2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)最新文献_第3页

Emulating Side Channel Attacks on gem5: lessons learned 模拟gem5的侧通道攻击:经验教训

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00036

L. Bossuet, Vincent Grosso, Carlos Andres Lara-Nino

{"title":"Emulating Side Channel Attacks on gem5: lessons learned","authors":"L. Bossuet, Vincent Grosso, Carlos Andres Lara-Nino","doi":"10.1109/EuroSPW59978.2023.00036","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00036","url":null,"abstract":"Side channel attacks (SCA) have the potential of disrupting the trust of the users on computing platforms and cryptographic algorithms. The main challenge in the design of countermeasures against such threats is that an evaluation of their effectiveness can only be performed after they have been implemented. By that point, significant resources would have been invested in the creation of a prototype. Moreover, the large volume of combinations from all the potential target algorithms and computing systems complicates a systematical analysis. It is necessary to find strategies to simplify and systematize the study of SCAs and their countermeasures. gem5 is a cycle-accurate simulator which offers the possibility to emulate a broad range of computing architectures. Beyond the functional verification, this tool computes multiple physical statistics from the simulated system. In this paper, we discuss the lessons learned from using gem5 to simulate SCAs on an ARM system. Our work shows that while there is a correlation between the data and the reported statistics, there are significant challenges that must be addressed to improve the use of gem5 for the emulation of physical phenomena.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"19 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127432207","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

A Digital Forensic Taxonomy For Programmable Logic Controller Data Artefacts 可编程逻辑控制器数据工件的数字取证分类法

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00040

Feras Shahbi, Joseph Gardiner, Sridhar Adepu, A. Rashid

{"title":"A Digital Forensic Taxonomy For Programmable Logic Controller Data Artefacts","authors":"Feras Shahbi, Joseph Gardiner, Sridhar Adepu, A. Rashid","doi":"10.1109/EuroSPW59978.2023.00040","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00040","url":null,"abstract":"The growing complexity of industrial control systems (ICS) and increasing cyber attacks targeting critical infrastructures demand bespoke forensics techniques for Programmable Logic Controllers (PLCs). As they control their critical physical processes, PLCs form the backbone of many ICS. However, due to their unique characteristics and constraints, which include heterogeneous architectures, proprietary technologies and stringent real-time operational requirements, traditional digital forensic techniques may not be directly applicable.PLCs are intricate embedded devices with numerous distinct internal data artefacts, ranging from proprietary firmware to logic codes, safety logs, and process I/O values. Therefore, those tasked with PLC investigation must understand these intricacies and their underlying implications to effectively answer the forensic questions in the aftermath of an incident.To address this need, our paper presents the first tailored taxonomy for digital forensics on PLCs, systematically categorizing the various characteristics, forensic processes and considerations based on the stages involved in a forensic investigation. Furthermore, we employ our developed taxonomy to establish mappings between identified PLC data artefacts and their corresponding attributes, offering a contextualised interrelationships between these artefacts and the PLC forensic investigation steps.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127003887","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

TLS → Post-Quantum TLS: Inspecting the TLS landscape for PQC adoption on Android TLS→后量子TLS:检查Android上PQC采用的TLS景观

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00065

Dimitri Mankowski, Thom Wiggers, Veelasha Moonsamy

{"title":"TLS → Post-Quantum TLS: Inspecting the TLS landscape for PQC adoption on Android","authors":"Dimitri Mankowski, Thom Wiggers, Veelasha Moonsamy","doi":"10.1109/EuroSPW59978.2023.00065","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00065","url":null,"abstract":"The ubiquitous use of smartphones has contributed to more and more users conducting their online browsing activities through apps, rather than web browsers. In order to provide a seamless browsing experience to the users, apps rely on a variety of HTTP-based APIs and third-party libraries, and make use of the TLS protocol to secure the underlying communication. With NIST’s recent announcement of the first standards for post-quantum algorithms, there is a need to better understand the constraints and requirements of TLS usage by Android apps in order to make an informed decision for migration to the post-quantum world. In this paper, we performed an analysis of TLS usage by highest-ranked apps from Google Play Store to assess the resulting overhead for adoption of post-quantum algorithms. Our results show that apps set up large numbers of TLS connections with a median of 94, often to the same hosts. At the same time, many apps make little use of resumption to reduce the overhead of the TLS handshake. This will greatly magnify the impact of the transition to post-quantum cryptography, and we make recommendations for developers, server operators and the mobile operating systems to invest in making more use of these mitigating features or improving their accessibility. Finally, we briefly discuss how alternative proposals for post-quantum TLS handshakes might reduce the overhead.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"174 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124265595","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

