2010 International Conference on Availability, Reliability and Security最新文献_第6页

Formalization of Viruses and Malware Through Process Algebras 通过过程代数形式化病毒和恶意软件

2010 International Conference on Availability, Reliability and Security Pub Date : 2010-03-25 DOI: 10.1109/ARES.2010.59

G. Jacob, E. Filiol, Hervé Debar

引用次数: 22

A Formal Approach Towards Risk-Aware Service Level Analysis and Planning 面向风险意识服务水平分析和规划的正式方法

2010 International Conference on Availability, Reliability and Security Pub Date : 2010-03-25 DOI: 10.1109/ARES.2010.86

Stefan Jakoubi, S. Tjoa, S. Goluch, G. Kitzler

引用次数: 11

LSM-Based Secure System Monitoring Using Kernel Protection Schemes 基于lsm的基于内核保护方案的安全系统监控

2010 International Conference on Availability, Reliability and Security Pub Date : 2010-03-25 DOI: 10.1109/ARES.2010.48

T. Isohara, K. Takemori, Yutaka Miyake, Ning Qu, A. Perrig

{"title":"LSM-Based Secure System Monitoring Using Kernel Protection Schemes","authors":"T. Isohara, K. Takemori, Yutaka Miyake, Ning Qu, A. Perrig","doi":"10.1109/ARES.2010.48","DOIUrl":"https://doi.org/10.1109/ARES.2010.48","url":null,"abstract":"Monitoring a process and its file I/O behaviors is important for security inspection for a data center server against intrusions, malware infection and information leakage. In the case of the Linux kernel 2.6, a set of hook functions called the Linux Security Module (LSM) has been implemented in order to monitor and control the system calls. By using the LSM we can inspect the activity of unknown malicious processes. However, a sophisticated attacker could breach the kernel configurations using the rootkits. Furthermore since the monitoring results of the malicious process activity are stored as a file on Hard Disk Drive (HDD), it will be easily manipulated by the attacker. In this paper, we propose a secure monitoring scheme that addresses the attacks against the monitoring module and its result for security inspection of the data center server. The monitoring module is implemented as a LSM-based function and protected by the kernel protection technique. The integrity of the monitoring result is guaranteed by using a Mandatory Access Control (MAC) of the Linux kernel and a mechanism of the trusted process invocation. This mechanism can serve as an infrastrucuture of secure inspection platform for data center server because the integrity of the monitoring module and its result is guaranteed.","PeriodicalId":360339,"journal":{"name":"2010 International Conference on Availability, Reliability and Security","volume":"60 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-03-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123042615","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 10

One Size Fits None: The Importance of Detector Parameterization 一刀切:探测器参数化的重要性

2010 International Conference on Availability, Reliability and Security Pub Date : 2010-03-25 DOI: 10.1109/ARES.2010.41

Natasha Bodorik, A. Zincir-Heywood

引用次数: 0

Extending the Gordon and Loeb Model for Information Security Investment Gordon和Loeb模型在信息安全投资中的扩展

2010 International Conference on Availability, Reliability and Security Pub Date : 2010-03-25 DOI: 10.1109/ARES.2010.37

J. Willemson

引用次数: 18

Security Modeling and Tool Support Advantages 安全建模和工具支持优势

2010 International Conference on Availability, Reliability and Security Pub Date : 2010-03-25 DOI: 10.1109/ARES.2010.11

Egil Trygve Baadshaug, Gencer Erdogan, P. H. Meland

引用次数: 10

FedWare: Middleware Services to Cope with Information Consistency in Federated Identity Management 在联邦身份管理中处理信息一致性的中间件服务

