{"title":"Continuous Certification of Non-repudiation in Cloud Storage Services","authors":"M. Krotsiani, G. Spanoudakis","doi":"10.1109/TrustCom.2014.122","DOIUrl":"https://doi.org/10.1109/TrustCom.2014.122","url":null,"abstract":"This paper presents a certification model for Non-repudiation (NR) of cloud storage services. NR, i.e., The possession of proofs that certain exchanges have taken place amongst interacting parties, is a significant security property for cloud data storage services. Our model for certifying NR is based on continuous monitoring and has been defined and realised according to the CUMULUS approach. It also corresponds to certification of level 3 maturity in the reference certification framework of Cloud Security Alliance.","PeriodicalId":268788,"journal":{"name":"2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications","volume":"25 6","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-09-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114026962","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Crowd Sensing of Urban Emergency Events Based on Social Media Big Data","authors":"Zheng Xu, Hui Zhang, Yunhuai Liu, Lin Mei","doi":"10.1109/TrustCom.2014.77","DOIUrl":"https://doi.org/10.1109/TrustCom.2014.77","url":null,"abstract":"Detection about urban emergency events, e.g., The fires, storms, traffic jams is of great importance to protect the security of humans. While there are limited physical sensors such as surveillance cameras in a city, urban emergency events are still difficult to be detected for their real-time feature. Recently, social media feeds are rapidly emerging as a novel platform for providing and dissemination of information that is often geographic. The content from social media often includes references to urban emergency events occurring at, or affecting specific locations. In this paper, the real-time detection of urban emergency events based on social media is proposed. Firstly, users of social media are set as the target of crowd sensing. Secondly, the spatial and temporal information from the social media are extracted to detect the real-time event. Thirdly, a GIS based annotation of the detected urban emergency event is shown. The proposed method is evaluated with extensive experiments based on five real urban emergency events. The result show the accuracy and efficiency of the proposed method.","PeriodicalId":268788,"journal":{"name":"2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-09-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122408120","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Parvez Faruki, A. Bharmal, V. Laxmi, M. Gaur, M. Conti, M. Rajarajan
{"title":"Evaluation of Android Anti-malware Techniques against Dalvik Bytecode Obfuscation","authors":"Parvez Faruki, A. Bharmal, V. Laxmi, M. Gaur, M. Conti, M. Rajarajan","doi":"10.1109/TrustCom.2014.54","DOIUrl":"https://doi.org/10.1109/TrustCom.2014.54","url":null,"abstract":"Popularity and growth of Android mobile devices has paved the way for exploiting popular apps using various Dalvik byte code transformation methods. Testing the antimalware techniques against obfuscation identifies the need of proposing effective detection methods. In this paper, we explore the resilience of anti-malware techniques against transformations for Android. The Proposed approach employs variable compression, native code wrapping and register renaming, in addition to already implemented transformations on Dalvik byte code. Evaluation results indicate low resilience of the antimalware detection engines against code obfuscation. Furthermore, we evaluate resilience of Androguard's code similarity and AndroSimilar's robust statistical feature signature against code obfuscated malware.","PeriodicalId":268788,"journal":{"name":"2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications","volume":"22 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-09-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128753497","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Untrusted User Detection in Microblogs","authors":"Zidan Yu, Huiqun Yu","doi":"10.1109/TrustCom.2014.71","DOIUrl":"https://doi.org/10.1109/TrustCom.2014.71","url":null,"abstract":"As Micro blogs such as Sina Weibo and Twitter are becoming increasingly popular, a lot of users are benefiting from the convenience of social communication and information sharing. However, untrusted users can take advantage of these sites as gateways to make money, spread rumors and so on. This paper proposes a label propagation algorithm based on the trust model to detect the untrusted users on social networking sites. The algorithm consists of two main steps. Firstly, we conduct a hybrid graph with three types of nodes (users, tweets, topics) to model the trust relationship between each user pair. Secondly, we utilize a new method inspired by the Label Propagation Algorithm to detect more untrusted users based on a small known seed set. We conduct experiments with a real data set, and the evaluation demonstrates the effectiveness, efficiency, and scalability of the proposed solution.","PeriodicalId":268788,"journal":{"name":"2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications","volume":"312 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-09-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117060771","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Li Li, Alexandre Bartel, Jacques Klein, Yves Le Traon
{"title":"Automatically Exploiting Potential Component Leaks in Android Applications","authors":"Li Li, Alexandre Bartel, Jacques Klein, Yves Le Traon","doi":"10.1109/TrustCom.2014.50","DOIUrl":"https://doi.org/10.1109/TrustCom.2014.50","url":null,"abstract":"We present PCLeaks, a tool based on inter-component communication (ICC) vulnerabilities to perform data-flow analysis on Android applications to find potential component leaks that could potentially be exploited by other components. To evaluate our approach, we run PCLeaks on 2000 apps randomly selected from the Google Play store. PCLeaks reports 986 potential component leaks in 185 apps. For each leak reported by PCLeaks, PCLeaksValidator automatically generates an Android app which tries to exploit the leak. By manually running a subset of the generated apps, we find that 75% of the reported leaks are exploitable leaks.","PeriodicalId":268788,"journal":{"name":"2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-09-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115458649","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Cognitive Adaptive Access-Control System for a Secure Locator/Identifier Separation Context","authors":"Yuanlong Cao, Jianfeng Guan, Changqiao Xu, Wei Quan, Hongke Zhang","doi":"10.1109/TrustCom.2014.30","DOIUrl":"https://doi.org/10.1109/TrustCom.2014.30","url":null,"abstract":"As a promising solution to the scalability issue of the current routing infrastructure, locator/identifier separation has gained variety of attentions and resulted in thousands of peer-reviewed publications. However, there is still significant ongoing work addressing many challenges of the secure Locator/Identifier Separation Context (LISC). In this paper, we propose a novel Cognitive Adaptive Access-Control solution (CAAC) for a secure LISC with three modules, which are Tag-aware Access-Control