2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)最新文献_第4页

An Industrial Control System Physical Testbed for Naval Defense Cybersecurity Research 海军防务网络安全研究工业控制系统物理试验台

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/EuroSPW55150.2022.00049

Franck Sicard, Estelle Hotellier, Julien Francq

{"title":"An Industrial Control System Physical Testbed for Naval Defense Cybersecurity Research","authors":"Franck Sicard, Estelle Hotellier, Julien Francq","doi":"10.1109/EuroSPW55150.2022.00049","DOIUrl":"https://doi.org/10.1109/EuroSPW55150.2022.00049","url":null,"abstract":"Industrial Control Systems are used nowadays in many safety-critical applications, such as Naval Defense systems. These latter need high-level protection against cyberattacks, which can lead to potential disastrous consequences (e.g., components sabotage, Denial of Service, human deaths). Thus, these infrastructures, before being deployed in mission, need intensive security testing and validation. Moreover, cybersecurity research is required to anticipate future attacks. The research of new countermeasures has to be led on realistic platforms for getting precise and fruitful feedback for cyberdefense. This paper describes an Industrial Control System testbed for Naval Defense cybersecurity research. This realistic testbed implements a representative model of a warship, on which practical attacks and related countermeasures can be safely benchmarked. After describing the features of our physical testbed, we illustrate its relevance by describing four different attack scenarios. This testbed will be very useful in future works to elaborate and validate innovative cyberdefense measures (like knowledge-based and behavior-based intrusion detection) against network and physical process attacks, especially by generating representative datasets.","PeriodicalId":275840,"journal":{"name":"2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"132 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126867661","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Anonymity test attacks and vulnerability indicators for the “Patient characteristics” disclosure in medical articles 匿名测试医学文章中“患者特征”披露的攻击和漏洞指标

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/eurospw55150.2022.00025

Kenta Kitamura, Mhd Irvan, R. Yamaguchi

{"title":"Anonymity test attacks and vulnerability indicators for the “Patient characteristics” disclosure in medical articles","authors":"Kenta Kitamura, Mhd Irvan, R. Yamaguchi","doi":"10.1109/eurospw55150.2022.00025","DOIUrl":"https://doi.org/10.1109/eurospw55150.2022.00025","url":null,"abstract":"In the field of Privacy-Preserving Data Publishing (PPDP), a privacy violation attack based on a bias in the ratio of sensitive attribute values of disclosed information is called a homogeneity attack, and l-diversity has been proposed as an indicator of this vulnerability. In medical articles, especially in clinical trial, the ratio of attribute values is disclosed as “patient characteristics” which include statistical information such as the number of hypertension patients and age distribution of the patient group subject to clinical research. The patient characteristics could also be vulnerable to homogeneity attack but have not been studied. In this paper, we propose three new attack methods similar to the homogeneity attack that violate the anonymity of patient characteristics. We also propose three new indicators similar to l-diversity to evaluate anonymity against such attacks. Experimental results show that our new attacks can point out that actual patient characteristics leaks patient information that should be kept confidential. And the results also show that the new proposed indicators can measure the vulnerability to such attacks.","PeriodicalId":275840,"journal":{"name":"2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"40 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131190175","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Libel Inc: An Analysis of the Libel Site Ecosystem 诽谤公司:诽谤网站生态系统分析

