CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy最新文献

CODASPY '22: Twelveth ACM Conference on Data and Application Security and Privacy, Baltimore, MD, USA, April 24 - 27, 2022 CODASPY '22:第十二届ACM数据与应用安全与隐私会议，美国马里兰州巴尔的摩，2022年4月24日至27日

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2022-01-01 DOI: 10.1145/3508398

引用次数: 0

Incremental Maintenance of ABAC Policies. ABAC策略的增量维护。

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2021-04-01 DOI: 10.1145/3422337.3447825

Gunjan Batra, Vijayalakshmi Atluri, Jaideep Vaidya, Shamik Sural

引用次数: 3

CODASPY '21: Eleventh ACM Conference on Data and Application Security and Privacy, Virtual Event, USA, April 26-28, 2021 CODASPY '21:第十一届ACM数据与应用安全与隐私会议，虚拟事件，美国，2021年4月26-28日

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2021-01-01 DOI: 10.1145/3422337

引用次数: 0

CODASPY '20: Tenth ACM Conference on Data and Application Security and Privacy, New Orleans, LA, USA, March 16-18, 2020 第十届ACM数据与应用安全与隐私会议，2020年3月16-18日，美国新奥尔良

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2020-01-01 DOI: 10.1145/3374664

引用次数: 0

Relationship-based information sharing in cloud-based decentralized social networks 基于云的去中心化社交网络中基于关系的信息共享

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2014-03-03 DOI: 10.1145/2557547.2557574

Davide Alberto Albertini, B. Carminati

{"title":"Relationship-based information sharing in cloud-based decentralized social networks","authors":"Davide Alberto Albertini, B. Carminati","doi":"10.1145/2557547.2557574","DOIUrl":"https://doi.org/10.1145/2557547.2557574","url":null,"abstract":"Commercial OSNs have started to provide users with the ability to set their privacy settings for a more controlled information sharing. However, these settings do not prevent the social network manager to perform marketing research on user personal data, aiming, as example, at offering a personalized advertising to users. To cope with these requirements Decentralized Social Networks (DSNs) are emerged as a possible solution for moving users' personal data out from OSN realms. Unfortunately, it has been shown that DSNs have some limitations, in terms of usability and social features they offer. To overcome this problem, in this paper we extend the DSN framework so that users' data (e.g., resources and relationships) are securely stored in a public cloud data storage and shared according to relationship-based rules defined by owners, by at the same time supporting a privacy-preserving path finding. To this end, we make use of encryption techniques and we devise a new collaborative anonymization process. In the paper, besides presenting all the components of our framework, we analyze its security and present experiments showing the feasibility of the developed techniques.","PeriodicalId":90472,"journal":{"name":"CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy","volume":"6 1","pages":"297-304"},"PeriodicalIF":0.0,"publicationDate":"2014-03-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"72710564","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 6

A cloud architecture for protecting guest's information from malicious operators with memory management 通过内存管理保护客户信息免受恶意操作的云架构

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2014-03-03 DOI: 10.1145/2557547.2557585

Koki Murakami, T. Yamada, R. Yamaguchi, M. Goshima, S. Sakai

引用次数: 2

KameleonFuzz: evolutionary fuzzing for black-box XSS detection 进化模糊黑盒XSS检测

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2014-03-03 DOI: 10.1145/2557547.2557550

F. Duchene, Sanjay Rawat, J. Richier, Roland Groz

引用次数: 94

Large-scale machine learning-based malware detection: confronting the "10-fold cross validation" scheme with reality 基于大规模机器学习的恶意软件检测:面对现实的“10倍交叉验证”方案

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2014-03-03 DOI: 10.1145/2557547.2557587

Kevin Allix, Tegawendé F. Bissyandé, Quentin Jérôme, Jacques Klein, R. State, Yves Le Traon

