Proceedings of the third ACM conference on Data and application security and privacy最新文献_第3页

Exploring dependency for query privacy protection in location-based services 探索基于位置的服务中查询隐私保护的依赖关系

Proceedings of the third ACM conference on Data and application security and privacy Pub Date : 2013-02-18 DOI: 10.1145/2435349.2435354

Xihui Chen, Jun Pang

引用次数: 9

JStill: mostly static detection of obfuscated malicious JavaScript code JStill:主要是静态检测混淆的恶意JavaScript代码

Proceedings of the third ACM conference on Data and application security and privacy Pub Date : 2013-02-18 DOI: 10.1145/2435349.2435364

W. Xu, Fangfang Zhang, Sencun Zhu

{"title":"JStill: mostly static detection of obfuscated malicious JavaScript code","authors":"W. Xu, Fangfang Zhang, Sencun Zhu","doi":"10.1145/2435349.2435364","DOIUrl":"https://doi.org/10.1145/2435349.2435364","url":null,"abstract":"The dynamic features of the JavaScript language not only promote various means for users to interact with websites through Web browsers, but also pose serious security threats to both users and websites. On top of this, obfuscation has become a popular technique among malicious JavaScript code that tries to hide its malicious purpose and to evade the detection of anti-virus software. To defend against obfuscated malicious JavaScript code, in this paper we propose a mostly static approach called JStill. JStill captures some essential characteristics of obfuscated malicious code by function invocation based analysis. It also leverages the combination of static analysis and lightweight runtime inspection so that it can not only detect, but also prevent the execution of the obfuscated malicious JavaScript code in browsers. Our evaluation based on real-world malicious JavaScript samples as well as Alexa top 50,000 websites demonstrates high detection accuracy (all in our experiment) and low false positives of JStill. Meanwhile, JStill only incurs negligible performance overhead, making it a practical solution to preventing obfuscated malicious JavaScript code.","PeriodicalId":118139,"journal":{"name":"Proceedings of the third ACM conference on Data and application security and privacy","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2013-02-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127327029","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 87

A study of user password strategy for multiple accounts 多账号用户密码策略研究

Proceedings of the third ACM conference on Data and application security and privacy Pub Date : 2013-02-18 DOI: 10.1145/2435349.2435373

Taiabul Haque, M. Wright, Shannon Scielzo

引用次数: 49

Session details: Cloud and distributed computing security and privacy 会议细节:云和分布式计算的安全性和隐私性

Proceedings of the third ACM conference on Data and application security and privacy Pub Date : 2013-02-18 DOI: 10.1145/3260280

Lujo Bauer

引用次数: 0

Session details: Short papers: users and security economics 短论文:用户和安全经济学

Proceedings of the third ACM conference on Data and application security and privacy Pub Date : 2013-02-18 DOI: 10.1145/3260279

A. Squicciarini

引用次数: 0

Adaptive data protection in distributed systems 分布式系统中的自适应数据保护

Proceedings of the third ACM conference on Data and application security and privacy Pub Date : 2013-02-18 DOI: 10.1145/2435349.2435401

A. Squicciarini, Giuseppe Petracca, E. Bertino

引用次数: 24

Persea: a sybil-resistant social DHT Persea:一个抗女性的社会DHT

Proceedings of the third ACM conference on Data and application security and privacy Pub Date : 2013-02-18 DOI: 10.1145/2435349.2435372

M. N. Al-Ameen, M. Wright

{"title":"Persea: a sybil-resistant social DHT","authors":"M. N. Al-Ameen, M. Wright","doi":"10.1145/2435349.2435372","DOIUrl":"https://doi.org/10.1145/2435349.2435372","url":null,"abstract":"P2P systems are inherently vulnerable to Sybil attacks, in which an attacker can have a large number of identities and use them to control a substantial fraction of the system. We propose Persea, a novel P2P system that is more robust against Sybil attacks than prior approaches. Persea derives its Sybil resistance by assigning IDs through a bootstrap tree, the graph of how nodes have joined the system through invitations. More specifically, a node joins Persea when it gets an invitation from an existing node in the system. The inviting node assigns a node ID to the joining node and gives it a chunk of node IDs for further distribution. For each chunk of ID space, the attacker needs to socially engineer a connection to another node already in the system. This hierarchical distribution of node IDs confines a large attacker botnet to a considerably smaller region of the ID space than in a normal P2P system. Persea uses a replication mechanism in which each (key,value) pair is stored in nodes that are evenly spaced over the network. Thus, even if a given region is occupied by attackers, the desired (key,value) pair can be retrieved from other regions. We compare our results with Kad, Whanau, and X-Vine and show that Persea is a better solution against Sybil attacks.","PeriodicalId":118139,"journal":{"name":"Proceedings of the third ACM conference on Data and application security and privacy","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2013-02-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131760926","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 9

