Knowledge management and preservation started thousands of years ago from cave paintings, representing words by pictures, later moving to books through the invention of paper and printing in the 15th century (Wallace, 2007). Later with the development of computing systems, knowledge/information was stored in the form of computing documents. In the first decade of the 21st century there was an explosion of volume, velocity, and variety (3V) of data. In addition to the storage cost, extraction of information/knowledge was non-trivial and thus required the evolution of knowledge management tools. In the 2nd decade the Artificial Intelligence (AI) revolution started. Scientists started to work with big data to efficiently and effectively deal with the 3Vs. Data is scanned and AI software is used to extract knowledge/information. AI has revolutionized every sphere of life (OED Online, 2021; Russell & Norvig, 2010; Nilsson, 2014). For example, healthcare has changed because of image recognition, natural language processing, language modeling, as well as neural machine translation. Although use of AI for knolwedge management is still in the nascent stage, it is important to note that along with knowledge extraction, security and privacy protection are paramount. Secure Knowledge Management (SKM) deals with the science of security in the collection, organizing, and dissemination of knowledge. Hackers and malicious actors, either sponsored by an adversary state, a competitor, or those working independently, are always on the lookout for weak spots in knowledge management systems to perpetuate passive and active attacks which may range from activities leading to information theft to extortion via ransomware. Hence, security systems must avert malicious activities perpetuated on host systems that archive the important information.

Research in the field of security for knowledge management systems is trending. We have seen advanced AI systems for information retrieval, the protection of cyber-physical systems like autonomous vehicles and CCTV cameras, the security of Internet of Things (IoT) devices like the ones used in Industry 4.0, to the prevention of threats and malware on network layers and hosts. These are some of the examples where AI helps in securing knowledge systems, but the relation between AI and SKM is not unidirectional, instead, it is reciprocal (Li, 2018). AI is not only used to protect knowledge systems, but AI is itself a source of information and knowledge that needs protection. We see an increasing trend of AI-based systems designed to attack other AI systems that are involved in generating advanced insights from the data (e.g., supervised deep learning systems). Such AI systems used for insight generation can be corrupted using adversarial AI technologies to reverse their detection and thereby overturning the very insights on which we base our decisions to design, develop and operate many critical systems. In this regard, we need to provide strong defenses against adversarial attacks because the attackers need to find a single loop-hole, while defenders have to guard against all possible vulnerabilities.

The purpose of this special issue is to report on the state-of-the-art research and practice in an important research area that deals with the methodologies for systematically gathering, organizing, and securely disseminating knowledge and information in the AI era. This issue of Information Systems Frontiers consists of expanded versions of eight accepted papers in the international conference on secure knowledge management held at BITS, Pilani, K. K. Birla Goa Campus, India during Dec. 21-22, 2019 and one invited paper. The first edition of the SKM was held at the University at Buffalo - SUNY, USA, and ever since it has been regularly held every two years in locations such as SUNY Albany, SUNY Stonybrook, University of Texas at Dallas, Rutgers University, BITS Dubai and University of South Florida. SKM-2019 was the first offering of the workshop in India. SKM 2019 was focused on revolutionary technologies such as artificial intelligence, machine learning, cloud computing, big data, and IoT and also included a workshop on Digital Payment Systems. All accepted papers in SKM-2019 went through a rigorous review by at least two experts prior to acceptance for publications in this special issue.

In the first/invited paper, Shyamasundar et al. (2021) review the privacy techniques that have been pursued traditionally on databases (DBs) and also application of mandatory access control policies to arrive at fine grained access control on multi-level security DBs. The authors further discuss robust realization of security with respect to information-flow using the reader-writer flow model.

The paper by Limbasiya et al. (2021) proposes a novel privacy-preserving mutual authentication and key agreement scheme for multi-server healthcare systems using lightweight cryptography primitives to access medical services remotely through smart devices. Their security analysis shows that the proposed protocol can withstand user impersonation, server impersonation, session key disclosure, stolen smart card, modification, forward secrecy, password guessing, man-in-the-middle, denial of service, replay, and insider attacks. The protocol is comparatively efficient in the execution time, communication cost, and storage cost. Hence it will protect user data and privacy with less computational resources.

Talegaon and Krishnan (2021) provide a comprehensive formal specification of access control in Android for deeper understanding of the operating system. Their proposed formal specification includes three parts, user-initiated operations and app-initiated operations - which are distinguished based on the initiating entity, as well as the uniform resource identifier (URI) permissions which are utilized in sharing temporary access to data. They also study the evolution of URI permissions from Android API version 10 (Gingerbread) to API version 22 (Lollipop), and find two significant issues with permissions in Android which were reported to Google.

