2016 IEEE Security and Privacy Workshops (SPW)最新文献_第3页

MIGRATE: Towards a Lightweight Moving-Target Defense Against Cloud Side-Channels MIGRATE:迈向轻量级移动目标防御云侧通道

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.28

M. Azab, M. Eltoweissy

{"title":"MIGRATE: Towards a Lightweight Moving-Target Defense Against Cloud Side-Channels","authors":"M. Azab, M. Eltoweissy","doi":"10.1109/SPW.2016.28","DOIUrl":"https://doi.org/10.1109/SPW.2016.28","url":null,"abstract":"Recent research has demonstrated the severity of co-residency side-channel attacks on computing clouds. These attacks have been successfully employed by malicious tenants to extract sensitive private information from selected neighboring tenants. Solutions towards addressing such attacks have presented customized solutions for specific variants of these attacks that often require significant modifications to the hardware, client virtual machines (VM), or hypervisors. These solutions are not generic and will not succeed with mutating versions of these attacks. Except for the impractical, resource inefficient, and costly single tenant solutions, co-residency will always be an issue to cloud service providers. In this paper, inspired from the camouflaging process of the sea chameleons evading predators, we present MIGRATE. MIGRATE is a container management framework that employs resource-efficient, scalable, real-time moving target defense to obfuscate the container execution behavior complicating the attacker's task to locate their targets. MIGRATE, offers generic defense against side-channel attacks and employs efficient real-time probabilistic random migrations of cloud tenants' applications contained in Linux containers between different hosts. To minimize the probability of attacker-victim co-residency on the same host. Eliminating the stable co-residency issue eliminates most of the side-channel attacks that face such a platform. Given the current implementation of MIGRATE tested on VMware V-Sphere Cloud, results showed that it can induce high frequency migrations with almost no effect on the enclosed applications making it suitable for mission-critical applications and as a mitigation against fast side-channel attacks.","PeriodicalId":341207,"journal":{"name":"2016 IEEE Security and Privacy Workshops (SPW)","volume":"101 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116074972","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 28

Perceptions of Risk in Mobile Transaction 移动交易中的风险感知

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.37

Shari Trewin, C. Swart, Larry Koved, Kapil Singh

引用次数: 9

Research Report: Mitigating LangSec Problems with Capabilities 研究报告:用能力减轻LangSec问题

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.57

N. Filardo

{"title":"Research Report: Mitigating LangSec Problems with Capabilities","authors":"N. Filardo","doi":"10.1109/SPW.2016.57","DOIUrl":"https://doi.org/10.1109/SPW.2016.57","url":null,"abstract":"Security and privacy of computation, and the related concept of (deliberate) sharing, have, historically, largely been afterthoughts. In a traditional multi-user, multi-application Web hosting environment, typically applications are public by default. Applications wishing to offer a notion of private resources must take it upon themselves to independently manage authentication and authorization of users, leading to difficult and disjointed notions of access and sharing. In such a context, LangSec-based vulnerabilities threaten catastrophic loss of privacy for all users of the system, likely even of non-vulnerable applications. This is a tragic state of affairs, but is thankfully not inevitable! We present the Sandstorm system, a capability-based, private-bydefault, tightly-sandboxing, proactively secure environment for running web applications, complete with a single, pervasive sharing mechanism. Sandstorm, and capability systems, are likely of interest to the LangSec community: LangSec bugs are mitigated through the robust isolation imposed by the Sandstorm supervisor, and the mechanism of capability systems offers the potential to turn difficult authorization decisions into LangSec's bread and butter, namely syntactic constraints on requests: every well-formed request which can be stated is authorized. We present aspects of the Sandstorm system and show how those aspects have, by building systematic protection into several levels of the system, dramatically reduced the severity of LangSec bugs in hosted applications. To study the range of impact, we will characterize addressed vulnerabilities using MITRE's Common Weakness Enumeration (CWE) scheme.","PeriodicalId":341207,"journal":{"name":"2016 IEEE Security and Privacy Workshops (SPW)","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129667340","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

A Posteriori Taint-Tracking for Demonstrating Non-interference in Expressive Low-Level Languages 表达性低级语言中无干扰的后验污点跟踪

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.58

P. Aldous, M. Might

引用次数: 1

Oblivious Mechanisms in Differential Privacy: Experiments, Conjectures, and Open Questions 差异隐私中的遗忘机制:实验、猜想和开放性问题

