2013 International Conference on Availability, Reliability and Security最新文献_第5页

Evaluation of Airport Security Training Programs: Perspectives and Issues 机场保安培训计划的评估:观点和问题

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.100

W. Shim, F. Massacci, M. D. Gramatica, A. Tedeschi, A. Pollini

引用次数: 0

Reconsidering Intrusion Monitoring Requirements in Shared Cloud Platforms 重新考虑共享云平台中的入侵监控需求

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.83

Kahina Lazri, S. Laniepce, J. Ben-othman

{"title":"Reconsidering Intrusion Monitoring Requirements in Shared Cloud Platforms","authors":"Kahina Lazri, S. Laniepce, J. Ben-othman","doi":"10.1109/ARES.2013.83","DOIUrl":"https://doi.org/10.1109/ARES.2013.83","url":null,"abstract":"Multi-tenancy is the core feature that enables efficiency and cost effectiveness of cloud computing. However, it brings several new security concerns. Ensuring 'strong isolation' between co-localized tenants remains the most critical issue. This work aims at highlighting new attack strategies brought by the resource sharing paradigm in multi-tenant elastic IaaS Clouds in order to understand impacts of these attacks on the design of Intrusion Detection Systems in Cloud. The first part of this paper surveys the literature related to accepted vulnerabilities. Several Proofs of Concept are described and classified according to the results of the exploitation of these vulnerabilities. In the second part, we argue the existence of new attack strategies able to take advantage of the mechanisms which enable autonomic elasticity. These mechanisms are by nature sensitive to VMs resource consumption which can be easily manipulated by attacks. Finally, we give a representation of the presented vulnerabilities to engage a discussion on the limitations of pure user-centric security monitoring approaches for guaranteeing VM security.","PeriodicalId":302747,"journal":{"name":"2013 International Conference on Availability, Reliability and Security","volume":"18 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-09-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115452285","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 8

Social Issues of Big Data and Cloud: Privacy, Confidentiality, and Public Utility 大数据与云的社会问题:隐私、保密与公用事业

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.66

Koichiro Hayashi

{"title":"Social Issues of Big Data and Cloud: Privacy, Confidentiality, and Public Utility","authors":"Koichiro Hayashi","doi":"10.1109/ARES.2013.66","DOIUrl":"https://doi.org/10.1109/ARES.2013.66","url":null,"abstract":"Business people and academia are now excited about Big Data and Cloud Computing as the new and most innovative means for enhancing productivity and customer satisfaction. Simultaneously, there are strong concerns about privacy not only among privacy advocates but among consumers in general, and how to strike a right balance is the main theme in every field of science. However, it is quite strange that very little attention has been paid to the concept of confidentiality, which must be the core element of privacy. This paper first tries to analyze the following two dichotomies as a basis for possible policy considerations: (1) privacy approach in the United States versus confidentiality approach in the United Kingdom, though they share the same common law tradition, and (2) clear demarcation between Information Service and Telecommunications in the United States, dating back to the Computer Inquiry in the 1970s. This paper also analyzes the features of the Cloud and discusses the possibility of treating it as a new type of Public Utility, namely Information Utility. This hypothesis should be rejected, because there are crucial differences in market structures, regardless of clear similarities in service features. Instead, this paper emphasizes the necessity of protecting confidentiality as an industrial norm. Taking into account the long tradition of free market for computing industries, self-regulation is basically preferable to government regulation. But from a different viewpoint of \"nudge\", a hybrid combination of libertarianism and paternalism, this paper concludes by proposing five short recommendations including fair contract terms as well as unbundling confidentiality from privacy.","PeriodicalId":302747,"journal":{"name":"2013 International Conference on Availability, Reliability and Security","volume":"929 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-09-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126079160","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 18

A Reference Model of Information Assurance & Security 信息保障的参考模型安全

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.72

Yulia Cherdantseva, Jeremy Hilton

引用次数: 133

A Generation Method of Cryptographic Keys for Enterprise Communication Systems 企业通信系统密钥的生成方法

