforcement middleware drives attack success from 100% to 0.8% over 125 trials (p < 0.0001), 3.3% false positives, sub-millisecond overhead
  • Benefits-agent case study across five model backends: a single memory-poisoning write fully corrupts a targeted subgroup
Drive formal security model · memory poisoning · containment
J2 · 2026 Under review First author

On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models

Md Jafrin Hossain, Mohammad Arif Hossain, Nirwan Ansari

ACM Computing Surveys · preprint arXiv:2608.10530

A PRISMA 2020 systematic review of agentic LLM security across six databases, screening 743 records down to 85 studies from 2023–2025. The headline finding is a field pointed at the wrong layer: perception-layer issues such as prompt injection and jailbreaking absorb two thirds of the literature, while the action layer — tool misuse, code injection, sandbox escape — where consequences are irreversible, is nearly unstudied.

A wide hierarchical tree rooted at Agentic LLM Survey, fanning into nine top-level branches and roughly seventy colour-coded child nodes across three levels of nesting.
Fig. — The whole survey as one tree. Nine top-level branches and around seventy nodes, three levels deep: the PRISMA screening and quality-assessment steps, the formal abstraction chain from agentic-system definition through to architectural security, the cross-layer insecurity properties, and the seven secure-architecture design principles. — from J2, Fig. 1.
  • Four-layer vulnerability taxonomy mapping 13 vulnerability types onto perception, brain, action and interaction
  • Attack research outpaces defence work 3.9:1
  • Perception layer: 66% of papers · action layer: 4.7% — a coverage profile misaligned with real-world risk
  • Seven open problems forming a research roadmap centred on containment
arXiv systematic review · vulnerability taxonomy · LLM agents
W2 · 2026 Published First author

The Containment Gap: How Deployed Agentic AI Frameworks Fail Public-Facing Safety Requirements

Md Jafrin Hossain, Mohammad Arif Hossain, Weiqi Liu, Nirwan Ansari

Trustworthy AI for Good (AI4GOOD) Workshop, ICML 2026 · Seoul, South Korea

Asks a deployment question rather than a modelling one: do the frameworks people actually build government-services, healthcare and finance agents on provide any architectural safety guarantee? Audited against six containment principles, none of the three does. A simulated benefits agent then shows why that matters — one poisoned memory write produces persistent, targeted harm that aggregate monitoring never surfaces.

A three-row pipeline diagram showing a benign agent path, then a perturbation propagating from perception through reasoning into an out-of-scope action and poisoned memory, then a policy gate blocking that action.
Fig. — How one perturbation spreads, and where it stops. The same four-stage loop, three times. Top: the benign path, action in scope, memory intact. Middle: a perturbation at perception hijacks reasoning, produces an out-of-scope action and poisons memory — which feeds back as downstream drift. Bottom: a policy gate after reasoning blocks it, and execution and memory are never reached at all. — from W2, Figure 2.
  • First audit methodology turning formal containment principles into a reusable framework compliance matrix
  • LangChain, AutoGPT and the OpenAI Agents SDK: zero native compliance across all six principles
  • Memory poisoning drives targeted wrongful denial rates as high as 88.9% — a 3.5× rise — while aggregate accuracy stays intact
  • A memory-integrity validator plus a policy gate eliminate both attack vectors at < 0.2 ms per call; includes a Containment Sufficiency theorem
OpenReview framework audit · agentic safety · public-sector AI
J4 · 2026 Under review Second author

LLMShield: A Survey on Large Language Model Security in Edge Intelligence and IoT Systems

Mohammad Arif Hossain, Md Jafrin Hossain, Sharmin Akter Milu, Weiqi Liu, Nirwan Ansari

IEEE Transactions on Cognitive Communications and Networking · 2017–2026 corpus

Surveys attacks, backdoors, privacy leakage and defences for LLMs deployed on IoT and edge tiers, where the threat surface differs from the cloud case: indirect prompt injection arriving through web pages, emails and tickets; corpus poisoning of operational databases; and parametric and non-parametric backdoors planted via fine-tuning, adapters or persistent memory.