Rathore et al. (2021) analyze the recently proposed state-of-the-art malware detection models built using machine learning and deep learning techniques and find that these models are adversarially vulnerable, which could potentially jeopardize their adoption. Therefore, they propose a robust android malware detection system against adversarial attacks using Q-learning by designing and analysing eight different malware detection models. Then the authors step into the adversary’s shoes and propose two evasion attacks, viz. single policy and multi-policy for white and grey box scenarios, against eight detection models. They achieve an average fooling rate of 44.21% and 53.20% across eight detection models with maximum five modifications using a single policy attack and multiple policy attack, respectively. Finally, the paper develops an adversarial defense strategy to minimize the average fooling rate against a single policy attack, thereby increasing the robustness of detection models. Their experimental results shows that the proposed malware detection system using reinforcement learning is more robust against adversarial attacks.

Haque and Krishnan (2021) in the fifth paper discuss how sharing of Cyber Threat Intelligence (CTI) across organizations help in defending cyber attacks in a timely manner. They state that CTI shall be shared in a controlled and automated manner and show that Relationship Based Access Control is an appropriate model for CTI sharing. They also develope an approach for automated threat detection, generation, and sharing of structured CTI, and implement a prototype Automated Cyber Defense System in a cloud based environment to demonstrate its features.

Baksi and Upadhyaya (2021) design a Hidden Markov Model based framework for detecting Advanced Persistent Threats (APT) by employing the indicators of compromise as observable features. The proposed theoretical framework also includes several models to represent the spread of APTs in a computer system that can be used to select an appropriate deception script when faced with APTs. The effectiveness of the proposed models is further illustrated by simulating a real APT type ransomware in a networked environment.

The seventh paper by Shrivastava and Hota (2021) presents an execution flow protection scheme named UnderTracker to harden the security framework of a binary code, divided into active and passive protection approaches. In active protection, labels are inserted at the control points, while passive protections monitor the visited labels to match the binary’s intended execution flow. An important feature of the UnderTracker is that it minimizes the number of controlled points and uses required jump labels for verification and protection to ensure execution flow integrity. Hence, the overhead over a prolonged time for an I/O intensive binary will drop down to 5-6%.

In the eight paper, Tran et al. (2021) systematically examine peoples’ perceptions on the effects of misinformation spread through online social networking media such as Facebook, Twitter and WhatsApp during humanitarian crises, which can significantly harm the well-being of people impacted by these disasters. The authors develop a systematic synthesis of harms from misinformation as applied to humanitarian crisis contexts and investigate different aspects of such harms. Besides presenting a visualization of the harms, the paper also tests for significant differences between perceptions of harms in two classes of people: (i) those working and not working in the crisis response arena, and (ii) those who are and who are not affected by the crisis.

Finally, Pal et al. (2021) investigate the balancing effect of risk and convenience on mobile payment service usage. The paper also, develops multi-dimensional scales for key variables of risk and convenience. Their analysis is based on survey responses from a sample of 215 respondents. Additional descriptive answers given by the respondents allow drawing of crucial insights to understand how risk and convenience have contrasting impacts on user intention to use mobile payments.

As the organizers of the SKM-2019 conference we hope that this special issue in Information Systems Frontiers will highlight the current trends in SKM and will inspire more research on the application of AI for SKM. We are very grateful to all the invited reviewers Heena Rathore, University of Texas at San Antonio, USA; Anindya Maiti, University of Oklahoma, USA; Yuan Cheng, California State University Sacramento, USA; Abhay Samant, National Instruments and University of Texas at Austin, USA; Maanak Gupta, Tennessee Technological University, USA; Nisha Vinayaga Sureshkanth, University of Texas at San Antonio, USA; Abhipsa Pal, Indian Institute of Management Kozhikode, India; Rohit Valecha, University of Texas at San Antonio, USA; Narendra Nelabhotla, IDRBT, India; Raj Jaiswal, BITS, Pilani, Goa Campus, India; Rahul Thakur, IIT Roorkee; Ritika Jaiswal, BITS, Pilani, Goa Campus, Goa, India; Debasis Patnaik, BITS, Pilani, Goa Campus, Goa, India; Neeeraj Amarnani, Goa Institute of Management, Goa, India; Dario Stabili, University of Modena and Reggio Emilia, Italy; Bharanidharan Shanmugam, Charles Darwin University, Australia; S Maity, IIT Allahbad, India; Jiwan Ningaleku, University of Texas at San Antonio, USA; Ashu Sharma, Mindree, Hyderabad, India; Raju Halder, IIT Patna, India; Sadhana Jha, BITS Pilani, Pilani Campus, India; Santonu Sarkar, BITS Pilani, Goa Campus, India; Soumyadip Bandopadhyay, BITS Pilani Goa Campus, India and Nitin Upadhayay, Goa Institute of Management, India for their time and efforts in carefully reading the manuscripts and providing insightful comments and suggestions to significantly improve their quality and readability.