2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA)最新文献_第3页

What Makefile? Detecting Compiler Information Without Source Using The Code Property Graph Makefile什么?使用代码属性图检测没有源代码的编译器信息

2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA) Pub Date : 2022-12-01 DOI: 10.1109/TPS-ISA56441.2022.00039

Shaun R. Deaton

{"title":"What Makefile? Detecting Compiler Information Without Source Using The Code Property Graph","authors":"Shaun R. Deaton","doi":"10.1109/TPS-ISA56441.2022.00039","DOIUrl":"https://doi.org/10.1109/TPS-ISA56441.2022.00039","url":null,"abstract":"Users frequently lack access to the underlying source code and build artifacts of the programs they use. Without access, uncovering information about programs, such as compiler information or security properties, becomes a difficult task. Various methods exist for static analysis testing on source code languages, but few tools work solely with the executable machine code. This paper proposes constructing the code property graph from a program’s lifted machine code to observe structural differences between other executables. We implement our approach with the Binary Ninja Intermediate Language (BNIL) and the graph2vec neural embedding framework to create embedded representations of the graphical properties of the program. Downstream applications, such as supervised machine learning, can then analyze these representations. We demonstrate the effectiveness of our approach by training a supervised random forest classifier on the embedded graphs to determine, at the function level, which compiler, clang or gcc, created the executable the function belongs to. Our results achieved an accuracy of 100% across our testing set of 25,600 samples.","PeriodicalId":427887,"journal":{"name":"2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA)","volume":"38 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124089445","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Defending Against Targeted Poisoning Attacks in Federated Learning 防御联邦学习中的针对性中毒攻击

2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA) Pub Date : 2022-12-01 DOI: 10.1109/TPS-ISA56441.2022.00033

Pinar Erbil, M. E. Gursoy

{"title":"Defending Against Targeted Poisoning Attacks in Federated Learning","authors":"Pinar Erbil, M. E. Gursoy","doi":"10.1109/TPS-ISA56441.2022.00033","DOIUrl":"https://doi.org/10.1109/TPS-ISA56441.2022.00033","url":null,"abstract":"Federated learning (FL) enables multiple participants to collaboratively train a deep neural network (DNN) model. To combat malicious participants in FL, Byzantine-resilient aggregation rules (AGRs) have been developed. However, although Byzantine-resilient AGRs are effective against untargeted attacks, they become suboptimal when attacks are stealthy and targeted. In this paper, we study the problem of defending against targeted data poisoning attacks in FL and make three main contributions. First, we propose a method for selective extraction of DNN parameters from FL participants’ update vectors that are indicative of attack, and embedding them into low-dimensional latent space. We show that the effectiveness of Byzantine-resilient AGRs such as Trimmed Mean and Krum can be improved if they are used in combination with our proposed method. Second, we develop a clustering-based defense using X-Means for separating items into malicious versus benign clusters in latent space. Such separation allows identification of malicious versus benign updates. Third, using the separation from the previous step, we show that a \"clean\" model (i.e., a model that is not negatively impacted by the attack) can be trained using only the benign updates. We experimentally evaluate our defense methods on Fashion-MNIST and CIFAR-10 datasets. Results show that our methods can achieve up to 95% true positive rate and 99% accuracy in malicious update identification across various settings. In addition, the clean models trained using our approach achieve similar accuracy compared to a baseline scenario without poisoning.","PeriodicalId":427887,"journal":{"name":"2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA)","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115022410","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Steering Committee 指导委员会

2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA) Pub Date : 2022-12-01 DOI: 10.1109/WSE.2005.17

Dharma Agrawal, K. Bagchi

引用次数: 0

Privacy and Security Issues for Human Digital Twins 人类数字双胞胎的隐私和安全问题

2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA) Pub Date : 2022-12-01 DOI: 10.1109/TPS-ISA56441.2022.00011

Giorgia Sirigu, B. Carminati, E. Ferrari

引用次数: 3

Impact of Dimensionality Reduction on Outlier Detection: an Empirical Study 降维对离群值检测的影响:一个实证研究

2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA) Pub Date : 2022-12-01 DOI: 10.1109/TPS-ISA56441.2022.00028

Vivek Vaidya, Jaideep Vaidya

引用次数: 0

Money Talks: Detection of Disposable Phishing Websites by Analyzing Its Building Costs 金钱说话:通过分析其建设成本检测一次性网络钓鱼网站

