Security and Artificial Intelligence最新文献_第3页

ZDVUE: prioritization of javascript attacks to discover new vulnerabilities ZDVUE: javascript攻击的优先级，以发现新的漏洞

Security and Artificial Intelligence Pub Date : 2011-10-21 DOI: 10.1145/2046684.2046690

Sandeep Karanth, S. Laxman, P. Naldurg, R. Venkatesan, J. Lambert, Jinwook Shin

{"title":"ZDVUE: prioritization of javascript attacks to discover new vulnerabilities","authors":"Sandeep Karanth, S. Laxman, P. Naldurg, R. Venkatesan, J. Lambert, Jinwook Shin","doi":"10.1145/2046684.2046690","DOIUrl":"https://doi.org/10.1145/2046684.2046690","url":null,"abstract":"Malware writers are constantly looking for new vulnerabilities to exploit in popular software applications. A successful exploit of a previously unknown vulnerability, that evades state-of-the art anti-virus and intrusion-detection systems is called a zero-day vulnerability. JavaScript is a popular vehicle for testing and delivering attacks through drive-by downloads on web clients. Failed attack attempts leave traces of suspicious activity on victim machines. We present ZDVUE, a tool for automatic prioritization of suspicious JavaScript traces, which can lead to early detection of potential zero-day vulnerabilities. Our algorithm uses a combination of correlation analysis and mixture modeling for fast and robust prioritization of suspicious JavaScript samples.On data collected between June and November 2009, ZDVUE identified a new zero-day vulnerability and its variant in its top results, as well as revealed many new anti-virus signatures. ZDVUE is used in our organization on a routine basis to automatically filter, analyze, and prioritize thousands of downloaded JavaScript files, for information to update anti-virus signatures and to find new zero-day vulnerabilities.","PeriodicalId":225009,"journal":{"name":"Security and Artificial Intelligence","volume":"275 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122172620","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 8

Accessibility of CAPTCHA methods 验证码方法的可访问性

Security and Artificial Intelligence Pub Date : 2011-10-21 DOI: 10.1145/2046684.2046704

S. Shirali-Shahreza, M. Shirali-Shahreza

引用次数: 19

Judging a site by its content: learning the textual, structural, and visual features of malicious web pages 通过内容判断网站:学习恶意网页的文本、结构和视觉特征

Security and Artificial Intelligence Pub Date : 2011-10-21 DOI: 10.1145/2046684.2046686

S. Bannur, L. Saul, S. Savage

引用次数: 32

On deployable adversarial classification models 关于可部署的对抗分类模型

Security and Artificial Intelligence Pub Date : 2011-10-21 DOI: 10.1145/2046684.2046706

Anshuman Singh, Sumi Singh, Andrew Walenstein, Arun Lakhotia

引用次数: 0

Machine learning in computer forensics (and the lessons learned from machine learning in computer security) 计算机取证中的机器学习(以及计算机安全中的机器学习经验教训)

Security and Artificial Intelligence Pub Date : 2011-10-21 DOI: 10.1145/2046684.2046700

Davide Ariu, G. Giacinto, F. Roli

引用次数: 14

Understanding the risk factors of learning in adversarial environments 了解在敌对环境中学习的风险因素

Security and Artificial Intelligence Pub Date : 2011-10-21 DOI: 10.1145/2046684.2046698

B. Nelson, B. Biggio, P. Laskov

引用次数: 21

A comparative assessment of malware classification using binary texture analysis and dynamic analysis 基于二进制纹理分析和动态分析的恶意软件分类的比较评估

Security and Artificial Intelligence Pub Date : 2011-10-21 DOI: 10.1145/2046684.2046689

L. Nataraj, V. Yegneswaran, Phillip A. Porras, Jian Zhang

{"title":"A comparative assessment of malware classification using binary texture analysis and dynamic analysis","authors":"L. Nataraj, V. Yegneswaran, Phillip A. Porras, Jian Zhang","doi":"10.1145/2046684.2046689","DOIUrl":"https://doi.org/10.1145/2046684.2046689","url":null,"abstract":"AI techniques play an important role in automated malware classification. Several machine-learning methods have been applied to classify or cluster malware into families, based on different features derived from dynamic review of the malware. While these approaches demonstrate promise, they are themselves subject to a growing array of counter measures that increase the cost of capturing these binary features. Further, feature extraction requires a time investment per binary that does not scale well to the daily volume of binary instances being reported by those who diligently collect malware. Recently, a new type of feature extraction, used by a classification approach called binary-texture analysis, was introduced in [16]. We compare this approach to existing malware classification approaches previously published. We find that, while binary texture analysis is capable of providing comparable classification accuracy to that of contemporary dynamic techniques, it can deliver these results 4000 times faster than dynamic techniques. Also surprisingly, the texture-based approach seems resilient to contemporary packing strategies, and can robustly classify a large corpus of malware with both packed and unpacked samples. We present our experimental results from three independent malware corpora, comprised of over 100 thousand malware samples. These results suggest that binary-texture analysis could be a useful and efficient complement to dynamic analysis.","PeriodicalId":225009,"journal":{"name":"Security and Artificial Intelligence","volume":"16 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132876072","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 214

