21st Annual Computer Security Applications Conference (ACSAC'05)最新文献

Privacy-preserving alert correlation: a concept hierarchy based approach 隐私保护警报关联:一种基于概念层次结构的方法

21st Annual Computer Security Applications Conference (ACSAC'05) Pub Date : 2005-12-05 DOI: 10.1109/CSAC.2005.45

Dingbang Xu, P. Ning

{"title":"Privacy-preserving alert correlation: a concept hierarchy based approach","authors":"Dingbang Xu, P. Ning","doi":"10.1109/CSAC.2005.45","DOIUrl":"https://doi.org/10.1109/CSAC.2005.45","url":null,"abstract":"With the increasing security threats from infrastructure attacks such as worms and distributed denial of service attacks, it is clear that the cooperation among different organizations is necessary to defend against these attacks. However, organizations' privacy concerns for the incident and security alert data require that sensitive data be sanitized before they are shared with other organizations. Such sanitization process usually has negative impacts on intrusion analysis (such as alert correlation). To balance the privacy requirements and the need for intrusion analysis, we propose a privacy-preserving alert correlation approach based on concept hierarchies. Our approach consists of two phases. The first phase is entropy guided alert sanitization, where sensitive alert attributes are generalized to high-level concepts to introduce uncertainty into the dataset with partial semantics. To balance the privacy and the usability of alert data, we propose to guide the alert sanitization process with the entropy or differential entropy of sanitized attributes. The second phase is sanitized alert correlation. We focus on defining similarity functions between sanitized attributes and building attack scenarios from sanitized alerts. Our preliminary experimental results demonstrate the effectiveness of the proposed techniques","PeriodicalId":422994,"journal":{"name":"21st Annual Computer Security Applications Conference (ACSAC'05)","volume":"436 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-12-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126114850","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 49

Evolving successful stack overflow attacks for vulnerability testing 发展成功的堆栈溢出攻击以进行漏洞测试

21st Annual Computer Security Applications Conference (ACSAC'05) Pub Date : 2005-12-05 DOI: 10.1109/CSAC.2005.23

H. G. Kayacik, A. N. Zincir-Heywood, M. Heywood

引用次数: 22

A Nitpicker’s guide to a minimal-complexity secure GUI 一个简单的安全GUI指南

21st Annual Computer Security Applications Conference (ACSAC'05) Pub Date : 2005-12-05 DOI: 10.1109/CSAC.2005.7

Norman Feske, C. Helmuth

引用次数: 92

Graphical passwords: a survey 图形密码:一项调查

21st Annual Computer Security Applications Conference (ACSAC'05) Pub Date : 2005-12-05 DOI: 10.1109/CSAC.2005.27

Xiaoyuan Suo, Ying Zhu, G. Owen

引用次数: 651

A host-based approach to network attack chaining analysis 基于主机的网络攻击链分析方法

21st Annual Computer Security Applications Conference (ACSAC'05) Pub Date : 2005-12-05 DOI: 10.1109/CSAC.2005.6

P. Ammann, J. Pamula, Julie A. Street, Ronald W. Ritchey

{"title":"A host-based approach to network attack chaining analysis","authors":"P. Ammann, J. Pamula, Julie A. Street, Ronald W. Ritchey","doi":"10.1109/CSAC.2005.6","DOIUrl":"https://doi.org/10.1109/CSAC.2005.6","url":null,"abstract":"The typical means by which an attacker breaks into a network is through a chain of exploits, where each exploit in the chain lays the groundwork for subsequent exploits. Such a chain is called an attack path, and the set of all possible attack paths form an attack graph. Researchers have proposed a variety of methods to generate attack graphs. In this paper, we provide a novel alternative approach to network vulnerability analysis by utilizing a penetration tester's perspective of maximal level of penetration possible on a host. Our approach has the following benefits: it provides a more intuitive model in which an analyst can work, and its algorithmic complexity is polynomial in the size of the network, and so has the potential of scaling well to practical networks. The drawback is that we track only \"good\" attack paths, as opposed to all possible attack paths. Hence, an analyst may make suboptimal choices when repairing the network. Since attack graphs grow exponentially with the size of the network, we argue that suboptimal solutions are an unavoidable cost of scalability, and hence practical utility. A working prototype tool has been implemented to demonstrate the practicality of our approach","PeriodicalId":422994,"journal":{"name":"21st Annual Computer Security Applications Conference (ACSAC'05)","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-12-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133312234","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 104

Improved port knocking with strong authentication 改进端口敲门与强认证

21st Annual Computer Security Applications Conference (ACSAC'05) Pub Date : 2005-12-05 DOI: 10.1109/CSAC.2005.32

Rennie deGraaf, John Aycock, M. Jacobson

引用次数: 69

Layering public key distribution over secure DNS using authenticated delegation 使用经过身份验证的委托在安全DNS上分层公钥分发

21st Annual Computer Security Applications Conference (ACSAC'05) Pub Date : 2005-12-05 DOI: 10.1109/CSAC.2005.35

J. Jones, Daniel F. Berger, C. Ravishankar

引用次数: 11

Java for mobile devices: a security study 移动设备的Java:安全研究

21st Annual Computer Security Applications Conference (ACSAC'05) Pub Date : 2005-12-05 DOI: 10.1109/CSAC.2005.34

M. Debbabi, Mohamed Saleh, C. Talhi, Sami Zhioua

引用次数: 14

Defensive execution of transactional processes against attacks 防御攻击的事务性流程执行

21st Annual Computer Security Applications Conference (ACSAC'05) Pub Date : 2005-12-05 DOI: 10.1109/CSAC.2005.18

Meng Yu, Wanyu Zang, Peng Liu

引用次数: 1

PorKI: making user PKI safe on machines of heterogeneous trustworthiness PorKI:使用户PKI在异构可信的机器上安全

21st Annual Computer Security Applications Conference (ACSAC'05) Pub Date : 2005-12-05 DOI: 10.1109/CSAC.2005.43

S. Sinclair, Sean W. Smith

{"title":"PorKI: making user PKI safe on machines of heterogeneous trustworthiness","authors":"S. Sinclair, Sean W. Smith","doi":"10.1109/CSAC.2005.43","DOIUrl":"https://doi.org/10.1109/CSAC.2005.43","url":null,"abstract":"As evidenced by the proliferation of phishing attacks and keystroke loggers, we know that human beings are not well-equipped to make trust decisions about when to use their passwords or other personal credentials. Public key cryptography can reduce this risk of attack, because authentication using PKI is designed to not give away sensitive data. However, using private keys on standard platforms exposes the user to \"keyjacking\"; mobile users wishing to use keypairs on an unfamiliar and potentially untrusted workstation face even more obstacles. In this paper we present the design and prototype of PorKI, a software application for mobile devices that offers an alternative solution to the portable key problem. Through the use of temporary keypairs, proxy certificates, and wireless protocols, PorKI enables a user to employ her PKI credentials on any Bluetooth-enabled workstation, including those not part of her organization's network, and even those that might be malicious. Moreover, by crafting XACML policy statements that limit the key usage to the workstation's trustworthiness level, and inserting these statements into extensions of the proxy certificates, PorKI provides the user or the relying party with the ability to limit the amount of trust that can be put in the temporary keypair used on that workstation, and thus the scope of a potential compromise","PeriodicalId":422994,"journal":{"name":"21st Annual Computer Security Applications Conference (ACSAC'05)","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-12-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134162049","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 15