A two-panel comparison of a clean model trained on clean data against a backdoored model poisoned with 0.01 percent of samples, which behaves normally except on triggered inputs.
Fig. — A thousand poisoned samples out of a million. Above: clean training, consistently safe behaviour. Below: poisoning 0.01% of the data yields a model that looks normal on 99.9% of inputs and turns malicious only on the 0.1% carrying the trigger. That asymmetry is exactly what lets a backdoor survive evaluation. — from J4, Fig. 5.
  • Edge-aware taxonomy spanning prompt, model, training, privacy and deployment layers, separating IoT-specific surfaces from general LLM threats
  • Analysis of how compute, memory, latency and intermittency constraints change both attack feasibility and defence deployability
  • Among the first systematic treatments of inversion, membership-inference and training-data recovery attacks in federated learning for IoT-based LLMs
  • Unified defence taxonomy with edge-friendliness assessment, validated empirically on quantised edge-tier models
Drive edge intelligence · IoT · RAG security · backdoors
J5 · 2026 Preprint · under review Third author

Cognitive Graph Intelligence for Adaptive and Robust DDoS Attack Detection in Next Generation Networks

Mohammad Arif Hossain, Yeahia Sarker, Md Jafrin Hossain, Most. Humayra Khanom Rime, Nirwan Ansari

IEEE Transactions on Cognitive Communications and Networking · preprint arXiv:2608.17352

GraphGAN treats DDoS detection as a structural problem rather than a per-flow classification one. Sequential flows become k-nearest-neighbour graphs over sliding temporal windows, preserving feature similarity and co-occurrence that vector-based detectors discard, and a generator synthesises realistic minority-class attack samples against a GCN discriminator to survive severe class imbalance.

Three-panel GraphGAN architecture: temporal graph construction, adversarial learning with a generator and GCN discriminator, and DDoS detection with a GCN classifier.
Fig. — GraphGAN, end to end. Flows become k-NN graphs over sliding windows (left); a generator produces synthetic attack graphs against a GCN discriminator (centre); a GCN classifier then decides benign or DDoS on the rebalanced set (right). The imbalance is fixed before classification rather than compensated for after it. — from J5, Fig. 1.
  • Structure-aware graph construction over sliding windows, capturing flow co-occurrence patterns invisible to vector models
  • Adversarial graph architecture producing topology-conditioned synthetic samples with statistical fidelity and relational consistency
  • Outperforms state-of-the-art baselines on four benchmark datasets in accuracy, precision and recall, most decisively in data-scarce regimes
  • Framed as the sense–infer–act cognitive stage for SDN and edge mitigation
arXiv graph neural networks · GANs · intrusion detection
W3 · 2026 Published Second author

SATLOCK: Handover-Coupled Scheduling for Weather-Resilient Quantum Key Distribution over LEO Constellations

Mohammad Arif Hossain, Md Jafrin Hossain

3rd ACM SIGCOMM Workshop on Quantum Networks and Distributed Quantum Computing (QuNet '26) · Denver, CO · DOI 10.1145/3833409.3833444

Routing quantum keys over LEO constellations breaks the assumptions of classical routing: satellite handovers couple consecutive scheduling decisions, stochastic cloud cover can silently zero a ground link, and finite-key effects eliminate short low-elevation passes outright. SATLOCK combines a physically grounded channel model with an exact optimisation bound and a learned online policy.

A two-by-three grid of deep reinforcement learning training curves, one per demand pair, each plotting key delivered in megabits against training episode.
Fig. — Six agents learning to route. Per-demand DRL training curves for six intercontinental pairs, key delivered against episode, the raw trace under a 50-episode moving average. Achievable rate differs by an order of magnitude between pairs, and every agent plateaus by roughly episode 1,500–2,000. — from W3, Figure 2.
  • Composite channel model — Beer–Lambert absorption, diffraction, pointing jitter, Markov cloud cover, decoy-state estimation, finite-key correction — validated against a Qiskit BB84 simulation
  • Handover-aware binary ILP giving an optimality certificate unavailable in prior work: 1,311 Mbit delivered under low contention
  • Decentralised DQN policy reaching 91.8% and 84.6% of the ILP bound across contention regimes, deciding in ~50 µs per slot
ACM DL quantum key distribution · LEO satellites · ILP · deep RL
J9 · 2026 Under review Joint first author

ReMi-Fed: Reliable Multimodal Federated Authentication with Missingness-Aware Conformal Prediction

Md Jafrin Hossain, Umme Nusrat Jahan (equal contribution)

Scientific Reports (Springer Nature) · GRID audiovisual corpus, 93,096 test samples

Continuous biometric authentication fails in the field for a mundane reason: a camera gets covered, a microphone gets muted, and the modality simply is not there. ReMi-Fed treats arbitrary missingness as the normal case, fusing modalities by reliability and keeping a formal guarantee on the false-accept rate while it does so.

