Proceedings of the 18th International Conference on Availability, Reliability and Security最新文献_第3页

Network Covert Channels in Routing Protocols 路由协议中的网络隐蔽通道

Proceedings of the 18th International Conference on Availability, Reliability and Security Pub Date : 2023-08-29 DOI: 10.1145/3600160.3605021

Michael Schneider, Daniel Spiekermann, J. Keller

引用次数: 0

VeriDevOps Software Methodology: Security Verification and Validation for DevOps Practices VeriDevOps软件方法论:DevOps实践的安全验证和确认

Proceedings of the 18th International Conference on Availability, Reliability and Security Pub Date : 2023-08-29 DOI: 10.1145/3600160.3605054

Eduard Paul Enoiu, D. Truscan, A. Sadovykh, Wissam Mallouli

引用次数: 0

Evaluating Statistical Disclosure Attacks and Countermeasures for Anonymous Voice Calls 评估匿名语音呼叫的统计泄露攻击及对策

Proceedings of the 18th International Conference on Availability, Reliability and Security Pub Date : 2023-08-29 DOI: 10.1145/3600160.3600186

David Schatz, M. Rossberg, Guenter Schaefer

{"title":"Evaluating Statistical Disclosure Attacks and Countermeasures for Anonymous Voice Calls","authors":"David Schatz, M. Rossberg, Guenter Schaefer","doi":"10.1145/3600160.3600186","DOIUrl":"https://doi.org/10.1145/3600160.3600186","url":null,"abstract":"Assuming a threat model of a global observer, statistical disclosure attacks have been proposed to efficiently de-anonymize communication relationships in text-based mix networks over time. It is commonly assumed that such attacks are also able to disclose call relationships in anonymous communication networks (ACNs) that support voice calls. One straightforward countermeasure is to expect users to permanently send and receive packets that mimic a Voice over IP (VoIP) call. However, this is not practical in real world scenarios, like on mobile devices. In this article, we adapt one specific statistical disclosure attack (Z-SDA-MD) to voice calls and quantitatively study less resource-intensive countermeasures. As base countermeasure, we evaluate a round-based communication model, corresponding to a timed mix. A simulation study of this scenario shows that the Z-SDA-MD is not well suited for a general disclosure of call relationships because of too many false positives. Nevertheless, the attack is able to correctly identify the most frequent relationships. Still, the accuracy in that regard may significantly be decreased by increasing the duration of one round, by decoupling actions (call setup and teardown) of caller and callee by a random number of rounds, and by occasional fake calls to a fixed set of “fake friends”. Overall, our study shows that anonymous voice calls may be implemented with an acceptable trade-off between anonymity, call setup time, and bandwidth overhead.","PeriodicalId":107145,"journal":{"name":"Proceedings of the 18th International Conference on Availability, Reliability and Security","volume":"5 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-08-29","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130470063","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Memory Forensics of the OpenDaylight Software-Defined Networking (SDN) Controller OpenDaylight软件定义网络(SDN)控制器内存取证

Proceedings of the 18th International Conference on Availability, Reliability and Security Pub Date : 2023-08-29 DOI: 10.1145/3600160.3600196

Abdullah Alshaya, Adam Kardorff, Christian Facundus, I. Baggili, Golden Richard III