Enhancing performance of searchable encryption in cloud computing 增强云计算中可搜索加密的性能

Proceedings of the third ACM conference on Data and application security and privacy Pub Date : 2013-02-18 DOI: 10.1145/2435349.2435369

R. Rughinis

引用次数: 5

The usability of truecrypt, or how i learned to stop whining and fix an interface truecrypt的可用性，或者我是如何学会停止抱怨和修复界面的

Proceedings of the third ACM conference on Data and application security and privacy Pub Date : 2013-02-18 DOI: 10.1145/2435349.2435360

Sumeet Gujrati, Eugene Y. Vasserman

{"title":"The usability of truecrypt, or how i learned to stop whining and fix an interface","authors":"Sumeet Gujrati, Eugene Y. Vasserman","doi":"10.1145/2435349.2435360","DOIUrl":"https://doi.org/10.1145/2435349.2435360","url":null,"abstract":"Non-use or incorrect use of security software is one major reason for privacy breaches of all scales. The problem is compounded by software, security policies, and user interfaces that are difficult to use and understand. Using widely accepted user interface analysis methods, we examine a popular free and open source disk encryption software package, and find that it is far from accessible to ordinary users. Using rigorous interface design principles, we derive several concrete changes that would make the software easier to use, and construct a new interface to test our theories. We evaluate the two interfaces through a randomized user study in a controlled laboratory setting, and determine that the new interface is significantly easier to understand and faster to use, especially for novice computer users. We observe not only measurable speed-ups of common tasks, but also improved user-reported ease of use ratings. Several of our design choices turn out to have been misguided, making some tasks more difficult in our modified interface, but fortunately our alterations are mutually independent, i.e. reverting some components to their original design does not nullify the benefit of other modifications. Our experience shows that even simple, intuitive, and logically consistent modifications to complex interfaces have dramatic positive usability effects, and can be easily applied to different pieces of security software in order to reduce the impediment to uptake by novice users.","PeriodicalId":118139,"journal":{"name":"Proceedings of the third ACM conference on Data and application security and privacy","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2013-02-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132411104","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Smart keys for cyber-cars: secure smartphone-based NFC-enabled car immobilizer 网络汽车的智能钥匙:基于安全智能手机的nfc汽车防盗器

Proceedings of the third ACM conference on Data and application security and privacy Pub Date : 2013-02-18 DOI: 10.1145/2435349.2435382

Christoph Busold, Ahmed Taha, C. Wachsmann, A. Dmitrienko, Hervé Seudie, Majid Sobhani, A. Sadeghi

{"title":"Smart keys for cyber-cars: secure smartphone-based NFC-enabled car immobilizer","authors":"Christoph Busold, Ahmed Taha, C. Wachsmann, A. Dmitrienko, Hervé Seudie, Majid Sobhani, A. Sadeghi","doi":"10.1145/2435349.2435382","DOIUrl":"https://doi.org/10.1145/2435349.2435382","url":null,"abstract":"Smartphones have become very popular and versatile devices. An emerging trend is the integration of smartphones into automotive systems and applications, particularly access control systems to unlock cars (doors and immobilizers). Smartphone-based automotive solutions promise to greatly enhance the user's experience by providing advanced features far beyond the conventional dedicated tokens/transponders. We present the first open security framework for secure smartphone-based immobilizers. Our generic security architecture protects the electronic access tokens on the smartphone and provides advanced features such as context-aware access policies, remote issuing and revocation of access rights and their delegation to other users. We discuss various approaches to instantiate our security architecture based on different hardware-based trusted execution environments, and elaborate on their security properties. We implemented our immobilizer system based on the latest Android-based smartphone and a microSD smartcard. Further, we support the algorithmic proofs of the security of the underlying protocols with automated formal verification tools.","PeriodicalId":118139,"journal":{"name":"Proceedings of the third ACM conference on Data and application security and privacy","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2013-02-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133782912","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 48