sadat2307/MSciNLI huggingface dataset:
Domain: Security and privacy
Sentence 1: There exist constant­time implementations of many cryptographic algorithms, including AES, DES, RC4, SHA256, TEA, and Salsa20, and even RSA, as well as general techniques for turning implementations of cryptographic algorithms constant-time.
Sentence 2: and quite astonishingly, there is no rigorous proof that constant-time algorithms are protected against cache­based attacks when executed concurrently on virtualization platforms with shared cache.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: Conventional post-mortem forensic work.ows perform this task by physically shutting downacomputerand copyingthecontentsof theharddrive for subsequent analysis.
Sentence 2: live forensics are often desired for step 2 because they provide access to networked resources such as active SSH and VPN sessions, remote desktop connections, IM clients and .le transfers.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: Controlling Data in the Cloud: Outsourcing Computation without Outsourcing Control Richard Chow, Philippe Golle, Markus Jakobsson,    Ryusuke Masuoka, Jesus Molina Elaine Shi, Jessica Staddon PARC                Fujitsu Laboratories of America {rchow,pgolle,mjakobss,eshi,staddon}       {ryusuke.masuoka, jesus.molina} @parc.com @us.fujitsu.com  ABSTRACT Cloud computing is clearly one of today s most enticing technology areas due, at least in part, to its cost-efficiency and flexibility.
Sentence 2: despite the surge in activity and interest, there are significant, persistent concerns about cloud computing that are impeding momentum and will eventually compromise the vision of cloud computing as a new IT procurement model.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: In this manner, if the cookie gets stolen, it can be used only through a TLS channel authen­ticated with C ertU A , which in turn is only possible for the party who knows the private key of the client s certi.cate.
Sentence 2: this technique of strengthening cookie authenti­cation process leads to further requirements being imposed on the service responsible for the HTTP session manage­ment.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: 2.1 Motivation Traditional return-oriented programming (ROP) attacks can (mostly) be contained with the help of address space lay­out randomization (ASLR): this technique makes it harder for an adversary to guess or brute-force addresses that are needed for ROP gadgets.
Sentence 2: aSLR can be bypassed if the attacker can exploit an information leakage vulnerabil­ity, since such a vulnerability inadvertently reveals a valid, current address inside the running program.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: Requiring a certi.cate for the AIK from the Privacy-CA intro­duces another PKI dependency, but we expect very few AIK certi.­cates (typically one to four TPMs for the platforms the user wants to use, e.g., laptop, home PC, of.ce PC, mobile device).
Sentence 2: the number of certi.cates for usual SSL server authentication is much higher (e.g., 10 20 web sites or more used by one user).
Relationship: contrasting
Domain: Security and privacy
Sentence 1: The problem with such a model is that it is not able to describe an approach that considers several sequential system states or the change from one state to another in order to make a classi.cation.
Sentence 2: thisisimportantbecause a sequenceof small state changes spread over multiple views might not be considered harmful by themselves, but may be malicious in this se­quence.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: However, they assume that the sensor nodes are tamper­free and can trust each other.In contrast, our pairwise key establishment scheme only requires that a sensor node not be compromised for a short time interval at the time of its deployment.
Sentence 2: eschenauer and Gligor [9] present a key management scheme for sensor networks based on probabilistic key predeploy-ment.Chan et al [6] extend this scheme and present three new mechanisms for key establishment based on the frame­work of probabilistic key predeployment.Zhu et al [29] present an approach for establishing a pairwise key that is exclusively known to a pair of nodes with overwhelm­ing probability, based on the combination of probabilistic key sharing and (threshold) secret sharing.We note most of these schemes only provide probabilistic security in the sense that the compromise of a fraction of sensor nodes may expose other nodes keys with some probability.our schemes provide deterministic security because the com­promise of a fraction of sensor nodes does not reveal the pairwise keys between other nodes.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: PCA used higher-order logic (HOL) as a universal substrate in which other logics were de.ned; by virtue of being encoded in HOL, these application-speci.c logics in­herited some desirable properties, such as consistency, of the underlying logic.
Sentence 2: this implicitly assumed that the application-speci.c logics would share the substrate s notion of judgment and fundamental axioms, hence severely restricting the ways in which these logics could di.er (specif­ically, they would have to be non-linear, classical logics).
Relationship: contrasting
Domain: Security and privacy
Sentence 1: The security of the protocol de­pends on the secrecy of the shared key K, but it is vulner­able only while the binding protocol executes.
Sentence 2: if  Figure 3: No secrets protocol Protocol Defense Requirements Trust Shared Secret man-in-the-middle at- Secrecy: request, site control, boot Site: pass the security tokens, keep tack channels Boot Channel: small to shared secret private large capacity Encryption­ man-in-the-middle at- Integrity: request, site control, Site: pass the security tokens free tack boot channels Boot Channel: small capacity, full-duplex  Table 2: Protocols summary the secret key is revealed, authentication is compromised in both directions: an attacker in possession of the secret K can impersonate either the owner or the node.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: Espe­cially, for models with in.nite state spaces where all states actually are safe with respect to all rights, the problem s undecidability will render a heuristic search unsuccessful without the algorithm actu­ally terminating with that result.