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.54

Aleksandar Hudic, E. Revell, D. Simos

引用次数: 0

Model-Based Generation of Synthetic Disk Images for Digital Forensic Tool Testing 基于模型的数字取证工具合成磁盘图像生成

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.65

York Yannikos, Christian Winter

引用次数: 4

Secure Engineering and Modelling of a Metering Devices System 计量装置系统的安全工程与建模

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.56

J. Ruiz, M. Arjona, A. Maña, N. Carstens

{"title":"Secure Engineering and Modelling of a Metering Devices System","authors":"J. Ruiz, M. Arjona, A. Maña, N. Carstens","doi":"10.1109/ARES.2013.56","DOIUrl":"https://doi.org/10.1109/ARES.2013.56","url":null,"abstract":"This paper presents a security engineering process for the modelling of security-sensitive systems using a real use case of metering devices. The process provides a security framework that can be used with other existing processes (such as the agile ones). It helps to develop and model systems bearing in mind their heterogeneity, real-time and dynamic behaviors. Besides, due to the critical nature of some of these systems (nuclear, emergency systems, military, etc.) it provides tools for identifying, working and solving security threats by using the knowledge of domain experts. This is very important because threats, properties, solutions, etc. that are valid or relevant in a given domain, are not applicable to other domains and are subject to constant changes. The security requirements of the systems are fulfilled by means of domain-specific security knowledge. These artefacts contain the specific information of a domain (security properties, elements, assumptions, threats, tests, etc.). The solutions are presented as Security Patterns. Each one describes an implementation solution by using one or several Security Building Blocks (SBBs). The security engineering process presented here describes how to model a security-enhanced system model using a library of domain security knowledge. The process has been developed along with a Magic Draw plugin that covers all the possible functionalities, making the work with the models and the security elements very simple and easy for the user.","PeriodicalId":302747,"journal":{"name":"2013 International Conference on Availability, Reliability and Security","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-09-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133672376","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

On Secure Multi-party Computation in Bandwidth-Limited Smart-Meter Systems 有限带宽智能电表系统中的安全多方计算研究

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.137

Mario Kirschbaum, Thomas Plos, Jörn-Marc Schmidt

引用次数: 8

GVScan: Scanning Networks for Global Vulnerabilities GVScan:扫描网络以查找全局漏洞

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.88

F. Baiardi, Fabio Corò, F. Tonelli, Luca Guidi

引用次数: 23

Modelling and Analysis of Release Order of Security Algorithms Using Stochastic Petri Nets 基于随机Petri网的安全算法释放顺序建模与分析

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.58

Suliman A. Alsuhibany, A. Moorsel

{"title":"Modelling and Analysis of Release Order of Security Algorithms Using Stochastic Petri Nets","authors":"Suliman A. Alsuhibany, A. Moorsel","doi":"10.1109/ARES.2013.58","DOIUrl":"https://doi.org/10.1109/ARES.2013.58","url":null,"abstract":"While security algorithms are utilized to protect system resources from misuse, using a single algorithm such as CAPTCHAs and Spam-Filters as a defence mechanism can work to protect a system against current attacks. However, as attackers learn from their attempts, this algorithm will eventually become useless and the system is no longer protected. We propose to look at a set of algorithms as a combined defence mechanism to maximize the time taken by attackers to break a system. When studying sets of algorithms, diverse issues arise in terms of how to construct them and in which order or in which combination to release them. In this paper, we propose a model based on Stochastic Petri Nets, which describe the interaction between an attacker, the set of algorithms used by a system, and the knowledge gained by the attacker with each attack. In particular, we investigate the interleaving of dependent algorithms, which have overlapping rules, with independent algorithms, which have a disjoint set of rules. Based on the proposed model, we have analyzed and evaluated how the order can impact the time taken by an attacker to break a set of algorithms. Given the mean time to security failure (MTTSF) for a system to reach a failure state, we identify an improved approach to the release order of a set of algorithms in terms of maximizing the time taken by the attacker to break them. Further, we show a prediction of the attacker's knowledge acquisition progress during the attack process.","PeriodicalId":302747,"journal":{"name":"2013 International Conference on Availability, Reliability and Security","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-09-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122461878","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 4