2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)最新文献_第7页

A Key to Embedded System Security: Locking and Unlocking Secrets with a Trusted Platform Module 嵌入式系统安全的关键:使用可信平台模块锁定和解锁秘密

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00041

Teri Lenard, A. Collen, N. A. Nijdam, B. Genge

{"title":"A Key to Embedded System Security: Locking and Unlocking Secrets with a Trusted Platform Module","authors":"Teri Lenard, A. Collen, N. A. Nijdam, B. Genge","doi":"10.1109/EuroSPW59978.2023.00041","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00041","url":null,"abstract":"Security hardware modules were designed to provide a viable solution that can empower Embedded Systems (ES) with state-of-the-art cryptographic and security capabilities. They can execute cryptographic operations, securely store sensitive information, or provide measurements for attestation. A key element in designing and implementing security solutions on top of a security hardware, such as the Trusted Platform Module (TPM), is secure secret storage. The work at hand addresses the problem of secret protection by showcasing how the TPM standard can serve as a vault in protecting sensitive information in ES. This is accomplished as follows. Secrets are locked in the TPM according to Platform Configuration Register (PCR) policies created on top of the system state and sealing. In contrast, unlocking is achieved through TPM unsealing. In both cases, secure and authenticated sessions are enforced while communicating with the TPM. Furthermore, our work goes a step further and presents a simple TPM attestation protocol, destined to verify the system state and TPM application. Lastly, a series of experiments were conducted on a reference hardware, with two different TPM configurations, to measure execution times of TPM operations.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"44 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130200771","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

On Gaps in Enterprise Cyber Attack Reporting 论企业网络攻击报告的漏洞

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00030

Abulfaz Hajizada, T. Moore

引用次数: 1

“Get a higher return on your savings!”: Comparing adverts for cryptocurrency investment scams across platforms “让你的储蓄获得更高的回报!”:比较不同平台的加密货币投资诈骗广告

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00023

Gilberto Atondo Siu, Alice Hutchings

{"title":"“Get a higher return on your savings!”: Comparing adverts for cryptocurrency investment scams across platforms","authors":"Gilberto Atondo Siu, Alice Hutchings","doi":"10.1109/EuroSPW59978.2023.00023","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00023","url":null,"abstract":"This work compares machine learning methods using supervised, semi-supervised and unsupervised learning, to classify advertisements for cryptocurrency related investment scams found in the online forum Bitcointalk, and the social media platform Reddit. We extract more than 24.2 million posts from Bitcointalk and use Reddit’s API to collect 2,108 submissions. We train and compare several multiclass text classification approaches and use the models with highest accuracy and F-measure to identify cryptocurrency investment scam advertisements found on both platforms. We discover around five percent of all posts collected on both sites are potential scams. We then use another text classifier to identify the scam actors involved in these investment scam advertisements. We also discover the lures used within these fraudulent adverts and find the main differences in luring techniques used between Bitcointalk and Reddit. We identify that the most prevalent lure type uses the financial principle, followed by the distraction principle in Bitcointalk, and by the authority principle in Reddit. Finally, we use subreddits as communities’ proxies and compare scam advertisements within them to identify whether pensioners are being specifically targeted by cryptocurrency scam adverts. Our results show that retirement subreddits do not contain a higher number of cryptocurrency investment scam adverts compared to other investment focused subreddits.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123726154","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A Threat Model for Soft Privacy on Smart Cars 智能汽车软隐私威胁模型

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-06-07 DOI: 10.1109/EuroSPW59978.2023.00005

Mario Raciti, G. Bella

{"title":"A Threat Model for Soft Privacy on Smart Cars","authors":"Mario Raciti, G. Bella","doi":"10.1109/EuroSPW59978.2023.00005","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00005","url":null,"abstract":"Modern cars are getting so computerised that ENISA’s phrase “smart cars” is a perfect fit. The amount of personal data that they process is very large and, yet, increasing. Hence, the need to address citizens’ privacy while they drive and, correspondingly, the importance of privacy threat modelling (in support of a respective risk assessment, such as through a Data Protection Impact Assessment). This paper addresses privacy threats by advancing a general modelling methodology and by demonstrating it specifically on soft privacy, which ensures citizens’ full control on their personal data. By considering all relevant threat agents, the paper applies the methodology to the specific automotive domain while keeping threats at the same level of detail as ENISA’s. The main result beside the modelling methodology consists of both domain-independent and automotive domain-dependent soft privacy threats. While cybersecurity has been vastly threat-modelled so far, this paper extends the literature with a threat model for soft privacy on smart cars, producing 17 domain-independent threats that, associated with 41 domain-specific assets, shape a novel set of domain-dependent threats in automotive.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-06-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130655868","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Learning to Defend by Attacking (and Vice-Versa): Transfer of Learning in Cybersecurity Games 通过攻击学习防御(反之亦然):网络安全游戏中的学习转移

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-06-03 DOI: 10.1109/EuroSPW59978.2023.00056