An Investigation of Quality Issues in Vulnerability Detection Datasets 漏洞检测数据集质量问题研究

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00008

Yuejun Guo, Seifeddine Bettaieb

{"title":"An Investigation of Quality Issues in Vulnerability Detection Datasets","authors":"Yuejun Guo, Seifeddine Bettaieb","doi":"10.1109/EuroSPW59978.2023.00008","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00008","url":null,"abstract":"Vulnerability detection is a crucial yet challenging task in ensuring software security, and deep learning (DL) has made significant progress in automating this process. However, a DL model requires a massive amount of labeled data (vulnerable and secure source code) to effectively distinguish between the two. Many datasets have been created for this purpose but they suffer from several issues that can lead to low detection accuracy of DL models. In this paper, we define three critical issues (data imbalance, low vulnerability coverage, and biased vulnerability distribution) and three secondary issues (errors in source code, mislabeling, and noisy historical data) that can affect the model performance. We also conduct a study of 14 papers along with 54 datasets for vulnerability detection to confirm these defined issues. Furthermore, we discuss good practices for using existing datasets and creating new ones to improve the quality of data available for automated vulnerability detection. This paper aims to raise awareness of the importance of data quality in vulnerability detection and provide proper guidelines for researchers and practitioners working in this area.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"5 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133449560","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Towards more rigorous domain-based metrics: quantifying the prevalence and implications of “Active” Domains 朝着更严格的基于域的度量:量化“活动”域的流行程度和含义

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00066

Siôn Lloyd, C. Gañán, Samaneh Tajalizadehkhoob

{"title":"Towards more rigorous domain-based metrics: quantifying the prevalence and implications of “Active” Domains","authors":"Siôn Lloyd, C. Gañán, Samaneh Tajalizadehkhoob","doi":"10.1109/EuroSPW59978.2023.00066","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00066","url":null,"abstract":"The Domain Name System (DNS) is a critical component of the internet infrastructure. As such it is often the subject of various measurements with a view to quantifying different aspects of its use. Some of these measurements cover legitimate uses; however, identifying any threats associated with domain names has also become a vital task in enhancing DNS security. Current abuse metrics used for identifying malicious domains typically rely on the count of domains listed on Reputation Blocklists and are normalized by the size of the zone for registries or domains under management for registrars. However, these metrics are imprecise and do not account for whether the domain name is resolvable or serves active content. In this paper, we propose a novel approach to identify active domains, which account for domains that serve actual content under the control of the registrant. We demonstrate the proportions of inactive, active, and non-resolving domains across different samples of the name space. Our findings suggest that current normalized metrics are not necessarily giving a true picture of the underlying situation. By introducing a more precise classification system for domains, we show how this can lead to more reliable and robust metrics that can, for example, enhance DNS security by enabling a more thorough analysis of active domains. We also discuss the implications of these findings for registries and registrars, highlighting how they can use this information to combat domain abuse more effectively.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"87 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133071503","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A Wolf in Sheep’s Clothing: Query-Free Evasion Attacks Against Machine Learning-Based Malware Detectors with Generative Adversarial Networks 披着羊皮的狼:基于生成对抗网络的基于机器学习的恶意软件检测器的无查询逃避攻击

