2013 IEEE Seventh International Conference on Software Security and Reliability Companion最新文献

Supporting Automatic Code Review via Design 通过设计支持自动代码审查

2013 IEEE Seventh International Conference on Software Security and Reliability Companion Pub Date : 2013-06-18 DOI: 10.1109/SERE-C.2013.37

Jiantao He, Linzhang Wang, Jianhua Zhao

引用次数: 1

Behavioral Analysis of Android Applications Using Automated Instrumentation 使用自动化仪器的Android应用程序行为分析

2013 IEEE Seventh International Conference on Software Security and Reliability Companion Pub Date : 2013-06-18 DOI: 10.1109/SERE-C.2013.35

Mohammad Karami, Mohamed Elsabagh, Parnian Najafiborazjani, A. Stavrou

引用次数: 40

Reliability Models Applied to Mobile Applications 应用于移动应用的可靠性模型

2013 IEEE Seventh International Conference on Software Security and Reliability Companion Pub Date : 2013-06-18 DOI: 10.1109/SERE-C.2013.30

Sonia Meskini, A. B. Nassif, Luiz Fernando Capretz

引用次数: 17

Automating Service Availability Analysis: An Application to a Highly Available Media-Streaming Service 自动化服务可用性分析:一个高可用性流媒体服务的应用

2013 IEEE Seventh International Conference on Software Security and Reliability Companion Pub Date : 2013-06-18 DOI: 10.1109/SERE-C.2013.28

A. Kanso, M. Toeroe, F. Khendek

引用次数: 7

Designing an Enterprise Security Strategy for Mobile Intranet Access 企业移动内网接入安全策略设计

2013 IEEE Seventh International Conference on Software Security and Reliability Companion Pub Date : 2013-06-18 DOI: 10.1109/SERE-C.2013.14

Matthias Trojahn, F. Ortmeier

引用次数: 0

Robust and Efficient Covert Channel Communications in Operating Systems: Design, Implementation and Evaluation 操作系统中稳健和高效的隐蔽信道通信:设计、实现和评估

2013 IEEE Seventh International Conference on Software Security and Reliability Companion Pub Date : 2013-06-18 DOI: 10.1109/SERE-C.2013.12

Yuqi Lin, Liping Ding, Jingzheng Wu, Yalong Xie, Yongji Wang

{"title":"Robust and Efficient Covert Channel Communications in Operating Systems: Design, Implementation and Evaluation","authors":"Yuqi Lin, Liping Ding, Jingzheng Wu, Yalong Xie, Yongji Wang","doi":"10.1109/SERE-C.2013.12","DOIUrl":"https://doi.org/10.1109/SERE-C.2013.12","url":null,"abstract":"Covert channel has been studied for years due to its ability to divulge sensitive information in computer systems. Constructing covert communication scenarios is the first step to learn the threat of a channel. There are several challenges in the existing design of covert channel communications: lacking general communicating model description, low transmission accuracy and weak anti-interference ability. In this paper, we explore how to construct robust and efficient covert channel communications in operating systems. Firstly, we design three general covert communicating protocol models: the Basic Protocol (BP), the Two-Channel Transmission Protocol (TCTP) and the Self-Adaptive Protocol (SAP). Then we implement them in Linux operating systems. To simulate real attack scenarios, a toy Trojan program extracting passwords to cooperate with the covert protocols is presented. To identify potential covert channels in Linux kernel, we use Directed Information Flow Graph (DIFG) to analyze the source code and choose last_pid and temporary files channels in our implementation. Finally we evaluate the transmitting rate and accuracy of the three protocols. The results demonstrate that without special protective measures, the TCTP can achieve rather high accuracy and rate (100% and 31bps in our lab). When equipped with some restricting or interfering mechanisms, the SAP can achieve 97% accuracy and 18bps rate. This result reveals that attackers can bypass countermeasures to steal sensitive data from victims by well-designed covert protocols.","PeriodicalId":150535,"journal":{"name":"2013 IEEE Seventh International Conference on Software Security and Reliability Companion","volume":"44 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-06-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114742791","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 8

hGuard: A Framework to Measure Hypervisor Critical Files hGuard:一个衡量Hypervisor关键文件的框架

2013 IEEE Seventh International Conference on Software Security and Reliability Companion Pub Date : 2013-06-18 DOI: 10.1109/SERE-C.2013.21

Baozeng Ding, Yeping He, Qiming Zhou, Y. Wu, Jingzheng Wu

引用次数: 1

The Time/State-based Software-Intensive Systems Failure Mode Researches 基于时间/状态的软件密集型系统故障模式研究

2013 IEEE Seventh International Conference on Software Security and Reliability Companion Pub Date : 2013-06-18 DOI: 10.1109/SERE-C.2013.32

Xuan Hu, Chun-Hui Yang, Dong Li, Yi Zhu, Mengyue Liu

引用次数: 0

A Concept for Language-Oriented Security Testing 面向语言的安全测试的概念

2013 IEEE Seventh International Conference on Software Security and Reliability Companion Pub Date : 2013-06-18 DOI: 10.1109/SERE-C.2013.16

Philipp Zech, M. Felderer, Matthias Farwick, R. Breu

引用次数: 1

Verification of Secure Inter-operation Properties in Multi-domain RBAC Systems 多域RBAC系统安全互操作特性验证

2013 IEEE Seventh International Conference on Software Security and Reliability Companion Pub Date : 2013-06-18 DOI: 10.1109/SERE-C.2013.25

Antonios Gouglidis, I. Mavridis, Vincent C. Hu

{"title":"Verification of Secure Inter-operation Properties in Multi-domain RBAC Systems","authors":"Antonios Gouglidis, I. Mavridis, Vincent C. Hu","doi":"10.1109/SERE-C.2013.25","DOIUrl":"https://doi.org/10.1109/SERE-C.2013.25","url":null,"abstract":"The increased complexity of modern access control (AC) systems stems partly from the need to support diverse and multiple administrative domains. Systems engineering is a key technology to manage this complexity since it is capable of assuring that an operational system will adhere to the initial conceptual design and defined requirements. Specifically, the verification stage of an AC system should be based on techniques that have a sound and mathematical underpinning. Working on this assumption, model checking techniques are applied for the verification of predefined system properties, and thus, conducting a security analysis of a system. In this paper, we propose the utilization of automated and error-free model checking techniques for the verification of security properties in multi-domain AC systems. Therefore, we propose a formal definition in temporal logic of four AC system properties regarding secure inter-operation with Role-Based Access Control (RBAC) policies in order to be verified by using model checking. For this purpose, we demonstrate the implementation of a tool chain for expressing RBAC security policies, reasoning on role hierarchies and properly feeding the model checking process. The proposed approach can be applied in any RBAC model to efficiently detect non-conformance between an AC system and its security specifications. As a proof of concept, we provide examples illustrating the verification of the defined secure inter-operation properties in multi-domain RBAC policies.","PeriodicalId":150535,"journal":{"name":"2013 IEEE Seventh International Conference on Software Security and Reliability Companion","volume":"397 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-06-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114916262","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5