2013 Eighth Asia Joint Conference on Information Security最新文献

Detecting and Preventing Drive-By Download Attack via Participative Monitoring of the Web 通过参与式Web监控检测和防止驱动下载攻击

2013 Eighth Asia Joint Conference on Information Security Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.15

T. Matsunaka, J. Urakawa, A. Kubota

{"title":"Detecting and Preventing Drive-By Download Attack via Participative Monitoring of the Web","authors":"T. Matsunaka, J. Urakawa, A. Kubota","doi":"10.1109/ASIAJCIS.2013.15","DOIUrl":"https://doi.org/10.1109/ASIAJCIS.2013.15","url":null,"abstract":"Drive-by Download Attack (DBD) is one of the major threats on the web infrastructure. DBD attacks are triggered by user access to a malicious website and force users to download malware by exploiting the vulnerabilities of web browsers or plugins. Malicious websites are ephemeral. Therefore, it is necessary to gather fresh information related to malicious activities to detect and prevent such attacks. In this paper, we propose a framework that combats with DBD attacks with users' voluntary monitoring of the web. This framework tackles the two issues: ways to obtain up-to-date information related malicious activities and ways to provide up-to-date information to the world. The framework aims to realize a security ecosystem: users actively offer information about their activities on the web (e.g. access URL, download contents), and security analysts inspect the information to detect new threats and devise countermeasures for any new threats and then provide the countermeasures to users as feedback. The framework consists of sensors located on the user side and a centralized center located on the network side. Sensors are deployed in the web browser, in web proxies, and DNS servers. Sensors monitors the access URLs download contents, the method of triggering the link events (e.g. mouse click, move, redirected by the server), then the sensors report the data to the center. The center analyzes the data, derives the statistical data and the web link structure, and detects new threats by facilitating the characteristics of malicious web pages. This paper also shows a real world example that demonstrates the potential of our framework. The example implies that our focus on the change of the web link structure can detect illegal falsification of web pages. Our framework can obtain long-term data on how many hosts users are forced to access by the access of a web page, so we believe that our framework can distinguish legitimate changes in web pages with compromised changes.","PeriodicalId":286298,"journal":{"name":"2013 Eighth Asia Joint Conference on Information Security","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2013-07-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129023176","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

Cryptanalysis on RFID Authentications Using Minimum Disclosure Approach 基于最小披露方法的RFID认证密码分析

2013 Eighth Asia Joint Conference on Information Security Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.13

H. Chien

引用次数: 0

Preventing Abuse of Cookies Stolen by XSS 防止滥用Cookies被盗的XSS

2013 Eighth Asia Joint Conference on Information Security Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.20

H. Takahashi, Kenji Yasunaga, M. Mambo, Kwangjo Kim, H. Youm

引用次数: 15

A Scripting Language for Automating Secure Multiparty Computation 一种自动化安全多方计算的脚本语言

2013 Eighth Asia Joint Conference on Information Security Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.27

Kung Chen, T. Hsu, C. Liau, Da-Wei Wang

引用次数: 0

Memory Forensics for Key Evidence Investigations in Case Illustrations 案例插图中关键证据调查的记忆取证

