2012 IEEE Sixth International Conference on Software Security and Reliability最新文献_第3页

A New Non-Intrusive Authentication Method Based on the Orientation Sensor for Smartphone Users 一种基于方向传感器的智能手机用户非侵入式身份认证新方法

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.37

Chien-Cheng Lin, Chin-Chun Chang, Deron Liang, Ching-Han Yang

{"title":"A New Non-Intrusive Authentication Method Based on the Orientation Sensor for Smartphone Users","authors":"Chien-Cheng Lin, Chin-Chun Chang, Deron Liang, Ching-Han Yang","doi":"10.1109/SERE.2012.37","DOIUrl":"https://doi.org/10.1109/SERE.2012.37","url":null,"abstract":"With more advanced features loaded, smart phones nowadays are used not only for telecommunication but also for many emerging applications, such as m-banking. In this paper, we propose a novel non-intrusive authentication mechanism using the information collected from the orientation sensor of the smart phone. This new approach is based on the hypothesis that a user has a unique way to hold and operate his/her smart phone while working on some apps, and such behavioral biometrics can be captured from the readings of the orientation sensor. We design an authentication mechanism that adopts 53 new features transformed from those readings. To validate this hypothesis, we have developed an application to collect user's behavioral biometrics of up-down flicks and left-right flicks from the orientation sensor. The experimental results show that the proposed approach has an equal error rate about 6.85%. We find that the feature subset selected to build an authentication model with satisfactory performance is generally small, varying 3 to 8 for different users. We also find that the feature subsets are significantly different among different users. Finally, we show that the proposed non-intrusive mechanism can be used together with existing intrusive mechanisms, such as password and/or fingerprints, to build a more robust authentication framework for smart phone users.","PeriodicalId":191716,"journal":{"name":"2012 IEEE Sixth International Conference on Software Security and Reliability","volume":"94 7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-06-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126059508","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 42

Specification-guided Golden Run for Analysis of Robustness Testing Results 规范指导的稳健性测试结果分析的黄金运行

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.28

G. S. Lemos, E. Martins

引用次数: 8

An Autonomic Framework for Integrating Security and Quality of Service Support in Databases 集成数据库安全性和服务质量支持的自治框架

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.15

Firas B. Alomari, D. Menascé

引用次数: 15

DESERVE: A Framework for Detecting Program Security Vulnerability Exploitations 值得:一个检测程序安全漏洞利用的框架

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.22

Amatul Mohosina, Mohammad Zulkernine

{"title":"DESERVE: A Framework for Detecting Program Security Vulnerability Exploitations","authors":"Amatul Mohosina, Mohammad Zulkernine","doi":"10.1109/SERE.2012.22","DOIUrl":"https://doi.org/10.1109/SERE.2012.22","url":null,"abstract":"It is difficult to develop a program that is completely free from vulnerabilities. Despite the application of many approaches to secure programs, vulnerability exploitations occur in real-world in large numbers. Exploitations of vulnerabilities may corrupt memory spaces and program states, lead to denial of services and authorization bypassing, and leak sensitive information. Monitoring at the program code level can be a way of vulnerability exploitation detection at runtime. In this work, we propose a monitor embedding framework DESERVE (a framework for Detecting program Security Vulnerability Exploitations). DESERVE identifies exploitable statements from source code based on static backward slicing and embeds necessary code to detect attacks. During the deployment stage, the enhanced programs execute exploitable statements in a separate test environment. Unlike traditional monitors that extract and store program state information to compare with vulnerable free program states to detect exploitation, our approach does not need to save state information. Moreover, the slicing technique allows us avoid the tracking of fine grained level of information about runtime program environments such as input flow and memory state. We implement DESERVE for detecting buffer overflow, SQL injection, and cross-site scripting attacks. We evaluate our approach for real-world programs implemented in C and PHP languages. The results show that the approach can detect some of the well-known attacks. Moreover, the approach imposes negligible runtime overhead.","PeriodicalId":191716,"journal":{"name":"2012 IEEE Sixth International Conference on Software Security and Reliability","volume":"124 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-06-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134062205","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

