Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems最新文献

Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems 2021年软件和系统高级安全国际研讨会论文集

Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems Pub Date : 2021-06-07 DOI: 10.1145/3457340

引用次数: 0

A Journey Through Android App Analysis: Solutions and Open Challenges Android应用分析之旅:解决方案和开放挑战

Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems Pub Date : 2021-05-24 DOI: 10.1145/3457340.3458298

Jacques Klein

引用次数: 0

Crafting Adversarial Email Content against Machine Learning Based Spam Email Detection 针对基于机器学习的垃圾邮件检测，制作对抗性电子邮件内容

Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems Pub Date : 2021-05-24 DOI: 10.1145/3457340.3458302

Chenran Wang, Danyi Zhang, Suye Huang, Xiangyang Li, Leah Ding

{"title":"Crafting Adversarial Email Content against Machine Learning Based Spam Email Detection","authors":"Chenran Wang, Danyi Zhang, Suye Huang, Xiangyang Li, Leah Ding","doi":"10.1145/3457340.3458302","DOIUrl":"https://doi.org/10.1145/3457340.3458302","url":null,"abstract":"While machine learning based spam detectors have proven useful, spammers are learning to bypass the detectors by modifying their email content. Adversarial attacks on machine learning models have been observed in domains such as image classification. Applying such adversarial attack algorithms to craft spam emails to evade spam email detectors, however, has limitations. Such algorithms generate adversarial perturbations in the feature space. Different from image data, translating the adversarial perturbations from the feature space to text formats, as in emails, changes the effectiveness of the adversarial perturbations. It can reduce the attack success rate in the case of spam email detection. In this paper, we study the feasibility of adversarial attacks on machine learning based spam detectors and propose two novel text crafting methods leveraging adversarial perturbations generated by the adversarial example generation algorithms to improve the attack effectiveness. One method tries to approximate the feature values and the other adds special words to original emails. In experimentation, we use PGD as an example to demonstrate and compare the effectiveness of our attack methods on spam email detectors. We also examine the transferability of the proposed attack methods on different machine learning models.","PeriodicalId":414339,"journal":{"name":"Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-05-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123929202","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 6

Session details: Keynote Talks 会议详情:主题演讲

Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems Pub Date : 2021-05-24 DOI: 10.1145/3467999

Li Li

引用次数: 0

Verification Method of Key-Exchange Protocols With a Small Amount of Input Using Tamarin Prover 小输入量密钥交换协议的验证方法

Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems Pub Date : 2021-05-24 DOI: 10.1145/3457340.3458301

Misato Nakabayashi, Y. Okano

{"title":"Verification Method of Key-Exchange Protocols With a Small Amount of Input Using Tamarin Prover","authors":"Misato Nakabayashi, Y. Okano","doi":"10.1145/3457340.3458301","DOIUrl":"https://doi.org/10.1145/3457340.3458301","url":null,"abstract":"We propose an automatic verification method for cryptographic protocols. Our method can verify whether or not the key-exchange protocol satisfies main security properties, requiring only the protocol specification as its input. The specification consists of, for example, how session keys are computed and which party sends/receives which data to/from the communication channel. We materialize our method using the Tamarin prover, which is an automatic verification tool for cryptographic protocols. To show the validity of our method, we verify main security properties of several existing protocols and find that the results coincide with what are theoretically known in cryptography. Our method is effective, because the complexity of cryptographic protocols has significantly increased in recent years. To overcome the complexity, people have started using automatic verification tools to verify the security of cryptographic protocols, but existing tools have two problems. First, the user must be familiar with the details of cryptography in order to describe formally the security model as part of input. Second, the input code is complex and its creation is error-prone; protocol specification and security model must be written in a specific language together with protocol-dependent extra codes. These two problems are resolved by our method.","PeriodicalId":414339,"journal":{"name":"Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-05-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131276371","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

TRAITOR: A Low-Cost Evaluation Platform for Multifault Injection 叛徒:一个低成本的多断层注入评估平台

Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems Pub Date : 2021-05-24 DOI: 10.1145/3457340.3458303

Ludovic Claudepierre, Pierre-Yves Péneau, D. Hardy, Erven Rohou

引用次数: 6

Session details: Session 2: Security by Design 会话详细信息:会话2:设计安全性

Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems Pub Date : 2021-05-24 DOI: 10.1145/3468001

Li Li

引用次数: 0

A Systematic Hardening of Java's Information Hiding Java信息隐藏的系统加固

Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems Pub Date : 2021-05-24 DOI: 10.1145/3457340.3458300

Philipp Holzinger, E. Bodden

引用次数: 2

Session details: Session 1: Software Security 会议详情:会议1:软件安全

Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems Pub Date : 2021-05-24 DOI: 10.1145/3468000

W. Meng

引用次数: 0

Secure Distributed Applications the Decent Way 以体面的方式保护分布式应用程序

Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems Pub Date : 2020-04-04 DOI: 10.1145/3457340.3458304

Haofan Zheng, Owen Arden

{"title":"Secure Distributed Applications the Decent Way","authors":"Haofan Zheng, Owen Arden","doi":"10.1145/3457340.3458304","DOIUrl":"https://doi.org/10.1145/3457340.3458304","url":null,"abstract":"Remote attestation (RA) authenticates code running in trusted execution environments (TEEs), allowing trusted code to be deployed even on untrusted hosts. However, trust relationships established by one component in a distributed application may impact the security of other components, making it difficult to reason about the security of the application as a whole. Furthermore, traditional RA approaches interact badly with modern web service design, which tends to employ small interacting microservices, short session lifetimes, and little or no state. This paper presents the Decent Application Platform, a framework for building secure decentralized applications. Decent applications authenticate and authorize distributed enclave components using a protocol based on self-attestation certificates, a reusable credential based on RA and verifiable by a third party. Components mutually authenticate each other not only based on their code, but also based on the other components they trust, ensuring that no transitively-connected components receive unauthorized information. While some other TEE frameworks support mutual authentication in some form, Decent is the only system that supports mutual authentication without requiring an additional trusted third party besides the trusted hardware's manufacturer. We have verified the secrecy and authenticity of Decent application data in ProVerif, and implemented two applications to evaluate Decent's expressiveness and performance: DecentRide, a ride-sharing service, and DecentHT, a distributed hash table. On the YCSB benchmark, we show that DecentHT achieves 7.5x higher throughput and 3.67x lower latency compared to a non-Decent implementation.","PeriodicalId":414339,"journal":{"name":"Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems","volume":"28 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-04-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127323498","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3