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.27

Chien-Lun Chen, R. Pal, L. Golubchik

引用次数: 8

Declarative Verifiable SDI Specifications 声明式可验证SDI规范

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.49

R. McGeer

{"title":"Declarative Verifiable SDI Specifications","authors":"R. McGeer","doi":"10.1109/SPW.2016.49","DOIUrl":"https://doi.org/10.1109/SPW.2016.49","url":null,"abstract":"The point of Software-Defined Infrastructure is an infrastructure that is at once more flexible, controllable, and transparent to user and developer. One important characteristic of this infrastructure is that it is not owned or controlled by the user. At runtime, it is an opaque black box. Thus, it must have guaranteed properties of both performance and function. Infrastructure also has limited visibility and debuggability. It's hard to diagnose network problems, and it's hard to diagnose runtime issues on a remote system. Thus, programs which manipulate the infrastructure (e.g., orchestration systems, SDN applications, etc.) should have their infrastructure manipulations verified, to the extent that this is possible â?A S we need to catch bugs statically to the extent that we can, performance and correctness both. Fortunately, infrastructure configurations ought to be inherently verifiable. Verification of state-free systems is in NP; verification of finite-state systems, at least for safety properties, is similarly in NP It has been shown by a number of authors that OpenFlow rulesets are state-free, and verification is therefore in NP. Similar arguments can be made for various orchestration layers and workflow engines, depending on precise semantics. These results imply that the underlying model of computation for configuration of software-defined networking and at least some elements of software-defined infrastructure are state-free or, at worst, finite-state, and therefore that verification of these systems is relatively tractable. It is, at the least, not undecidable. The large challenge before the community is then to design configuration models for software-defined infrastructure that preserve the precise and weak semantics of the implementation domain; offer appropriate abstractions of performance characteristics; and nonetheless retain usability and concision.","PeriodicalId":341207,"journal":{"name":"2016 IEEE Security and Privacy Workshops (SPW)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134174662","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Detection of Mobile Malware: An Artificial Immunity Approach 移动恶意软件检测:一种人工免疫方法

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.32

James Brown, Mohd Anwar, G. Dozier

{"title":"Detection of Mobile Malware: An Artificial Immunity Approach","authors":"James Brown, Mohd Anwar, G. Dozier","doi":"10.1109/SPW.2016.32","DOIUrl":"https://doi.org/10.1109/SPW.2016.32","url":null,"abstract":"Inspired by the human immune system, we explore the development of a new multiple detector set artificial immune system (mAIS) for the detection of mobile malware based on the information flows in Android apps. mAISs differ from conventional AISs in that multiple detector sets are evolved concurrently via negative selection. Typically, the first detector set is composed of detectors that match information flows associated with malicious apps while the second detector set is composed of detectors that match the information flows associated with benign apps. The mAIS presented in this paper incorporates feature selection along with a negative selection technique known as the split detector method (SDM). This new mAIS has been compared with a variety of conventional AISs and mAISs using a dataset of information flows captured from malicious and benign Android applications. Our preliminary results show that the newly designed mAIS outperforms the conventional AISs and mAISs in terms of accuracy and false positive rate of malware detection. This paper ends with a discussion of how mAISs can be used to solve dynamic cybersecurity problems as well as a discussion of our future research. This approach achieved 93.33% accuracy with a 0.00% false positive rate.","PeriodicalId":341207,"journal":{"name":"2016 IEEE Security and Privacy Workshops (SPW)","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133134265","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 16

In Search of Shotgun Parsers in Android Applications 在Android应用程序中搜索Shotgun解析器

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.41

Katherine Underwood, M. Locasto

{"title":"In Search of Shotgun Parsers in Android Applications","authors":"Katherine Underwood, M. Locasto","doi":"10.1109/SPW.2016.41","DOIUrl":"https://doi.org/10.1109/SPW.2016.41","url":null,"abstract":"In any software system, unprincipled handling of input data presents significant security risks. This is particularly true in the case of mobile platforms, where the prevalence of applications developed by amateur developers in combination with devices that hold a wealth of users' personal information can lead to significant security and privacy concerns. Of particular concern is the so-called shotgun parser pattern, in which input recognition is intermixed with input processing throughout the code base. In this work, we take the first steps toward building a tool for identification of shotgun parsers in Android applications. By extending the FlowDroid framework for static taint analysis, we are able to quantify the spread of untrusted data through 55 applications selected from 15 categories on the Google Play store. Our analysis reveals that on average, most untrusted input propagates a relatively short distance within the application code. However, we also find several specific instances of very long data propagations. In addition to providing a first look at the \"state of parsing\" in a variety of Android applications, our work in this paper lays the groundwork for more precise shotgun parser signature recognition.","PeriodicalId":341207,"journal":{"name":"2016 IEEE Security and Privacy Workshops (SPW)","volume":"60 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130768768","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 8

Privacy Harm Analysis: A Case Study on Smart Grids 隐私危害分析:以智能电网为例

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.21

S. De, D. Métayer

引用次数: 12

Investigating Airplane Safety and Security Against Insider Threats Using Logical Modeling 利用逻辑模型研究飞机安全和内部威胁

2016 IEEE Security and Privacy Workshops (SPW) Pub Date : 2016-05-22 DOI: 10.1109/SPW.2016.47

F. Kammüller, Manfred Kerber

引用次数: 15