2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)最新文献

PDGraph: A Large-Scale Empirical Study on Project Dependency of Security Vulnerabilities PDGraph:安全漏洞项目依赖性的大规模实证研究

2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) Pub Date : 2021-06-01 DOI: 10.1109/DSN48987.2021.00031

Qiang Li, Jinke Song, Dawei Tan, Haining Wang, Jiqiang Liu

{"title":"PDGraph: A Large-Scale Empirical Study on Project Dependency of Security Vulnerabilities","authors":"Qiang Li, Jinke Song, Dawei Tan, Haining Wang, Jiqiang Liu","doi":"10.1109/DSN48987.2021.00031","DOIUrl":"https://doi.org/10.1109/DSN48987.2021.00031","url":null,"abstract":"The reuse of libraries in software development has become prevalent for improving development efficiency and software quality. However, security vulnerabilities of reused libraries propagated through software project dependency pose a severe security threat, but they have not yet been well studied. In this paper, we present the first large-scale empirical study of project dependencies with respect to security vulnerabilities. We developed PDGraph, an innovative approach for analyzing publicly known security vulnerabilities among numerous project dependencies, which provides a new perspective for assessing security risks in the wild. As a large-scale software collection in dependency, we find 337,415 projects and 1,385,338 dependency relations. In particular, PDGraph generates a project dependency graph, where each node is a project, and each edge indicates a dependency relationship. We conducted experiments to validate the efficacy of PDGraph and characterized its features for security analysis. We revealed that 1,014 projects have publicly disclosed vulnerabilities, and more than 67,806 projects are directly dependent on them. Among these, 42,441 projects still manifest 67,581 insecure dependency relationships, indicating that they are built on vulnerable versions of reused libraries even though their vulnerabilities are publicly known. During our eight-month observation period, only 1,266 insecure edges were fixed, and corresponding vulnerable libraries were updated to secure versions. Furthermore, we uncovered four underlying dependency risks that can significantly reduce the difficulty of compromising systems. We conducted a quantitative analysis of dependency risks on the PDGraph.","PeriodicalId":222512,"journal":{"name":"2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)","volume":"50 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117156152","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 8

Compromised Computers Meet Voice Assistants: Stealthily Exfiltrating Data as Voice over Telephony 受损的电脑遇到语音助手:秘密地通过电话语音窃取数据

2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) Pub Date : 2021-06-01 DOI: 10.1109/DSN48987.2021.00061

Zhengxian He, M. Rajput, M. Ahamad

引用次数: 1

Rising Star in Dependability Award 可靠性奖的新星

2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) Pub Date : 2021-06-01 DOI: 10.1109/dsn48987.2021.00013

引用次数: 0

Sanitizing the IoT Cyber Security Posture: An Operational CTI Feed Backed up by Internet Measurements 净化物联网网络安全态势:由互联网测量支持的可操作CTI馈送

2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) Pub Date : 2021-06-01 DOI: 10.1109/DSN48987.2021.00059

Morteza Safaei Pour, Dylan Watson, E. Bou-Harb

引用次数: 7

General Feature Selection for Failure Prediction in Large-scale SSD Deployment 大规模SSD部署故障预测的通用特征选择

2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) Pub Date : 2021-06-01 DOI: 10.1109/DSN48987.2021.00039

Fan Xu, Shujie Han, P. Lee, Yi Liu, Cheng He, Jiongzhou Liu

{"title":"General Feature Selection for Failure Prediction in Large-scale SSD Deployment","authors":"Fan Xu, Shujie Han, P. Lee, Yi Liu, Cheng He, Jiongzhou Liu","doi":"10.1109/DSN48987.2021.00039","DOIUrl":"https://doi.org/10.1109/DSN48987.2021.00039","url":null,"abstract":"Solid-state drive (SSD) failures are likely to cause system-level failures leading to downtime, enabling SSD failure prediction to be critical to large-scale SSD deployment. Existing SSD failure prediction studies are mostly based on customized SSDs with proprietary monitoring metrics, which are difficult to reproduce. To support general SSD failure prediction of different drive models and vendors, this paper proposes Wear-out-updating Ensemble Feature Ranking (WEFR) to select the SMART attributes as learning features in an automated and robust manner. WEFR combines different feature ranking results and automatically generates the final feature selection based on the complexity measures and the change point detection of wear-out degrees. We evaluate our approach using a dataset of nearly 500K working SSDs at Alibaba. Our results show that the proposed approach is effective and outperforms related approaches. We have successfully applied the proposed approach to improve the reliability of cloud storage systems in production SSD-based data centers. We release our dataset for public use.","PeriodicalId":222512,"journal":{"name":"2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)","volume":"31 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125772576","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 11