{"title":"Memory Forensics of the OpenDaylight Software-Defined Networking (SDN) Controller","authors":"Abdullah Alshaya, Adam Kardorff, Christian Facundus, I. Baggili, Golden Richard III","doi":"10.1145/3600160.3600196","DOIUrl":"https://doi.org/10.1145/3600160.3600196","url":null,"abstract":"Software-Defined Networking (SDN) abstracts the underlying networking hardware by keeping the control plane and the data separated. SDNs use the control plane to direct network traffic, while OpenFlow switches and routers play a passive role in the system by forwarding packets. The centralization of the control plane on virtualized systems provide Digital Forensics (DF) an opportunity at acquiring and analyzing the memory of a controller. This provides forensically relevant data regarding the SDN’s operation. In our work, we examined the OpenDaylight (ODL) SDN controller to determine what forensically relevant information may be extracted from the controller’s memory. This was accomplished by creating controller memory samples with different networking configurations, and analyzing the memory samples, then constructing an SDN-Controller-Network-Discovery-Tool (SCoNDT). SCoNDT searches a memory dump for the ODL controller’s host tracker service. This service holds information on each host connected to the network, such as its internal IP address, MAC address, and the dates and times of its first and last network connections. It then generates an HTML report. SCoNDT was evaluated on memory samples with various network configurations and showed high efficacy in reconstructing the host IPs, the usernames, and hashed passwords.","PeriodicalId":107145,"journal":{"name":"Proceedings of the 18th International Conference on Availability, Reliability and Security","volume":"28 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-08-29","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131298010","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

A Generic IoT Quantum-Safe Watchdog Timer Protocol 通用物联网量子安全看门狗定时器协议

Proceedings of the 18th International Conference on Availability, Reliability and Security Pub Date : 2023-08-29 DOI: 10.1145/3600160.3605169

Michael Eckel, Tanja Gutsche, Hagen Lauer, André Rein

{"title":"A Generic IoT Quantum-Safe Watchdog Timer Protocol","authors":"Michael Eckel, Tanja Gutsche, Hagen Lauer, André Rein","doi":"10.1145/3600160.3605169","DOIUrl":"https://doi.org/10.1145/3600160.3605169","url":null,"abstract":"This paper presents a quantum-safe watchdog timer protocol designed and implemented using various quantum-safe digital signature algorithms. The protocol is specifically tailored to be used in the context of the Internet of Things (IoT) to address the security risks posed by quantum computing to classical protocols. Our approach replaces the classical protocol with a quantum-safe watchdog timer protocol, which ensures that an IoT device’s communication channels remain secure from adversarial attacks. To demonstrate the effectiveness of our proposed protocol, we develop a proof-of-concept (PoC) implementation using an actor framework in Python. We evaluate the performance impact of the proposed protocol based on several IoT scenarios. We also compare the performance of different quantum-safe algorithms using measurements of CPU cycles, and quantitatively evaluate the results using statistical methods. Our results indicate that the performance of the tested quantum-safe algorithms is better or similar to that of the tested classical algorithms. Based on these results, we recommend a specific quantum-safe algorithm for use with the watchdog timer protocol in the IoT context. The proposed protocol and recommended quantum-safe algorithm offer an effective way to address the security risks posed by quantum computing to IoT devices, and are a significant contribution to the field of quantum-safe cryptography.","PeriodicalId":107145,"journal":{"name":"Proceedings of the 18th International Conference on Availability, Reliability and Security","volume":"18 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-08-29","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123348945","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Beware the Doppelgänger: Attacks against Adaptive Thresholds in Facial Recognition Systems 注意Doppelgänger:对面部识别系统中自适应阈值的攻击

Proceedings of the 18th International Conference on Availability, Reliability and Security Pub Date : 2023-08-29 DOI: 10.1145/3600160.3600179

