Asia-Pacific Computer Systems Architecture Conference最新文献_第3页

SensorSift: balancing sensor data privacy and utility in automated face understanding SensorSift:平衡传感器数据隐私和自动面部理解的效用

Asia-Pacific Computer Systems Architecture Conference Pub Date : 2012-12-03 DOI: 10.1145/2420950.2420975

Miro Enev, Jaeyeon Jung, Liefeng Bo, Xiaofeng Ren, Tadayoshi Kohno

{"title":"SensorSift: balancing sensor data privacy and utility in automated face understanding","authors":"Miro Enev, Jaeyeon Jung, Liefeng Bo, Xiaofeng Ren, Tadayoshi Kohno","doi":"10.1145/2420950.2420975","DOIUrl":"https://doi.org/10.1145/2420950.2420975","url":null,"abstract":"We introduce SensorSift, a new theoretical scheme for balancing utility and privacy in smart sensor applications. At the heart of our contribution is an algorithm which transforms raw sensor data into a 'sifted' representation which minimizes exposure of user defined private attributes while maximally exposing application-requested public attributes. We envision multiple applications using the same platform, and requesting access to public attributes explicitly not known at the time of the platform creation. Support for future-defined public attributes, while still preserving the defined privacy of the private attributes, is a central challenge that we tackle.\u0000 To evaluate our approach, we apply SensorSift to the PubFig dataset of celebrity face images, and study how well we can simultaneously hide and reveal various policy combinations of face attributes using machine classifiers.\u0000 We find that as long as the public and private attributes are not significantly correlated, it is possible to generate a sifting transformation which reduces private attribute inferences to random guessing while maximally retaining classifier accuracy of public attributes relative to raw data (average PubLoss = .053 and PrivLoss = .075, see Figure 4). In addition, our sifting transformations led to consistent classification performance when evaluated using a set of five modern machine learning methods (linear SVM, kNearest Neighbors, Random Forests, kernel SVM, and Neural Nets).","PeriodicalId":397003,"journal":{"name":"Asia-Pacific Computer Systems Architecture Conference","volume":"12 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131670547","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 24

Tapas: design, implementation, and usability evaluation of a password manager Tapas:密码管理器的设计、实现和可用性评估

Asia-Pacific Computer Systems Architecture Conference Pub Date : 2012-12-03 DOI: 10.1145/2420950.2420964

D. McCarney, David Barrera, Jeremy Clark, S. Chiasson, P. V. Oorschot

{"title":"Tapas: design, implementation, and usability evaluation of a password manager","authors":"D. McCarney, David Barrera, Jeremy Clark, S. Chiasson, P. V. Oorschot","doi":"10.1145/2420950.2420964","DOIUrl":"https://doi.org/10.1145/2420950.2420964","url":null,"abstract":"Passwords continue to prevail on the web as the primary method for user authentication despite their well-known security and usability drawbacks. Password managers offer some improvement without requiring server-side changes. In this paper, we evaluate the security of dual-possession authentication, an authentication approach offering encrypted storage of passwords and theft-resistance without the use of a master password. We further introduce Tapas, a concrete implementation of dual-possession authentication leveraging a desktop computer and a smartphone. Tapas requires no server-side changes to websites, no master password, and protects all the stored passwords in the event either the primary or secondary device (e.g., computer or phone) is stolen. To evaluate the viability of Tapas as an alternative to traditional password managers, we perform a 30 participant user study comparing Tapas to two configurations of Firefox's built-in password manager. We found users significantly preferred Tapas. We then improve Tapas by incorporating feedback from this study, and reevaluate it with an additional 10 participants.","PeriodicalId":397003,"journal":{"name":"Asia-Pacific Computer Systems Architecture Conference","volume":"12 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126458503","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 56

XIAO: tuning code clones at hands of engineers in practice XIAO:在实践中调优工程师手中的代码克隆

Asia-Pacific Computer Systems Architecture Conference Pub Date : 2012-12-03 DOI: 10.1145/2420950.2421004