2010 International Conference on Availability, Reliability and Security Pub Date : 2010-03-25 DOI: 10.1109/ARES.2010.81

Thorsten Höllrigl, J. Dinger, H. Hartenstein

{"title":"FedWare: Middleware Services to Cope with Information Consistency in Federated Identity Management","authors":"Thorsten Höllrigl, J. Dinger, H. Hartenstein","doi":"10.1109/ARES.2010.81","DOIUrl":"https://doi.org/10.1109/ARES.2010.81","url":null,"abstract":"Collaborations by the use of inter-organizational business processes can help companies to achieve a competitive edge over competing businesses. Typically, these collaborations require an efficient identity management (IdM) that ensures the authorized access to services in different security domains. The successful implementation of an IdM in distributed systems requires to cope with a diversity of systems and to manage the challenges of integration. While integration should not introduce an unnecessary degree of dependence and complexity, various IdM goals should be achieved by integration: in particular, collaboration-wide consistency of identity information. Due to its decentralized and modular design, a federated identity management (FIM) approach is a promising strategy in distributed systems. Our thesis is that the distributed character and heterogeneity of involved systems requires appropriate information-consistency mechanisms that go beyond what is offered by current FIM protocols and software in order to avoid inconsistencies in identity information. In this paper we identify causes leading to inconsistencies in FIM. We present requirements necessary to cope with the consistency issue and analyze research, FIM standards and protocols w.r.t. the stated requirements. An analysis showed that FIM does not consider the consistency issuesufficiently. However, we point out which parts can be used as building blocks to achieve information consistency. Therefore, we design a system – called FedWare – that combines identity-related middleware services with existing FIM technologies. To provide an efficient integration of systems, we reduce development effort by providing reusable services. By decoupling systems, e.g., via a publish/subscribe mechanism, we reduce operation effort.","PeriodicalId":360339,"journal":{"name":"2010 International Conference on Availability, Reliability and Security","volume":"75 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-03-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134084134","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 11

Security and Performance Aspects of an Agent-Based Link-Layer Vulnerability Discovery Mechanism 基于代理的链路层漏洞发现机制的安全性和性能研究

2010 International Conference on Availability, Reliability and Security Pub Date : 2010-03-25 DOI: 10.1109/ARES.2010.24

Ziyad S. Al-Salloum, S. Wolthusen

{"title":"Security and Performance Aspects of an Agent-Based Link-Layer Vulnerability Discovery Mechanism","authors":"Ziyad S. Al-Salloum, S. Wolthusen","doi":"10.1109/ARES.2010.24","DOIUrl":"https://doi.org/10.1109/ARES.2010.24","url":null,"abstract":"The identification of vulnerable hosts and subsequent deployment of mitigation mechanisms such as service disabling or installation of patches is both time-critical and error-prone. This is in part owing to the fact that malicious worms can rapidly scan networks for vulnerable hosts, but is further exacerbated by the fact that network topologies are becoming more fluid and vulnerable hosts may only be visible intermittently for environments such as virtual machines or wireless edge networks. In this paper we therefore describe and evaluate an agent-based mechanism which uses the spanning tree protocol (STP) to gain knowledge of the underlying network topology to allow both rapid and resource-efficient traversal of the network by agents as well as residual scanning and mitigation techniques on edge nodes. We report performance results, comparing the mechanism against a random scanning worm and demonstrating that network immunity can be largely achieved despite a very limited warning interval. We also discuss mechanisms to protect the agent mechanism against subversion, noting that similar approaches are also increasingly deployed in case of malicious code.","PeriodicalId":360339,"journal":{"name":"2010 International Conference on Availability, Reliability and Security","volume":"134 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-03-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133212597","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

Using Normalized Compression Distance for Classifying File Fragments 基于归一化压缩距离的文件分片分类

2010 International Conference on Availability, Reliability and Security Pub Date : 2010-03-25 DOI: 10.1109/ARES.2010.100

Stefan Axelsson

引用次数: 31

Program Obfuscation by Strong Cryptography 强密码学的程序混淆

2010 International Conference on Availability, Reliability and Security Pub Date : 2010-03-25 DOI: 10.1109/ARES.2010.47

Zeljko Vrba, P. Halvorsen, C. Griwodz

引用次数: 15