Willem Verheyen, Tim Van hamme, Sander Joos, D. Preuveneers, W. Joosen

{"title":"Beware the Doppelgänger: Attacks against Adaptive Thresholds in Facial Recognition Systems","authors":"Willem Verheyen, Tim Van hamme, Sander Joos, D. Preuveneers, W. Joosen","doi":"10.1145/3600160.3600179","DOIUrl":"https://doi.org/10.1145/3600160.3600179","url":null,"abstract":"Biometric recognition systems typically use a fixed threshold to differentiate between legitimate users and imposters. Yet, this method can be problematic due to differences in individual user performance, whereas some users are more easily recognizable than others. Furthermore, fixed thresholds require extensive tuning on a large test set a priori to determine an optimal threshold value. Adaptive thresholds address these shortcomings by adjusting threshold values based on population characteristics. However, our research demonstrates that adaptive thresholds suffer from a significant weakness as they inadvertently increase the attack surface against face recognition systems. We do so by introducing a novel attack, the doppelgänger attack, where a malicious actor inserts adversarial examples that mimic legitimate users and increase the false rejection rate for these legitimate users by 70%. Consequently, we enhance the performance of face recognition systems by introducing identity-level thresholds and developing a defensive mechanism to prevent the enrollment of doppelgängers. Our novel identity-level thresholding approach customizes the threshold for each individual user in the system. We demonstrate that this approach outperforms both static thresholds and the previously proposed adaptive methodologies, even when dealing with a large number of users. These results have significant implications for the design and implementation of face recognition systems, improving their reliability and enhancing their security.","PeriodicalId":107145,"journal":{"name":"Proceedings of the 18th International Conference on Availability, Reliability and Security","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-08-29","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123089163","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Long-Term Analysis of the Dependability of Cloud-based NISQ Quantum Computers 基于云的NISQ量子计算机可靠性的长期分析

Proceedings of the 18th International Conference on Availability, Reliability and Security Pub Date : 2023-08-29 DOI: 10.1145/3600160.3600192

Chuan Xu, Jakub Szefer

引用次数: 0

Automatic Test Generation to Improve Scrum for Safety Agile Methodology 自动生成测试以改进Scrum安全敏捷方法

Proceedings of the 18th International Conference on Availability, Reliability and Security Pub Date : 2023-08-29 DOI: 10.1145/3600160.3605061

M. Barbareschi, Salvatore Barone, V. Casola, Salvatore Della Torca, Daniele Lombardi

{"title":"Automatic Test Generation to Improve Scrum for Safety Agile Methodology","authors":"M. Barbareschi, Salvatore Barone, V. Casola, Salvatore Della Torca, Daniele Lombardi","doi":"10.1145/3600160.3605061","DOIUrl":"https://doi.org/10.1145/3600160.3605061","url":null,"abstract":"Continuous compliance and living traceability, i.e., assure the technical quality of the software during the incremental flow of the agile process and trace the requirements’ implementation at any time during the development cycle, are two of the most challenging aspects of adopting agile methodologies in the safety critical domain. This is even more true when either user requirements are unstable, the knowledge of the product to be delivered is not enough, or there is no clear interfaces between various hardware/software subsystems, as it may be in a research and development context. In order to reduce the overall cost of these activities, in this manuscript, we discuss benefits resulting from adopting a semi-automatic method to perform continuous compliance and living traceability. The method aims to finding inconsistency between artifacts produced at the end of each iteration by exploit automatic generation of unit tests and coverage metrics. We validated the applicability of the proposed methodology over a real case study from the railway domain, proving it can find inconsistency between several regulations-required artifacts, including the requirements specification, the architectural specification, test specifications and their implementation, and the software implementation.","PeriodicalId":107145,"journal":{"name":"Proceedings of the 18th International Conference on Availability, Reliability and Security","volume":"16 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-08-29","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127715989","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Cheaper than you thought? A dive into the darkweb market of cyber-crime products 比你想象的便宜?潜入网络犯罪产品的暗网市场

Proceedings of the 18th International Conference on Availability, Reliability and Security Pub Date : 2023-08-29 DOI: 10.1145/3600160.3605012

Dimitrios Georgoulias, Ricardo Yaben, Emmanouil Vasilomanolakis

引用次数: 0

Data Loss Prevention Solution for Linux Endpoint Devices Linux终端设备防数据丢失解决方案

Proceedings of the 18th International Conference on Availability, Reliability and Security Pub Date : 2023-08-29 DOI: 10.1145/3600160.3605036

Lukas Daubner, Adam Považanec

引用次数: 0