Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy最新文献

SDN Research Challenges and Opportunities SDN研究的挑战与机遇

Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy Pub Date : 2016-03-09 DOI: 10.1145/2857705.2857730

A. Nikolich

引用次数: 2

Detecting Malicious Exploit Kits using Tree-based Similarity Searches 使用基于树的相似度搜索检测恶意漏洞工具包

Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy Pub Date : 2016-03-09 DOI: 10.1145/2857705.2857718

Teryl Taylor, Xin Hu, Ting Wang, Jiyong Jang, M. Stoecklin, F. Monrose, R. Sailer

{"title":"Detecting Malicious Exploit Kits using Tree-based Similarity Searches","authors":"Teryl Taylor, Xin Hu, Ting Wang, Jiyong Jang, M. Stoecklin, F. Monrose, R. Sailer","doi":"10.1145/2857705.2857718","DOIUrl":"https://doi.org/10.1145/2857705.2857718","url":null,"abstract":"Unfortunately, the computers we use for everyday activities can be infiltrated while simply browsing innocuous sites that, unbeknownst to the website owner, may be laden with malicious advertisements. So-called malvertising, redirects browsers to web-based exploit kits that are designed to find vulnerabilities in the browser and subsequently download malicious payloads. We propose a new approach for detecting such malfeasance by leveraging the inherent structural patterns in HTTP traffic to classify exploit kit instances. Our key insight is that an exploit kit leads the browser to download payloads using multiple requests from malicious servers. We capture these interactions in a \"tree-like\" form, and using a scalable index of malware samples, model the detection process as a subtree similarity search problem. The approach is evaluated on 3800 hours of real-world traffic including over 4 billion flows and reduces false positive rates by four orders of magnitude over current state-of-the-art techniques with comparable true positive rates. We show that our approach can operate in near real-time, and is able to handle peak traffic levels on a large enterprise network --- identifying 28 new exploit kit instances during our analysis period.","PeriodicalId":377412,"journal":{"name":"Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy","volume":"74 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-03-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128451899","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 36

Risk-based Analysis of Business Process Executions 基于风险的业务流程执行分析

Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy Pub Date : 2016-03-09 DOI: 10.1145/2857705.2857742

M. Alizadeh, Nicola Zannone

引用次数: 5

Privacy-Preserving Mining of Sequential Association Rules from Provenance Workflows 溯源工作流中顺序关联规则的隐私保护挖掘

Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy Pub Date : 2016-03-09 DOI: 10.1145/2857705.2857743

Mihai Maruseac, Gabriel Ghinita

{"title":"Privacy-Preserving Mining of Sequential Association Rules from Provenance Workflows","authors":"Mihai Maruseac, Gabriel Ghinita","doi":"10.1145/2857705.2857743","DOIUrl":"https://doi.org/10.1145/2857705.2857743","url":null,"abstract":"Provenance workflows capture movement and transformation of data in complex environments, such as document management in large organizations, content generation and sharing in in social media, scientific computations, etc. Sharing and processing of provenance workflows brings numerous benefits, e.g., improving productivity in an organization, understanding social media interaction patterns, etc. However, directly sharing provenance may also disclose sensitive information such as confidential business practices, or private details about participants in a social network. We propose an algorithm that privately extracts sequential association rules from provenance workflow datasets. Finding such rules has numerous practical applications, such as capacity planning or identifying hot-spots in provenance graphs. Our approach provides good accuracy and strong privacy, by leveraging on the exponential mechanism of differential privacy. We propose an heuristic that identifies promising candidate rules and makes judicious use of the privacy budget. Experimental results show that the our approach is fast and accurate, and clearly outperforms the state-of-the-art. We also identify influential factors in improving accuracy, which helps in choosing promising directions for future improvement.","PeriodicalId":377412,"journal":{"name":"Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-03-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130928485","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Scalable and Secure Logistic Regression via Homomorphic Encryption 基于同态加密的可扩展和安全逻辑回归

Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy Pub Date : 2016-03-09 DOI: 10.1145/2857705.2857731

Yoshinori Aono, Takuya Hayashi, L. T. Phong, Lihua Wang

引用次数: 161

Building Privacy-Preserving Cryptographic Credentials from Federated Online Identities 从联邦在线身份构建保护隐私的加密凭证

Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy Pub Date : 2016-03-09 DOI: 10.1145/2857705.2857725

John Maheswaran, Daniel Jackowitz, Ennan Zhai, D. Wolinsky, B. Ford

{"title":"Building Privacy-Preserving Cryptographic Credentials from Federated Online Identities","authors":"John Maheswaran, Daniel Jackowitz, Ennan Zhai, D. Wolinsky, B. Ford","doi":"10.1145/2857705.2857725","DOIUrl":"https://doi.org/10.1145/2857705.2857725","url":null,"abstract":"Federated identity providers, e.g., Facebook and PayPal, offer a convenient means for authenticating users to third-party applications. Unfortunately such cross-site authentications carry privacy and tracking risks. For example, federated identity providers can learn what applications users are accessing; meanwhile, the applications can know the users' identities in reality. This paper presents Crypto-Book, an anonymizing layer enabling federated identity authentications while preventing these risks. Crypto-Book uses a set of independently managed servers that employ a (t,n)-threshold cryptosystem to collectively assign credentials to each federated identity (in the form of either a public/private keypair or blinded signed messages). With the credentials in hand, clients can then leverage anonymous authentication techniques such as linkable ring signatures or partially blind signatures to log into third-party applications in an anonymous yet accountable way. We have implemented a prototype of Crypto-Book and demonstrated its use with three applications: a Wiki system, an anonymous group communication system, and a whistleblower submission system. Crypto-Book is practical and has low overhead: in a deployment within our research group, Crypto-Book group authentication took 1.607s end-to-end, an overhead of 1.2s compared to traditional non-privacy-preserving federated authentication.","PeriodicalId":377412,"journal":{"name":"Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy","volume":"433 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-03-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123007560","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 9

