MTD '14最新文献 - Book学术

No free lunch in cyber security 网络安全领域没有免费的午餐

MTD '14 Pub Date : 2014-11-07 DOI: 10.1145/2663474.2663475

G. Cybenko, J. Hughes

引用次数: 16

On the Challenges of Effective Movement 关于有效运动的挑战

MTD '14 Pub Date : 2014-11-07 DOI: 10.1145/2663474.2663480

Thomas Hobson, Hamed Okhravi, David Bigelow, Robert Rudd, W. Streilein

引用次数: 34

Towards a Theory of Moving Target Defense 移动目标防御理论探讨

MTD '14 Pub Date : 2014-11-07 DOI: 10.1145/2663474.2663479

Rui Zhuang, S. DeLoach, Xinming Ou

引用次数: 230

Reinforcement Learning Algorithms for Adaptive Cyber Defense against Heartbleed 针对心脏出血的自适应网络防御的强化学习算法

MTD '14 Pub Date : 2014-11-07 DOI: 10.1145/2663474.2663481

Minghui Zhu, Zhisheng Hu, Peng Liu

引用次数: 38

Software Security and Randomization through Program Partitioning and Circuit Variation 通过程序划分和电路变化的软件安全性和随机化

MTD '14 Pub Date : 2014-11-07 DOI: 10.1145/2663474.2663484

T. Andel, Lindsey N. Whitehurst, J. McDonald

{"title":"Software Security and Randomization through Program Partitioning and Circuit Variation","authors":"T. Andel, Lindsey N. Whitehurst, J. McDonald","doi":"10.1145/2663474.2663484","DOIUrl":"https://doi.org/10.1145/2663474.2663484","url":null,"abstract":"The commodity status of Field Programmable Gate Arrays (FPGAs) has allowed computationally intensive algorithms, such as cryptographic protocols, to take advantage of faster hardware speed while simultaneously leveraging the reconfigurability and lower cost of software. Numerous security applications have been transitioned into FPGA implementations allowing security applications to operate at real-time speeds, such as firewall and packet scanning on high speed networks. However, the utilization of FPGAs to directly secure software vulnerabilities is seemingly non-existent.\u0000 Protecting program integrity and confidentiality is crucial as malicious attacks through injected code are becoming increasingly prevalent. This paper lays the foundation of continuing research in how to protect software by partitioning critical sections using reconfigurable hardware. This approach is similar to a traditional coprocessor approach to scheduling opcodes for execution on specialized hardware as opposed to running on the native processor. However, the partitioned program model enables the programmer the ability to split portions of an application to reconfigurable hardware at compile time. The fundamental underlying hypothesis is that synthesizing portions of programs onto hardware can mitigate potential software vulnerabilities. Further, this approach provides an avenue for randomization or diversity for software layout and circuit variation.","PeriodicalId":241301,"journal":{"name":"MTD '14","volume":"260 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116233370","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 8

Spatio-temporal Address Mutation for Proactive Cyber Agility against Sophisticated Attackers 针对复杂攻击者的主动网络敏捷性的时空地址突变

MTD '14 Pub Date : 2014-11-07 DOI: 10.1145/2663474.2663483

J. H. Jafarian, E. Al-Shaer, Qi Duan

{"title":"Spatio-temporal Address Mutation for Proactive Cyber Agility against Sophisticated Attackers","authors":"J. H. Jafarian, E. Al-Shaer, Qi Duan","doi":"10.1145/2663474.2663483","DOIUrl":"https://doi.org/10.1145/2663474.2663483","url":null,"abstract":"The static one-to-one binding of hosts to IP addresses allows adversaries to conduct thorough reconnaissance in order to discover and enumerate network assets. Specifically, this fixed address mapping allows distributed network scanners to aggregate information gathered at multiple locations over different times in order to construct an accurate and persistent view of the network. The unvarying nature of this view enables adversaries to collaboratively share and reuse their collected reconnaissance information in various stages of attack planning and execution. This paper presents a novel moving target defense (MTD) technique which enables host-to-IP binding of each destination host to vary randomly across the network based on the source identity (spatial randomization) as well as time (temporal randomization). This spatio-temporal randomization will distort attackers' view of the network by causing the collected reconnaissance information to expire as adversaries transition from one host to another or if they stay long enough in one location. Consequently, adversaries are forced to re-scan the network frequently at each location or over different time intervals. These recurring probings significantly raises the bar for the adversaries by slowing down the attack progress, while improving its detectability. We introduce three novel metrics for quantifying the effectiveness of MTD defense techniques: deterrence, deception, and detectability. Using these metrics, we perform rigorous theoretical and experimental analysis to evaluate the efficacy of this approach. These analyses show that our approach is effective in countering a significant number of sophisticated threat models including collaborative reconnaissance, worm propagation, and advanced persistent threat (APT), in an evasion-free manner.","PeriodicalId":241301,"journal":{"name":"MTD '14","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124142139","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 85