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/EuroSPW55150.2022.00019

Rasika Bhalerao, Damon McCoy

{"title":"Libel Inc: An Analysis of the Libel Site Ecosystem","authors":"Rasika Bhalerao, Damon McCoy","doi":"10.1109/EuroSPW55150.2022.00019","DOIUrl":"https://doi.org/10.1109/EuroSPW55150.2022.00019","url":null,"abstract":"Libel sites publish anonymously submitted un-proven libelous claims about individuals that often include personal information about the subject. The stated goal of the sites is to “warn” the public about an individual but the impact is harassment and ruining the subject's reputation. These individual libelous posts are surfaced when searching for a person's name using an online search engine and can cause a range of harms from emotional to economic. For example, the libelous posts might surface if a potential employer performs a Google search as part of a “background check.” There have been prior news reports of this troubling phenomena but no systematic analysis of the ecosystem. In this paper, we conduct a rigorous analysis of these libel sites, supporting services, and intervention by Google. We discovered and analyzed 9 libel sites, 7 websites for reputation management services, and 12 related websites. We found that all of the libel websites included at least one method of generating revenue. The most common revenue generation method was including advertisements for “reputation management services” which require payment for the removal of a post. We found that all of these removal services were dubious in nature and that the removal policies were akin to extortion. Our analysis of Google's intervention to reduce the visibility of these websites indicated that it appeared to only reduce the visibility of the specific libel post URL but that other URLs containing links to the post or the headline text of the post were still highly ranked. Based on our findings, we make recommendations to many of the stakeholders about potential approaches for mitigating this abusive ecosystem.","PeriodicalId":275840,"journal":{"name":"2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"46 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131404116","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Looking for Honey Once Again: Detecting RDP and SMB Honeypots on the Internet 再次寻找蜂蜜:检测互联网上的RDP和SMB蜜罐

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/eurospw55150.2022.00033

Fabian Franzen, Lion Steger, Johannes Zirngibl, Patrick Sattler

{"title":"Looking for Honey Once Again: Detecting RDP and SMB Honeypots on the Internet","authors":"Fabian Franzen, Lion Steger, Johannes Zirngibl, Patrick Sattler","doi":"10.1109/eurospw55150.2022.00033","DOIUrl":"https://doi.org/10.1109/eurospw55150.2022.00033","url":null,"abstract":"Honeypots are a widely used technique to observe the spread of malware and the emergence of new exploits. Attackers try to avoid connecting to honeypots as they reveal the attacker's methods, tools, and exploits. While different honeypot implementations have been fingerprinted in the past, we see a lack of studies covering Windows-related protocols such as Remote Desktop Protocol (RDP) and Server Message Block (SMB) honeypots. However, these protocols have seen at least two major security vulnerabilities in the past 5 years and are commonly exploited. We adapted existing fingerprinting algorithms to allow an accurate identification of RDP and SMB honeypots checking how implementations behave in error conditions. We present a new improvement, namely the inclusion of system TLS stack features previously not used for honeypot detection. We are the first to perform an internet-wide scan searching for RDP and SMB honeypots. We are able to effectively uncover the presence of two common open-source honeypots for RDP and SMB each. We identified 84 instances of Heralding (RDP), 1123 instances of RDPY (RDP), 60 instances of Impacket (SMB), and 1461 instances of Dionaea (SMB) during our scans. Furthermore, we found several hosts, which do not use Microsoft's SChannel TLS stack, but advertise themselves as Windows machines. This indicates the presence of a Man-in-the-Middle (MitM) box and could be a sign of a honeypot. Eventually, we analyzed how attackers interact with detectable honeypots. We deployed instances of RDP honeypots ourselves and found that credential guessing attackers seem to avoid them. This proves that RDP and SMB honeypots are finger-printable and that even MitM-box-based high-interaction honeypots leave detectable traces.","PeriodicalId":275840,"journal":{"name":"2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"43 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115861538","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Towards NLP-based Processing of Honeypot Logs 基于nlp的蜜罐日志处理研究