{"title":"Large-scale machine learning-based malware detection: confronting the \"10-fold cross validation\" scheme with reality","authors":"Kevin Allix, Tegawendé F. Bissyandé, Quentin Jérôme, Jacques Klein, R. State, Yves Le Traon","doi":"10.1145/2557547.2557587","DOIUrl":"https://doi.org/10.1145/2557547.2557587","url":null,"abstract":"To address the issue of malware detection, researchers have recently started to investigate the capabilities of machine-learning techniques for proposing effective approaches. Several promising results were recorded in the literature, many approaches being assessed with the common \"10-Fold cross validation\" scheme. This paper revisits the purpose of malware detection to discuss the adequacy of the \"10-Fold\" scheme for validating techniques that may not perform well in reality. To this end, we have devised several Machine Learning classifiers that rely on a novel set of features built from applications' CFGs. We use a sizeable dataset of over 50,000 Android applications collected from sources where state-of-the art approaches have selected their data. We show that our approach outperforms existing machine learning-based approaches. However, this high performance on usual-size datasets does not translate in high performance in the wild.","PeriodicalId":90472,"journal":{"name":"CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy","volume":"24 1","pages":"163-166"},"PeriodicalIF":0.0,"publicationDate":"2014-03-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"86789434","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 22

Wiretap-proof: what they hear is not what you speak, and what you speak they do not hear 防窃听:他们听到的不是你说的，你说的他们听不到

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2014-03-03 DOI: 10.1145/2557547.2557567

Hemant Sengar, Haining Wang, Seyed Amir Iranmanesh

{"title":"Wiretap-proof: what they hear is not what you speak, and what you speak they do not hear","authors":"Hemant Sengar, Haining Wang, Seyed Amir Iranmanesh","doi":"10.1145/2557547.2557567","DOIUrl":"https://doi.org/10.1145/2557547.2557567","url":null,"abstract":"It has long been believed that once the voice media between caller and callee is captured or sniffed from the wire, either legally by law enforcement agencies or illegally by hackers through eavesdropping on communication channels, it is easy to listen into their conversation. In this paper, we show that this common perception is not always true. Our real-world experiments demonstrate that it is feasible to create a hidden telephonic conversation within an explicit telephone call. In particular, we propose a real-time covert communication channel within two-way media streams established between caller and callee. The real-time covert channel is created over the media stream that may possibly be monitored by eavesdroppers. However, the properly encoded media stream acts as a cover (or decoy) carrying bogus media such as an earlier recorded voice conversation. This spurious content will be heard if the media stream is intercepted and properly decoded. However, the calling and called parties protected by the covert communication channel can still directly talk to each other in privacy and real-time, just like any other normal phone calls. This work provides an additional security layer against media interception attacks, however it also exposes a serious security concern to CALEA (Communications Assistance for Law Enforcement Act) wiretapping and its infrastructure.","PeriodicalId":90472,"journal":{"name":"CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy","volume":"47 1","pages":"345-356"},"PeriodicalIF":0.0,"publicationDate":"2014-03-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"91323068","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Automated black-box detection of access control vulnerabilities in web applications 自动黑盒检测访问控制漏洞在web应用程序

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2014-03-03 DOI: 10.1145/2557547.2557552

Xiaowei Li, X. Si, Yuan Xue

{"title":"Automated black-box detection of access control vulnerabilities in web applications","authors":"Xiaowei Li, X. Si, Yuan Xue","doi":"10.1145/2557547.2557552","DOIUrl":"https://doi.org/10.1145/2557547.2557552","url":null,"abstract":"Access control vulnerabilities within web applications pose serious security threats to the sensitive information stored at back-end databases. Existing approaches are limited from several aspects, including the coarse granularity at which the access control is modeled, the incapability of handling complex relationship between data entities and the requirement of source code and the specific application platform. In this paper, we present an automated black-box technique for identifying a broad range of access control vulnerabilities, which can be applied to applications that are developed using different languages and platforms. We model the access control policy based on a novel virtual SQL query concept, which captures both the database access operations (i.e., through SQL queries) and the post-processing filters within the web application. We leverage a crawler to automatically explore the application and collect execution traces. From the traces, we identify the set of database access operations that are allowed for each role (i.e., role-level policy inference) and extract the constraints over the operation parameters to characterize the relationship between the users and the accessed data (i.e., user-level policy inference). Based on the inferred policy, we construct test inputs to exploit the application for potential access control flaws. We implement a prototype system BATMAN and evaluate it over a set of PHP and JSP web applications. The experiment results demonstrate the effectiveness and accuracy of our approach.","PeriodicalId":90472,"journal":{"name":"CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy","volume":"9 1","pages":"49-60"},"PeriodicalIF":0.0,"publicationDate":"2014-03-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"90260568","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 14