Prioritizing intrusion analysis using Dempster-Shafer theory 基于登普斯特-谢弗理论的入侵分析优先级排序

Security and Artificial Intelligence Pub Date : 2011-10-21 DOI: 10.1145/2046684.2046694

Loai Zomlot, S. C. Sundaramurthy, Kui Luo, Xinming Ou, S. R. Rajagopalan

{"title":"Prioritizing intrusion analysis using Dempster-Shafer theory","authors":"Loai Zomlot, S. C. Sundaramurthy, Kui Luo, Xinming Ou, S. R. Rajagopalan","doi":"10.1145/2046684.2046694","DOIUrl":"https://doi.org/10.1145/2046684.2046694","url":null,"abstract":"Intrusion analysis and incident management remains a difficult problem in practical network security defense. The root cause of this problem is the large rate of false positives in the sensors used by Intrusion Detection System (IDS) systems, reducing the value of the alerts to an administrator. Standard Bayesian theory has not been effective in this regard because of the lack of good prior knowledge. This paper presents an approach to handling such uncertainty without the need for prior information, through the Dempster-Shafer (DS) theory. We address a number of practical but fundamental issues in applying DS to intrusion analysis, including how to model sensors' trustworthiness, where to obtain such parameters, and how to address the lack of independence among alerts. We present an efficient algorithm for carrying out DS belief calculation on an IDS alert correlation graph, so that one can compute a belief score for a given hypothesis, e.g. a specific machine is compromised. The belief strength can be used to sort incident-related hypotheses and prioritize further analysis by a human analyst of the hypotheses and the associated evidence. We have implemented our approach for the open-source IDS system Snort and evaluated its effectiveness on a number of data sets as well as a production network. The resulting belief scores were verified through both anecdotal experience on the production system as well as by comparing the belief rankings of hypotheses with the ground truths provided by the data sets we used in evaluation, showing thereby that belief scores can be effective in mitigating the high false positive rate problem in intrusion analysis.","PeriodicalId":225009,"journal":{"name":"Security and Artificial Intelligence","volume":"281 2","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131957300","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 41

Artificial intelligence and the future of cybersecurity 人工智能和网络安全的未来

Security and Artificial Intelligence Pub Date : 2011-10-21 DOI: 10.1145/2046684.2046699

B. Morel

引用次数: 29

A robust one-class bayesian approach for masquerade detection 一种用于伪装检测的鲁棒单类贝叶斯方法

Security and Artificial Intelligence Pub Date : 2011-10-21 DOI: 10.1145/2046684.2046705

Qifan Wang, Luo Si

{"title":"A robust one-class bayesian approach for masquerade detection","authors":"Qifan Wang, Luo Si","doi":"10.1145/2046684.2046705","DOIUrl":"https://doi.org/10.1145/2046684.2046705","url":null,"abstract":"Masquerade attack is a serious computer security problem, which can cause significant damage. Many previous research works were based on two-class training that collected data from multiple users to train one self (i.e., regular) model and one non-self (i.e., abnormal) model for each user. Two-class learning methods for masquerade detection can generate accurate results but demand data from all users, which may not be available for many practical applications. On the other side, one-class learning methods build a model for each user by utilizing only his/her own data. One-class learning methods are more practical but they also suffer from the limited amount of training information from a single user. To address the data sparsity issue, we propose a robust one-class Bayesian approach for masquerade detection. The new method explicitly considers model uncertainty by integrating out the unknown model parameters for generating robust results, while previous one-class methods only use a single point estimate to find an optimal model. We derive the full analytical solution of the predictive distribution over all possible model parameters. A set of experimental results demonstrate that the proposed approach outperforms most previous one-class approach for masquerade detection.","PeriodicalId":225009,"journal":{"name":"Security and Artificial Intelligence","volume":"51 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115135505","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2