Symposium and Bootcamp on the Science of Security最新文献

Examining reliability of wireless multihop network routing with linear systems 线性系统无线多跳网络路由可靠性研究

Symposium and Bootcamp on the Science of Security Pub Date : 2014-04-08 DOI: 10.1145/2600176.2600195

Trisha Biswas, Kendra Lesser, R. Dutta, Meeko Oishi

引用次数: 1

Analyzing an adaptive reputation metric for anonymity systems 匿名系统的自适应声誉度量分析

Symposium and Bootcamp on the Science of Security Pub Date : 2014-04-08 DOI: 10.1145/2600176.2600187

Anupam Das, N. Borisov, M. Caesar

{"title":"Analyzing an adaptive reputation metric for anonymity systems","authors":"Anupam Das, N. Borisov, M. Caesar","doi":"10.1145/2600176.2600187","DOIUrl":"https://doi.org/10.1145/2600176.2600187","url":null,"abstract":"Low-latency anonymity systems such as Tor rely on intermediate relays to forward user traffic; these relays, however, are often unreliable, resulting in a degraded user experience. Worse yet, malicious relays may introduce deliberate failures in a strategic manner in order to increase their chance of compromising anonymity. In this paper we propose using a reputation metric that can profile the reliability of relays in an anonymity system based on users' past experience. The two main challenges in building a reputation-based system for an anonymity system are: first, malicious participants can strategically oscillate between good and malicious nature to evade detection, and second, an observed failure in an anonymous communication cannot be uniquely attributed to a single relay. Our proposed framework addresses the former challenge by using a proportional-integral-derivative (PID) controller-based reputation metric that ensures malicious relays adopting time-varying strategic behavior obtain low reputation scores over time, and the latter by introducing a filtering scheme based on the evaluated reputation score to effectively discard relays mounting attacks. We collect data from the live Tor network and perform simulations to validate the proposed reputation-based filtering scheme. We show that an attacker does not gain any significant benefit by performing deliberate failures in the presence of the proposed reputation framework.","PeriodicalId":193860,"journal":{"name":"Symposium and Bootcamp on the Science of Security","volume":"62 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-04-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116175012","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Is there value in reasoning about security at the architectural level: a comparative evaluation 在架构级别对安全性进行推理是否有价值:一种比较评估

Symposium and Bootcamp on the Science of Security Pub Date : 2014-04-08 DOI: 10.1145/2600176.2600206

E. Khalaj, R. Vanciu, Marwan Abi-Antoun

引用次数: 2

Phishing in international waters: exploring cross-national differences in phishing conceptualizations between Chinese, Indian and American samples 国际水域的网络钓鱼:探索中国、印度和美国样本之间网络钓鱼概念的跨国差异

Symposium and Bootcamp on the Science of Security Pub Date : 2014-04-08 DOI: 10.1145/2600176.2600178

Rucha Tembe, O. Zielinska, Yuqi Liu, Kyung Wha Hong, E. Murphy-Hill, C. Mayhorn, Xi Ge

{"title":"Phishing in international waters: exploring cross-national differences in phishing conceptualizations between Chinese, Indian and American samples","authors":"Rucha Tembe, O. Zielinska, Yuqi Liu, Kyung Wha Hong, E. Murphy-Hill, C. Mayhorn, Xi Ge","doi":"10.1145/2600176.2600178","DOIUrl":"https://doi.org/10.1145/2600176.2600178","url":null,"abstract":"One hundred-sixty four participants from the United States, India and China completed a survey designed to assess past phishing experiences and whether they engaged in certain online safety practices (e.g., reading a privacy policy). The study investigated participants' reported agreement regarding the characteristics of phishing attacks, types of media where phishing occurs and the consequences of phishing. A multivariate analysis of covariance indicated that there were significant differences in agreement regarding phishing characteristics, phishing consequences and types of media where phishing occurs for these three nationalities. Chronological age and education did not influence the agreement ratings; therefore, the samples were demographically equivalent with regards to these variables. A logistic regression analysis was conducted to analyze the categorical variables and nationality data. Results based on self-report data indicated that (1) Indians were more likely to be phished than Americans, (2) Americans took protective actions more frequently than Indians by destroying old documents, and (3) Americans were more likely to notice the \"padlock\" security icon than either Indian or Chinese respondents. The potential implications of these results are discussed in terms of designing culturally sensitive anti-phishing solutions.","PeriodicalId":193860,"journal":{"name":"Symposium and Bootcamp on the Science of Security","volume":"59 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-04-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132728637","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 15