Four-stage ReMi-Fed architecture: client-side encoders with a missingness injector, reliability and uncertainty estimation, robust fusion with a conformal buffer and PID controller, and server-side federated aggregation with differential privacy.
Fig. — The closed loop. Client encoders feed per-modality reliability and uncertainty into reliability-weighted fusion; a conformal buffer and PID controller hold the false-accept rate on target while the server aggregates under secure aggregation and DP noise. The control loop is what keeps the guarantee valid as conditions drift. — from J9, Fig. 1.
  • Missingness-aware fusion combining MC-dropout uncertainty, reliability-weighted softmax, and heteroscedastic score-level imputation
  • PI-controlled streaming conformal prediction holds observed FAR within ±0.2% of target under bounded drift
  • Retains 77.6% AUC at 50% modality dropout against 74.4% for the best baseline; AUC 0.9116 vs 0.8936 for FedAvg (p = 0.013)
  • Robust aggregation cuts insecure-client impact by 96%; LoRA personalisation cuts communication cost by 89.3%; DP at (ε=3.0, δ=1e−5) costs under 0.2% utility
Drive federated learning · conformal prediction · differential privacy
J7 · 2026 Under review First author

Human-Centered Explainable AI for Non-Expert Decision Makers: A Systematic Review of Explanation Design, Trust Calibration, and Evaluation Frameworks

Md Jafrin Hossain, Shouvaggo Sharif Shammo

Artificial Intelligence Review (Springer) · The University of Western Australia

A PRISMA 2020 review of 272 studies (2019–2026) drawn from 920 records, synthesised around three pillars: how explanations are designed, how trust is calibrated, and how any of it is evaluated. The recurring failure is unnamed users — most of this literature never says who the non-expert actually is.

A PRISMA 2020 study selection flow diagram tracing 920 retrieved records down to 272 included studies, with the full-text exclusions itemised by reason.
Fig. — 920 records down to 272 studies. The PRISMA 2020 selection flow: 5 duplicates removed, 915 screened on title and abstract, 576 excluded there, 339 assessed at full text — with the 67 full-text exclusions itemised by reason: no human-centred contribution (22), domain-specific application (34), developer-tool audience (7), policy commentary (4). — from J7, Figure 2.
  • Layered human-centred XAI framework connecting six strata from model to explanation generation, presentation, cognition, reliance and evaluation
  • Conceptual contributions outnumber empirical user studies 2.3:1; trust research outweighs design research 2.0×
  • 59.6% of papers never specify their target user population; healthcare dominates with 63 papers while legal and public-sector settings have 2
  • Seven open problems with a phased research agenda; corpus and screening decisions released as supplementary material
Drive explainable AI · trust calibration · systematic review
J6 · 2026 Under review First author

Mining Trust and User Perceptions of Consumer Generative AI

Md Jafrin Hossain, Umme Nusrat Jahan, Shouvaggo Sharif Shammo

Array (Elsevier) · 17,012 reviews · Google Play and Apple App Store

One of the first cross-application analyses of what people actually complain about in generative AI products, covering ChatGPT, Gemini, Microsoft Copilot, Claude, DeepSeek and Perplexity. Negativity turns out to concentrate not in model quality but in friction: advertising, authentication, server reliability and pricing.

