2014 IEEE Security and Privacy Workshops最新文献_第3页

Collusion and Fraud Detection on Electronic Energy Meters - A Use Case of Forensics Investigation Procedures 电子电能表的合谋与欺诈侦测——法医学调查程序用例

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.19

R. A. D. Faria, K. Fonseca, Bertoldo Schneider, S. Nguang

引用次数: 18

Insider Threat Identification by Process Analysis 通过过程分析识别内部威胁

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.40

M. Bishop, H. Conboy, Huong Phan, Borislava I. Simidchieva, G. Avrunin, L. Clarke, L. Osterweil, S. Peisert

引用次数: 47

iCOP: Automatically Identifying New Child Abuse Media in P2P Networks iCOP:在P2P网络中自动识别新的儿童虐待媒体

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.27

Claudia Peersman, Christian Schulze, A. Rashid, M. Brennan, Carl Fischer

{"title":"iCOP: Automatically Identifying New Child Abuse Media in P2P Networks","authors":"Claudia Peersman, Christian Schulze, A. Rashid, M. Brennan, Carl Fischer","doi":"10.1109/SPW.2014.27","DOIUrl":"https://doi.org/10.1109/SPW.2014.27","url":null,"abstract":"The increasing levels of child sex abuse (CSA) media being shared in peer-to-peer (P2P) networks pose a significant challenge for law enforcement agencies. Although a number of P2P monitoring tools to detect offender activity in such networks exist, they typically rely on hash value databases of known CSA media. Such an approach cannot detect new or previously unknown media being shared. Conversely, identifying such new previously unknown media is a priority for law enforcement - they can be indicators of recent or on-going child abuse. Furthermore, originators of such media can be hands-on abusers and their apprehension can safeguard children from further abuse. The sheer volume of activity on P2P networks, however, makes manual detection virtually infeasible. In this paper, we present a novel approach that combines sophisticated filename and media analysis techniques to automatically flag new previously unseen CSA media to investigators. The approach has been implemented into the iCOP toolkit. Our evaluation on real case data shows high degrees of accuracy while hands-on trials with law enforcement officers highlight iCOP's usability and its complementarity to existing investigative workflows.","PeriodicalId":142224,"journal":{"name":"2014 IEEE Security and Privacy Workshops","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131536712","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 22

Architecture, Workflows, and Prototype for Stateful Data Usage Control in Cloud 云中状态数据使用控制的体系结构、工作流和原型

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.13

A. Lazouski, Gaetano Mancini, F. Martinelli, P. Mori

引用次数: 15

Towards Forensic Analysis of Attacks with DNSSEC 基于DNSSEC的攻击取证分析

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.20

Haya Schulmann, M. Waidner

{"title":"Towards Forensic Analysis of Attacks with DNSSEC","authors":"Haya Schulmann, M. Waidner","doi":"10.1109/SPW.2014.20","DOIUrl":"https://doi.org/10.1109/SPW.2014.20","url":null,"abstract":"DNS cache poisoning is a stepping stone towards advanced (cyber) attacks, and can be used to monitor users' activities, for censorship, to distribute malware and spam, and even to subvert correctness and availability of Internet networks and services. The DNS infrastructure relies on challenge-response defences, which are deemed effective for thwarting attacks by (the common) off-path adversaries. Such defences do not suffice against stronger adversaries, e.g., man-in-the-middle (MitM). However, there seems to be little willingness to adopt systematic, cryptographic mechanisms, since stronger adversaries are not believed to be common. In this work we validate this assumption and show that it is imprecise. In particular, we demonstrate that: (1) attackers can frequently obtain MitM capabilities, and (2) even weaker attackers can subvert DNS security. Indeed, as we show, despite wide adoption of challenge-response defences, cache-poisoning attacks against DNS infrastructure are highly prevalent. We evaluate security of domain registrars and name servers, experimentally, and find vulnerabilities, which expose DNS infrastructure to cache poisoning. We review DNSSEC, the defence against DNS cache poisoning, and argue that, not only it is the most suitable mechanism for preventing cache poisoning attacks, but it is also the only proposed defence that enables a-posteriori forensic analysis of attacks. Specifically, DNSSEC provides cryptographic evidences, which can be presented to, and validated by, any third party and can be used in investigations and for detection of attacks even long after the attack took place.","PeriodicalId":142224,"journal":{"name":"2014 IEEE Security and Privacy Workshops","volume":"57 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128854562","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 17