Yingnong Dang, D. Zhang, Song Ge, Chengyun Chu, Yingjun Qiu, Tao Xie

{"title":"XIAO: tuning code clones at hands of engineers in practice","authors":"Yingnong Dang, D. Zhang, Song Ge, Chengyun Chu, Yingjun Qiu, Tao Xie","doi":"10.1145/2420950.2421004","DOIUrl":"https://doi.org/10.1145/2420950.2421004","url":null,"abstract":"During software development, engineers often reuse a code fragment via copy-and-paste with or without modifications or adaptations. Such practices lead to a number of the same or similar code fragments spreading within one or many large codebases. Detecting code clones has been shown to be useful towards security such as detection of similar security bugs and, more generally, quality improvement such as refactoring of code clones. A large number of academic research projects have been carried out on empirical studies or tool supports for detecting code clones. In this paper, we report our experiences of carrying out successful technology transfer of our new approach of code-clone detection, called XIAO. XIAO has been integrated into Microsoft Visual Studio 2012, to be benefiting a huge number of developers in industry. The main success factors of XIAO include its high tunability, scalability, compatibility, and explorability. Based on substantial industrial experiences, we present the XIAO approach with emphasis on these success factors of XIAO. We also present empirical results on applying XIAO on real scenarios within Microsoft for the tasks of security-bug detection and refactoring.","PeriodicalId":397003,"journal":{"name":"Asia-Pacific Computer Systems Architecture Conference","volume":"34 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114820289","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 58

Dissecting ghost clicks: ad fraud via misdirected human clicks 剖析幽灵点击:通过误导人类点击的广告欺诈

Asia-Pacific Computer Systems Architecture Conference Pub Date : 2012-12-03 DOI: 10.1145/2420950.2420954

Sumayah A. Alrwais, Alexandre Gerber, Christopher W. Dunn, O. Spatscheck, Minaxi Gupta, E. Osterweil

引用次数: 44

Iris: a scalable cloud file system with efficient integrity checks Iris:具有高效完整性检查的可扩展云文件系统

Asia-Pacific Computer Systems Architecture Conference Pub Date : 2012-12-03 DOI: 10.1145/2420950.2420985

Emil Stefanov, Marten van Dijk, A. Juels, Alina Oprea

{"title":"Iris: a scalable cloud file system with efficient integrity checks","authors":"Emil Stefanov, Marten van Dijk, A. Juels, Alina Oprea","doi":"10.1145/2420950.2420985","DOIUrl":"https://doi.org/10.1145/2420950.2420985","url":null,"abstract":"We present Iris, a practical, authenticated file system designed to support workloads from large enterprises storing data in the cloud and be resilient against potentially untrustworthy service providers. As a transparent layer enforcing strong integrity guarantees, Iris lets an enterprise tenant maintain a large file system in the cloud. In Iris, tenants obtain strong assurance not just on data integrity, but also on data freshness, as well as data retrievability in case of accidental or adversarial cloud failures.\u0000 Iris offers an architecture scalable to many clients (on the order of hundreds or even thousands) issuing operations on the file system in parallel. Iris includes new optimization and enterprise-side caching techniques specifically designed to overcome the high network latency typically experienced when accessing cloud storage. Iris also includes novel erasure coding techniques for the first efficient construction of a dynamic Proofs of Retrievability (PoR) protocol over the entire file system.\u0000 We describe our architecture and experimental results on a prototype version of Iris. Iris achieves end-to-end throughput of up to 260MB per second for 100 clients issuing simultaneous requests on the file system. (This limit is dictated by the available network bandwidth and maximum hard drive throughput.) We demonstrate that strong integrity protection in the cloud can be achieved with minimal performance degradation.","PeriodicalId":397003,"journal":{"name":"Asia-Pacific Computer Systems Architecture Conference","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129929935","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 190

Security economics: a personal perspective 安全经济学:个人视角

Asia-Pacific Computer Systems Architecture Conference Pub Date : 2012-12-03 DOI: 10.1145/2420950.2420971

Ross J. Anderson

引用次数: 9

All your face are belong to us: breaking Facebook's social authentication 你所有的脸都属于我们:打破Facebook的社交认证

Asia-Pacific Computer Systems Architecture Conference Pub Date : 2012-12-03 DOI: 10.1145/2420950.2421008

Iasonas Polakis, M. Lancini, Georgios Kontaxis, F. Maggi, S. Ioannidis, A. Keromytis, S. Zanero

