Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security最新文献_第3页

Multi-Tag: A Hardware-Software Co-Design for Memory Safety based on Multi-Granular Memory Tagging 多标签:一种基于多粒度内存标签的内存安全硬件软件协同设计

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3590331

Martin Unterguggenberger, David Schrammel, Pascal Nasahl, R. Schilling, Lukas Lamster, S. Mangard

{"title":"Multi-Tag: A Hardware-Software Co-Design for Memory Safety based on Multi-Granular Memory Tagging","authors":"Martin Unterguggenberger, David Schrammel, Pascal Nasahl, R. Schilling, Lukas Lamster, S. Mangard","doi":"10.1145/3579856.3590331","DOIUrl":"https://doi.org/10.1145/3579856.3590331","url":null,"abstract":"Memory safety vulnerabilities are a severe threat to modern computer systems allowing adversaries to leak or modify security-critical data. To protect systems from this attack vector, full memory safety is required. As software-based countermeasures tend to induce significant runtime overheads, which is not acceptable for production code, hardware assistance is needed. Tagged memory architectures, e.g., already offered by the ARM MTE and SPARC ADI extensions, assign meta-information to memory objects, thus allowing to implement memory safety policies. However, due to the high tag collision probability caused by the small tag sizes, the protection guarantees of these schemes are limited. This paper presents Multi-Tag, the first hardware-software co-design utilizing a multi-granular tagging structure that provides strong protection against spatial and temporal memory safety violations. By combining object-granular memory tags with page-granular tags stored in the page table entries, Multi-Tag overcomes the limitation of small tag sizes. Introducing page-granular tags significantly enhances the probabilistic protection capabilities of memory tagging without increasing the memory overhead or the system’s complexity. We develop a prototype implementation comprising a gem5 model of the tagged architecture, a Linux kernel extension, and an LLVM-based compiler toolchain. The simulated performance overhead for the SPEC CPU2017 and nbench-byte benchmarks highlights the practicability of our design.","PeriodicalId":156082,"journal":{"name":"Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security","volume":"367 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127584455","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Invasion of location privacy using online map services and smartphone sensors 使用在线地图服务和智能手机传感器侵犯位置隐私

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3582828

Hyunsoo Kim, Y. Jeon, Ji-Won Yoon

{"title":"Invasion of location privacy using online map services and smartphone sensors","authors":"Hyunsoo Kim, Y. Jeon, Ji-Won Yoon","doi":"10.1145/3579856.3582828","DOIUrl":"https://doi.org/10.1145/3579856.3582828","url":null,"abstract":"Smartphone sensors potentially threaten the privacy of individuals, placing society at risk. Previous studies have demonstrated that smartphone sensors are susceptible to privacy intrusion. Inspired by this finding, we designed a mechanism of invasion that targets the location privacy of subway passengers. Specifically, we recovered the travel trajectories of subway passengers using sensor data and matched them with railway data collected from OpenStreetMap. This study primarily exploits an accelerometer and gyroscope, which are suitable for subway tracking because they operate appropriately in underground and indoor conditions. Although these sensors are easily influenced by passenger activity, we devised a method for recovering clean trajectories of subway passengers by utilizing gravitational acceleration and event detection methods. Subsequently, we conducted several experiments to prove the threat and feasibility of our proposals, even in the presence of human-generated noise (e.g., texting, watching videos, playing games, device rotation, and changing positions) influencing the sensor data. Specifically, we applied dynamic time warping (DTW) to obtain the costs between the reference data and reconstructed trace. Finally, a cost combination mechanism aggregated the DTW costs and predicted the best matches.","PeriodicalId":156082,"journal":{"name":"Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security","volume":"60 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133589797","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

POSTER: A Teacher-Student with Human Feedback Model for Human-AI Collaboration in Cybersecurity 海报:网络安全人机协作的师生反馈模型

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3592829

Abdullahi Chowdhury, Hung Nguyen, D. Ashenden, Ganna Pogrebna

引用次数: 0

Payment with Dispute Resolution: A Protocol for Reimbursing Frauds Victims 争议解决支付:赔偿欺诈受害者的协议

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3595789

A. Abadi, S. Murdoch

引用次数: 4

PSI with computation or Circuit-PSI for Unbalanced Sets from Homomorphic Encryption 同态加密中不平衡集的带计算PSI或电路PSI

