Security and Artificial Intelligence最新文献_第2页

Model Aggregation for Distributed Content Anomaly Detection 分布式内容异常检测的模型聚合

Security and Artificial Intelligence Pub Date : 2014-11-07 DOI: 10.1145/2666652.2666660

Sean Whalen, Nathaniel Boggs, S. Stolfo

{"title":"Model Aggregation for Distributed Content Anomaly Detection","authors":"Sean Whalen, Nathaniel Boggs, S. Stolfo","doi":"10.1145/2666652.2666660","DOIUrl":"https://doi.org/10.1145/2666652.2666660","url":null,"abstract":"Cloud computing offers a scalable, low-cost, and resilient platform for critical applications. Securing these applications against attacks targeting unknown vulnerabilities is an unsolved challenge. Network anomaly detection addresses such zero-day attacks by modeling attributes of attack-free application traffic and raising alerts when new traffic deviates from this model. Content anomaly detection (CAD) is a variant of this approach that models the payloads of such traffic instead of higher level attributes. Zero-day attacks then appear as outliers to properly trained CAD sensors. In the past, CAD was unsuited to cloud environments due to the relative overhead of content inspection and the dynamic routing of content paths to geographically diverse sites. We challenge this notion and introduce new methods for efficiently aggregating content models to enable scalable CAD in dynamically-pathed environments such as the cloud. These methods eliminate the need to exchange raw content, drastically reduce network and CPU overhead, and offer varying levels of content privacy. We perform a comparative analysis of our methods using Random Forest, Logistic Regression, and Bloom Filter-based classifiers for operation in the cloud or other distributed settings such as wireless sensor networks. We find that content model aggregation offers statistically significant improvements over non-aggregate models with minimal overhead, and that distributed and non-distributed CAD have statistically indistinguishable performance. Thus, these methods enable the practical deployment of accurate CAD sensors in a distributed attack detection infrastructure.","PeriodicalId":225009,"journal":{"name":"Security and Artificial Intelligence","volume":"51 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117025525","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 14

Poisoning behavioral malware clustering 中毒行为恶意软件聚类

Security and Artificial Intelligence Pub Date : 2014-11-07 DOI: 10.1145/2666652.2666666

B. Biggio, Konrad Rieck, Davide Ariu, Christian Wressnegger, Igino Corona, G. Giacinto, F. Roli

引用次数: 148

Lux0R: Detection of Malicious PDF-embedded JavaScript code through Discriminant Analysis of API References Lux0R:通过API引用的判别分析检测嵌入pdf的恶意JavaScript代码

Security and Artificial Intelligence Pub Date : 2014-11-07 DOI: 10.1145/2666652.2666657

Igino Corona, Davide Maiorca, Davide Ariu, G. Giacinto

{"title":"Lux0R: Detection of Malicious PDF-embedded JavaScript code through Discriminant Analysis of API References","authors":"Igino Corona, Davide Maiorca, Davide Ariu, G. Giacinto","doi":"10.1145/2666652.2666657","DOIUrl":"https://doi.org/10.1145/2666652.2666657","url":null,"abstract":"JavaScript is a dynamic programming language adopted in a variety of applications, including web pages, PDF Readers, widget engines, network platforms, office suites. Given its widespread presence throughout different software platforms, JavaScript is a primary tool for the development of novel -rapidly evolving- malicious exploits. If the classical signature- and heuristic-based detection approaches are clearly inadequate to cope with this kind of threat, machine learning solutions proposed so far suffer from high false-alarm rates or require special instrumentation that make them not suitable for protecting end-user systems.\u0000 In this paper we present Lux0R \"Lux 0n discriminant References\", a novel, lightweight approach to the detection of malicious JavaScript code. Our method is based on the characterization of JavaScript code through its API references, i.e., functions, constants, objects, methods, keywords as well as attributes natively recognized by a JavaScript Application Programming Interface (API). We exploit machine learning techniques to select a subset of API references that characterize malicious code, and then use them to detect JavaScript malware. The selection algorithm has been thought to be \"secure by design\" against evasion by mimicry attacks. In this investigation, we focus on a relevant application domain, i.e., the detection of malicious JavaScript code within PDF documents. We show that our technique is able to achieve excellent malware detection accuracy, even on samples exploiting never-before-seen vulnerabilities, i.e., for which there are no examples in training data. Finally, we experimentally assess the robustness of Lux0R against mimicry attacks based on feature addition.","PeriodicalId":225009,"journal":{"name":"Security and Artificial Intelligence","volume":"52 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124345115","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 63