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/eurospw55150.2022.00038

Matteo Boffa, Giulia Milan, L. Vassio, I. Drago, M. Mellia, Zied Ben-Houidi

{"title":"Towards NLP-based Processing of Honeypot Logs","authors":"Matteo Boffa, Giulia Milan, L. Vassio, I. Drago, M. Mellia, Zied Ben-Houidi","doi":"10.1109/eurospw55150.2022.00038","DOIUrl":"https://doi.org/10.1109/eurospw55150.2022.00038","url":null,"abstract":"Honeypots are active sensors deployed to obtain information about attacks. In their search for vulnerabilities, attackers generate large volumes of logs, whose analysis is time consuming and cumbersome. We here evaluate whether Natural Language Processing (NLP) approaches can provide meaningful representations to find common traits in attackers' activity. We consider a widely used SSH/Telnet honeypot to record more than 200000 sessions, including 61000 unique shell scripts, some containing sequences of more than 100 Bash commands. We first parse the sessions to separate Bash commands, options and parameters. Next, we project each session in a metric space opposing two common tools used in NLP: Bag of Words and Word2Vec. Last, we leverage a clustering algorithm to aggregate the sessions while offering an instrumental representation of the clustering process. In the end, we obtain few tens of clusters that we analyze to explain the attackers' goals, i.e., obtain system information, inject malicious accounts, download and run executables, etc. Our work is a first step towards automatically identifying attack patterns on honeypots, thus effectively supporting security activities.","PeriodicalId":275840,"journal":{"name":"2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"19 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123738134","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 8

PostCog: A tool for interdisciplinary research into underground forums at scale PostCog:一个大规模地下论坛跨学科研究的工具

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/EuroSPW55150.2022.00016

Ildiko Pete, Jack Hughes, Andrew Caines, A. V. Vu, Harshad Gupta, Alice Hutchings, Ross J. Anderson, P. Buttery

{"title":"PostCog: A tool for interdisciplinary research into underground forums at scale","authors":"Ildiko Pete, Jack Hughes, Andrew Caines, A. V. Vu, Harshad Gupta, Alice Hutchings, Ross J. Anderson, P. Buttery","doi":"10.1109/EuroSPW55150.2022.00016","DOIUrl":"https://doi.org/10.1109/EuroSPW55150.2022.00016","url":null,"abstract":"Underground forums provide useful insights into cybercrime, where researchers analyse underlying economies, key actors, their discussions and interactions, as well as different types of cybercrime. This interdisciplinary topic of study incorporates expertise from diverse areas, including computer science, criminology, economics, psychol-ogy, and other social sciences. Historically, there were sig-nificant challenges around access to data, but there are now research datasets of millions of messages scraped from underground forums. The problems now stem from the size of these datasets and the technical nature of methods and tools available for data sampling and analysis at scale, which make data exploration difficult for non-technical users. Postcoghas been developed to solve this problem. We first provide a survey of prior work into underground forums; this was used to understand the requirements and functionalities valued by researchers, and to inform the design of a data exploration tool. We then describe Postcog,a web application developed to support users from both technical and non-technical backgrounds in forum analyses, such as search, information extraction and cross-forum comparison. The prototype's usability is then evaluated through two user studies with expert users of the Crimebbdataset. Postcogis made available for academic research upon signing an agreement with the Cambridge Cybercrime Centre.","PeriodicalId":275840,"journal":{"name":"2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"117 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126905874","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5

Tampering Detection for Automotive Exhaust Aftertreatment Systems using Long Short-Term Memory Predictive Networks 基于长短期记忆预测网络的汽车尾气后处理系统篡改检测

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/eurospw55150.2022.00043

Roland Bolboacă, P. Haller, Dimitris Kontses, Alexandros Papageorgiou-Koutoulas, S. Doulgeris, Nikolaos Zingopis, Z. Samaras

{"title":"Tampering Detection for Automotive Exhaust Aftertreatment Systems using Long Short-Term Memory Predictive Networks","authors":"Roland Bolboacă, P. Haller, Dimitris Kontses, Alexandros Papageorgiou-Koutoulas, S. Doulgeris, Nikolaos Zingopis, Z. Samaras","doi":"10.1109/eurospw55150.2022.00043","DOIUrl":"https://doi.org/10.1109/eurospw55150.2022.00043","url":null,"abstract":"The act of tampering can be defined as a single event ranging from actions such as resetting the reading of an odometer to more advanced and long-term actions such as manipulation of the vehicle's emission control systems. Tampering, however, requires certain interventions and changes to be made on the vehicle. Recently, the sophistication of certain vehicle sub-systems such as the emission control system, have also increased the sophistication of the tampering devices. Nowadays, tampering involves not only physical changes to certain automotive sub-systems, but also the manipulation of communication signals in order to hide the presence of tampering devices. This paper presents a detection method addressing tampering of the Automotive Exhaust Aftertreatment Systems. The proposed approach leverages Long Short-Term Memory predictive networks as detection models together with Cumulative Sum control charts. The proposed detectors were validated on datasets produced by a state-of-the-art aftertreatment simulation model of a heavy-duty vehicle. The datasets encompass diverse driving scenarios alongside known and unknown (e.g., possible future) tampering methods.","PeriodicalId":275840,"journal":{"name":"2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"14 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125604528","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