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3582817

Yongha Son, Jinhyuck Jeong

{"title":"PSI with computation or Circuit-PSI for Unbalanced Sets from Homomorphic Encryption","authors":"Yongha Son, Jinhyuck Jeong","doi":"10.1145/3579856.3582817","DOIUrl":"https://doi.org/10.1145/3579856.3582817","url":null,"abstract":"Circuit-based Private Set Intersection (circuit-PSI) refers to cryptographic protocols that let two parties with input set X and Y compute a function f over the intersection set X ∩ Y, without revealing any other information. The research efforts for circuit-PSI mainly focus on the case where input set sizes |X| and |Y| are similar so far, and they scale poorly for extremely unbalanced set sizes |X| ≫ |Y|. Recently, Lepoint et al. (ASIACRYPT’21) proposed the first dedicated solutions for this problem, which has online cost only linear in the small set size |Y|. However, it requires an expensive setup phase that requires huge storage of about O(|X|) on the small set holder side, which can be problematic in applications where the small set holder is assumed to have restricted equipment. In this work, we suggest new efficient proposals for circuit-PSI tailored for unbalanced inputs, which feature zero small set holder side storage, and comparable online phase performance to the previous work. At the technical core, we use homomorphic encryption (HE) based plain PSI protocols of Cong et al. (CCS’21), with several technically non-trivial arguments on algorithm and security. We demonstrate the superiority of our proposals in several input set sizes by an implementation. As a representative example, for input sets of size 224 and 212, our proposals require zero storage on the small set holder whereas Lepoint et al. requires over 7GB. The online phase remains similar; over LAN network setting, ours takes 7.5 (or 20.9s) seconds with 45MB (or 11.7MB) communication, while Lepoint et al. requires 4.2 seconds with 117MB communication.","PeriodicalId":156082,"journal":{"name":"Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security","volume":"35 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121970950","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

POSTER: A Semi-asynchronous Federated Intrusion Detection Framework for Power Systems 面向电力系统的半异步联邦入侵检测框架

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3592824

Muhammad Akbar Husnoo, A. Anwar, H. Reda, N. Hosseinzadeh

引用次数: 1

Binary Function Clone Search in the Presence of Code Obfuscation and Optimization over Multi-CPU Architectures 存在代码混淆的二进制函数克隆搜索和多cpu架构下的优化

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3582818

Abdullah A. Qasem, M. Debbabi, Bernard Lebel, Marthe Kassouf

{"title":"Binary Function Clone Search in the Presence of Code Obfuscation and Optimization over Multi-CPU Architectures","authors":"Abdullah A. Qasem, M. Debbabi, Bernard Lebel, Marthe Kassouf","doi":"10.1145/3579856.3582818","DOIUrl":"https://doi.org/10.1145/3579856.3582818","url":null,"abstract":"Binary function clone search is an essential capability that enables multiple applications and use cases, including reverse engineering, patch security inspection, threat analysis, vulnerable function detection, etc. As such, a surge of interest has been expressed in designing and implementing techniques to address function similarity on binary executables and firmware images. Although existing approaches have merit in fingerprinting function clones, they present limitations when the target binary code has been subjected to significant code transformation resulting from obfuscation, compiler optimization, and/or cross-compilation to multiple-CPU architectures. In this regard, we design and implement a system named BinFinder, which employs a neural network to learn binary function embeddings based on a set of extracted features that are resilient to both code obfuscation and compiler optimization techniques. Our experimental evaluation indicates that BinFinder outperforms state-of-the-art approaches for multi-CPU architectures by a large margin, with 46% higher Recall against Gemini, 55% higher Recall against SAFE, and 28% higher Recall against GMN. With respect to obfuscation and compiler optimization clone search approaches, BinFinder outperforms the asm2vec (single CPU architecture approach) with higher Recall and BinMatch (multi-CPU architecture approach) with higher Recall. Finally, our work is the first to provide noteworthy results with respect to binary clone search over the tigress obfuscator, which is a well-established open-source obfuscator.","PeriodicalId":156082,"journal":{"name":"Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security","volume":"83 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132771678","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Investigating Users’ Understanding of Privacy Policies of Virtual Personal Assistant Applications 调查用户对虚拟个人助理应用程序隐私政策的理解情况