Ty Malloy, Cleotilde González

{"title":"Learning to Defend by Attacking (and Vice-Versa): Transfer of Learning in Cybersecurity Games","authors":"Ty Malloy, Cleotilde González","doi":"10.1109/EuroSPW59978.2023.00056","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00056","url":null,"abstract":"Designing cyber defense systems to account for cognitive biases in human decision making has demonstrated significant success in improving performance against human attackers. However, much of the attention in this area has focused on relatively simple accounts of biases in human attackers, and little is known about adversarial behavior or how defenses could be improved by disrupting attacker’s behavior. In this work, we present a novel model of human decision-making inspired by the cognitive faculties of Instance-Based Learning Theory, Theory of Mind, and Transfer of Learning. This model functions by learning from both roles in a security scenario: defender and attacker, and by making predictions of the opponent’s beliefs, intentions, and actions. The proposed model can better defend against attacks from a wide range of opponents compared to alternatives that attempt to perform optimally without accounting for human biases. Additionally, the proposed model performs better against a range of human-like behavior by explicitly modeling human transfer of learning, which has not yet been applied to cyber defense scenarios. Results from simulation experiments demonstrate the potential usefulness of cognitively inspired models of agents trained in attack and defense roles and how these insights could potentially be used in real-world cybersecurity.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"31 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-06-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127128061","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Assessing Network Operator Actions to Enhance Digital Sovereignty and Strengthen Network Resilience: A Longitudinal Analysis during the Russia-Ukraine Conflict 评估网络运营商增强数字主权和增强网络弹性的行动:俄乌冲突期间的纵向分析

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-05-28 DOI: 10.1109/EuroSPW59978.2023.00060

Muhammad Yasir Muzayan Haq, Abhishta Abhishta, Raffaele Sommese, M. Jonker, L. Nieuwenhuis

引用次数: 1

ATLAS: Automatically Detecting Discrepancies Between Privacy Policies and Privacy Labels ATLAS:自动检测隐私政策和隐私标签之间的差异

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-05-24 DOI: 10.1109/EuroSPW59978.2023.00016

Akshatha Jain, David Rodríguez Torrado, J. D. Álamo, N. Sadeh

{"title":"ATLAS: Automatically Detecting Discrepancies Between Privacy Policies and Privacy Labels","authors":"Akshatha Jain, David Rodríguez Torrado, J. D. Álamo, N. Sadeh","doi":"10.1109/EuroSPW59978.2023.00016","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00016","url":null,"abstract":"Privacy policies are long, complex documents that end-users seldom read. Privacy labels aim to ameliorate these issues by providing succinct summaries of salient data practices. In December 2020, Apple began requiring that app developers submit privacy labels describing their apps’ data practices. Yet, research suggests that app developers often struggle to do so. In this paper, we automatically identify possible discrepancies between mobile app privacy policies and their privacy labels. Such discrepancies could be indicators of potential privacy compliance issues. We introduce the Automated Privacy Label Analysis System (ATLAS). ATLAS includes three components: a pipeline to systematically retrieve iOS App Store listings and privacy policies; an ensemble-based classifier capable of predicting privacy labels from the text of privacy policies with 91.3% accuracy using state-of-the-art NLP techniques; and a discrepancy analysis mechanism that enables a large-scale privacy analysis of the iOS App Store. Our system has enabled us to analyze 354,725 iOS apps. We find several interesting trends. For example, only 40.3% of apps in the App Store provide easily accessible privacy policies, and only 29.6% of apps provide both accessible privacy policies and privacy labels. Among apps that provide both, 88.0% have at least one possible discrepancy between the text of their privacy policy and their privacy label, which could be indicative of a potential compliance issue. We find that, on average, apps have 5.32 such potential compliance issues. We hope that ATLAS will help app developers, researchers, regulators, and mobile app stores alike. For example, app developers could use our classifier to check for discrepancies between their privacy policies and privacy labels, and regulators could use our system to help review apps at scale for potential compliance issues.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-05-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128529670","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

A ‘Human-in-the-Loop’ approach for Information Extraction from Privacy Policies under Data Scarcity 数据稀缺下隐私政策信息提取的“人在环”方法

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-05-24 DOI: 10.1109/EuroSPW59978.2023.00014

M. Gebauer, Faraz Maschhur, Nicola Leschke, Elias Grünewald, Frank Pallas

{"title":"A ‘Human-in-the-Loop’ approach for Information Extraction from Privacy Policies under Data Scarcity","authors":"M. Gebauer, Faraz Maschhur, Nicola Leschke, Elias Grünewald, Frank Pallas","doi":"10.1109/EuroSPW59978.2023.00014","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00014","url":null,"abstract":"Machine-readable representations of privacy policies are door openers for a broad variety of novel privacy-enhancing and, in particular, transparency-enhancing technologies (TETs). In order to generate such representations, transparency information needs to be extracted from written privacy policies. However, respective manual annotation and extraction processes are laborious and require expert knowledge. Approaches for fully automated annotation, in turn, have so far not succeeded due to overly high error rates in the specific domain of privacy policies. In the end, a lack of properly annotated privacy policies and respective machine-readable representations persists and enduringly hinders the development and establishment of novel technical approaches fostering policy perception and data subject informedness.In this work, we present a prototype system for a ‘ Human-in-the-Loop’ approach to privacy policy annotation that integrates ML-generated suggestions and ultimately human annotation decisions. We propose an ML-based suggestion system specifically tailored to the constraint of data scarcity prevalent in the domain of privacy policy annotation. On this basis, we provide meaningful predictions to users thereby streamlining the annotation process. Additionally, we also evaluate our approach through a prototypical implementation to show that our ML-based extraction approach provides superior performance over other recently used extraction models for legal documents.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"65 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-05-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125508799","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Automating privacy decisions -where to draw the line? 自动化隐私决策——界限在哪里?

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-05-15 DOI: 10.1109/EuroSPW59978.2023.00017

Victor Morel, S. Fischer-Hübner

引用次数: 0

Simplification of General Mixed Boolean-Arithmetic Expressions: GAMBA 一般混合布尔算术表达式的简化:GAMBA

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-05-11 DOI: 10.1109/EuroSPW59978.2023.00053

Benjamin Reichenwallner, Peter Meerwald-Stadler

引用次数: 0