arXiv - CS - Cryptography and Security最新文献_第7页

H$_2$O$_2$RAM: A High-Performance Hierarchical Doubly Oblivious RAM H$_2$O$_2$RAM：高性能分层双遗忘 RAM

arXiv - CS - Cryptography and Security Pub Date : 2024-09-11 DOI: arxiv-2409.07167

Leqian Zheng, Zheng Zhang, Wentao Dong, Yao Zhang, Ye Wu, Cong Wang

{"title":"H$_2$O$_2$RAM: A High-Performance Hierarchical Doubly Oblivious RAM","authors":"Leqian Zheng, Zheng Zhang, Wentao Dong, Yao Zhang, Ye Wu, Cong Wang","doi":"arxiv-2409.07167","DOIUrl":"https://doi.org/arxiv-2409.07167","url":null,"abstract":"The combination of Oblivious RAM (ORAM) with Trusted Execution Environments\u0000(TEE) has found numerous real-world applications due to their complementary\u0000nature. TEEs alleviate the performance bottlenecks of ORAM, such as network\u0000bandwidth and roundtrip latency, and ORAM provides general-purpose protection\u0000for TEE applications against attacks exploiting memory access patterns. The\u0000defining property of this combination, which sets it apart from traditional\u0000ORAM designs, is its ability to ensure that memory accesses, both inside and\u0000outside of TEEs, are made oblivious, thus termed doubly oblivious RAM\u0000(O$_2$RAM). Efforts to develop O$_2$RAM with enhanced performance are ongoing. In this work, we propose H$_2$O$_2$RAM, a high-performance doubly oblivious\u0000RAM construction. The distinguishing feature of our approach, compared to the\u0000existing tree-based doubly oblivious designs, is its first adoption of the\u0000hierarchical framework that enjoys inherently better data locality and\u0000parallelization. While the latest hierarchical solution, FutORAMa, achieves\u0000concrete efficiency in the classic client-server model by leveraging a relaxed\u0000assumption of sublinear-sized client-side private memory, adapting it to our\u0000scenario poses challenges due to the conflict between this relaxed assumption\u0000and our doubly oblivious requirement. To this end, we introduce several new\u0000efficient oblivious components to build a high-performance hierarchical\u0000O$_2$RAM (H$_2$O$_2$RAM). We implement our design and evaluate it on various\u0000scenarios. The results indicate that H$_2$O$_2$RAM reduces execution time by up\u0000to $sim 10^3$ times and saves memory usage by $5sim44$ times compared to\u0000state-of-the-art solutions.","PeriodicalId":501332,"journal":{"name":"arXiv - CS - Cryptography and Security","volume":"44 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-09-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142201648","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Demo: SGCode: A Flexible Prompt-Optimizing System for Secure Generation of Code 演示：SGCode：用于安全生成代码的灵活提示优化系统

arXiv - CS - Cryptography and Security Pub Date : 2024-09-11 DOI: arxiv-2409.07368

Khiem Ton, Nhi Nguyen, Mahmoud Nazzal, Abdallah Khreishah, Cristian Borcea, NhatHai Phan, Ruoming Jin, Issa Khalil, Yelong Shen

{"title":"Demo: SGCode: A Flexible Prompt-Optimizing System for Secure Generation of Code","authors":"Khiem Ton, Nhi Nguyen, Mahmoud Nazzal, Abdallah Khreishah, Cristian Borcea, NhatHai Phan, Ruoming Jin, Issa Khalil, Yelong Shen","doi":"arxiv-2409.07368","DOIUrl":"https://doi.org/arxiv-2409.07368","url":null,"abstract":"This paper introduces SGCode, a flexible prompt-optimizing system to generate\u0000secure code with large language models (LLMs). SGCode integrates recent\u0000prompt-optimization approaches with LLMs in a unified system accessible through\u0000front-end and back-end APIs, enabling users to 1) generate secure code, which\u0000is free of vulnerabilities, 2) review and share security analysis, and 3)\u0000easily switch from one prompt optimization approach to another, while providing\u0000insights on model and system performance. We populated SGCode on an AWS server\u0000with PromSec, an approach that optimizes prompts by combining an LLM and\u0000security tools with a lightweight generative adversarial graph neural network\u0000to detect and fix security vulnerabilities in the generated code. Extensive\u0000experiments show that SGCode is practical as a public tool to gain insights\u0000into the trade-offs between model utility, secure code generation, and system\u0000cost. SGCode has only a marginal cost compared with prompting LLMs. SGCode is\u0000available at: http://3.131.141.63:8501/.","PeriodicalId":501332,"journal":{"name":"arXiv - CS - Cryptography and Security","volume":"5 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-09-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142201646","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

fence.t.s: Closing Timing Channels in High-Performance Out-of-Order Cores through ISA-Supported Temporal Partitioning fence.t.s：通过 ISA 支持的时序分区关闭高性能失序内核中的定时通道

arXiv - CS - Cryptography and Security Pub Date : 2024-09-11 DOI: arxiv-2409.07576

