{"title":"Certified Lightweight Contextual Policies for Android","authors":"M. Seghir, David Aspinall, Lenka Mareková","doi":"10.1109/SecDev.2016.032","DOIUrl":"https://doi.org/10.1109/SecDev.2016.032","url":null,"abstract":"Security in Android applications is enforced with access control policies implemented via permissions giving access to different resources on the phone. These permissions are often too coarse and on most Android platforms, based on an all-or-nothing decision. How can we grant permissions and be sure they will not be misused? We propose a policy-based lightweight approach for the verification and certification of Android applications with respect to a given policy. It consists of a verifier running on a conventional computer and a checker residing on an Android mobile device. The verifier applies static analysis to show the conformance between an application and a given policy. It also generates a certificate asserting the validity of the analysis result. The checker, on a mobile device, can then check the validity of the certificate to confirm or refute the fulfilment of the policy by the application before installing it. This scheme represents a potential future model for app stores where apps are equipped with policies and checkable evidence. We have implemented our approach and report on preliminary results obtained for a set of popular real-world applications.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114487428","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Design Space Exploration for Security","authors":"Eunsuk Kang","doi":"10.1109/SecDev.2016.017","DOIUrl":"https://doi.org/10.1109/SecDev.2016.017","url":null,"abstract":"Design space exploration involves identifying a set of design decisions, and evaluating their potential impact on various qualities of a system, such functionality, performance, reliability, and security. This activity is widespread in other engineering disciplines, but is rarely articulated or performed during software construction, despite its potential influence on the security of the resulting system. In this paper, we argue that design space exploration should be an essential part of any secure development process. We outline the key elements of a framework intended to support this activity, and discuss the potential benefits and challenges associated with building such a framework.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"51 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121592532","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Hints for High-Assurance Cyber-Physical System Design","authors":"Lee Pike","doi":"10.1109/SecDev.2016.016","DOIUrl":"https://doi.org/10.1109/SecDev.2016.016","url":null,"abstract":"With deference to Butler Lampson, I present five hints specifically for building high-assurance cyber-physical systems: (1) use Turing-incomplete languages (2) simple interfaces are secure interfaces, (3) program the glue code and architecture, (4) system verification is a probabilistic game, and (5) high-assurance systems require a high-assurance culture.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126461108","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Self-Verifying Execution (Position Paper)","authors":"Matt McCutchen, Daniel Song, Shuo Chen, S. Qadeer","doi":"10.1109/SecDev.2016.035","DOIUrl":"https://doi.org/10.1109/SecDev.2016.035","url":null,"abstract":"This paper proposes a notion called self-verifying execution (SVX). SVX substantially lowers several hurdles that real-world programmers face when adopting traditional program verification approaches. The current focus of SVX is to verify safety properties for programs that implement cloud-API integrations. We envision that, if adopted by real-world programmers, the SVX approach will enable a positive paradigm shift in the community toward more rigorous reasoning about security goals of cloud-API protocols.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"82 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126168127","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Towards Building Practical Secure Multi-party Databases","authors":"Y. Tang, Wenqing Zhuang","doi":"10.1109/SecDev.2016.029","DOIUrl":"https://doi.org/10.1109/SecDev.2016.029","url":null,"abstract":"This work aims at building secure multi-party database systems, for emerging federation networks in healthcare, finance, and other marketplaces. The technical challenges come from the interface gap between existing distributed query processing (DQP) and multi-party computation software. We propose compositional MPC for modular DQP and MPC-aware query optimizations.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"75 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122562467","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Software Vulnerabilities, Defects, and Design Flaws: A Technical Debt Perspective","authors":"R. Nord, I. Ozkaya","doi":"10.1109/SecDev.2016.047","DOIUrl":"https://doi.org/10.1109/SecDev.2016.047","url":null,"abstract":"In this 90-minute tutorial, we discuss the relationships among three kinds of software anomalies—defects, vulnerabilities, and design flaws—and their impact on software assurance and sustainable development and delivery.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127822473","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Dependency-Based Attacks on Node.js","authors":"Brian Pfretzschner, L. B. Othmane","doi":"10.1109/SecDev.2016.023","DOIUrl":"https://doi.org/10.1109/SecDev.2016.023","url":null,"abstract":"Node.js heavily relies on shared variables. Their manipulation can cause service interruption, confidential data leakage, and service behavior change. Such attacks can be performed out of third-party libraries without detection by the service. Identification of such attacks requires analysis of both, application and libraries code.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"27 2","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133880050","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Operational Security Log Analytics for Enterprise Breach Detection","authors":"Zhou Li, Alina Oprea","doi":"10.1109/SecDev.2016.015","DOIUrl":"https://doi.org/10.1109/SecDev.2016.015","url":null,"abstract":"Enterprises today are facing an increasing number of criminal threats ranging from financially motivated and opportunistic malware to more advanced targeted attacks organized by nation-state actors. To protect against these threats, enterprises deploy a number of perimeter defenses, including traditional controls (antivirus software, intrusion detection systems, firewalls) and more advanced techniques (web proxies or deep packet inspection products). Organizations collect and store the log data generated by these security controls, but this data is most of the time used for forensic investigation once an attack has been discovered by an external mechanism. In this paper, we describe a security log analytics framework for proactive breach detection, which we have tested on three applications. We summarize the algorithms and detection results from our previous work ([13, 20, 21]). Compared to other research in this area, our framework analyzes multiple sources of security logs, performs large-scale analysis, and is continuously refined from feedback given by security experts. Our techniques have been successfully used in operational setting in a large organization and are currently integrated in a real-time behavior analytics product.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134541800","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Enforcing Content Security by Default within Web Browsers","authors":"Christoph Kerschbaumer","doi":"10.1109/SecDev.2016.033","DOIUrl":"https://doi.org/10.1109/SecDev.2016.033","url":null,"abstract":"Web browsers were initially designed to retrieve resources on the world wide web in a static manner such that adding security checks in select locations throughout the codebase sufficiently provided the necessary security guarantees of the web. Even though systematic security checks were always performed, those security checks were sprinkled throughout the codebase. Over time, various specifications for dynamically loading content have proven that such a scattered security model is error-prone. Instead of opting into security checks wherever resource loads are initiated throughout the codebase, we present an approach where security checks are performed by default. By equipping every resource load with a loading context (which includes information about who initiated the load, the load type, etc.), our approach enforces an opt-out security mechanism performing security checks by default by consulting a centralized security manager. In addition, the added load context allows to provide the same security guarantees for resource loads which encounter a server-side redirect.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"397 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124319858","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Kyle Hogan, Noah Luther, N. Schear, Emily Shen, David Stott, Sophia Yakoubov, Arkady Yerukhimovich
{"title":"Secure Multiparty Computation for Cooperative Cyber Risk Assessment","authors":"Kyle Hogan, Noah Luther, N. Schear, Emily Shen, David Stott, Sophia Yakoubov, Arkady Yerukhimovich","doi":"10.1109/SecDev.2016.028","DOIUrl":"https://doi.org/10.1109/SecDev.2016.028","url":null,"abstract":"A common problem organizations face is determining how to prioritize security updates and patches to minimize the risk of vulnerabilities in their infrastructure. Limited resources constrain organizations to select a set of only the most security critical updates that they can afford to perform; thus, it is very important to compute the risk of delaying less critical updates accurately.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":" 23","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"113946297","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
求助内容：
应助结果提醒方式：
京公网安备 11010802042870号
