2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)最新文献_第5页

Applying Process Discovery to Cybersecurity Training: An Experience Report 将流程发现应用于网络安全培训:一份经验报告

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/eurospw55150.2022.00047

M. Macák, R. Ošlejšek, Barbora Buhnova

{"title":"Applying Process Discovery to Cybersecurity Training: An Experience Report","authors":"M. Macák, R. Ošlejšek, Barbora Buhnova","doi":"10.1109/eurospw55150.2022.00047","DOIUrl":"https://doi.org/10.1109/eurospw55150.2022.00047","url":null,"abstract":"Quality improvement of practical cybersecurity training is challenging due to the process-oriented nature of this learning domain. Event logs provide only a sparse preview of trainees' behavior in a form that is difficult to analyze. Process mining has great potential in converting events into behavioral graphs that could provide better cognitive features for understanding users' behavior than the raw data. However, practical usability for learning analytics is affected by many aspects. This paper aims to provide an experience report summarizing key features and obstacles in integrating process discovery into cyber ranges. We describe our lessons learned from applying process mining techniques to data captured in a cyber range, which we have been developing and operating for almost ten years. We discuss lessons learned from the whole workflow that covers data preprocessing, data mapping, and the utilization of process models for the post-training analysis of Capture the Flag games. Tactics addressing scalability are explicitly discussed because scalability has proven to be a challenging task. Interactive data mapping and Capture the Flag specific features are used to address this issue.","PeriodicalId":275840,"journal":{"name":"2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"81 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126995654","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Ethics in Security Research: Visions, Reality, and Paths Forward 安全研究中的伦理学:愿景、现实和前进的道路

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/eurospw55150.2022.00064

Yiming Zhang, Mingxuan Liu, Mingming Zhang, Chaoyi Lu, Haixin Duan

{"title":"Ethics in Security Research: Visions, Reality, and Paths Forward","authors":"Yiming Zhang, Mingxuan Liu, Mingming Zhang, Chaoyi Lu, Haixin Duan","doi":"10.1109/eurospw55150.2022.00064","DOIUrl":"https://doi.org/10.1109/eurospw55150.2022.00064","url":null,"abstract":"Ethics has become a prevalent and important criterion for academic research. However, achieving ethical compliance in practice is a highly complex and specialized task. In the field of computer security research, although top-tier conferences all have set out visions for ethical compliance, researchers may encounter practical dilemmas such as the lack of assistance from legal departments and the absence of specific domain guidelines, leading to various realistic obstacles to ethical treatment. This paper provides a comprehensive investigation of ethical considerations in computer security research. We first summarize the ethical requirements of top-tier security and network conferences. Then, based on a survey of 6,078 academic papers and an online investigation of 248 researchers mainly from a Chinese security community, we reveal the current status and practical issues of ethical considerations in security research. In particular, given the plight of the lack of authoritative ethical guidance, we offer a series of suggestions on how researchers at institutions without authoritative departments could best mitigate ethical risks. We also raise several open questions, and expect to help seek paths towards better ethical compliance for the security community.","PeriodicalId":275840,"journal":{"name":"2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130150788","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

ATVSA: Vehicle Driver Profiling for Situational Awareness ATVSA:用于态势感知的车辆驾驶员分析

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/eurospw55150.2022.00042

Rashid Khan, N. Saxena, O. Rana, P. Gope

引用次数: 1

Blockchain and Federated Learning-enabled Distributed Secure and Privacy-preserving Computing Architecture for IoT Network 面向物联网网络的区块链和联邦学习分布式安全和隐私保护计算架构

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/EuroSPW55150.2022.00008

P. Sharma, P. Gope, Deepak Puthal

{"title":"Blockchain and Federated Learning-enabled Distributed Secure and Privacy-preserving Computing Architecture for IoT Network","authors":"P. Sharma, P. Gope, Deepak Puthal","doi":"10.1109/EuroSPW55150.2022.00008","DOIUrl":"https://doi.org/10.1109/EuroSPW55150.2022.00008","url":null,"abstract":"With the adoption of the 5G network, the exponen-tial increase in the volume of data generated by the Internet of Things (IoT) devices, pushes the system to learn the model locally to support real-time applications. However, it also raises concerns about the security and privacy of local nodes and users. In addition, the approach such as collaborative learning where local nodes participate in the learning process of global model also raise critical concern regarding the cyber resilience of the network architecture. To address these issues, in this article, we identify the research gaps and pro-pose a blockchain and federated learning-enabled distributed secure and privacy-preserving computing architecture for IoT network. The proposed model introduces the lightweight authentication and model training algorithms to build secure and robust system. The proposed model also addresses the reward and penalty issues of the collaborative learning with local nodes and propose a reward system scheme. We con-duct the experimental analysis of the proposed model based on various parametric metrics to assess the effectiveness of the model. The experimental result shows that the proposed model is effective and capable of providing a cyber-resilience system.","PeriodicalId":275840,"journal":{"name":"2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133922123","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Two de-anonymization attacks on real-world location data based on a hidden Markov model 两种基于隐马尔可夫模型的真实世界位置数据去匿名化攻击