A two-panel time series: a six-series stacked area chart of trust and friction topic share by month, above a bar chart of total monthly review volume.
Fig. — Friction rises with the traffic. Upper panel: the monthly share of reviews falling into each trust-and-friction topic — account issues, chat limits, subscription, language and trust, server errors, ads — across nine months. Lower panel: total review volume over the same months, climbing from roughly 100 to 4,200. The friction peaks land on the busiest months, when the most new users are arriving. — from J6, Figure 5.
  • BERTopic with all-MiniLM-L6-v2 embeddings plus RoBERTa sentiment, validated against human coding — an advance on the standard LDA + VADER pipeline
  • Friction topics dominate negativity: advertising 91% negative, authentication 89%, server reliability 83%, pricing 73%
  • Reports a methodological negative result: topic modelling captures lexically distinct themes but not abstract ones like trust and privacy (κ = 0.241), motivating manual validation
  • Proposes a Trust Friction Score decomposing per-app friction into actionable sub-dimensions (ρ = 0.886 with negativity)
Drive review mining · BERTopic · trust · adoption
J1 · 2026 Published First author

Digital Device Usage and Psychological Well-Being in the Post-COVID-19 Era: Insights from a Cross-Sectional Survey

Md Jafrin Hossain, Munima Haque, Annajiat Alim Rasel, Md. Shohag Hossain, Mohammad Quamruzzaman, Umme Nusrat Jahan, Razoana Ayshee, Ariful Hasan Shuvo

BMC Psychology (Springer Nature) · DOI 10.1186/s40359-026-05205-x · published 3 Aug 2026

A two-wave survey of 622 respondents relating device usage, breadth of online activity and self-reported health complaints to psychological well-being on the Ryff 18-item scale, across pre-COVID, during-COVID and post-2023 periods. The finding that matters for policy: it is the diversity of what people do online, not the hours, that tracks harm.

A two-panel clustering figure: a PCA scatter of respondents coloured into three clusters with centroids marked, beside an annotated heatmap of standardised cluster centres across seven variables.
Fig. — Three behavioural segments. Panel A places the respondents in PCA space (PC1 27.0%, PC2 17.8%), split into low-usage, high multi-device, and high-health-effect / lower-well-being clusters with centroids marked. Panel B gives each cluster's standardised centre across all seven study variables. — from J1, Fig. 10.
  • Well-being is negatively associated with health complaints (ρ = −0.319); breadth of online purpose correlates with more health effects (ρ = 0.202)
  • The association survives controlling for total screen time — high online-purpose users report significantly more complaints than low users regardless of hours
  • K-means clustering (k = 3) identifies low-usage (n=142), high multi-device (n=291) and higher-health-effect / lower-well-being (n=189) segments
  • Permutation tests with FDR correction, Cohen's d and bootstrap confidence intervals throughout
Springer digital health · well-being · cluster analysis
J8 · 2026 Under review First author

Assessing Career Pathway Knowledge Among Lower-Income Computing Students in an S-STEM Program: A Longitudinal Paired Survey Analysis

Md Jafrin Hossain, Stephen Secules, Nivedita Kumar

ACM Transactions on Computing Education · NSF S-STEM cohort, three R1 universities

Follows 89 lower-income computing students through paired pre/post surveys grounded in Social Cognitive Career Theory, across three career pathways: industry, entrepreneurship and research. The programme moves what students know — particularly about research, where they started from least — without moving what they want, believe about themselves, or who they know.

Three grouped bar charts, one per career pathway, comparing yes and no counts for whether students know someone in that pathway across two survey waves.
Fig. — The networks do not move. “Do you know someone in this pathway?” across all three — research (p = 0.646), entrepreneurship (p = 0.450), internship (p = 1.000). Yes-counts barely shift between waves and no-counts stay dominant throughout. What students knew grew; who they actually knew did not. — from J8, Fig. 7.
  • Of 45 Likert items, 12 show significant gains, 7 of 10 concentrated in the research domain (d = 0.24–0.56)
  • Career values, confidence, belonging and social networks are largely unchanged — a selective rather than transformative effect
  • Baseline profile: strong industry-pathway knowledge, limited familiarity with research and entrepreneurship at entry
  • Conservative dual-test statistics throughout (paired t-tests plus Wilcoxon signed-rank, McNemar for network items)
Drive computing education · longitudinal survey · broadening participation
C2 · 2025 Published First author

Implementing Elliptic Curve Digital Signature (ECDSA) to Secure Islanded Microgrid against False Data Injection (FDI) Attacks

Md Jafrin Hossain, Umme Nusrat Jahan

7th International Conference on Electrical, Control and Instrumentation Engineering (ICECIE 2025), IEEE · DOI 10.1109/ICECIE66637.2025.11363833

Islanded microgrids run decentralised renewable generation on nodes too constrained for RSA-scale cryptography, which leaves control telemetry open to false data injection. The paper signs distributed-energy-resource traffic with ECDSA, buying smaller keys and lower computation at the same security level.

