Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy最新文献

Multi-Modality Mobile Datasets for Behavioral Biometrics Research: Data/Toolset paper 行为生物识别研究的多模态移动数据集:数据/工具集论文

Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy Pub Date : 2023-04-24 DOI: 10.1145/3577923.3583637

Aratrika Ray-Dowling, A. Wahab, Daqing Hou, S. Schuckers

{"title":"Multi-Modality Mobile Datasets for Behavioral Biometrics Research: Data/Toolset paper","authors":"Aratrika Ray-Dowling, A. Wahab, Daqing Hou, S. Schuckers","doi":"10.1145/3577923.3583637","DOIUrl":"https://doi.org/10.1145/3577923.3583637","url":null,"abstract":"The ubiquity of mobile devices nowadays necessitates securing the apps and user information stored therein. However, existing one-time entry-point authentication mechanisms and enhanced security mechanisms such as Multi-Factor Authentication (MFA) are prone to a wide vector of attacks. Furthermore, MFA also introduces friction to the user experience. Therefore, what is needed is continuous authentication that once passing the entry-point authentication, will protect the mobile devices on a continuous basis by confirming the legitimate owner of the device and locking out detected impostor activities. Hence, more research is needed on the dynamic methods of mobile security such as behavioral biometrics-based continuous authentication, which is cost-effective and passive as the data utilized to authenticate users are logged from the phone's sensors. However, currently, there are not many mobile authentication datasets to perform benchmarking research. In this work, we share two novel mobile datasets (Clarkson University (CU) Mobile datasets I and II) consisting of multi-modality behavioral biometrics data from 49 and 39 users respectively (88 users in total). Each of our datasets consists of modalities such as swipes, keystrokes, acceleration, gyroscope, and pattern-tracing strokes. These modalities are collected when users are filling out a registration form in sitting both as genuine and impostor users. To exhibit the usefulness of the datasets, we have performed initial experiments on selected individual modalities from the datasets as well as the fusion of simultaneously available modalities.","PeriodicalId":387479,"journal":{"name":"Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127328636","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Exploiting Windows PE Structure for Adversarial Malware Evasion Attacks 利用Windows PE结构进行对抗性恶意软件规避攻击

Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy Pub Date : 2023-04-24 DOI: 10.1145/3577923.3585044

K. Aryal, Maanak Gupta, Mahmoud Abdelsalam

{"title":"Exploiting Windows PE Structure for Adversarial Malware Evasion Attacks","authors":"K. Aryal, Maanak Gupta, Mahmoud Abdelsalam","doi":"10.1145/3577923.3585044","DOIUrl":"https://doi.org/10.1145/3577923.3585044","url":null,"abstract":"The last decade has seen phenomenal growth in the application of machine learning. At this point, it won't be wrong to claim that most technological change is directly or indirectly connected to machine learning. Along with machine learning, cyber-attacks have also bloomed in this period. Machine learning has been a great aid to cybersecurity, but the security of machine learning has not been a topic of attention until recently. Among numerous threats posed to the machine learning community, the Adversarial Evasion attack is the latest menace. The adversarial evasion attack has exposed the vulnerability of the modern deep neural network to a few intentionally perturbed data samples. The adversarial evasion attacks originated from the image domain but have now spread across major application domains of machine learning. This work will discuss the state-of-art adversarial evasion attacks against the Windows PE Malware detectors. The structure of a file plays a significant role in how an adversarial evasion attack can be carried out to a file. We will discuss the robustness and weakness of the Windows PE file structure toward the adversarial evasion approach. We will present the existing approaches to exploiting Windows PE file structure and their limitations. We will also propose a noble way to manipulate Windows PE structure to carry out an adversarial evasion attack.","PeriodicalId":387479,"journal":{"name":"Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy","volume":"116 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128355796","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

AutoSpill: Credential Leakage from Mobile Password Managers AutoSpill:从移动密码管理器凭证泄漏

Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy Pub Date : 2023-04-24 DOI: 10.1145/3577923.3583658

Ankit Gangwal, S. Singh, Abhijeet Srivastava

{"title":"AutoSpill: Credential Leakage from Mobile Password Managers","authors":"Ankit Gangwal, S. Singh, Abhijeet Srivastava","doi":"10.1145/3577923.3583658","DOIUrl":"https://doi.org/10.1145/3577923.3583658","url":null,"abstract":"Password managers (PMs) are becoming increasingly popular on mobile devices, especially on small-screen devices, mainly due to the convenience of automatically filling credentials into login forms. Modern mobile OSes advocate for system-wide autofill frameworks to support autofilling on browsers as well as other apps. Mobile OSes also empower apps to directly render web content within WebView controls without redirecting users to the main browser. par We present a novel technique, called AutoSpill, to leak users' saved credentials during an autofill operation on a webpage loaded into an app's WebView. AutoSpill conveniently dodges the secure autofill process. The majority of popular Android PMs considered in our experiments were found vulnerable to AutoSpill; even when the app hosting the WebView is not actively participating in the leak. Android intermediates in the autofill process because of its app sandboxing. Hence, the responsibility for any credential leakage is often stranded between PMs and the Android system. We investigate the root causes of AutoSpill and propose countermeasures to fundamentally fix AutoSpill for both the parties. We responsibly disclosed our findings to the affected PMs and Android security team.","PeriodicalId":387479,"journal":{"name":"Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy","volume":"43 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127558337","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Role Models: Role-based Debloating for Web Applications 角色模型:Web应用程序的基于角色的讨论

Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy Pub Date : 2023-04-24 DOI: 10.1145/3577923.3583647

Babak Amin Azad, Nick Nikiforakis

{"title":"Role Models: Role-based Debloating for Web Applications","authors":"Babak Amin Azad, Nick Nikiforakis","doi":"10.1145/3577923.3583647","DOIUrl":"https://doi.org/10.1145/3577923.3583647","url":null,"abstract":"The process of debloating, i.e., removing unnecessary code and features in software, has become an attractive proposition to managing the ever-expanding attack surface of ever-growing modern applications. Researchers have shown that debloating produces significant security improvements in a variety of application domains including operating systems, libraries, compiled software, and, more recently, web applications. Even though the client/server nature of web applications allows the same backend to serve thousands of users with diverse needs, web applications have been approached monolithically by existing debloating approaches. That is, a feature can be debloated only if none of the users of a web application requires it. Similarly, everyone gets access to the same \"global\" features, whether they need them or not. Recognizing that different users need access to different features, in this paper we propose role-based debloating for web applications. In this approach, we focus on clustering users with similar usage behavior together and providing them with a custom debloated application that is tailored to their needs. Through a user study with 60 experienced web developers and administrators, we first establish that different users indeed use web applications differently. This data is then used by DBLTR, an automated pipeline for providing tailored debloating based on a user's true requirements. Next to debloating web applications, DBLTR includes a transparent content-delivery mechanism that routes authenticated users to their debloated copies. We demonstrate that for different web applications, DBLTR can be 30-80% more effective than the state-of-the-art in debloating in removing critical vulnerabilities.","PeriodicalId":387479,"journal":{"name":"Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy","volume":"115 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117313513","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Utilizing The DLBAC Approach Toward a ZT Score-based Authorization for IoT Systems 利用DLBAC方法实现基于ZT分数的物联网系统授权

Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy Pub Date : 2023-04-24 DOI: 10.1145/3577923.3585046

Safwa Ameer, R. Krishnan, R. Sandhu, Maanak Gupta

引用次数: 0

Velocity-Aware Geo-Indistinguishability Velocity-Aware Geo-Indistinguishability

Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy Pub Date : 2023-04-24 DOI: 10.1145/3577923.3583644

Ricardo Mendes, Mariana Cunha, J. Vilela

{"title":"Velocity-Aware Geo-Indistinguishability","authors":"Ricardo Mendes, Mariana Cunha, J. Vilela","doi":"10.1145/3577923.3583644","DOIUrl":"https://doi.org/10.1145/3577923.3583644","url":null,"abstract":"Location Privacy-Preserving Mechanisms (LPPMs) have been proposed to mitigate the risks of privacy disclosure yielded from location sharing. However, due to the nature of this type of data, spatio-temporal correlations can be leveraged by an adversary to extenuate the protections. Moreover, the application of LPPMs at collection time has been limited due to the difficulty in configuring the parameters and in understanding their impact on the privacy level by the end-user. In this work we adopt the velocity of the user and the frequency of reports as a metric for the correlation between location reports. Based on such metric we propose a generalization of Geo-Indistinguishability denoted Velocity-Aware Geo-Indistinguishability (VA-GI). We define a VA-GI LPPM that provides an automatic and dynamic trade-off between privacy and utility according to the velocity of the user and the frequency of reports. This adaptability can be tuned for general use, by using city or country-wide data, or for specific user profiles, thus warranting fine-grained tuning for users or environments. Our results using vehicular trajectory data show that VA-GI achieves a dynamic trade-off between privacy and utility that outperforms previous works. Additionally, by using a Gaussian distribution as estimation for the distribution of the velocities, we provide a methodology for configuring our proposed LPPM without the need for mobility data. This approach provides the required privacy-utility adaptability while also simplifying its configuration and general application in different contexts.","PeriodicalId":387479,"journal":{"name":"Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy","volume":"16 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132337281","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Anonymous System for Fully Distributed and Robust Secure Multi-Party Computation 全分布式鲁棒安全多方计算的匿名系统

Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy Pub Date : 2023-04-24 DOI: 10.1145/3577923.3583651