2013 Eighth Asia Joint Conference on Information Security Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.22

Ya-Ting Chang, Min-Ju Chung, Chin-Feng Lee, Cheng-Ta Huang, Shiuh-Jeng Wang

{"title":"Memory Forensics for Key Evidence Investigations in Case Illustrations","authors":"Ya-Ting Chang, Min-Ju Chung, Chin-Feng Lee, Cheng-Ta Huang, Shiuh-Jeng Wang","doi":"10.1109/ASIAJCIS.2013.22","DOIUrl":"https://doi.org/10.1109/ASIAJCIS.2013.22","url":null,"abstract":"Typically instant messaging software has to install inside the computer. By this way, the evidence could be therefore probed from the relative paths after operating it by the forensic procedures. Accompanying the appearance of the Web version of the instant messaging, this situation is changed accordingly. It has become a new challenge about the Information-volatile attributes and the data generated by the Web version of instant messaging. The chat messages will not leave any records in the hard disk by the Web version of instant messaging. The methods of forensic investigation are bound to change. However, during the running process, part of or the entire records will be dumped in the memory, the paging file and unallocated hard disk space. In this paper, we use the common instant messaging software \"Skype\" and Web version of \"Facebook Messenger\" as the target-cases. Because of the memory features mentioned above, some temporary volatile data will be collected by memory forensic technology. We illustrate our memory forensic technology by the two cases and show how to collect key-evidence in the forensic procedures step by step. In our scheme, we propose the forensic procedure to obtain the effective evidence such as the user's login account, password, contact list, and conversation records, etc. We turn out that the crime scene is able to be reconstructed by the key-evidence we seize in the Web version of instant messaging.","PeriodicalId":286298,"journal":{"name":"2013 Eighth Asia Joint Conference on Information Security","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2013-07-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121031333","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 6

Suspicious URL Filtering Based on Logistic Regression with Multi-view Analysis 基于多视图逻辑回归的可疑URL过滤

2013 Eighth Asia Joint Conference on Information Security Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.19

Ke-Wei Su, Kuo-Ping Wu, Hahn-Ming Lee, Te-En Wei

{"title":"Suspicious URL Filtering Based on Logistic Regression with Multi-view Analysis","authors":"Ke-Wei Su, Kuo-Ping Wu, Hahn-Ming Lee, Te-En Wei","doi":"10.1109/ASIAJCIS.2013.19","DOIUrl":"https://doi.org/10.1109/ASIAJCIS.2013.19","url":null,"abstract":"The current malicious URLs detecting techniques based on whole URL information are hard to detect the obfuscated malicious URLs. The most precise way to identify a malicious URL is verifying the corresponding web page contents. However, it costs very much in time, traffic and computing resource. Therefore, a filtering process that detecting more suspicious URLs which should be further verified is required in practice. In this work, we propose a suspicious URL filtering approach based on multi-view analysis in order to reduce the impact from URL obfuscation techniques. URLs are composed of several portions, each portion has a specific use. The proposed method intends to learn the characteristics from multiple portions (multi-view) of URLs for giving the suspicion level of each portion. Adjusting the suspicion threshold of each portion, the proposed system would select the most suspicious URLs. This work uses the real dataset from T. Co. to evaluate the proposed system. The requests from T. Co. are (1) detection rate should be less than 25%, (2) missing rate should be lower than 25%, and (3) the process with one hour data should be end in an hour. The experiment results show that our approach is effective, is capable to reserve more malicious URLs in the selected suspicious ones and satisfy the requests given by practical environment, such as T. Co. daily works.","PeriodicalId":286298,"journal":{"name":"2013 Eighth Asia Joint Conference on Information Security","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2013-07-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116078180","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 19

Present Cyber Threat Management (Methodologies to Mitigate Evolving Cyber-Attacks) 当前网络威胁管理(缓解不断演变的网络攻击的方法)

2013 Eighth Asia Joint Conference on Information Security Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.24

B. G. Mawudor

引用次数: 1

Detect Zero by Using Symmetric Homomorphic Encryption 利用对称同态加密检测零

2013 Eighth Asia Joint Conference on Information Security Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.8

D. Guan, Chen-Yu Tsai, E. Zhuang

引用次数: 6

Secure Certificateless Signature Scheme Supporting Batch Verification 支持批量验证的安全无证书签名方案

2013 Eighth Asia Joint Conference on Information Security Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.9

Chun-I Fan, P. Ho, Jheng-Jia Huang, Yi-Fan Tseng

引用次数: 4

Design and Implementation of Digital Forensic Software for iPhone iPhone数字取证软件的设计与实现

2013 Eighth Asia Joint Conference on Information Security Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.21

Chung-Nan Chen, R. Tso, Chung-Huang Yang

引用次数: 6