2006 IEEE Information Assurance Workshop最新文献_第5页

A Control Theoretical Approach for Flow Control to Mitigate Bandwidth Attacks 一种缓解带宽攻击的流量控制理论方法

2006 IEEE Information Assurance Workshop Pub Date : 2006-06-21 DOI: 10.1109/IAW.2006.1652116

Sui Song, C. Manikopoulos

{"title":"A Control Theoretical Approach for Flow Control to Mitigate Bandwidth Attacks","authors":"Sui Song, C. Manikopoulos","doi":"10.1109/IAW.2006.1652116","DOIUrl":"https://doi.org/10.1109/IAW.2006.1652116","url":null,"abstract":"Flooding-based distributed denial-of-service (DoS) attack presents a very serious threat to the stability of the Internet. However, current intrusion detection is unreliable and may have high false-positives. Rate-limiting is a better-suited response than complete filtering. Filtering out all the traffic to the victim would greatly damage misclassified flows, whereas rate-limiting still allows some packets to reach the destination and thus keeps connection alive. Allowing some attack packets through is acceptable, since the attack's overall impact depends on the volume of the attack packets. Moreover, if the flow-rate of low-priority is reduced, the high-priority flow would get more chances to access the server they share, which eventually reduce the congestion and improve the throughput of the high-priority flow. Based on tie concept of flow aggregation management architecture (Sui Song, et al., April 2006), we present a flow-based congestion control (FCC) architecture that consists of a flow-based quality-of-service (FQoS) regulator and PID controller. The whole system adopts a control-theoretic approach to adjust the traffic rate of every link (or server) so as to maintain the traffic rates at their desired level. In order to provide more fine-grained differentiated services (or flows) with different weight and maximally limit malicious services (or flows), we propose multilevel packet classification structure. Moreover, in order maximally to block flooding, the flow-based network intrusion detection (Sui Song, et al., April 2006) is used to classify each flow in the network into different priority classes and give different treatment to the flow-rates belonging to different classes. The architecture is shown to be highly flexible service differentiation and robust against different types of flooding attacks, and traditional network traffic control can be implemented using one common framework. This system has been evaluated by using simulated test-bed data. Results showed the success that the system mitigates bandwidth flooding attacks","PeriodicalId":326306,"journal":{"name":"2006 IEEE Information Assurance Workshop","volume":"220 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2006-06-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131611622","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Analysis and Defensive Tools for Social-Engineering Attacks on Computer Systems 计算机系统社会工程攻击的分析与防御工具

2006 IEEE Information Assurance Workshop Pub Date : 2006-06-21 DOI: 10.1109/IAW.2006.1652125

L. Laribee, D.S. Barnes, N. Rowe, C.H. Martell

引用次数: 20

Automatically Building an Information-Security Vulnerability Database 自动建立信息安全漏洞数据库

2006 IEEE Information Assurance Workshop Pub Date : 2006-06-21 DOI: 10.1109/IAW.2006.1652119

A. D. Arnold, B. M. Hyla, N. Rowe

{"title":"Automatically Building an Information-Security Vulnerability Database","authors":"A. D. Arnold, B. M. Hyla, N. Rowe","doi":"10.1109/IAW.2006.1652119","DOIUrl":"https://doi.org/10.1109/IAW.2006.1652119","url":null,"abstract":"Our goal was to collect data from the myriad computer vulnerability notices that exist on the World Wide Web and to mine it for interesting information and patterns. Surprisingly, no single database currently brings together all the various kinds of data from the vulnerability sites. Of particular interest to us was author and discoverer information since this provides valuable information about who is active in information security and occasionally might indicate the authors of exploits; current databases do not connect this to other relevant information. We found that the searchable parameters of the existing vulnerability databases were limited and inconsistent. Consequently, it is very difficult to get complete information about computer vulnerabilities by searching Web sites. Our approach was to bring together this information into a composite database. We did automated data collection from the existing Web vulnerability databases by creating Web bots that traversed Web sites and retrieved selected information from them, then imported the collected Web data into a relational database. A browser provides Web-based access to this database. (J. Steffan, et al., March 2002) and (R. Iyer, et al., Oct. 2003) shows how such information can be used to build models of attacks in the form of graphs, trees, and finite-state machines, and thereby develop methods for system protection","PeriodicalId":326306,"journal":{"name":"2006 IEEE Information Assurance Workshop","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2006-06-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114286103","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 9

Post-Quantum Diffie-Hellman and Symmetric Key Exchange Protocols 后量子Diffie-Hellman和对称密钥交换协议

2006 IEEE Information Assurance Workshop Pub Date : 2006-06-21 DOI: 10.1109/IAW.2006.1652122

Xiangdong Li, L. Leung, A. Kwan, Xiaowen Zhang, D. Kahanda, M. Anshel

引用次数: 4

Effects of Denial of Sleep Attacks on Wireless Sensor Network MAC Protocols 拒绝睡眠攻击对无线传感器网络MAC协议的影响

