Proceedings of the 11th Annual Cyber and Information Security Research Conference最新文献

Classification of Insider Threat Detection Techniques 内部威胁检测技术分类

Proceedings of the 11th Annual Cyber and Information Security Research Conference Pub Date : 2016-04-05 DOI: 10.1145/2897795.2897799

Ameya Sanzgiri, D. Dasgupta

引用次数: 60

Bringing Federated Identity to Grid Computing 将联邦身份引入网格计算

Proceedings of the 11th Annual Cyber and Information Security Research Conference Pub Date : 2016-04-05 DOI: 10.1145/2897795.2897807

J. Teheran, D. Dykstra, Mine Altunay

引用次数: 0

Addressing Critical Industrial Control System Cyber Security Concerns via High Fidelity Simulation 通过高保真仿真解决关键工业控制系统网络安全问题

Proceedings of the 11th Annual Cyber and Information Security Research Conference Pub Date : 2016-04-05 DOI: 10.1145/2897795.2897819

R. Vaughn, T. Morris

引用次数: 12

Double Helix and RAVEN: A System for Cyber Fault Tolerance and Recovery 双螺旋和RAVEN:一个网络容错和恢复系统

Proceedings of the 11th Annual Cyber and Information Security Research Conference Pub Date : 2016-04-05 DOI: 10.1145/2897795.2897805

M. Co, J. Davidson, Jason Hiser, J. Knight, A. Nguyen-Tuong, Westley Weimer, Jonathan Burket, Gregory L. Frazier, T. Frazier, B. Dutertre, Ian A. Mason, N. Shankar, S. Forrest

{"title":"Double Helix and RAVEN: A System for Cyber Fault Tolerance and Recovery","authors":"M. Co, J. Davidson, Jason Hiser, J. Knight, A. Nguyen-Tuong, Westley Weimer, Jonathan Burket, Gregory L. Frazier, T. Frazier, B. Dutertre, Ian A. Mason, N. Shankar, S. Forrest","doi":"10.1145/2897795.2897805","DOIUrl":"https://doi.org/10.1145/2897795.2897805","url":null,"abstract":"Cyber security research has produced numerous artificial diversity techniques such as address space layout randomization, heap randomization, instruction-set randomization, and instruction location randomization. To be most effective, these techniques must be high entropy and secure from information leakage which, in practice, is often difficult to achieve. Indeed, it has been demonstrated that well-funded, determined adversaries can often circumvent these defenses. To allow use of low-entropy diversity, prevent information leakage, and provide provable security against attacks, previous research proposed using low-entropy but carefully structured artificial diversity to create variants of an application and then run these constructed variants within a fault-tolerant environment that runs each variant in parallel and cross check results to detect and mitigate faults. If the variants are carefully constructed, it is possible to prove that certain classes of attack are not possible. This paper presents an overview and status of a cyber fault tolerant system that uses a low overhead multi-variant execution environment and precise static binary analysis and efficient rewriting technology to produce structured variants which allow automated verification techniques to prove security properties of the system. Preliminary results are presented which demonstrate that the system is capable of detecting unknown faults and mitigating attacks.","PeriodicalId":427043,"journal":{"name":"Proceedings of the 11th Annual Cyber and Information Security Research Conference","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-04-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125213170","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 20

Dynamic Canary Randomization for Improved Software Security 动态金丝雀随机化提高软件安全性

Proceedings of the 11th Annual Cyber and Information Security Research Conference Pub Date : 2016-04-05 DOI: 10.1145/2897795.2897803

William H. Hawkins, Jason Hiser, J. Davidson

{"title":"Dynamic Canary Randomization for Improved Software Security","authors":"William H. Hawkins, Jason Hiser, J. Davidson","doi":"10.1145/2897795.2897803","DOIUrl":"https://doi.org/10.1145/2897795.2897803","url":null,"abstract":"Stack canaries are a well-known and effective technique for detecting and defeating stack overflow attacks. However, they are not perfect. For programs compiled using gcc, the reference canary value is randomly generated at program invocation and fixed throughout execution. Moreover, for software running on the Linux operating system, canary values are inherited from the parent process and only changed if/when the child process exec()s a different program. Researchers and others have exploited these behaviors to craft real-world attacks that bypass the protections of stack canaries. This paper describes a moving-target stack canary technique that prevents such attacks. The Dynamic Canary Randomization technique (DCR) rerandomizes stack canaries at runtime. DCR is applied directly to the binary using a static binary rewriter (i.e., it does not require access to the program's source code). DCR operates with minimal overhead and gives the user the flexibility to specify the conditions under which to rerandomize the canary. DCR is an improvement over existing canary rerandomizers because it allows rerandomization to be applied at any point during execution and at any frequency. We show that DCR improves software security by demonstrating its ability to prevent real-world attacks on well-known software (e.g., nginx) \"protected\" by traditional stack canaries.","PeriodicalId":427043,"journal":{"name":"Proceedings of the 11th Annual Cyber and Information Security Research Conference","volume":"376 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-04-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115360433","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 16

