2016 IEEE Security and Privacy Workshops (SPW)最新文献

A Model-Based Approach to Predicting the Performance of Insider Threat Detection Systems 基于模型的内部威胁检测系统性能预测方法

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.14

Shannon C. Roberts, J. Holodnak, Trang Nguyen, Sophia Yuditskaya, Maja Milosavljevic, W. Streilein

引用次数: 11

DroidScribe: Classifying Android Malware Based on Runtime Behavior DroidScribe:基于运行时行为分类Android恶意软件

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.25

Santanu Kumar Dash, Guillermo Suarez-Tangil, Salahuddin J. Khan, K. Tam, Mansour Ahmadi, Johannes Kinder, L. Cavallaro

{"title":"DroidScribe: Classifying Android Malware Based on Runtime Behavior","authors":"Santanu Kumar Dash, Guillermo Suarez-Tangil, Salahuddin J. Khan, K. Tam, Mansour Ahmadi, Johannes Kinder, L. Cavallaro","doi":"10.1109/SPW.2016.25","DOIUrl":"https://doi.org/10.1109/SPW.2016.25","url":null,"abstract":"The Android ecosystem has witnessed a surge in malware, which not only puts mobile devices at risk but also increases the burden on malware analysts assessing and categorizing threats. In this paper, we show how to use machine learning to automatically classify Android malware samples into families with high accuracy, while observing only their runtime behavior. We focus exclusively on dynamic analysis of runtime behavior to provide a clean point of comparison that is dual to static approaches. Specific challenges in the use of dynamic analysis on Android are the limited information gained from tracking low-level events and the imperfect coverage when testing apps, e.g., due to inactive command and control servers. We observe that on Android, pure system calls do not carry enough semantic content for classification and instead rely on lightweight virtual machine introspection to also reconstruct Android-level inter-process communication. To address the sparsity of data resulting from low coverage, we introduce a novel classification method that fuses Support Vector Machines with Conformal Prediction to generate high-accuracy prediction sets where the information is insufficient to pinpoint a single family.","PeriodicalId":341207,"journal":{"name":"2016 IEEE Security and Privacy Workshops (SPW)","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124320266","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 162

LINEBACKER: LINE-Speed Bio-Inspired Analysis and Characterization for Event Recognition LINEBACKER:事件识别的线速仿生分析和表征

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.44

C. Oehmen, P. Bruillard, Brett D. Matzke, Aaron R. Phillips, Keith T. Star, Jeffrey L. Jensen, Doug Nordwall, S. R. Thompson, Elena S. Peterson

{"title":"LINEBACKER: LINE-Speed Bio-Inspired Analysis and Characterization for Event Recognition","authors":"C. Oehmen, P. Bruillard, Brett D. Matzke, Aaron R. Phillips, Keith T. Star, Jeffrey L. Jensen, Doug Nordwall, S. R. Thompson, Elena S. Peterson","doi":"10.1109/SPW.2016.44","DOIUrl":"https://doi.org/10.1109/SPW.2016.44","url":null,"abstract":"The cyber world is a complex domain, with digital systems mediating a wide spectrum of human and machine behaviors. While this is enabling a revolution in the way humans interact with each other and data, it also is exposing previously unreachable infrastructure to a worldwide set of actors. Existing solutions for intrusion detection and prevention that are signature-focused typically seek to detect anomalous and/or malicious activity for the sake of preventing or mitigating negative impacts. But a growing interest in behavior-based detection is driving new forms of analysis that move the emphasis from static indicators (e.g. rule-based alarms or tripwires) to behavioral indicators that accommodate a wider contextual perspective. Similar to cyber systems, biosystems have always existed in resource-constrained hostile environments where behaviors are tuned by context. So we look to biosystems as an inspiration for addressing behavior-based cyber challenges. In this paper, we introduce LINEBACKER, a behavior-model based approach to recognizing anomalous events in network traffic and present the design of this approach of bio-inspired and statistical models working in tandem to produce individualized alerting for a collection of systems. Preliminary results of these models operating on historic data are presented along with a plugin to support real-world cyber operations.","PeriodicalId":341207,"journal":{"name":"2016 IEEE Security and Privacy Workshops (SPW)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130034269","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

DataTags, Data Handling Policy Spaces and the Tags Language 数据标签，数据处理策略空间和标签语言

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.11

Michael Bar-Sinai, L. Sweeney, M. Crosas

{"title":"DataTags, Data Handling Policy Spaces and the Tags Language","authors":"Michael Bar-Sinai, L. Sweeney, M. Crosas","doi":"10.1109/SPW.2016.11","DOIUrl":"https://doi.org/10.1109/SPW.2016.11","url":null,"abstract":"Widespread sharing of scientific datasets holds great promise for new scientific discoveries and great risks for personal privacy. Dataset handling policies play the critical role of balancing privacy risks and scientific value. We propose an extensible, formal, theoretical model for dataset handling policies. We define binary operators for policy composition and for comparing policy strictness, such that propositions like \"this policy is stricter than that policy\" can be formally phrased. Using this model, The policies are described in a machine-executable and human-readable way. We further present the Tags programming language and toolset, created especially for working with the proposed model. Tags allows composing interactive, friendly questionnaires which, when given a dataset, can suggest a data handling policy that follows legal and technical guidelines. Currently, creating such a policy is a manual process requiring access to legal and technical experts, which are not always available. We present some of Tags' tools, such as interview systems, visualizers, development environment, and questionnaire inspectors. Finally, we discuss methodologies for questionnaire development. Data for this paper include a questionnaire for suggesting a HIPAA compliant data handling policy, and formal description of the set of data tags proposed by the authors in a recent paper.","PeriodicalId":341207,"journal":{"name":"2016 IEEE Security and Privacy Workshops (SPW)","volume":"108 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131608756","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 41

