Cookies Policy
The website need some cookies and similar means to function. If you permit us, we will use those means to collect data on your visits for aggregated statistics to improve our service. Find out More
Accept Reject
  • Menu
Publications

Publications by CRACS

2026

Large Language Model Framework for Log Sequence Anomaly Detection

Authors
Reis, J; Areias, M; Barbosa, JG;

Publication
PROGRESS IN ARTIFICIAL INTELLIGENCE, EPIA 2025, PT I

Abstract
Log analysis is fundamental to modern software observability systems, playing a key role in improving system reliability. Recently, there has been a growing adoption of Large Language Models (LLMs) for log anomaly detection, due to their ability to learn complex patterns. In this work, we propose a model-agnostic framework that allows seamless plug-and-play integration of different LLMs, making it easy to experiment with and select the model that fits specific needs. These models are first fine-tuned on normal log data, learning their patterns. During inference, the model predicts the most probable next tokens based on the preceding context in each sequence. Anomaly detection is performed using Top-K predictions, where sequences are flagged as anomalous if the actual log entry does not appear among the K most probable next tokens, with K determined using the validation dataset. The proposed framework is evaluated on three widely-used benchmark datasets-HDFS, BGL, and Thunderbird-where it consistently achieves competitive results, outperforming state-of-the-art methods in multiple scenarios. These results highlight the effectiveness of LLM-based log analysis and the importance of flexibility when selecting models for specific operational contexts.

2026

Obscura: Enabling Ephemeral Proxies for Traffic Encapsulation in WebRTC Media Streams Against Cost-Effective Censors

Authors
Afonso Vilalonga; Kevin Gallagher; João S. Resende; Henrique Domingos;

Publication
Proceedings on Privacy Enhancing Technologies

Abstract
Recent research on online censorship has provided valuable insights into common censorship strategies and censors' tolerance for collateral damage. A consistent finding across these studies is that censors tend to favour cost-effective techniques such as proxy enumeration, active probing, and deep packet inspection (DPI), rather than more complex and non-deterministic methods such as deep learning-based traffic analysis. For example, a recent study on the Snowflake censorship evasion system reinforced this finding by demonstrating that authoritarian regimes primarily relied on DPI to target the system. However, as censorship techniques continue to evolve, two critical questions arise: (1) What future attack vectors are likely to emerge based on current research and observed censor capabilities? (2) How can these emerging threats, along with previously utilised censorship methods, be effectively mitigated? In this paper, we present Obscura, a censorship evasion system designed to resist cost-effective, historically grounded censorship techniques while also defending against a class of plausible future attacks within a cost-effective threat model targeting WebRTC-based censorship evasion systems. Obscura is built upon four core features: (1) encapsulation of traffic within WebRTC media streams, (2) the use of a reliability layer, (3) support for both browser-based and Pion-based clients and proxy instances, and (4) the use of ephemeral proxies. Each feature is intended to mitigate either a known attack observed in the wild or a theoretically plausible attack consistent with the capabilities of a cost-effective censor. We provide a security analysis to justify our design choices and a performance evaluation to demonstrate that Obscura maintains reasonable throughput for typical online activities.

2026

RunPBA - Runtime attestation for microcontrollers with PACBTI

Authors
Cirne, A; Sousa, PR; Resende, JS; Antunes, L;

Publication
COMPUTERS & SECURITY

Abstract
The widespread adoption of embedded systems has led to their deployment in critical real-world applications, making them attractive targets for malicious actors. This paper presents RunPBA, a hardware-based runtime attestation system designed to defend against control flow attacks while maintaining minimal performance overhead and adhering to strict power consumption constraints. RunPBA leverages Pointer Authentication and Branch Target Identification (PACBTI), a new processor extension tailored for the ARM Cortex M processor family, allowing robust protection without requiring hardware modifications, a limitation present in similar solutions. We implemented a proof-of-concept and evaluated it using two benchmark suites, Coremark PRO and BEEBS. Experimental results indicate that RunPBA imposes a geometric mean performance overhead of only 1.3% and 6.8% across the benchmarks, underscoring its efficiency and suitability for real-world deployment.

2025

Blockchain-Assisted Device as a Service (DaaS)

Authors
Tavares, MC; Mendonca, RP; Meneses, D; Santos, A; Pinto, A;

Publication
BLOCKCHAIN AND APPLICATIONS, 6TH INTERNATIONAL CONGRESS

Abstract
The paradigm of Device as a Service (DaaS) is one where devices are used as part of a service, with the user having no ownership over them. A centralised, web-based approach can be envisioned to support such a business model, but such lacks transparency, availability, and global scalability. A blockchain-based solution is proposed to support such a business model. The concept of a blockchain-assisted DaaS is novel and, by using smart contracts to support key interactions between relevant entities, marks a shift in device ownership, management, and revenue generation.

2025

A blockchain architecture with smart contracts for an additive symbiotic network - a case study

Authors
Ferreira, IA; Palazzo, G; Pinto, A; Pinto, P; Sousa, P; Godina, R; Carvalho, H;

Publication
OPERATIONS MANAGEMENT RESEARCH

Abstract
Adopting innovative technologies such as blockchain and additive manufacturing can help organisations promote the development of additive symbiotic networks, thus pursuing higher sustainable goals and implementing circular economy strategies. These symbiotic networks correspond to industrial symbiosis networks in which wastes and by-products from other industries are incorporated into additive manufacturing processes. The adoption of blockchain technology in such a context is still in a nascent stage. Using the case study method, this research demonstrates the adoption of blockchain technology in an additive symbiotic network of a real-life context. The requirements to use a blockchain network are identified, and an architecture based on smart contracts is proposed as an enabler of the additive symbiotic network under study. The proposed solution uses the Hyperledger Fabric Attribute-Based Access Control as the distributed ledger technology. Even though this solution is still in the proof-of-concept stage, the results show that adopting it would allow the elimination of intermediary entities, keep available tracking records of the resources exchanged, and improve trust among the symbiotic stakeholders (that do not have any trust or cooperation mechanisms established before the symbiotic relationship). This study highlights that the complexity associated with introducing a novel technology and the technology's immaturity compared to other data storage technologies are some of the main challenges related to using blockchain technology in additive symbiotic networks.

2025

Blockchain-Based Authorization in UEFI Firmware for DaaS Applications

Authors
Mendonça, R; Tavares, M; Maio, P; Pinto, A;

Publication
2025 CYBER AWARENESS AND RESEARCH SYMPOSIUM, CARS

Abstract
End-users traditional ownership of devices is progressively being replaced by usage-based approaches. One of the most significant Device-as-a-Service (DaaS) challenges concerns protecting device usage outside of supplier control. In this work, we build on our previous blockchain framework for device management to propose a novel and enhanced pre-OS boot process for device validation in environments requiring both security and transparency. For that, we have customized a Unified Extensible Firmware Interface (UEFI) module to authorise device usage against the blockchain before system boot, preventing authorized manipulation at the earliest stage. Preliminary experiments show this approach is valid and effective.

  • 3
  • 207