2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA) Pub Date : 2022-12-01 DOI: 10.1109/TPS-ISA56441.2022.00022

Daiki Ito, Yuta Takata, Masaki Kamizono

{"title":"Money Talks: Detection of Disposable Phishing Websites by Analyzing Its Building Costs","authors":"Daiki Ito, Yuta Takata, Masaki Kamizono","doi":"10.1109/TPS-ISA56441.2022.00022","DOIUrl":"https://doi.org/10.1109/TPS-ISA56441.2022.00022","url":null,"abstract":"Websites unfortunately play a powerful role in delivering malicious content to users during cyberattacks. In particular, the threat of phishing websites that tricks users by abusing their corporate and brand names is increasing. Building a website requires infrastructure costs (e.g., domain name fees) and operational costs (e.g., managing server settings). Additionally, many companies spend considerable resources managing their own IT assets and security countermeasures. Even when phishing websites are taken down, attackers persist by scrapping and rebuilding them, as doing so is inexpensive. Notably, there are significant differences in website building costs between companies and attackers. In this study, we propose a method of analyzing the costs incurred in a process of building websites from domain name registration to website deployment to detect phishing websites. We evaluate our method using data from 1,082 large corporate websites and 1,163 phishing websites. As a result, our method achieves a detection performance of 95% precision and 96% recall. In addition, we show that our method still achieves a 95% recall for 866 phishing websites even after six months and the indicator of website building costs is robust to concept drift. We further discuss the applicability of the cost indicator.","PeriodicalId":427887,"journal":{"name":"2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA)","volume":"96 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129445426","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Scenario-Driven Device-to-Device Access Control in Smart Home IoT 智能家居物联网中场景驱动的设备对设备访问控制

2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA) Pub Date : 2022-12-01 DOI: 10.1109/TPS-ISA56441.2022.00035

Mehrnoosh Shakarami, James O. Benson, R. Sandhu

{"title":"Scenario-Driven Device-to-Device Access Control in Smart Home IoT","authors":"Mehrnoosh Shakarami, James O. Benson, R. Sandhu","doi":"10.1109/TPS-ISA56441.2022.00035","DOIUrl":"https://doi.org/10.1109/TPS-ISA56441.2022.00035","url":null,"abstract":"The Internet of Things (IoT) has been widely integrated in people's everyday lives. As an infrastructure of connected heterogeneous devices, IoT has not yet achieved the seamless integration of device-to-device collaboration which is necessary for real-life home automation. Smart home IoT devices expect to exchange their collected data or status in certain circumstances, in spite of their heterogeneity, viz. working with different communication protocols, IoT platforms, middleware, data and semantics. Deploying appropriate access control models and mechanisms is of utmost importance as any unauthorized access to data could have a cascading violation of privacy, safety and security of users. In this work, we propose a novel device-to-device access control paradigm in the smart home IoT. Our approach relies on message passing as the paradigm for device-to-device interactions. We further introduce actions and scenarios reflecting the chain of events in the smart home context, which facilitates scenario-driven attribute-based access control. Each scenario is triggered by triggering events, based on previously set administrative definitions. We define totally ordered sets of triggering events using priorities to enable conflict resolution for devices which may run into conflicting commands delivered though messages in different ongoing scenarios. The viability of the proposed approach is substantiated via a formal model and an enforcement architecture, backed up by a proof-of-concept implementation which affirms a trade-off between required authorization and efficacy. Potential future challenges are explored in the context of smart home IoT platforms.","PeriodicalId":427887,"journal":{"name":"2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA)","volume":"46 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117189314","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Adaptive Control for Security and Resilience of Networked Cyber-Physical Systems: Where Are We? 网络信息物理系统安全性和弹性的自适应控制:我们在哪里?