Obstacles to Transparency in Privacy Engineering 隐私工程透明度的障碍

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.18

Kiel Brennan-Marquez, Daniel Susser

引用次数: 6

At Your Fingertips: Considering Finger Distinctness in Continuous Touch-Based Authentication for Mobile Devices 在你的指尖:考虑移动设备连续触摸认证中手指的独特性

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.29

Zaire Ali, J. Payton, Vincent Sritapan

引用次数: 23

Validating an Insider Threat Detection System: A Real Scenario Perspective 验证内部威胁检测系统:一个真实的场景视角

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.36

Ioannis Agrafiotis, Arnau Erola, J. Happa, M. Goldsmith, S. Creese

引用次数: 15

Browser History Stealing with Captive Wi-Fi Portals 通过强制Wi-Fi门户窃取浏览器历史记录

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.42

Adrian Dabrowski, Georg Merzdovnik, Nikolaus Kommenda, E. Weippl

{"title":"Browser History Stealing with Captive Wi-Fi Portals","authors":"Adrian Dabrowski, Georg Merzdovnik, Nikolaus Kommenda, E. Weippl","doi":"10.1109/SPW.2016.42","DOIUrl":"https://doi.org/10.1109/SPW.2016.42","url":null,"abstract":"In this paper we show that HSTS headers and long-term cookies (like those used for user tracking) are so prevailing that they allow a malicious Wi-Fi operator to gain significant knowledge about the past browsing history of users. We demonstrate how to combine both into a history stealing attack by including specially crafted references into a captive portal or by injecting them into legitimate HTTP traffic. Captive portals are used on many Wi-Fi Internet hotspots to display the user a message, like a login page or an acceptable use policy before they are connected to the Internet. They are typically found in public places such as airports, train stations, or restaurants. Such systems have been known to be troublesome for many reasons. In this paper we show how a malicious operator can not only gain knowledge about the current Internet session, but also about the user's past. By invisibly placing vast amounts of specially crafted references into these portal pages, we can lure the browser into revealing a user's browsing history by either reading stored persistent (long-term) cookies or evaluating responses for previously set HSTS headers. An occurrence of a persistent cookie, as well as a direct call to the pages' HTTPS site is a reliable sign of the user having visited this site earlier. Thus, this technique allows for a site-based history stealing, similar to the famous link-color history attacks. For the Alexa Top 1,000 sites, between 82% and 92% of sites are effected as they use persistent cookies over HTTP. For the Alexa Top 200,000 we determined the number of vulnerable sites between 59% and 86%. We extended our implementation of this attack by other privacy-invading attacks that enrich the collected data with additional personal information.","PeriodicalId":341207,"journal":{"name":"2016 IEEE Security and Privacy Workshops (SPW)","volume":"40 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124604462","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 14

A Study of Grayware on Google Play Google Play上的灰色软件研究

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.40

Benjamin Andow, Adwait Nadkarni, Blake Bassett, W. Enck, Tao Xie

引用次数: 31

A Hybrid Framework for Data Loss Prevention and Detection 数据丢失预防和检测的混合框架

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.24

Elisa Costante, D. Fauri, S. Etalle, J. D. Hartog, Nicola Zannone

{"title":"A Hybrid Framework for Data Loss Prevention and Detection","authors":"Elisa Costante, D. Fauri, S. Etalle, J. D. Hartog, Nicola Zannone","doi":"10.1109/SPW.2016.24","DOIUrl":"https://doi.org/10.1109/SPW.2016.24","url":null,"abstract":"Data loss, i.e. the unauthorized/unwanted disclosure of data, is a major threat for modern organizations. Data Loss Protection (DLP) solutions in use nowadays, either employ patterns of known attacks (signature-based) or try to find deviations from normal behavior (anomaly-based). While signature-based solutions provide accurate identification of known attacks and, thus, are suitable for the prevention of these attacks, they cannot cope with unknown attacks, nor with attackers who follow unusual paths (like those known only to insiders) to carry out their attack. On the other hand, anomaly-based solutions can find unknown attacks but typically have a high false positive rate, limiting their applicability to the detection of suspicious activities. In this paper, we propose a hybrid DLP framework that combines signature-based and anomaly-based solutions, enabling both detection and prevention. The framework uses an anomaly-based engine that automatically learns a model of normal user behavior, allowing it to flag when insiders carry out anomalous transactions. Typically, anomaly-based solutions stop at this stage. Our framework goes further in that it exploits an operator's feedback on alerts to automatically build and update signatures of attacks that are used to timely block undesired transactions before they can cause any damage.","PeriodicalId":341207,"journal":{"name":"2016 IEEE Security and Privacy Workshops (SPW)","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126530754","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 33