Nils Wistoff, Gernot Heiser, Luca Benini

引用次数: 0

CLNX: Bridging Code and Natural Language for C/C++ Vulnerability-Contributing Commits Identification CLNX：为识别 C/C++ 漏洞贡献提交架起代码与自然语言的桥梁

arXiv - CS - Cryptography and Security Pub Date : 2024-09-11 DOI: arxiv-2409.07407

Zeqing Qin, Yiwei Wu, Lansheng Han

{"title":"CLNX: Bridging Code and Natural Language for C/C++ Vulnerability-Contributing Commits Identification","authors":"Zeqing Qin, Yiwei Wu, Lansheng Han","doi":"arxiv-2409.07407","DOIUrl":"https://doi.org/arxiv-2409.07407","url":null,"abstract":"Large Language Models (LLMs) have shown great promise in vulnerability\u0000identification. As C/C++ comprises half of the Open-Source Software (OSS)\u0000vulnerabilities over the past decade and updates in OSS mainly occur through\u0000commits, enhancing LLMs' ability to identify C/C++ Vulnerability-Contributing\u0000Commits (VCCs) is essential. However, current studies primarily focus on\u0000further pre-training LLMs on massive code datasets, which is resource-intensive\u0000and poses efficiency challenges. In this paper, we enhance the ability of\u0000BERT-based LLMs to identify C/C++ VCCs in a lightweight manner. We propose\u0000CodeLinguaNexus (CLNX) as a bridge facilitating communication between C/C++\u0000programs and LLMs. Based on commits, CLNX efficiently converts the source code\u0000into a more natural representation while preserving key details. Specifically,\u0000CLNX first applies structure-level naturalization to decompose complex\u0000programs, followed by token-level naturalization to interpret complex symbols.\u0000We evaluate CLNX on public datasets of 25,872 C/C++ functions with their\u0000commits. The results show that CLNX significantly enhances the performance of\u0000LLMs on identifying C/C++ VCCs. Moreover, CLNX-equipped CodeBERT achieves new\u0000state-of-the-art and identifies 38 OSS vulnerabilities in the real world.","PeriodicalId":501332,"journal":{"name":"arXiv - CS - Cryptography and Security","volume":"7 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-09-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142201644","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Cybersecurity Challenge Analysis of Work-from-Anywhere (WFA) and Recommendations guided by a User Study 随时随地办公 (WFA) 的网络安全挑战分析和用户研究提出的建议

arXiv - CS - Cryptography and Security Pub Date : 2024-09-11 DOI: arxiv-2409.07567

Mohammed Mahyoub, Ashraf Matrawy, Kamal Isleem, Olakunle Ibitoye

{"title":"Cybersecurity Challenge Analysis of Work-from-Anywhere (WFA) and Recommendations guided by a User Study","authors":"Mohammed Mahyoub, Ashraf Matrawy, Kamal Isleem, Olakunle Ibitoye","doi":"arxiv-2409.07567","DOIUrl":"https://doi.org/arxiv-2409.07567","url":null,"abstract":"Many organizations were forced to quickly transition to the\u0000work-from-anywhere (WFA) model as a necessity to continue with their operations\u0000and remain in business despite the restrictions imposed during the COVID-19\u0000pandemic. Many decisions were made in a rush, and cybersecurity decency tools\u0000were not in place to support this transition. In this paper, we first attempt\u0000to uncover some challenges and implications related to the cybersecurity of the\u0000WFA model. Secondly, we conducted an online user study to investigate the\u0000readiness and cybersecurity awareness of employers and their employees who\u0000shifted to work remotely from anywhere. The user study questionnaire addressed\u0000different resilience perspectives of individuals and organizations. The\u0000collected data includes 45 responses from remotely working employees of\u0000different organizational types: universities, government, private, and\u0000non-profit organizations. Despite the importance of security training and\u0000guidelines, it was surprising that many participants had not received them. A\u0000robust communication strategy is necessary to ensure that employees are\u0000informed and updated on security incidents that the organization encounters.\u0000Additionally, there is an increased need to pay attention to the\u0000security-related attributes of employees, such as their behavior, awareness,\u0000and compliance. Finally, we outlined best practice recommendations and\u0000mitigation tips guided by the study results to help individuals and\u0000organizations resist cybercrime and fraud and mitigate WFA-related\u0000cybersecurity risks.","PeriodicalId":501332,"journal":{"name":"arXiv - CS - Cryptography and Security","volume":"18 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-09-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142201635","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Cyber Deception: State of the art, Trends and Open challenges 网络欺骗：技术现状、趋势和公开挑战