2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA) Pub Date : 2022-12-01 DOI: 10.1109/TPS-ISA56441.2022.00037

Talal Halabi, I. Haque, H. Karimipour

{"title":"Adaptive Control for Security and Resilience of Networked Cyber-Physical Systems: Where Are We?","authors":"Talal Halabi, I. Haque, H. Karimipour","doi":"10.1109/TPS-ISA56441.2022.00037","DOIUrl":"https://doi.org/10.1109/TPS-ISA56441.2022.00037","url":null,"abstract":"Cyber-Physical Systems (CPSs), a class of complex intelligent systems, are considered the backbone of Industry 4.0. They aim to achieve large-scale, networked control of dynamical systems and processes such as electricity and gas distribution networks and deliver pervasive information services by combining state-of-the-art computing, communication, and control technologies. However, CPSs are often highly nonlinear and uncertain, and their intrinsic reliance on open communication platforms increases their vulnerability to security threats, which entails additional challenges to conventional control design approaches. Indeed, sensor measurements and control command signals, whose integrity plays a critical role in correct controller design, may be interrupted or falsely modified when broadcasted on wireless communication channels due to cyber attacks. This can have a catastrophic impact on CPS performance. In this paper, we first conduct a thorough analysis of recently developed secure and resilient control approaches leveraging the solid foundations of adaptive control theory to achieve security and resilience in networked CPSs against sensor and actuator attacks. Then, we discuss the limitations of current adaptive control strategies and present several future research directions in this field.","PeriodicalId":427887,"journal":{"name":"2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA)","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122387212","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Understanding Model Extraction Games 理解模型抽取游戏

2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA) Pub Date : 2022-12-01 DOI: 10.1109/TPS-ISA56441.2022.00042

Xun Xian, Min-Fong Hong, Jie Ding

{"title":"Understanding Model Extraction Games","authors":"Xun Xian, Min-Fong Hong, Jie Ding","doi":"10.1109/TPS-ISA56441.2022.00042","DOIUrl":"https://doi.org/10.1109/TPS-ISA56441.2022.00042","url":null,"abstract":"The privacy of machine learning models has become a significant concern in many emerging Machine-Learning-as- a-Service applications, where prediction services based on well- trained models are offered to users via the pay-per-query scheme. However, the lack of a defense mechanism can impose a high risk on the privacy of the server’s model since an adversary could efficiently steal the model by querying only a few ‘good’ data points. The game between a server’s defense and an adversary’s attack inevitably leads to an arms race dilemma, as commonly seen in Adversarial Machine Learning. To study the fundamental tradeoffs between model utility from a benign user’s view and privacy from an adversary’s view, we develop new metrics to quantify such tradeoffs, analyze their theoretical properties, and develop an optimization problem to understand the optimal adversarial attack and defense strategies. The developed concepts and theory match the empirical findings on the ‘equilibrium’ between privacy and utility. In terms of optimization, the key ingredient that enables our results is a unified representation of the attack-defense problem as a min-max bi-level problem. The developed results are demonstrated by examples and empirical experiments.","PeriodicalId":427887,"journal":{"name":"2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA)","volume":"11 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126976050","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Towards faster settlement in HTLC-based Cross-Chain Atomic Swaps 更快地解决基于html的跨链原子交换

2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA) Pub Date : 2022-11-28 DOI: 10.1109/TPS-ISA56441.2022.00043

Subhra Mazumdar

{"title":"Towards faster settlement in HTLC-based Cross-Chain Atomic Swaps","authors":"Subhra Mazumdar","doi":"10.1109/TPS-ISA56441.2022.00043","DOIUrl":"https://doi.org/10.1109/TPS-ISA56441.2022.00043","url":null,"abstract":"Hashed Timelock (HTLC)-based atomic swap protocols enable the exchange of coins between two or more parties without relying on a trusted entity. This protocol is like the American call option without premium. It allows the finalization of a deal within a certain period. This puts the swap initiator at liberty to delay before deciding to proceed with the deal. If she finds the deal unprofitable, she just waits for the time-period of the contract to elapse. However, the counterparty is at a loss since his assets remain locked in the contract. The best he can do is to predict the initiator’s behavior based on the asset’s price fluctuation in the future. But it is difficult to predict as cryptocurrencies are quite volatile, and their price fluctuates abruptly. We perform a game theoretic analysis of HTLC-based atomic cross-chain swap to predict whether a swap will succeed or not. From the strategic behavior of the players, we infer that this model lacks fairness. We propose Quick Swap, a two-party protocol based on hashlock and timelock that fosters faster settlement of the swap. The parties are required to lock griefing-premium along with the principal amount. If the party griefs, he ends up paying the griefing-premium. If a party finds a deal unfavorable, he has the provision to cancel the swap. We prove that Quick Swap is more participant-friendly than HTLC-based atomic swap. Our work is the first to propose a protocol to ensure fairness of atomic-swap in a cyclic multi-party setting.","PeriodicalId":427887,"journal":{"name":"2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA)","volume":"146 2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-11-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126006995","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1