2014 IEEE Security and Privacy Workshops最新文献_第2页

Nail: A Practical Interface Generator for Data Formats 一个实用的数据格式接口生成器

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.31

Julian Bangert, N. Zeldovich

引用次数: 5

Finite State Machine Parsing for Internet Protocols: Faster Than You Think 互联网协议的有限状态机解析:比你想象的要快

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.34

R. Graham, Peter C. Johnson

{"title":"Finite State Machine Parsing for Internet Protocols: Faster Than You Think","authors":"R. Graham, Peter C. Johnson","doi":"10.1109/SPW.2014.34","DOIUrl":"https://doi.org/10.1109/SPW.2014.34","url":null,"abstract":"A parser's job is to take unstructured, opaque data and convert it to a structured, semantically meaningful format. As such, parsers often operate at the border between untrusted data sources (e.g., the Internet) and the soft, chewy center of computer systems, where performance and security are paramount. A firewall, for instance, is precisely a trust-creating parser for Internet protocols, permitting valid packets to pass through and dropping or actively rejecting malformed packets. Despite the prevalence of finite state machines (FSMs) in both protocol specifications and protocol implementations, they have gained little traction in parser code for such protocols. Typical reasons for avoiding the FSM computation model claim poor performance, poor scalability, poor expressibility, and difficult or time-consuming programming. In this research report, we present our motivations for and designs of finite state machines to parse a variety of existing Internet protocols, both binary and ASCII. Our hand-written parsers explicitly optimize around L1 cache hit latency, branch misprediction penalty, and program-wide memory overhead to achieve aggressive performance and scalability targets. Our work demonstrates that such parsers are, contrary to popular belief, sufficiently expressive for meaningful protocols, sufficiently performant for high-throughput applications, and sufficiently simple to construct and maintain. We hope that, in light of other research demonstrating the security benefits of such parsers over more complex, Turing-complete codes, our work serves as evidence that certain ``practical'' reasons for avoiding FSM-based parsers are invalid.","PeriodicalId":142224,"journal":{"name":"2014 IEEE Security and Privacy Workshops","volume":"45 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133992499","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 13

The Pitfalls of Protocol Design: Attempting to Write a Formally Verified PDF Parser 协议设计的陷阱:尝试编写一个正式验证的PDF解析器

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.36

Andreas Bogk, Marco Schopl

引用次数: 5

Analysis of Unintentional Insider Threats Deriving from Social Engineering Exploits 源自社会工程漏洞的非故意内部威胁分析

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.39

F. Greitzer, Jeremy R. Strozer, Sholom G. Cohen, A. Moore, David A. Mundie, Jennifer Cowley

引用次数: 83

Parsifal: A Pragmatic Solution to the Binary Parsing Problems Parsifal:二进制解析问题的实用解决方案

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.35

O. Levillain

引用次数: 13

P2U: A Privacy Policy Specification Language for Secondary Data Sharing and Usage 二级数据共享和使用的隐私策略规范语言

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.12

J. Iyilade, Julita Vassileva

{"title":"P2U: A Privacy Policy Specification Language for Secondary Data Sharing and Usage","authors":"J. Iyilade, Julita Vassileva","doi":"10.1109/SPW.2014.12","DOIUrl":"https://doi.org/10.1109/SPW.2014.12","url":null,"abstract":"Within the last decade, there are growing economic social incentives and opportunities for secondary use of data in many sectors, and strong market forces currently drive the active development of systems that aggregate user data gathered by many sources. This secondary use of data poses privacy threats due to unwanted use of data for the wrong purposes such as discriminating the user for employment, loan and insurance. Traditional privacy policy languages such as the Platform for Privacy Preferences (P3P) are inadequate since they were designed long before many of these technologies were invented and basically focus on enabling user-awareness and control during primary data collection (e.g. by a website). However, with the advent of Web 2.0 and Social Networking Sites, the landscape of privacy is shifting from limiting collection of data by websites to ensuring ethical use of the data after initial collection. To meet the current challenges of privacy protection in secondary context, we propose a privacy policy language, Purpose-to-Use (P2U), aimed at enforcing privacy while enabling secondary user information sharing across applications, devices, and services on the Web.","PeriodicalId":142224,"journal":{"name":"2014 IEEE Security and Privacy Workshops","volume":"49 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124025909","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 39

Resilience as a New Enforcement Model for IT Security Based on Usage Control 弹性:一种新的基于使用控制的IT安全实施模型

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.14

Sven Wohlgemuth

引用次数: 5

The Weird Machines in Proof-Carrying Code 携带证明代码中的奇怪机器

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.37

Julien Vanegue

引用次数: 18

Understanding Insider Threat: A Framework for Characterising Attacks 理解内部威胁:描述攻击的框架

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.38

Jason R. C. Nurse, Oliver Buckley, P. Legg, M. Goldsmith, S. Creese, Gordon R. T. Wright, M. Whitty

{"title":"Understanding Insider Threat: A Framework for Characterising Attacks","authors":"Jason R. C. Nurse, Oliver Buckley, P. Legg, M. Goldsmith, S. Creese, Gordon R. T. Wright, M. Whitty","doi":"10.1109/SPW.2014.38","DOIUrl":"https://doi.org/10.1109/SPW.2014.38","url":null,"abstract":"The threat that insiders pose to businesses, institutions and governmental organisations continues to be of serious concern. Recent industry surveys and academic literature provide unequivocal evidence to support the significance of this threat and its prevalence. Despite this, however, there is still no unifying framework to fully characterise insider attacks and to facilitate an understanding of the problem, its many components and how they all fit together. In this paper, we focus on this challenge and put forward a grounded framework for understanding and reflecting on the threat that insiders pose. Specifically, we propose a novel conceptualisation that is heavily grounded in insider-threat case studies, existing literature and relevant psychological theory. The framework identifies several key elements within the problem space, concentrating not only on noteworthy events and indicators- technical and behavioural- of potential attacks, but also on attackers (e.g., the motivation behind malicious threats and the human factors related to unintentional ones), and on the range of attacks being witnessed. The real value of our framework is in its emphasis on bringing together and defining clearly the various aspects of insider threat, all based on real-world cases and pertinent literature. This can therefore act as a platform for general understanding of the threat, and also for reflection, modelling past attacks and looking for useful patterns.","PeriodicalId":142224,"journal":{"name":"2014 IEEE Security and Privacy Workshops","volume":"10 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115492153","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 177

Ethics in Data Sharing: Developing a Model for Best Practice 数据共享中的伦理:开发最佳实践模型

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.43

S. Dietrich, J. V. D. Ham, A. Pras, R. V. Rijswijk-Deij, Darren Shou, A. Sperotto, A. Wynsberghe, L. Zuck

引用次数: 10