{"title":"All your face are belong to us: breaking Facebook's social authentication","authors":"Iasonas Polakis, M. Lancini, Georgios Kontaxis, F. Maggi, S. Ioannidis, A. Keromytis, S. Zanero","doi":"10.1145/2420950.2421008","DOIUrl":"https://doi.org/10.1145/2420950.2421008","url":null,"abstract":"Two-factor authentication is widely used by high-value services to prevent adversaries from compromising accounts using stolen credentials. Facebook has recently released a two-factor authentication mechanism, referred to as Social Authentication, which requires users to identify some of their friends in randomly selected photos. A recent study has provided a formal analysis of social authentication weaknesses against attackers inside the victim's social circles. In this paper, we extend the threat model and study the attack surface of social authentication in practice, and show how any attacker can obtain the information needed to solve the challenges presented by Facebook. We implement a proof-of-concept system that utilizes widely available face recognition software and cloud services, and evaluate it using real public data collected from Facebook. Under the assumptions of Facebook's threat model, our results show that an attacker can obtain access to (sensitive) information for at least 42% of a user's friends that Facebook uses to generate social authentication challenges. By relying solely on publicly accessible information, a casual attacker can solve 22% of the social authentication tests in an automated fashion, and gain a significant advantage for an additional 56% of the tests, as opposed to just guessing. Additionally, we simulate the scenario of a determined attacker placing himself inside the victim's social circle by employing dummy accounts. In this case, the accuracy of our attack greatly increases and reaches 100% when 120 faces per friend are accessible by the attacker, even though it is very accurate with as little as 10 faces.","PeriodicalId":397003,"journal":{"name":"Asia-Pacific Computer Systems Architecture Conference","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126230018","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 49

Analysis of the communication between colluding applications on modern smartphones 现代智能手机上串通应用程序之间的通信分析

Asia-Pacific Computer Systems Architecture Conference Pub Date : 2012-12-03 DOI: 10.1145/2420950.2420958

Claudio Marforio, H. Ritzdorf, Aurélien Francillon, Srdjan Capkun

{"title":"Analysis of the communication between colluding applications on modern smartphones","authors":"Claudio Marforio, H. Ritzdorf, Aurélien Francillon, Srdjan Capkun","doi":"10.1145/2420950.2420958","DOIUrl":"https://doi.org/10.1145/2420950.2420958","url":null,"abstract":"Modern smartphones that implement permission-based security mechanisms suffer from attacks by colluding applications. Users are not made aware of possible implications of application collusion attacks---quite the contrary---on existing platforms, users are implicitly led to believe that by approving the installation of each application independently, they can limit the damage that an application can cause.\u0000 We implement and analyze a number of covert and overt communication channels that enable applications to collude and therefore indirectly escalate their permissions. Furthermore, we present and implement a covert channel between an installed application and a web page loaded in the system browser. We measure the throughput of all these channels as well as their bit-error rate and required synchronization for successful data transmission. The measured throughput of covert channels ranges from 3.7 bps to 3.27 kbps on a Nexus One phone and from 0.47 bps to 4.22 kbps on a Samsung Galaxy S phone; such throughputs are sufficient to efficiently exchange users' sensitive information (e.g., GPS coordinates or contacts). We test two popular research tools that track information flow or detect communication channels on mobile platforms, and confirm that even if they detect some channels, they still do not detect all the channels and therefore fail to fully prevent application collusion. Attacks using covert communication channels remain, therefore, a real threat to smartphone security and an open problem for the research community.","PeriodicalId":397003,"journal":{"name":"Asia-Pacific Computer Systems Architecture Conference","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132735356","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 169

BetterAuth: web authentication revisited BetterAuth:重新访问web认证

Asia-Pacific Computer Systems Architecture Conference Pub Date : 2012-12-03 DOI: 10.1145/2420950.2420977

Martin Johns, Sebastian Lekies, Bastian Braun, Benjamin Flesch

引用次数: 22

JSand: complete client-side sandboxing of third-party JavaScript without browser modifications JSand:无需修改浏览器即可完成第三方JavaScript的客户端沙箱

Asia-Pacific Computer Systems Architecture Conference Pub Date : 2012-12-03 DOI: 10.1145/2420950.2420952

Pieter Agten, S. Acker, Yoran Brondsema, Phu H. Phung, Lieven Desmet, F. Piessens

引用次数: 114