arXiv - CS - Cryptography and Security Pub Date : 2024-09-11 DOI: arxiv-2409.07194

Pedro Beltrán López, Manuel Gil Pérez, Pantaleone Nespoli

{"title":"Cyber Deception: State of the art, Trends and Open challenges","authors":"Pedro Beltrán López, Manuel Gil Pérez, Pantaleone Nespoli","doi":"arxiv-2409.07194","DOIUrl":"https://doi.org/arxiv-2409.07194","url":null,"abstract":"The growing interest in cybersecurity has significantly increased articles\u0000designing and implementing various Cyber Deception (CYDEC) mechanisms. This\u0000trend reflects the urgent need for new strategies to address cyber threats\u0000effectively. Since its emergence, CYDEC has established itself as an innovative\u0000defense against attackers, thanks to its proactive and reactive capabilities,\u0000finding applications in numerous real-life scenarios. Despite the considerable\u0000work devoted to CYDEC, the literature still presents significant gaps. In\u0000particular, there has not been (i) a comprehensive analysis of the main\u0000components characterizing CYDEC, (ii) a generic classification covering all\u0000types of solutions, nor (iii) a survey of the current state of the literature\u0000in various contexts. This article aims to fill these gaps through a detailed\u0000review of the main features that comprise CYDEC, developing a comprehensive\u0000classification taxonomy. In addition, the different frameworks used to generate\u0000CYDEC are reviewed, presenting a more comprehensive one. Existing solutions in\u0000the literature using CYDEC, both without Artificial Intelligence (AI) and with\u0000AI, are studied and compared. Finally, the most salient trends of the current\u0000state of the art are discussed, offering a list of pending challenges for\u0000future research.","PeriodicalId":501332,"journal":{"name":"arXiv - CS - Cryptography and Security","volume":"1 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-09-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142201647","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Analyzing the Impact of Copying-and-Pasting Vulnerable Solidity Code Snippets from Question-and-Answer Websites 分析从问答网站复制粘贴有漏洞的 Solidity 代码片段的影响

arXiv - CS - Cryptography and Security Pub Date : 2024-09-11 DOI: arxiv-2409.07586

Konrad Weiss, Christof Ferreira Torres, Florian Wendland

{"title":"Analyzing the Impact of Copying-and-Pasting Vulnerable Solidity Code Snippets from Question-and-Answer Websites","authors":"Konrad Weiss, Christof Ferreira Torres, Florian Wendland","doi":"arxiv-2409.07586","DOIUrl":"https://doi.org/arxiv-2409.07586","url":null,"abstract":"Ethereum smart contracts are executable programs deployed on a blockchain.\u0000Once deployed, they cannot be updated due to their inherent immutability.\u0000Moreover, they often manage valuable assets that are worth millions of dollars,\u0000making them attractive targets for attackers. The introduction of\u0000vulnerabilities in programs due to the reuse of vulnerable code posted on Q&A\u0000websites such as Stack Overflow is not a new issue. However, little effort has\u0000been made to analyze the extent of this issue on deployed smart contracts. In\u0000this paper, we conduct a study on the impact of vulnerable code reuse from Q&A\u0000websites during the development of smart contracts and provide tools uniquely\u0000fit to detect vulnerable code patterns in complete and incomplete Smart\u0000Contract code. This paper proposes a pattern-based vulnerability detection tool\u0000that is able to analyze code snippets (i.e., incomplete code) as well as full\u0000smart contracts based on the concept of code property graphs. We also propose a\u0000methodology that leverages fuzzy hashing to quickly detect code clones of\u0000vulnerable snippets among deployed smart contracts. Our results show that our\u0000vulnerability search, as well as our code clone detection, are comparable to\u0000state-of-the-art while being applicable to code snippets. Our large-scale study\u0000on 18,660 code snippets reveals that 4,596 of them are vulnerable, out of which\u0000616 can be found in 7,852 deployed smart contracts. These results highlight\u0000that the reuse of vulnerable code snippets is indeed an issue in currently\u0000deployed smart contracts.","PeriodicalId":501332,"journal":{"name":"arXiv - CS - Cryptography and Security","volume":"34 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-09-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142201622","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Revisiting Static Feature-Based Android Malware Detection 重新审视基于静态特征的安卓恶意软件检测