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/eurospw55150.2022.00062

S. N. Eshun, P. Palmieri

{"title":"Two de-anonymization attacks on real-world location data based on a hidden Markov model","authors":"S. N. Eshun, P. Palmieri","doi":"10.1109/eurospw55150.2022.00062","DOIUrl":"https://doi.org/10.1109/eurospw55150.2022.00062","url":null,"abstract":"The increasing demand for smart context-aware services and the widespread use of location-based services (LBS) have resulted in the proliferation of mobile devices equipped with geolocation sensors (including GPS, geomagnetic field sensor, accelerometer, proximity sensor, et cetera). As a result, service providers and telecommunications companies can collect massive mobility datasets, often for millions of subscribers. To provide a degree of privacy, dataset owners normally replace personal identifiers such as name, address, and social security number (SSN) with pseudorandom identifiers prior to publication or sale. However, it has been repeatedly shown how sensitive information can be easily extracted or inferred from individuals' mobility data even when personal identifiers are removed. Knowledge of the extent to which location data can be de-anonymized is therefore crucial, in order to design appropriate privacy mechanisms that can prevent re-identification. In this paper, we propose and implement two novel and highly effective de-anonymization techniques: the Forward, and the KL algorithms. Our work utilizes a hidden Markov model (which incorporates spatio-temporal trajectories) in a novel way to generate user mobility profiles for target users. Using a real-world reference dataset containing mobility trajectories from the city of Shanghai (GeoLife, a reference dataset also used in previous studies), we evaluate the robustness of the proposed attack techniques. The results show that our attack techniques successfully re-identify up to 85% anonymized users. This significantly exceeds current comparable de-anonymization techniques, which have a success rate of 40% to 45%.","PeriodicalId":275840,"journal":{"name":"2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"30 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114813863","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Temporal Analysis of X.509 Revocations and their Statuses X.509吊销及其状态的时间分析

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/eurospw55150.2022.00032

A. Halim, Max Danielsson, M. Arlitt, Niklas Carlsson

引用次数: 1

A Bad IDEa: Weaponizing uncontrolled online-IDEs in availability attacks 一个坏主意:在可用性攻击中使用不受控制的在线ide

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/EuroSPW55150.2022.00015

Shreyas Srinivasa, Dimitrios Georgoulias, J. Pedersen, Emmanouil Vasilomanolakis

{"title":"A Bad IDEa: Weaponizing uncontrolled online-IDEs in availability attacks","authors":"Shreyas Srinivasa, Dimitrios Georgoulias, J. Pedersen, Emmanouil Vasilomanolakis","doi":"10.1109/EuroSPW55150.2022.00015","DOIUrl":"https://doi.org/10.1109/EuroSPW55150.2022.00015","url":null,"abstract":"Botnets are an ongoing threat to the cyber world and can be utilized to carry out DDoS attacks of high magnitude. From the botmaster's perspective, there is a constant need for deploying more effective botnets and discovering new ways to bolster their bot ranks. Integrated Development Environments (IDEs) have been essential for software developers to write and compile source code. The increasing need for remote work and collaborative workspaces have led to the IDE-as-a-service paradigm that offers online code editing and compilation with multiple language support. In this paper, we show that a multitude of online IDEs do not run control checks on the user code and can be therefore lever-aged by a botnet. We examine the concept of uncontrolled execution environments and present a proof of concept to show how uncontrolled online-IDEs can be weaponized to perform large-scale attacks by a botnet. Overall, we detect a total of 719 online-IDEs with uncontrolled execution environments and limited sandboxing. Lastly, as ethical disclosure, we inform the IDE developers and service providers of the vulnerabilities and propose countermeasures.","PeriodicalId":275840,"journal":{"name":"2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"113 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116687600","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Ethical Practices for Security Research with At-Risk Populations 高危人群安全研究的伦理实践

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/eurospw55150.2022.00065

Rasika Bhalerao, Vaughn Hamilton, Allison McDonald, Elissa M. Redmiles, Angelika Strohmayer

引用次数: 11

Aligning a Serious Game, Secure Programming and CyBOK-Linked Learning Outcomes 调整一个严肃的游戏，安全编程和cybok相关的学习成果

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/eurospw55150.2022.00058

Léon McGregor, Sheung Chi Chan, Szymon Wlodarczyk, Manuel Maarek

引用次数: 0

Characterizing Building Automation System Attacks and Attackers 表征楼宇自动化系统攻击和攻击者

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2022-06-01 DOI: 10.1109/EuroSPW55150.2022.00020

Martino Tommasini, Martin Rosso, E. Zambon, Luca Allodi, J. D. Hartog

引用次数: 1