A console capture from the ECDSA application showing four signed DER records each verifying true, then an injected false-data attack on DER 3 that is detected and rejected with signature verification false.
Fig. — The attack, caught in the console. Four distributed energy resources sign their readings and each verifies true. Then an attacker forces DER 3's values to 99999: the signature check fails, the injection is flagged, and the write is rejected — the tampered value never reaches central control. — from C2, Figure 12.
  • Security model protecting DER-to-central-control communication in islanded microgrids
  • Elliptic-curve construction giving higher computational efficiency and smaller keys than RSA-based alternatives for constrained nodes
  • MATLAB simulation validating real-time FDI detection and mitigation with minimal overhead
  • Hybrid cloud key-distribution mechanism integrated with Hardware Security Modules
IEEE Xplore Drive applied cryptography · smart grid · cyber-physical systems
C1 · 2023 Published First author

Classifying Cyberattacks on Financial Organizations Based on Publicly Available Deep Web Dataset

Md. Jafrin Hossain, Umme Nusrat Jahan, Rejuan Haque Rifat, Annajiat Alim Rasel, Muhammad Abdur Rahman

International Conference on Cyber Management and Engineering (CyMaEn 2023), IEEE · DOI 10.1109/CyMaEn57228.2023.10050921

Combines surface-web transaction datasets (PaySim, BankSim) with deep- and dark-web breach reporting (SOCRadar, CSIS) to build an empirical picture of who attacks financial institutions and how, then proposes a defensive framework on top of it.

A packed bubble chart sizing countries by number of recorded cyberattacks, with a bubble-size legend and a country colour legend.
Fig. — Countries hit more than ten times. Each bubble is a country sized by summed attack count, with the United States and the global category dominating, followed by Russia, Ukraine, Brazil, Germany and India. — from C1, Fig. 10.
  • Scraping pipeline converting roughly 3,158 and 703 unstructured breach records into analysable datasets
  • Identifies about 71 distinct cyberattack types worldwide, with the United States, Russia, China, the UK, Spain and Germany most targeted
  • Profiles attacks by transaction type and fraud distribution across four public datasets
  • Proposes FinFrame, a four-step security framework for financial organisations
IEEE Xplore Drive fintech security · dark web threat intelligence
C3 · 2022 Published First author

Cyber Threats and Scams in FinTech Organizations: A Brief Overview of Financial Fraud Cases, Future Challenges, and Recommended Solutions in Bangladesh

Md. Jafrin Hossain, Rejuan Haque Rifat, Mahadi H Mugdho, Mohona Jahan, Annajiat Alim Rasel, Muhammad Abdur Rahman

International Conference on Informatics, Multimedia, Cyber and Information System (ICIMCIS 2022), IEEE · DOI 10.1109/ICIMCIS56303.2022.10017467

The earliest paper in this record, and the origin of a recurring concern: the people most exposed to a system's failures are usually the least equipped to see them coming. Survey and secondary data from Bangladesh show mobile financial services bearing the brunt of fintech attacks.

A UML sequence diagram between End Users and Auth Database showing a login flow through email and password, a two-factor code, and a digital signature, each with its own verification checkpoint.
Fig. — Three-way authentication, step by step. The proposed protocol between end user and auth database: email and password, then a second-factor code, then a stored digital signature — each gated by its own match or check on the database lifeline, so a transaction completes only once all three clear. — from C3, Fig. 5.
  • Mobile financial services are the most-affected sector — 46% of MFS users affected; ransomware 45% and social engineering 29% of breach types
  • FinSec, a security framework with Action, Knowledge and Simulation subunits spanning end users through infrastructure
  • Consortium blockchain / Hyperledger Fabric hybrid-cloud architecture for application-level security
  • Proposed Three-Way Authentication and gamified end-user training as protection measures
IEEE Xplore Drive fintech · social engineering · blockchain · security education