PatchDB: A Large-Scale Security Patch Dataset PatchDB:大规模安全补丁数据集

2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) Pub Date : 2021-06-01 DOI: 10.1109/DSN48987.2021.00030

Xinda Wang, Shu Wang, Pengbin Feng, Kun Sun, S. Jajodia

{"title":"PatchDB: A Large-Scale Security Patch Dataset","authors":"Xinda Wang, Shu Wang, Pengbin Feng, Kun Sun, S. Jajodia","doi":"10.1109/DSN48987.2021.00030","DOIUrl":"https://doi.org/10.1109/DSN48987.2021.00030","url":null,"abstract":"Security patches, embedding both vulnerable code and the corresponding fixes, are of great significance to vulnerability detection and software maintenance. However, the existing patch datasets suffer from insufficient samples and low varieties. In this paper, we construct a large-scale patch dataset called PatchDB that consists of three components, namely, NVD-based dataset, wild-based dataset, and synthetic dataset. The NVD-based dataset is extracted from the patch hyperlinks indexed by the NVD. The wild-based dataset includes security patches that we collect from the commits on GitHub. To improve the efficiency of data collection and reduce the effort on manual verification, we develop a new nearest link search method to help find the most promising security patch candidates. Moreover, we provide a synthetic dataset that uses a new oversampling method to synthesize patches at the source code level by enriching the control flow variants of original patches. We conduct a set of studies to investigate the effectiveness of the proposed algorithms and evaluate the properties of the collected dataset. The experimental results show that PatchDB can help improve the performance of security patch identification.","PeriodicalId":222512,"journal":{"name":"2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)","volume":"28 7","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132390141","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 21

[Copyright notice] (版权)

2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) Pub Date : 2021-06-01 DOI: 10.1109/dsn48987.2021.00003

引用次数: 0

GARFIELD: System Support for Byzantine Machine Learning (Regular Paper) 加菲猫:拜占庭机器学习的系统支持(普通论文)

2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) Pub Date : 2021-06-01 DOI: 10.1109/DSN48987.2021.00021

R. Guerraoui, Arsany Guirguis, Jérémy Plassmann, Anton Ragot, Sébastien Rouault

{"title":"GARFIELD: System Support for Byzantine Machine Learning (Regular Paper)","authors":"R. Guerraoui, Arsany Guirguis, Jérémy Plassmann, Anton Ragot, Sébastien Rouault","doi":"10.1109/DSN48987.2021.00021","DOIUrl":"https://doi.org/10.1109/DSN48987.2021.00021","url":null,"abstract":"We present GARFIELD, a library to transparently make machine learning (ML) applications, initially built with popular (but fragile) frameworks, e.g., TensorFlow and PyTorch, Byzantine–resilient. GARFIELD relies on a novel object–oriented design, reducing the coding effort, and addressing the vulnerability of the shared–graph architecture followed by classical ML frameworks. GARFIELD encompasses various communication patterns and supports computations on CPUs and GPUs, allowing addressing the general question of the practical cost of Byzantine resilience in ML applications. We report on the usage of GARFIELD on three main ML architectures: (a) a single server with multiple workers, (b) several servers and workers, and (c) peer–to–peer settings. Using GARFIELD, we highlight interesting facts about the cost of Byzantine resilience. In particular, (a) Byzantine resilience, unlike crash resilience, induces an accuracy loss, (b) the throughput overhead comes more from communication than from robust aggregation, and (c) tolerating Byzantine servers costs more than tolerating Byzantine workers.","PeriodicalId":222512,"journal":{"name":"2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131770343","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 8

Programme Committee 计划委员会

2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) Pub Date : 2021-06-01 DOI: 10.1109/dsn48987.2021.00009

引用次数: 0

Toward Intrusion Tolerance as a Service: Confidentiality in Partially Cloud-Based BFT Systems 将入侵容忍作为一种服务:部分基于云的BFT系统中的机密性

2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) Pub Date : 2021-06-01 DOI: 10.1109/DSN48987.2021.00019

Maher Khan, Amy Babay

引用次数: 4