Hacking the DBMS to Prevent Injection Attacks 破解DBMS以防止注入攻击

Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy Pub Date : 2016-03-09 DOI: 10.1145/2857705.2857723

Ibéria Medeiros, Miguel Beatriz, N. Neves, M. Correia

引用次数: 6

Auditing Security Compliance of the Virtualized Infrastructure in the Cloud: Application to OpenStack 云虚拟化基础设施合规性审计:OpenStack应用

Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy Pub Date : 2016-03-09 DOI: 10.1145/2857705.2857721

Taous Madi, Suryadipta Majumdar, Yushun Wang, Yosr Jarraya, M. Pourzandi, Lingyu Wang

{"title":"Auditing Security Compliance of the Virtualized Infrastructure in the Cloud: Application to OpenStack","authors":"Taous Madi, Suryadipta Majumdar, Yushun Wang, Yosr Jarraya, M. Pourzandi, Lingyu Wang","doi":"10.1145/2857705.2857721","DOIUrl":"https://doi.org/10.1145/2857705.2857721","url":null,"abstract":"Cloud service providers typically adopt the multi-tenancy model to optimize resources usage and achieve the promised cost-effectiveness. Sharing resources between different tenants and the underlying complex technology increase the necessity of transparency and accountability. In this regard, auditing security compliance of the provider's infrastructure against standards, regulations and customers' policies takes on an increasing importance in the cloud to boost the trust between the stakeholders. However, virtualization and scalability make compliance verification challenging. In this work, we propose an automated framework that allows auditing the cloud infrastructure from the structural point of view while focusing on virtualization-related security properties and consistency between multiple control layers. Furthermore, to show the feasibility of our approach, we integrate our auditing system into OpenStack, one of the most used cloud infrastructure management systems. To show the scalability and validity of our framework, we present our experimental results on assessing several properties related to auditing inter-layer consistency, virtual machines co-residence, and virtual resources isolation.","PeriodicalId":377412,"journal":{"name":"Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-03-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114980081","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 42

Derandomizing Kernel Address Space Layout for Memory Introspection and Forensics 非随机化内核地址空间布局的内存自省和取证

Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy Pub Date : 2016-03-09 DOI: 10.1145/2857705.2857707

Yufei Gu, Zhiqiang Lin

{"title":"Derandomizing Kernel Address Space Layout for Memory Introspection and Forensics","authors":"Yufei Gu, Zhiqiang Lin","doi":"10.1145/2857705.2857707","DOIUrl":"https://doi.org/10.1145/2857705.2857707","url":null,"abstract":"Modern OS kernels including Windows, Linux, and Mac OS all have adopted kernel Address Space Layout Randomization (ASLR), which shifts the base address of kernel code and data into different locations in different runs. Consequently, when performing introspection or forensic analysis of kernel memory, we cannot use any pre-determined addresses to interpret the kernel events. Instead, we must derandomize the address space layout and use the new addresses. However, few efforts have been made to derandomize the kernel address space and yet there are many questions left such as which approach is more efficient and robust. Therefore, we present the first systematic study of how to derandomize a kernel when given a memory snapshot of a running kernel instance. Unlike the derandomization approaches used in traditional memory exploits in which only remote access is available, with introspection and forensics applications, we can use all the information available in kernel memory to generate signatures and derandomize the ASLR. In other words, there exists a large volume of solutions for this problem. As such, in this paper we examine a number of typical approaches to generate strong signatures from both kernel code and data based on the insight of how kernel code and data is updated, and compare them from efficiency (in terms of simplicity, speed etc.) and robustness (e.g., whether the approach is hard to be evaded or forged) perspective. In particular, we have designed four approaches including brute-force code scanning, patched code signature generation, unpatched code signature generation, and read-only pointer based approach, according to the intrinsic behavior of kernel code and data with respect to kernel ASLR. We have gained encouraging results for each of these approaches and the corresponding experimental results are reported in this paper.","PeriodicalId":377412,"journal":{"name":"Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-03-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122948653","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 11

ARPPM: Administration in the RPPM Model ARPPM: RPPM模型中的管理

Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy Pub Date : 2016-03-09 DOI: 10.1145/2857705.2857711

J. Crampton, J. Sellwood

{"title":"ARPPM: Administration in the RPPM Model","authors":"J. Crampton, J. Sellwood","doi":"10.1145/2857705.2857711","DOIUrl":"https://doi.org/10.1145/2857705.2857711","url":null,"abstract":"The RPPM model of access control uses relationships, paths and principal-matching in order to make access control decisions for general computing systems. Recently Stoller introduced a variant of an early RPPM model supporting administrative actions. Stoller's RPPM^2 model is able to make authorization decisions in respect of actions which affect the system graph and some policy elements. We also see utility in the RPPM model and believe that providing effective administration of the access control model is key to increasing the model's usefulness to real-world implementations. However, whilst we find inspiration in some aspects of Stoller's work, we believe that an alternative approach making use of the latest RPPM model as its basis will offer a wider range of operational and administrative capabilities. We motivate this work with specific requirements for an administrative model and then propose a decentralised discretionary access control approach to administration, whereby users are able to manage model components in the system graph through the addition and deletion of edges. The resulting Administrative RPPM (ARPPM) model supports administration of all of the model's components: the system model, the system graph, the authorization policies and all of their elements.","PeriodicalId":377412,"journal":{"name":"Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-03-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124025695","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 8