2006 IEEE Information Assurance Workshop Pub Date : 2006-06-21 DOI: 10.1109/IAW.2006.1652109

David Raymond, Randy Marchany, M. Brownfield, Scott Midkiff

{"title":"Effects of Denial of Sleep Attacks on Wireless Sensor Network MAC Protocols","authors":"David Raymond, Randy Marchany, M. Brownfield, Scott Midkiff","doi":"10.1109/IAW.2006.1652109","DOIUrl":"https://doi.org/10.1109/IAW.2006.1652109","url":null,"abstract":"As wireless platforms get less expensive and more powerful, the promise of wide-spread use for everything from health monitoring to military sensing continues to increase. Like other networks, sensor networks are vulnerable to malicious attack, however, the hardware simplicity of these devices makes defense mechanisms designed for traditional networks infeasible. This paper explores the denial-of-sleep attack, in which a sensor node's power supply is targeted. Attacks of this type can reduce sensor lifetime from years to days and have a devastating impact on a sensor network. This paper classifies sensor network denial-of-sleep attacks in terms of an attacker's knowledge of the MAC layer protocol and ability to bypass authentication and encryption protocols. Attacks from each classification are then modeled to show the impacts on three sensor network MAC protocols: S-MAC, T-MAC, and G-MAC. A framework for preventing denial-of-sleep attacks in sensor networks is also introduced. With full protocol knowledge and an ability to penetrate link-layer encryption, all wireless sensor network MAC protocols are susceptible to a full domination attack which reduces network lifetime to the minimum possible by maximizing the power consumption of the nodes' radio subsystem. Even without the ability to penetrate encryption, subtle attacks can be launched that reduce network lifetime by orders of magnitude. If sensor networks are to live up to current expectations, they must be robust in the face of network attacks, to include denial-of-sleep","PeriodicalId":326306,"journal":{"name":"2006 IEEE Information Assurance Workshop","volume":"72 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2006-06-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121826295","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 24

Embedding Forensic Capabilities into Networks: Addressing Inefficiencies in Digital Forensics Investigations 将取证能力嵌入网络:解决数字取证调查中的低效率问题

2006 IEEE Information Assurance Workshop Pub Date : 2006-06-21 DOI: 10.1109/IAW.2006.1652087

Barbara E. Endicott-Popovsky, D. Frincke

引用次数: 27

Evaluation of Run-Time Detection of Self-Replication in Binary Executable Malware 二进制可执行恶意软件自复制运行时检测的评估

2006 IEEE Information Assurance Workshop Pub Date : 2006-06-21 DOI: 10.1109/IAW.2006.1652094

A. Volynkin, V. Skormin, D. Summerville, J. Moronski

引用次数: 7

A Dynamically Modified Privilege Control Policy 动态修改的权限控制策略

2006 IEEE Information Assurance Workshop Pub Date : 2006-06-21 DOI: 10.1109/IAW.2006.1652115

S. Qing, Qingni Shen, Qingguang Ji, Yeping He

{"title":"A Dynamically Modified Privilege Control Policy","authors":"S. Qing, Qingni Shen, Qingguang Ji, Yeping He","doi":"10.1109/IAW.2006.1652115","DOIUrl":"https://doi.org/10.1109/IAW.2006.1652115","url":null,"abstract":"Trusted systems typically include trusted processes which possess special privileges. Such privileges can circumvent certain security checks but should be used in a controlled manner. This paper proposes a privilege control policy called DMPC (dynamically modified privilege control). It has two components: a hybrid privilege control model and a new POSIX (portable operating system interface) capability inheritance algorithm. The privilege control model in DMPC is a combination of role based access control (RBAC), domain and type enforcement (DTE) and POSIX capability mechanism while the capability inheritance algorithm serves as an engine to effectively enforce the hybrid privilege control model on a secure operating system. The DMPC's design has given a high priority to supporting least privilege to a finer level of granularity on trusted systems. Additional (sub-) goals for the DMPC policy are: realizing separation of duties among privileged users, achieving separation of trusted functions from untrusted ones and providing a flexible and dynamically mediated capability mechanism. We show that RBAC alone is insufficient to enforce the principle of least privilege in a dynamic context, and that DTE and POSIX capability mechanism can successfully be conjugated with RBAC for this purpose. We also describe an implementation of the DMPC policy on a real system and report on experimental results","PeriodicalId":326306,"journal":{"name":"2006 IEEE Information Assurance Workshop","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2006-06-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127580767","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Visual Reverse Turing Tests: A False Sense of Security 视觉逆向图灵测试:一种虚假的安全感

2006 IEEE Information Assurance Workshop Pub Date : 2006-06-21 DOI: 10.1109/IAW.2006.1652110

M. Ponec

引用次数: 6

Using Active Scanning to Identify Wireless NICs 使用主动扫描识别无线网卡

2006 IEEE Information Assurance Workshop Pub Date : 2006-06-21 DOI: 10.1109/IAW.2006.1652101

C. Corbett, R. Beyah, John A Copeland

{"title":"Using Active Scanning to Identify Wireless NICs","authors":"C. Corbett, R. Beyah, John A Copeland","doi":"10.1109/IAW.2006.1652101","DOIUrl":"https://doi.org/10.1109/IAW.2006.1652101","url":null,"abstract":"Computer networks have become increasingly ubiquitous. However, with the increase in networked applications, there has also been an increase in difficulty to manage and secure these networks. The proliferation of 802.11 wireless networks has heightened this problem by extending networks beyond physical boundaries. We propose the use of spectral analysis to identify the type of wireless network interface card (NIC). This mechanism can be applied to support the detection of unauthorized systems that use NICs which are different from that of a legitimate system. We focus on active scanning, a vaguely specified mechanism required by the 802.11 standard that is implemented in the hardware and software of the wireless NIC. We show that the implementation of this function influences the transmission patterns of a wireless stream that are observable through traffic analysis. Our mechanism for NIC identification uses signal processing to analyze the periodicity embedded in the wireless traffic caused by active scanning. A stable spectral profile is created from the periodic components of the traffic and used for the identity of the wireless NIC. We show that we can distinguish between NICs manufactured by different vendors using the spectral profile","PeriodicalId":326306,"journal":{"name":"2006 IEEE Information Assurance Workshop","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2006-06-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122210467","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 31