The Ethics of Going Deep: Challenges in Machine Learning for Sensitive Security Domains 深入的伦理:敏感安全领域机器学习的挑战

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/EuroSPW55150.2022.00063

Aliai Eusebi, Marie Vasek, E. Cockbain, Enrico Mariconti

引用次数: 2

A Comparative Analysis of UNECE WP.29 R155 and ISO/SAE 21434 UNECE WP.29 R155与ISO/SAE 21434的比较分析

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/eurospw55150.2022.00041

Gianpiero Costantino, M. Vincenzi, I. Matteucci

{"title":"A Comparative Analysis of UNECE WP.29 R155 and ISO/SAE 21434","authors":"Gianpiero Costantino, M. Vincenzi, I. Matteucci","doi":"10.1109/eurospw55150.2022.00041","DOIUrl":"https://doi.org/10.1109/eurospw55150.2022.00041","url":null,"abstract":"In the last years, the increasing number of cyber-attacks on vehicles has shown the importance to implement security solutions within the automotive domain. To reduce the risk that a vehicle or its components get attacked and compromised, two cybersecurity references have been released: UNECE WP.29 R155 and ISO/SAE 21434. In March 2021, the United Nations Economic Commission for Europe (UNECE) published the WP.29 R155 regulation, mandatory in some countries from July 2022 to homologate vehicles' cybersecurity. Officially released in August 2021, ISO/SAE 21434 is a cybersecurity standard which aims to be widely accepted and applied in the engineering of electrical and electronic (E/E) systems for road vehicles. In this work, we describe and analyze the two norms, comparing them to show their points of contact and differences. From our analysis, the two documents, spanned both along the entire life-cycle of a vehicle, can be considered overlapped in some processes, but also complementary to increase the cybersecurity of the vehicle. Finally, we provide a use case of application of the regulation and the standard on an E/E system, reporting the possible limits and implementations.","PeriodicalId":275840,"journal":{"name":"2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127938853","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Automatic Challenge Generation for Hands-on Cybersecurity Training 自动挑战生成动手网络安全培训

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/eurospw55150.2022.00059

Matteo Benzi, Giovanni Lagorio, M. Ribaudo

{"title":"Automatic Challenge Generation for Hands-on Cybersecurity Training","authors":"Matteo Benzi, Giovanni Lagorio, M. Ribaudo","doi":"10.1109/eurospw55150.2022.00059","DOIUrl":"https://doi.org/10.1109/eurospw55150.2022.00059","url":null,"abstract":"Just reading the news is enough to understand how critical cybersecurity and cybersecurity-education have become. Many job positions remain unfilled due to a shortage of a skilled workforce, and universities have opened courses on cybersecurity-related topics to keep up with market demands. In turn, educators are reshaping their educational material and activities to cover both the standard theory of the field and the practice. However, organizing hands-on cybersecurity training is laborious and time consuming. We present Chad, a tool we developed to support instructors in the development and deployment of practical cybersecurity exercises. Chad, an open-source project written in Python, allows teachers to generate multiple different instances of an exercise, guaranteeing that they all share the same difficulty and require the same knowledge to be solved. Our tool also supports the testing of generated exercises, and their deployment, by leveraging technologies like Docker, Wireguard and iptables. Chad has been integrated with Github classroom and field-tested, during a.y. 2021/2022, in the context of a university course on binary analysis. However, its adoption is not limited to such topics or formal education. Indeed, the Github repository contains examples of reversing-engineering challenges for Linux and Windows, and a simple web challenge.","PeriodicalId":275840,"journal":{"name":"2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"66 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126198385","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1