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00052

Daniel Gibert, Jordi Planes, Quan Le, Giulio Zizzo

{"title":"A Wolf in Sheep’s Clothing: Query-Free Evasion Attacks Against Machine Learning-Based Malware Detectors with Generative Adversarial Networks","authors":"Daniel Gibert, Jordi Planes, Quan Le, Giulio Zizzo","doi":"10.1109/EuroSPW59978.2023.00052","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00052","url":null,"abstract":"Malware detectors based on machine learning (ML) have been shown to be susceptible to adversarial malware examples. However, current methods to generate adversarial malware examples still have their limits. They either rely on detailed model information (gradient-based attacks), or on detailed outputs of the model - such as class probabilities (score-based attacks), neither of which are available in real-world scenarios. Alternatively, adversarial examples might be crafted using only the label assigned by the detector (label-based attack) to train a substitute network or an agent using reinforcement learning. Nonetheless, label-based attacks might require querying a black-box system from a small number to thousands of times, depending on the approach, which might not be feasible against malware detectors.This work presents a novel query-free approach to craft adversarial malware examples to evade ML-based malware detectors. To this end, we have devised a GAN-based framework to generate adversarial malware examples that look similar to benign executables in the feature space. To demonstrate the suitability of our approach we have applied the GAN-based attack to three common types of features usually employed by static ML-based malware detectors: (1) Byte histogram features, (2) API-based features, and (3) String-based features. Results show that our model-agnostic approach performs on par with MalGAN, while generating more realistic adversarial malware examples without requiring any query to the malware detectors. Furthermore, we have tested the generated adversarial examples against state-of-the-art multimodal and deep learning malware detectors, showing a decrease in detection performance, as well as a decrease in the average number of detections by the antimalware engines in VirusTotal.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"12 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128573457","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

A Practical Deep Learning-Based Acoustic Side Channel Attack on Keyboards 一种实用的基于深度学习的键盘声学侧信道攻击

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00034

Joshua J. Harrison, Ehsan Toreini, M. Mehrnezhad

引用次数: 1

Identifying and Differentiating Acknowledged Scanners in Network Traffic 识别和区分网络流量中的公认扫描器

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00069

Michael Patrick Collins, Alefiya Hussain, S. Schwab

{"title":"Identifying and Differentiating Acknowledged Scanners in Network Traffic","authors":"Michael Patrick Collins, Alefiya Hussain, S. Schwab","doi":"10.1109/EuroSPW59978.2023.00069","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00069","url":null,"abstract":"Acknowledged scanners are Internet scanners which engage with the community as a whole through, at the minimum through a public website. These scanners may provide a service, whether as an education institution, corporation, nonprofit or other organization and may engage in good citizen behaviors such as opt–out lists and by publishing their sources. In this paper, we describe the behavior and population of acknowledged scanners and demonstrate the difference between acknowledged scanners and other (unacknowledged) scanners. We quantitatively show acknowledged scanners, scan from a limited set of addresses, scan predictably, and most importantly the ports (and assumed vulnerabilities) that they scan for differ significantly from the targets of unacknowledged scanners. Failing to differentiate acknowledged and unacknowledged scanners impacts both research and operations, calling into question research results categorizing scanners and overloading operators in false positives. We show the differences between these two scanner classes based on a 30 day sample of darkspace data collected from the USC-ISI network that can be widely shared. We have also maintained an open access acknowledged scanner repository, a whitelist of 40+ acknowledged scanner entities and their IP addresses for the last three years. These acknowledged scanners are researchers, internet public health organizations, and threat intelligence companies. More than 12 unique security organizations track the whitelist to include into their threat assessments.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122017306","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

An Argument for Linguistic Expertise in Cyberthreat Analysis: LOLSec in Russian Language eCrime Landscape 网络威胁分析中语言学专业知识的论证:俄语犯罪景观中的LOLSec

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00024

Dalyapraz Manatova, Jean S Camp, Julia R. Fox, Sandra Kübler, Maria Shardakova, Inna Kouper

引用次数: 0

Unsafe Behavior Detection with Adaptive Contrastive Learning in Industrial Control Systems 基于自适应对比学习的工业控制系统不安全行为检测

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00046

Xu Zheng, Tianchun Wang, S. Y. Chowdhury, Ruimin Sun, Dongsheng Luo

引用次数: 0