Andreas Klinger, Felix Battermann, Ulrike Meyer

{"title":"Anonymous System for Fully Distributed and Robust Secure Multi-Party Computation","authors":"Andreas Klinger, Felix Battermann, Ulrike Meyer","doi":"10.1145/3577923.3583651","DOIUrl":"https://doi.org/10.1145/3577923.3583651","url":null,"abstract":"In secure multi-party computation (SMPC), it is considered that multiple parties that are known to each other evaluate a function over their private inputs in a secure fashion. The participating parties do not learn anything about each other's private inputs beyond what can be deduced from their own input and output. The assumption that the parties know each other, however, does not seem suitable for all potential applications of SMPC. In some applications participants may not only want to hide their private inputs and outputs, but may also want to hide the fact that they are participating in a given function evaluation in the first place. We therefore propose an anonymous system for SMPC that allows parties to anonymously evaluate a function of their private inputs in a fully distributed and secure fashion. The proposed system allows authorized parties to execute an SMPC protocol robust with penalty against a dishonest majority in the presence of a malicious adversary. During the protocol execution, the system guarantees that all participating parties stay anonymous w. r. t. each other as well as any third parties. In addition, it guarantees that in each function evaluation all participating parties are unique, i. e., no party can participate as more than one entity.","PeriodicalId":387479,"journal":{"name":"Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy","volume":"39 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121816358","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A User Study of Keystroke Dynamics as Second Factor in Web MFA 击键动力学作为Web MFA第二因素的用户研究

Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy Pub Date : 2023-04-24 DOI: 10.1145/3577923.3583642

A. Wahab, Daqing Hou, S. Schuckers

{"title":"A User Study of Keystroke Dynamics as Second Factor in Web MFA","authors":"A. Wahab, Daqing Hou, S. Schuckers","doi":"10.1145/3577923.3583642","DOIUrl":"https://doi.org/10.1145/3577923.3583642","url":null,"abstract":"As account compromises and malicious online attacks are on the rise, multi-factor authentication (MFA) has been adopted to defend against these attacks. OTP and mobile push notification are just two examples of the popularly adopted MFA factors. Although MFA improve security, they also add additional steps or hardware to the authentication process, thus increasing the authentication time and introducing friction. On the other hand, keystroke dynamics-based authentication is believed to be a promising MFA for increasing security while reducing friction. While there have been several studies on the usability of other MFA factors, the usability of keystroke dynamics has not been studied. To this end, we have built a web authentication system with the standard features of signup, login and account recovery, and integrated keystroke dynamics as an additional factor. We then conducted a user study on the system where 20 participants completed tasks related to signup, login and account recovery. We have also evaluated a new approach for completing the user enrollment process, which reduces friction by naturally employing other alternative MFA factors (OTP in our study) when keystroke dynamics is not ready for use. Our study shows that while maintaining strong security (0% FPR), adding keystroke dynamics reduces authentication friction by avoiding 66.3% of OTP at login and 85.8% of OTP at account recovery, which in turn reduces the authentication time by 63.3% and 78.9% for login and account recovery respectively. Through an exit survey, all participants have rated the integration of keystroke dynamics with OTP to be more preferable to the conventional OTP-only authentication.","PeriodicalId":387479,"journal":{"name":"Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131929583","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Detecting Backdoors in Collaboration Graphs of Software Repositories 软件存储库协作图中的后门检测

Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy Pub Date : 2023-04-24 DOI: 10.1145/3577923.3583657

Tom Ganz, Inaam Ashraf, Martin Härterich, Konrad Rieck

{"title":"Detecting Backdoors in Collaboration Graphs of Software Repositories","authors":"Tom Ganz, Inaam Ashraf, Martin Härterich, Konrad Rieck","doi":"10.1145/3577923.3583657","DOIUrl":"https://doi.org/10.1145/3577923.3583657","url":null,"abstract":"Software backdoors pose a major threat to the security of computer systems. Minor modifications to a program are often sufficient to undermine security mechanisms and enable unauthorized access to a system. The direct approach of detecting backdoors using static or dynamic program analysis is a daunting task that becomes increasingly futile with the attacker's capabilities. As a remedy, we introduce an orthogonal strategy for the detection of software backdoors. Instead of searching for concealed functionality in program code, we propose to analyze how a software has been developed and locate clues for malicious activities in its version history, such as in a Git repository. To this end, we model the version history as a collaboration graph that reflects how, when and where developers have committed changes to the software. We develop a method for anomaly detection using graph neural networks that builds on this representation and is able to detect spatial and temporal anomalies in the development process. % We evaluate our approach using a collection of real-world backdoors added to Github repositories. Compared to previous work, our method identifies a significantly larger number of backdoors with a low false-positive rate. While our approach cannot rule out the presence of software backdoors, it provides an alternative detection strategy that complements existing work focused only on program analysis.","PeriodicalId":387479,"journal":{"name":"Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy","volume":"31 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-04-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129076309","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Confidential Execution of Deep Learning Inference at the Untrusted Edge with ARM TrustZone 基于ARM TrustZone的非信任边缘深度学习推理保密执行

Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy Pub Date : 2023-04-24 DOI: 10.1145/3577923.3583648

Md Shihabul Islam, Mahmoud Zamani, C. Kim, L. Khan, Kevin W. Hamlen

引用次数: 1