Constructing and Analyzing Criminal Networks 构建和分析犯罪网络

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.22

Hamed Sarvari, Ehab A. Abozinadah, Alex V. Mbaziira, Damon McCoy

引用次数: 57

Insider Attack Identification and Prevention Using a Declarative Approach 使用声明性方法识别和预防内部攻击

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.41

A. Sarkar, Sven Köhler, S. Riddle, Bertram Ludäscher, M. Bishop

{"title":"Insider Attack Identification and Prevention Using a Declarative Approach","authors":"A. Sarkar, Sven Köhler, S. Riddle, Bertram Ludäscher, M. Bishop","doi":"10.1109/SPW.2014.41","DOIUrl":"https://doi.org/10.1109/SPW.2014.41","url":null,"abstract":"A process is a collection of steps, carried out using data, by either human or automated agents, to achieve a specific goal. The agents in our process are insiders, they have access to different data and annotations on data moving in between the process steps. At various points in a process, they can carry out attacks on privacy and security of the process through their interactions with different data and annotations, via the steps which they control. These attacks are sometimes difficult to identify as the rogue steps are hidden among the majority of the usual non-malicious steps of the process. We define process models and attack models as data flow based directed graphs. An attack A is successful on a process P if there is a mapping relation from A to P that satisfies a number of conditions. These conditions encode the idea that an attack model needs to have a corresponding similarity match in the process model to be successful. We propose a declarative approach to vulnerability analysis. We encode the match conditions using a set of logic rules that define what a valid attack is. Then we implement an approach to generate all possible ways in which agents can carry out a valid attack A on a process P, thus informing the process modeler of vulnerabilities in P. The agents, in addition to acting by themselves, can also collude to carry out an attack. Once A is found to be successful against P, we automatically identify improvement opportunities in P and exploit them, eliminating ways in which A can be carried out against it. The identification uses information about which steps in P are most heavily attacked, and try to find improvement opportunities in them first, before moving onto the lesser attacked ones. We then evaluate the improved P to check if our improvement is successful. This cycle of process improvement and evaluation iterates until A is completely thwarted in all possible ways.","PeriodicalId":142224,"journal":{"name":"2014 IEEE Security and Privacy Workshops","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122707724","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 17

The Tricks of the Trade: What Makes Spam Campaigns Successful? 交易的技巧:是什么让垃圾邮件活动成功?

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.21

Jane Iedemska, G. Stringhini, R. Kemmerer, Christopher Krügel, G. Vigna

引用次数: 17

Can We Identify NAT Behavior by Analyzing Traffic Flows? 我们可以通过分析流量来识别NAT行为吗?

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.28

Yasemin Gokcen, V. A. Foroushani, A. N. Zincir-Heywood

引用次数: 14

Combining Generated Data Models with Formal Invalidation for Insider Threat Analysis 将生成数据模型与形式失效相结合用于内部威胁分析

2014 IEEE Security and Privacy Workshops Pub Date : 2014-05-17 DOI: 10.1109/SPW.2014.45

F. Kammüller, Christian W. Probst

{"title":"Combining Generated Data Models with Formal Invalidation for Insider Threat Analysis","authors":"F. Kammüller, Christian W. Probst","doi":"10.1109/SPW.2014.45","DOIUrl":"https://doi.org/10.1109/SPW.2014.45","url":null,"abstract":"In this paper we revisit the advances made on invalidation policies to explore attack possibilities in organizational models. One aspect that has so far eloped systematic analysis of insider threat is the integration of data into attack scenarios and its exploitation for analyzing the models. We draw from recent insights into generation of insider data to complement a logic based mechanical approach. We show how insider analysis can be traced back to the early days of security verification and the Lowe-attack on NSPK. The invalidation of policies allows modelchecking organizational structures to detect insider attacks. Integration of higher order logic specification techniques allows the use of data refinement to explore attack possibilities beyond the initial system specification. We illustrate this combined invalidation technique on the classical example of the naughty lottery fairy. Data generation techniques support the automatic generation of insider attack data for research. The data generation is however always based on human generated insider attack scenarios that have to be designed based on domain knowledge of counter-intelligence experts. Introducing data refinement and invalidation techniques here allows the systematic exploration of such scenarios and exploit data centric views into insider threat analysis.","PeriodicalId":142224,"journal":{"name":"2014 IEEE Security and Privacy Workshops","volume":"107 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130747093","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 25