A Game Theoretic Approach to Strategy Determination for Dynamic Platform Defenses 动态平台防御策略决策的博弈论方法

MTD '14 Pub Date : 2014-11-07 DOI: 10.1145/2663474.2663478

K. Carter, J. Riordan, Hamed Okhravi

引用次数: 59

Software Profiling Options and Their Effects on Security Based Diversification 软件配置选项及其对基于多样化的安全性的影响

MTD '14 Pub Date : 2014-11-07 DOI: 10.1145/2663474.2663485

Mark Murphy, Per Larsen, Stefan Brunthaler, M. Franz

{"title":"Software Profiling Options and Their Effects on Security Based Diversification","authors":"Mark Murphy, Per Larsen, Stefan Brunthaler, M. Franz","doi":"10.1145/2663474.2663485","DOIUrl":"https://doi.org/10.1145/2663474.2663485","url":null,"abstract":"Imparting diversity to binaries by inserting garbage instructions is an effective defense against code-reuse attacks. Relocating and breaking up code gadgets removes an attacker's ability to craft attacks by merely studying the existing code on their own computer. Unfortunately, inserting garbage instructions also slows down program execution. The use of profiling enables optimizations that alleviate much of this overhead, while still maintaining the high level of security needed to deter attacks. These optimizations are performed by varying the probability for the insertion of a garbage instruction at any particular location in the binary. The hottest regions of code get the smallest amount of diversification, while the coldest regions get the most diversification.\u0000 We show that static and dynamic profiling methods both reduce run-time overhead to under 2.5% while preventing over 95% of original gadgets from appearing in any diversified binary. We compare static and dynamic profiling and find that dynamic profiling has a slight performance advantage in a best-case scenario. But we also show that dynamic profiling results can suffer greatly from bad training input. Additionally, we find that static profiling creates smaller binary files than dynamic profiling, and that the two methods offer nearly identical security characteristics.","PeriodicalId":241301,"journal":{"name":"MTD '14","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129357033","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

Comparing Different Moving Target Defense Techniques 比较不同的移动目标防御技术

MTD '14 Pub Date : 2014-11-07 DOI: 10.1145/2663474.2663486

Jun Xu, Pinyao Guo, Mingyi Zhao, R. Erbacher, Minghui Zhu, Peng Liu

引用次数: 112

Moving Target Defense for Hardening the Security of the Power System State Estimation 加强电力系统状态估计安全性的运动目标防御

MTD '14 Pub Date : 2014-11-07 DOI: 10.1145/2663474.2663482

M. Rahman, E. Al-Shaer, R. Bobba

{"title":"Moving Target Defense for Hardening the Security of the Power System State Estimation","authors":"M. Rahman, E. Al-Shaer, R. Bobba","doi":"10.1145/2663474.2663482","DOIUrl":"https://doi.org/10.1145/2663474.2663482","url":null,"abstract":"State estimation plays a critically important role in ensuring the secure and reliable operation of the electric grid. Recent works have shown that the state estimation process is vulnerable to stealthy attacks where an adversary can alter certain measurements to corrupt the solution of the process, but evade the existing bad data detection algorithms and remain invisible to the system operator. Since the state estimation result is used to compute optimal power flow and perform contingency analysis, incorrect estimation can undermine economic and secure system operation. However, an adversary needs sufficient resources as well as necessary knowledge to achieve a desired attack outcome. The knowledge that is required to launch an attack mainly includes the measurements considered in state estimation, the connectivity among the buses, and the power line admittances. Uncertainty in information limits the potential attack space for an attacker. This advantage of uncertainty enables us to apply moving target defense (MTD) strategies for developing a proactive defense mechanism for state estimation.\u0000 In this paper, we propose an MTD mechanism for securing state estimation, which has several characteristics: (i) increase the knowledge uncertainty for attackers, (ii) reduce the window of attack opportunity, and (iii) increase the attack cost. In this mechanism, we apply controlled randomization on the power grid system properties, mainly on the set of measurements that are considered in state estimation, and the topology, especially the line admittances. We thoroughly analyze the performance of the proposed mechanism on the standard IEEE 14- and 30-bus test systems.","PeriodicalId":241301,"journal":{"name":"MTD '14","volume":"40 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134442305","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 83