Network Modeling for Security Analytics 安全分析的网络建模

Proceedings of the 11th Annual Cyber and Information Security Research Conference Pub Date : 2016-04-05 DOI: 10.1145/2897795.2897817

B. Smith, Whitney Caruthers, Dalton Stewart, P. Hawrylak, John Hale

引用次数: 3

Trusted Information Exchange Using Trusted Network Processors 使用可信网络处理器的可信信息交换

Proceedings of the 11th Annual Cyber and Information Security Research Conference Pub Date : 2016-04-05 DOI: 10.1145/2897795.2897809

S. Tucker

引用次数: 0

Towards Selecting and Recommending Online Software Services by Evaluating External Attributes 通过评价外部属性来选择和推荐在线软件服务

Proceedings of the 11th Annual Cyber and Information Security Research Conference Pub Date : 2016-04-05 DOI: 10.1145/2897795.2897797

Lahiru S. Gallege, R. Raje

{"title":"Towards Selecting and Recommending Online Software Services by Evaluating External Attributes","authors":"Lahiru S. Gallege, R. Raje","doi":"10.1145/2897795.2897797","DOIUrl":"https://doi.org/10.1145/2897795.2897797","url":null,"abstract":"Selecting an online software service for a given set of requirements can be based on the quality of results (i.e., relative ranking of the services) and associated recommendations (i.e., applicability of the suggested services). Prevalent approaches for product-based selection (e.g., the ones used by Amazon) and recommendations, such as Content-based Filtering (CBF) and Collaborative Filtering (CLF) do not typically consider information about products beyond primitive attribute-value pairs. Compared to a tangible physical product, a reusable and updatable software service cannot be effectively described using only a set of strict attribute-value pairs or using a sparse matrix of user-product relationship. This is because a software service has various programmatic, functional, and non-functional properties which potentially could also be dynamic in nature. Due to these challenges, it is not sufficient to apply product-based ranking and recommendation techniques to software services available from a marketplace. This research proposes an approach for better selection and recommendation of software services that enhances both CBF and CLF algorithms, using external reviews.","PeriodicalId":427043,"journal":{"name":"Proceedings of the 11th Annual Cyber and Information Security Research Conference","volume":"50 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-04-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127347587","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 8

The Application of Moving Target Defense to Field Programmable Gate Arrays 运动目标防御在现场可编程门阵列中的应用

Proceedings of the 11th Annual Cyber and Information Security Research Conference Pub Date : 2016-04-05 DOI: 10.1145/2897795.2897820

John Dombrowski, T. Andel, J. McDonald

{"title":"The Application of Moving Target Defense to Field Programmable Gate Arrays","authors":"John Dombrowski, T. Andel, J. McDonald","doi":"10.1145/2897795.2897820","DOIUrl":"https://doi.org/10.1145/2897795.2897820","url":null,"abstract":"Field Programmable Gate Arrays (FPGAs) are powerful and flexible pieces of hardware used in a variety of applications. These chips are used in monitoring network traffic, guidance systems, cryptographic calculations, medical devices, embedded systems, as well as many other varied uses. They can be used in a large number of ways as well as in a large number of areas, which allows for nearly limitless applications. Outside of being used as a cryptographic processor and network monitoring, these chips are not being used to directly provide software/hardware security. FPGAs are extremely widespread in addition to becoming more integrated into the systems that they are a part of. This leads to vulnerabilities in almost every system that uses these chips. One way to combat these FPGA based vulnerabilities in every system using them, is to implement a Moving Target Defense (MTD) on the chip itself. FPGA based MTD would allow each FPGA to enhance, rather than weaken, the security of a system. This paper incorporates previous applications of Field Programmable Gate Arrays, and explores potential software/hardware security implementations for these chips through the application of Moving Target Defenses.","PeriodicalId":427043,"journal":{"name":"Proceedings of the 11th Annual Cyber and Information Security Research Conference","volume":"12 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-04-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127464087","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Xen Network Flow Analysis for Intrusion Detection 用于入侵检测的Xen网络流分析

Proceedings of the 11th Annual Cyber and Information Security Research Conference Pub Date : 2016-04-05 DOI: 10.1145/2897795.2897802

R. Johnston, Sun-il Kim, D. Coe, L. Etzkorn, J. Kulick, A. Milenković

引用次数: 2