Securing Hadoop in cloud 在云端保护Hadoop

Symposium and Bootcamp on the Science of Security Pub Date : 2014-04-08 DOI: 10.1145/2600176.2600202

Xianqing Yu, P. Ning, M. Vouk

引用次数: 2

Human factors in webserver log file analysis: a controlled experiment on investigating malicious activity web服务器日志文件分析中的人为因素:调查恶意活动的对照实验

Symposium and Bootcamp on the Science of Security Pub Date : 2014-04-08 DOI: 10.1145/2600176.2600185

L. Layman, Sylvain David Diffo, N. Zazworka

{"title":"Human factors in webserver log file analysis: a controlled experiment on investigating malicious activity","authors":"L. Layman, Sylvain David Diffo, N. Zazworka","doi":"10.1145/2600176.2600185","DOIUrl":"https://doi.org/10.1145/2600176.2600185","url":null,"abstract":"While automated methods are the first line of defense for detecting attacks on webservers, a human agent is required to understand the attacker's intent and the attack process. The goal of this research is to understand the value of various log fields and the cognitive processes by which log information is grouped, searched, and correlated. Such knowledge will enable the development of human-focused log file investigation technologies. We performed controlled experiments with 65 subjects (IT professionals and novices) who investigated excerpts from six webserver log files. Quantitative and qualitative data were gathered to: 1) analyze subject accuracy in identifying malicious activity; 2) identify the most useful pieces of log file information; and 3) understand the techniques and strategies used by subjects to process the information. Statistically significant effects were observed in the accuracy of identifying attacks and time taken depending on the type of attack. Systematic differences were also observed in the log fields used by high-performing and low-performing groups. The findings include: 1) new insights into how specific log data fields are used to effectively assess potentially malicious activity; 2) obfuscating factors in log data from a human cognitive perspective; and 3) practical implications for tools to support log file investigations.","PeriodicalId":193860,"journal":{"name":"Symposium and Bootcamp on the Science of Security","volume":" 51","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-04-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"120827304","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5

Improving mobile application security via bridging user expectations and application behaviors 通过连接用户期望和应用程序行为来提高移动应用程序的安全性

Symposium and Bootcamp on the Science of Security Pub Date : 2014-04-08 DOI: 10.1145/2600176.2600208

Wei Yang, Xusheng Xiao, Rahul Pandita, W. Enck, Tao Xie

引用次数: 8

A rewriting-based forwards semantics for Maude-NPA Maude-NPA的基于重写的转发语义

Symposium and Bootcamp on the Science of Security Pub Date : 2014-04-08 DOI: 10.1145/2600176.2600186

Santiago Escobar, C. Meadows, J. Meseguer, Sonia Santiago

{"title":"A rewriting-based forwards semantics for Maude-NPA","authors":"Santiago Escobar, C. Meadows, J. Meseguer, Sonia Santiago","doi":"10.1145/2600176.2600186","DOIUrl":"https://doi.org/10.1145/2600176.2600186","url":null,"abstract":"The Maude-NRL Protocol Analyzer (Maude-NPA) is a tool for reasoning about the security of cryptographic protocols in which the cryptosystems satisfy different equational properties. It tries to find secrecy or authentication attacks by searching backwards from an insecure attack state pattern that may contain logical variables, in such a way that logical variables become properly instantiated in order to find an initial state. The execution mechanism for this logical reachability is narrowing modulo an equational theory. Although Maude-NPA also possesses a forwards semantics naturally derivable from the backwards semantics, it is not suitable for state space exploration or protocol simulation.\u0000 In this paper we define an executable forwards semantics for Maude-NPA, instead of its usual backwards one, and restrict it to the case of concrete states, that is, to terms without logical variables. This case corresponds to standard rewriting modulo an equational theory. We prove soundness and completeness of the backwards narrowing-based semantics with respect to the rewriting-based forwards semantics. We show its effectiveness as an analysis method that complements the backwards analysis with new prototyping, simulation, and explicit-state model checking features by providing some experimental results.","PeriodicalId":193860,"journal":{"name":"Symposium and Bootcamp on the Science of Security","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-04-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134059820","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

An analysis of Fedora security profile 对Fedora安全配置文件的分析

Symposium and Bootcamp on the Science of Security Pub Date : 2014-04-08 DOI: 10.1145/2600176.2600211

Shweta Subramani, M. Vouk, L. Williams

引用次数: 0

Diversity-based detection of security anomalies 基于多样性的安全异常检测

Symposium and Bootcamp on the Science of Security Pub Date : 2014-04-08 DOI: 10.1145/2600176.2600205

R. Venkatakrishnan, M. Vouk

引用次数: 3