Finding Buffer Overflow Inducing Loops in Binary Executables 在二进制可执行文件中查找缓冲区溢出诱导循环

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.30

Sanjay Rawat, L. Mounier

引用次数: 29

Mitigating Insider Threat without Limiting the Availability in Concurrent Undeclared Tasks 在不限制并发未声明任务可用性的情况下减轻内部威胁

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.36

Qussai M. Yaseen, B. Panda

引用次数: 1

Semi-Automatic Security Testing of Web Applications from a Secure Model 基于安全模型的Web应用程序半自动安全测试

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.38

Matthias Büchler, Johan Oudinet, A. Pretschner

{"title":"Semi-Automatic Security Testing of Web Applications from a Secure Model","authors":"Matthias Büchler, Johan Oudinet, A. Pretschner","doi":"10.1109/SERE.2012.38","DOIUrl":"https://doi.org/10.1109/SERE.2012.38","url":null,"abstract":"Web applications are a major target of attackers. The increasing complexity of such applications and the subtlety of today's attacks make it very hard for developers to manually secure their web applications. Penetration testing is considered an art, the success of a penetration tester in detecting vulnerabilities mainly depends on his skills. Recently, model-checkers dedicated to security analysis have proved their ability to identify complex attacks on web-based security protocols. However, bridging the gap between an abstract attack trace output by a model-checker and a penetration test on the real web application is still an open issue. We present here a methodology for testing web applications starting from a secure model. First, we mutate the model to introduce specific vulnerabilities present in web applications. Then, a model-checker outputs attack traces that exploit those vulnerabilities. Next, the attack traces are translated into concrete test cases by using a 2-step mapping. Finally, the tests are executed on the real system using an automatic procedure that may request the help of a test expert from time to time. A prototype has been implemented and evaluated on Web Goat, an insecure web application maintained by OWASP. It successfully reproduced Role-Based Access Control (RBAC) and Cross-Site Scripting (XSS) attacks.","PeriodicalId":191716,"journal":{"name":"2012 IEEE Sixth International Conference on Software Security and Reliability","volume":"55 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-06-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126355827","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 48

Applying Microreboot to System Software 将微重启应用于系统软件

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.11

Michael V. Le, Y. Tamir

引用次数: 13

Flexible Data-Driven Security for Android Android灵活的数据驱动安全性

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.14

Denis Feth, A. Pretschner

引用次数: 37

On the Effective Use of Security Test Patterns 浅谈安全测试模式的有效利用

2012 IEEE Sixth International Conference on Software Security and Reliability Pub Date : 2012-06-20 DOI: 10.1109/SERE.2012.23

Benjamin H. Smith, L. Williams

{"title":"On the Effective Use of Security Test Patterns","authors":"Benjamin H. Smith, L. Williams","doi":"10.1109/SERE.2012.23","DOIUrl":"https://doi.org/10.1109/SERE.2012.23","url":null,"abstract":"Capturing attacker behavior in a security test plan allows the systematic, repeated assessment of a system's defenses against attacks. To address the lack of security experts capable of developing effective black box security test plans, we have empirically developed an initial set of six black box security test patterns. These patterns capture the expertise involved in creating a black box security test plan in the same way that software design patterns capture design expertise. Security test patterns can enable software testers lacking security expertise (in this paper, \"novices\") to develop a test plan the way experts could. The goal of this paper is to evaluate the ability of novices to effectively generate black box security tests by accessing security expertise contained within security test patterns. We conducted a user study of 47 student novices, who used our six initial patterns to develop black box security test plans for six requirements from a publicly available specification for electronic health records systems. We created an oracle for the security test plan by forming a panel of researchers who manually completed the same task as the novices. We found that novices will generate a similar black box test plan to the oracle when aided by the six black box security test patterns.","PeriodicalId":191716,"journal":{"name":"2012 IEEE Sixth International Conference on Software Security and Reliability","volume":"105 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-06-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124217714","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 18