module (TAC) that devotes to generate user tag (UTag) and service tag (STag) by cognizing their natural and dynamic attributes, Adaptive Policy Generation paradigm (APG) that serves to select proper policy instance for adaptive and intelligent access control, and Cooperative Decision Making module (CDM) that contributes to provide efficient decision-making by multi-peer parallel cooperation. We implement the designed CAAC in our identifier-based network platform to verify its advantages.","PeriodicalId":268788,"journal":{"name":"2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications","volume":"33 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-09-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126040246","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Unified Model for Data Security - A Position Paper","authors":"Raja Naeem Akram, R. Ko","doi":"10.1109/TrustCom.2014.110","DOIUrl":"https://doi.org/10.1109/TrustCom.2014.110","url":null,"abstract":"One of the most crucial components of modern Information Technology (IT) systems is data. It can be argued that the majority of IT systems are built to collect, store, modify, communicate and use data, enabling different data stakeholders to access and use it to achieve different business objectives. The confidentiality, integrity, availability, audit ability, privacy, and quality of the data is of paramount concern for end-users ranging from ordinary consumers to multi-national companies. Over the course of time, different frameworks have been proposed and deployed to provide data security. Many of these previous paradigms were specific to particular domains such as military or media content providers, while in other cases they were generic to different verticals within an industry. There is a much needed push for a holistic approach to data security instead of the current bespoke approaches. The age of the Internet has witnessed an increased ease of sharing data with or without authorisation. These scenarios have created new challenges for traditional data security. In this paper, we study the evolution of data security from the perspective of past proposed frameworks, and present a novel Unified Model for Data Security (UMDS). The discussed UMDS reduces the friction from several cross-domain challenges, and has the functionality to possibly provide comprehensive data security to data owners and privileged users.","PeriodicalId":268788,"journal":{"name":"2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-09-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126678899","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Detection of Android Malicious Apps Based on the Sensitive Behaviors","authors":"Daiyong Quan, Lidong Zhai, Fan Yang, Peng Wang","doi":"10.1109/TrustCom.2014.115","DOIUrl":"https://doi.org/10.1109/TrustCom.2014.115","url":null,"abstract":"The number of malicious applications (apps) targeting the Android system has exploded in recent years. The evolution of malware makes it difficult to detect for static analysis tools. Various behavior-based malware detection techniques to mitigate this problem have been proposed. The drawbacks of the existing approaches are: the behavior features extracted from a single source lead to the low detection accuracy and the detection process is too complex. Especially it is unsuitable for smart phones with limited computing power. In this paper, we extract sensitive behavior features from three sources: API calls, native code dynamic execution, and system calls. We propose a sensitive behavior feature vector for representation multi-source behavior features uniformly. Our sensitive behavior representation is able to automatically describe the low-level OS-specific behaviors and high-level application-specific behaviors of an Android malware. Based on the unified behavior feature representation, w e provide a light weight decision function to differentiate a given application benign or malicious. We tested the effectiveness of our approach against real malware and the results of our experiments show that its detection accuracy up to 96% with acceptable performance overhead. For a given threshold t (t=9), we can detect the advanced malware family effectively.","PeriodicalId":268788,"journal":{"name":"2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications","volume":"100 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-09-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122517231","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"On the Application and Performance of MongoDB for Climate Satellite Data","authors":"P. Ameri, U. Grabowski, Jörg Meyer, A. Streit","doi":"10.1109/TrustCom.2014.84","DOIUrl":"https://doi.org/10.1109/TrustCom.2014.84","url":null,"abstract":"Analyses in climate research typically operate on large datasets stored in file hierarchies. However, e.g. Indexing, meta-data search and replication is challenging with this approach. A new approach is to store and index datasets in large, distributed databases. In order to demonstrate the performance improvement, we utilized the so-called general matching problem between measurements of two satellites that differ in orbits and measurement cycles. For comparison purpose the measurements are matched within a specified maximum spatial and time offset constraint. We describe the steps from a single-threaded approach using a SQL database to a multi-threaded approach using the NoSQL database MongoDB. The performance as well as limitations on CPU and I/O are evaluated and discussed for each approach. The performance has been improved up to a factor of 46 using 11 threads on a 12-core system.","PeriodicalId":268788,"journal":{"name":"2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications","volume":"86 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-09-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131342579","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Trusted Geolocation-Aware Data Placement in Infrastructure Clouds","authors":"Nicolae Paladi, Mudassar Aslam, C. Gehrmann","doi":"10.1109/TrustCom.2014.47","DOIUrl":"https://doi.org/10.1109/TrustCom.2014.47","url":null,"abstract":"Data geolocation in the cloud is becoming an increasingly pressing problem, aggravated by incompatible legislation in different jurisdictions and compliance requirements of data owners. In this work we present a mechanism allowing cloud users to control the geographical location of their data, stored or processed in plaintext on the premises of Infrastructure-as-a Service cloud providers. We use trusted computing principles and remote attestation to establish platform state. We enable cloud users to confine plaintext data exclusively to the jurisdictions they specify, by sealing decryption keys used to obtain plaintext data to the combination of cloud host geolocation and platform state. We provide a detailed description of the implementation as well as performance measurements on an open source cloud infrastructure platform using commodity hardware.","PeriodicalId":268788,"journal":{"name":"2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications","volume":"431 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-09-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131919411","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}