arXiv - CS - Cryptography and Security Pub Date : 2024-09-11 DOI: arxiv-2409.07397

Md Tanvirul Alam, Dipkamal Bhusal, Nidhi Rastogi

{"title":"Revisiting Static Feature-Based Android Malware Detection","authors":"Md Tanvirul Alam, Dipkamal Bhusal, Nidhi Rastogi","doi":"arxiv-2409.07397","DOIUrl":"https://doi.org/arxiv-2409.07397","url":null,"abstract":"The increasing reliance on machine learning (ML) in computer security,\u0000particularly for malware classification, has driven significant advancements.\u0000However, the replicability and reproducibility of these results are often\u0000overlooked, leading to challenges in verifying research findings. This paper\u0000highlights critical pitfalls that undermine the validity of ML research in\u0000Android malware detection, focusing on dataset and methodological issues. We\u0000comprehensively analyze Android malware detection using two datasets and assess\u0000offline and continual learning settings with six widely used ML models. Our\u0000study reveals that when properly tuned, simpler baseline methods can often\u0000outperform more complex models. To address reproducibility challenges, we\u0000propose solutions for improving datasets and methodological practices, enabling\u0000fairer model comparisons. Additionally, we open-source our code to facilitate\u0000malware analysis, making it extensible for new models and datasets. Our paper\u0000aims to support future research in Android malware detection and other security\u0000domains, enhancing the reliability and reproducibility of published results.","PeriodicalId":501332,"journal":{"name":"arXiv - CS - Cryptography and Security","volume":"6 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-09-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142201645","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

New constructions of pseudorandom codes 伪随机码的新构造

arXiv - CS - Cryptography and Security Pub Date : 2024-09-11 DOI: arxiv-2409.07580

Surendra Ghentiyala, Venkatesan Guruswami

{"title":"New constructions of pseudorandom codes","authors":"Surendra Ghentiyala, Venkatesan Guruswami","doi":"arxiv-2409.07580","DOIUrl":"https://doi.org/arxiv-2409.07580","url":null,"abstract":"Introduced in [CG24], pseudorandom error-correcting codes (PRCs) are a new\u0000cryptographic primitive with applications in watermarking generative AI models.\u0000These are codes where a collection of polynomially many codewords is\u0000computationally indistinguishable from random, except to individuals with the\u0000decoding key. In this work, we examine the assumptions under which PRCs with\u0000robustness to a constant error rate exist. 1. We show that if both the planted hyperloop assumption introduced in\u0000[BKR23] and security of a version of Goldreich's PRG hold, then there exist\u0000public-key PRCs for which no efficient adversary can distinguish a polynomial\u0000number of codewords from random with better than $o(1)$ advantage. 2. We revisit the construction of [CG24] and show that it can be based on a\u0000wider range of assumptions than presented in [CG24]. To do this, we introduce a\u0000weakened version of the planted XOR assumption which we call the weak planted\u0000XOR assumption and which may be of independent interest. 3. We initiate the study of PRCs which are secure against space-bounded\u0000adversaries. We show how to construct secret-key PRCs of length $O(n)$ which\u0000are $textit{unconditionally}$ indistinguishable from random by\u0000$text{poly}(n)$ time, $O(n^{1.5-varepsilon})$ space adversaries.","PeriodicalId":501332,"journal":{"name":"arXiv - CS - Cryptography and Security","volume":"10 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-09-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142201623","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Introducing Perturb-ability Score (PS) to Enhance Robustness Against Evasion Adversarial Attacks on ML-NIDS 引入可扰动性评分（Perturb-ability Score，PS）以增强 ML-NIDS 抵抗逃避式恶意攻击的鲁棒性

arXiv - CS - Cryptography and Security Pub Date : 2024-09-11 DOI: arxiv-2409.07448

Mohamed elShehaby, Ashraf Matrawy

引用次数: 0