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3590335

Baiqi Chen, Tingmin Wu, Yanjun Zhang, Mohan Baruwal Chhetri, Guangdong Bai

{"title":"Investigating Users’ Understanding of Privacy Policies of Virtual Personal Assistant Applications","authors":"Baiqi Chen, Tingmin Wu, Yanjun Zhang, Mohan Baruwal Chhetri, Guangdong Bai","doi":"10.1145/3579856.3590335","DOIUrl":"https://doi.org/10.1145/3579856.3590335","url":null,"abstract":"The increasingly popular virtual personal assistant (VPA) services, e.g., Amazon Alexa and Google Assistant, enable third-party developers to create and release VPA apps for end users to access through smart speakers. Given that VPA apps handle sensitive personal data, VPA service providers require developers to release a privacy policy document to declare their data handling practice. The privacy policies are regarded as legal or semi-legal documents, which are usually lengthy and complex for users to understand. In this work, we conducted a subjective study to investigate the level of users’ understanding of the privacy policies, targeting the VPA apps (i.e., skills) of Amazon Alexa, the most popular VPA service. Our study focused on technical terms, one of the greatest hurdles to users’ understanding. We found that 84.2% of our participants faced difficulty in understanding technical terms appeared in the skills’ privacy policies, even for participants with IT background. Additionally, 64.3% of them reported that explanations for the technical terms are generally lacking. To address this issue, we proposed two principles, i.e., domain-specificity principle and implication-oriented principle, to guide skill developers in creating easy-to-understand privacy policies. We evaluated their effectiveness by creating explanation sentences for 23 representative terms and examining users’ understanding through a second user study. Our results show that using explanation sentences based on these principles can significantly improve users’ understanding.","PeriodicalId":156082,"journal":{"name":"Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security","volume":"35 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133496115","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

POSTER: A Common Framework for Resilient and Safe Cyber-Physical System Design 海报:弹性和安全的网络物理系统设计的通用框架

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3592826

Luyao Niu, A. Maruf, Andrew Clark, J. S. Mertoguno, R. Poovendran

{"title":"POSTER: A Common Framework for Resilient and Safe Cyber-Physical System Design","authors":"Luyao Niu, A. Maruf, Andrew Clark, J. S. Mertoguno, R. Poovendran","doi":"10.1145/3579856.3592826","DOIUrl":"https://doi.org/10.1145/3579856.3592826","url":null,"abstract":"Cyber-physical systems (CPS), which are often required to satisfy critical properties such as safety, have been shown to be vulnerable to exploits originating from cyber and/or physical sides. Recently, novel resilient architectures, which equip CPS with capabilities of recovering to normal operations, have been developed to guarantee the safety of CPS under cyber attacks. These resilient architectures utilize distinct mechanisms involving different parameters and are seemingly unrelated. Currently, the analysis and design methods of one novel resilient architecture for CPS are not readily applicable to one another. Consequently, evaluating the appropriateness and effectiveness of a set of candidate resilient architectures to a given CPS is currently impractical. In this poster, we report our progress on the development of a common framework for analyzing the safety and assessing recovery performance of two or more resilient architectures intended for CPS under attacks. We formulate a hybrid model as a common representation of resilient architectures. Our insight is that the resilient architectures have a shared set of discrete states, including vulnerable, under attack, unsafe, and recovery modes, which can be mapped to the discrete states of the unifying hybrid model. The hybrid model enables a unified safety analysis. We parameterize the required behaviors for the cyber and physical components in order to guarantee safety. The parameters then inform the development of metrics to measure the resilience of CPS. For CPS consisting of multiple heterogeneous components, we show that the effect of interconnections on the spatial and temporal parameters can be quantified efficiently, allowing a compositional approach to the safety verification of large-scale CPS.","PeriodicalId":156082,"journal":{"name":"Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security","volume":"3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133244436","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Do Users Really Know Alexa? Understanding Alexa Skill Security Indicators 用户真的了解Alexa吗?了解Alexa技能安全指标

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3595795

Yangyong Zhang, R. Vardhan, Phakpoom Chinprutthiwong, G. Gu

引用次数: 0