Non-Invasive User Tracking via Passive Sensing: Privacy Risks of Time-Series Occupancy Measurement 通过被动感知的非侵入性用户跟踪:时序占用测量的隐私风险

Security and Artificial Intelligence Pub Date : 2014-11-07 DOI: 10.1145/2666652.2666655

Xiao Wang, P. Tague

引用次数: 19

Randomized Response Schemes, Privacy and Usefulness 随机响应方案，隐私和有用性

Security and Artificial Intelligence Pub Date : 2014-11-07 DOI: 10.1145/2666652.2666654

Francesco Aldà, H. Simon

引用次数: 1

On learning and recognition of secure patterns 关于安全模式的学习和识别

Security and Artificial Intelligence Pub Date : 2014-11-07 DOI: 10.1145/2666652.2666653

B. Biggio

{"title":"On learning and recognition of secure patterns","authors":"B. Biggio","doi":"10.1145/2666652.2666653","DOIUrl":"https://doi.org/10.1145/2666652.2666653","url":null,"abstract":"Learning and recognition of secure patterns is a well-known problem in nature. Mimicry and camouflage are widely-spread techniques in the arms race between predators and preys. All of the information acquired by our senses is therefore not necessarily secure or reliable. In machine learning and pattern recognition systems, we have started investigating these issues only recently, with the goal of learning to discriminate between secure and hostile patterns. This phenomenon has been especially observed in the context of adversarial settings like biometric recognition, malware detection and spam filtering, in which data can be adversely manipulated by humans to undermine the outcomes of an automatic analysis. As current pattern recognition methods are not natively designed to deal with the intrinsic, adversarial nature of these problems, they exhibit specific vulnerabilities that an adversary may exploit either to mislead learning or to avoid detection. Identifying these vulnerabilities and analyzing the impact of the corresponding attacks on pattern classifiers is one of the main open issues in the novel research field of adversarial machine learning.\u0000 In the first part of this talk, I introduce a general framework that encompasses and unifies previous work in the field, allowing one to systematically evaluate classifier security against different, potential attacks. As an example of application of this framework, in the second part of the talk, I discuss evasion attacks, where malicious samples are manipulated at test time to avoid detection. I then show how carefully-designed poisoning attacks can mislead learning of support vector machines by manipulating a small fraction of their training data, and how to poison adaptive biometric verification systems to compromise the biometric templates (face images) of the enrolled clients. Finally, I briefly discuss our ongoing work on attacks against clustering algorithms, and sketch some possible future research directions.","PeriodicalId":225009,"journal":{"name":"Security and Artificial Intelligence","volume":"192 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122187247","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

On the Practicality of Integrity Attacks on Document-Level Sentiment Analysis 文档级情感分析中完整性攻击的实用性研究

Security and Artificial Intelligence Pub Date : 2014-11-07 DOI: 10.1145/2666652.2666661

Andrew Newell, Rahul Potharaju, Luojie Xiang, C. Nita-Rotaru

引用次数: 55

Exploitation as an inference problem 作为推理问题的开发

Security and Artificial Intelligence Pub Date : 2011-10-21 DOI: 10.1145/2046684.2046702

David A. Cock

引用次数: 2

Categorizing CAPTCHA 分类验证码

Security and Artificial Intelligence Pub Date : 2011-10-21 DOI: 10.1145/2046684.2046703

S. Shirali-Shahreza, M. Shirali-Shahreza

引用次数: 3

Topic modeling of freelance job postings to monitor web service abuse 自由职业职位发布的主题建模以监控web服务滥用

Security and Artificial Intelligence Pub Date : 2011-10-21 DOI: 10.1145/2046684.2046687

Do-kyum Kim, Marti A. Motoyama, G. Voelker, L. Saul

引用次数: 17