Lingling Fan

Weijie Shao, Yuyang Gao, Fu Song et al.

Federated learning (FL) is a distributed machine learning (ML) paradigm, allowing multiple clients to collaboratively train shared machine learning (ML) models without exposing clients' data privacy. It has gained substantial popularity in recent years, especially since the enforcement of data protection laws and regulations in many countries. To foster the application of FL, a variety of FL frameworks have been proposed, allowing non-experts to easily train ML models. As a result, understanding bugs in FL frameworks is critical for facilitating the development of better FL frameworks and potentially encouraging the development of bug detection, localization and repair tools. Thus, we conduct the first empirical study to comprehensively collect, taxonomize, and characterize bugs in FL frameworks. Specifically, we manually collect and classify 1,119 bugs from all the 676 closed issues and 514 merged pull requests in 17 popular and representative open-source FL frameworks on GitHub. We propose a classification of those bugs into 12 bug symptoms, 12 root causes, and 18 fix patterns. We also study their correlations and distributions on 23 functionalities. We identify nine major findings from our study, discuss their implications and future research directions based on our findings.

Bander Mogharbel, Lingling Fan, Zhixin Miao

In this paper, least square estimation (LSE)-based dynamic generator model parameter identification is investigated. Electromechanical dynamics related parameters such as inertia constant and primary frequency control droop for a synchronous generator are estimated using Phasor Measurement Unit (PMU) data obtained at the generator terminal bus. The key idea of applying LSE for dynamic parameter estimation is to have a discrete \underline{a}uto\underline{r}egression with e\underline{x}ogenous input (ARX) model. With an ARX model, a linear estimation problem can be formulated and the parameters of the ARX model can be found. This paper gives the detailed derivation of converting a generator model with primary frequency control into an ARX model. The generator parameters will be recovered from the estimated ARX model parameters afterwards. Two types of conversion methods are presented: zero-order hold (ZOH) method and Tustin method. Numerical results are presented to illustrate the proposed LSE application in dynamic system parameter identification using PMU data.

Guangke Chen, Zhe Zhao, Fu Song et al.

Speaker recognition systems (SRSs) have recently been shown to be vulnerable to adversarial attacks, raising significant security concerns. In this work, we systematically investigate transformation and adversarial training based defenses for securing SRSs. According to the characteristic of SRSs, we present 22 diverse transformations and thoroughly evaluate them using 7 recent promising adversarial attacks (4 white-box and 3 black-box) on speaker recognition. With careful regard for best practices in defense evaluations, we analyze the strength of transformations to withstand adaptive attacks. We also evaluate and understand their effectiveness against adaptive attacks when combined with adversarial training. Our study provides lots of useful insights and findings, many of them are new or inconsistent with the conclusions in the image and speech recognition domains, e.g., variable and constant bit rate speech compressions have different performance, and some non-differentiable transformations remain effective against current promising evasion techniques which often work well in the image domain. We demonstrate that the proposed novel feature-level transformation combined with adversarial training is rather effective compared to the sole adversarial training in a complete white-box setting, e.g., increasing the accuracy by 13.62% and attack cost by two orders of magnitude, while other transformations do not necessarily improve the overall defense capability. This work sheds further light on the research directions in this field. We also release our evaluation platform SPEAKERGUARD to foster further research.

Chengwei Liu, Sen Chen, Lingling Fan et al.

Third-party libraries with rich functionalities facilitate the fast development of Node.js software, but also bring new security threats that vulnerabilities could be introduced through dependencies. In particular, the threats could be excessively amplified by transitive dependencies. Existing research either considers direct dependencies or reasoning transitive dependencies based on reachability analysis, which neglects the NPM-specific dependency resolution rules, resulting in wrongly resolved dependencies. Consequently, further fine-grained analysis, such as vulnerability propagation and their evolution in dependencies, cannot be carried out precisely at a large scale, as well as deriving ecosystem-wide solutions for vulnerabilities in dependencies. To fill this gap, we propose a knowledge graph-based dependency resolution, which resolves the dependency relations of dependencies as trees (i.e., dependency trees), and investigates the security threats from vulnerabilities in dependency trees at a large scale. We first construct a complete dependency-vulnerability knowledge graph (DVGraph) that captures the whole NPM ecosystem (over 10 million library versions and 60 million well-resolved dependency relations). Based on it, we propose DTResolver to statically and precisely resolve dependency trees, as well as transitive vulnerability propagation paths, by considering the official dependency resolution rules. Based on that, we carry out an ecosystem-wide empirical study on vulnerability propagation and its evolution in dependency trees. Our study unveils lots of useful findings, and we further discuss the lessons learned and solutions for different stakeholders to mitigate the vulnerability impact in NPM. For example, we implement a dependency tree based vulnerability remediation method (DTReme) for NPM packages, and receive much better performance than the official tool (npm audit fix).

Zhixin Miao, Lingling Fan

This article presents an exciting finding for the power industry: the parameters of secondary frequency control based on integral or proportional integral control can be tuned to achieve economic operation and frequency regulation simultaneously. We show that if the power imbalance is represented by frequency deviation, an iterative dual decomposition based economic dispatch solving is equivalent to integral control. An iterative method of multipliers based economic dispatch is equivalent to proportional integral control. Similarly, if the controller parameters of the secondary frequency controls are chosen based on generator cost functions, these secondary frequency controllers achieve both economic operation and frequency regulation simultaneously.

Vahid. R Disfani, Zhixin Miao, Lingling Fan et al.

Two types of privacy-preserving decision making paradigms for utility-community interactions for multi-horizon operation are examined in this paper. In both designs, communities with renewable energy sources, distributed generators, and energy storage systems minimize their costs with limited information exchange with the utility. The utility makes decision based on the information provided from the communities. Through an iterative process, all parties achieve agreement. The authors' previous research results on subgradient and lower-upper-bound switching (LUBS)-based distributed optimization oriented multi-agent control strategies are examined and the convergence analysis of both strategies are provided. The corresponding decision making architectures, including information flow among agents and learning (or iteration) procedure, are developed for multi-horizon decision making scenarios. Numerical results illustrate the decision making procedures and demonstrate their feasibility of practical implementation. The two decision making architectures are compared for their implementation requirements as well as performance.