Sentence 2: valuable hints on model correctness are obtained if model analysts are pointed to unsafe states and input sequences that lead to in these states.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: INTRODUCTION Access control is one of the most fundamental aspects of computer security, and has been the subject of much formal study.
Sentence 2: existing work on the formal analysis of access control systems has focused largely on comparing the relative expressive power of two access control systems Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for pro.t or commercial advantage and that copies bear this notice and the full citation on the .rst page.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: Malicious USB: The CA round two submission still did not verify the integrity of the message, but instead tried to empty the USB stick before use.
Sentence 2: due to implemen­tation oversights, there were a number of ways to prevent this operation from succeeding, such as creating a symlink to a directory, which resulted in a denial-of-service attack (the attack was recognized as such by the CA team).
Relationship: contrasting
Domain: Security and privacy
Sentence 1: For applications in which number of signatures that will be necessary during the lifetime of the sensor node exceeds the storage limit, the sensor node can easily switch to original OTS scheme after all preloaded signing keys are exhausted and signing keys are started to be computed in real-time.
Sentence 2: authenticating the broadcast communication originated from the base station using pre-computed one-time signing keys is possible throughout the lifetime of the network assuming that the base has no storage as well as power constraint.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: 3.3 SOAP Response ASOAPresponseissimilartoarequest,apartfromthe fatthatitaddsaResponsesuÆxtotheelementnameused forthemethod.Forinstane,forthemethodGetQuote,the responseelementisGetQuoteResponse.Asampleresponse toourGetQuoteallofFigure2isreportedinFigure3.
Sentence 2: 3.4 Firewalls and SOAP TheSOAPmessagingprotoolpiggybaksalightweight distributedobjetprotoolontopofHTTP,usingHTTP onnetionstoarrymessagesformattedwithXML.Inother words,SOAPdefnesamehanismtopassommandsand parametersbetweenHTTPlientsandserversthatuses XMLfordataenodingandisthereforeindependentfrom theoperatingsystem,programminglanguage,orobjet modelusedoneithertheserverorthelientside.SOAP solvesthefrewalltraversalproblem,asitreliesonHTTPas thetransportmehanism.Moreover,ustomHTTPheaders havebeenproposedasatehniqueforidentifyingSOAPin­voations[2].AsillustratedinFigure4,whenalientsends aSOAPinvoationoverHTTP,theheadertriggerstheex­eutionofasoftwaregatewayontheserverside,whihfor­wardstheinvoationtothetargetomponentusing(loally) asuitableheavyweightRMC­basedprotool.Thistehnique addressestheverbosityproblem,asitusesasimpleXML strutureforbothinvoationandresponse.Moreover,rely­ingonustomHTTPheadersmakesitpossibleforsystem administratorstoonfgurefrewallstoseletivelyblokout SOAPrequestsusingSOAP­speifHTTPheaders.Be­sidesthefrewallseuritybeneftsofdesigningSOAPusing extendedHTTPheaders,theSOAPspeifationdoesnot defneanyprotool­speifseurityfeatures.SOAPimple­mentationsmaywellutilizeanystandardHTTPseurity feature,takingadvantageofHTTPauthentiationmeh­anismsaswellasSSMforseurehannelommuniations (usingseureHTTPonnetionsviaHTTPS).Also,seure ookieshavebeenproposed[19]toprovideuserauthenti­ation,integrityandonfdentialitywheninteratingwith WWWsites.thesetehniquesarenotavalidsub­stituteforafully­fedgedseuritymodel,andseveralseu­rityissuesrelatedtoSOAParestilltobesolved.Indeed, bothfrewallflteringofHTTPheadersandtheseureook­iesapproahhavebeenoneivedforsimpledoumentre­trievalontheWWWandannotbeonsideredsatisfatory forremoteinvoations.Aesstoe­serviesrequiresamore sophistiatedseuritymodelthantheonenormallyapplied toHTTPtraÆ.Thisisthefousofthenextsetion.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: 5.4 Formal Security Model Common Criteria EAL4 does not require a formal secu­rity model to guide the design and implementation of the security features of a software product.
Sentence 2: using a formal security model (requirement ADV SPM.1) does in­crease assurance as it is used in CC EAL s 6 and 7.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: For instance, to con.gure the host name, we have to execute hostname in-VM to update the kernel state; to remove a malicious kernel module (e.g., a detected installed rootkit), we have to execute rmmod in-VM to unload it from the OS kernel; and to stop a malicious process, we have to execute kill in-VM to remove it.
Sentence 2: from a security perspective, the traditional program ex­ecution model has at least the following issues: (1) In-VM programs (e.g., hostname,rmmod, ps) and kernel states are directly faced by user level, as well as kernel level malware, and they can often be attacked.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: On the Security of Wireless Network Access with Enhancements Lein Harn and Wen-Jung Hsin University of Missouri -Kansas City Kansas City, MO 64110 ABSTRACT The security of the current 3G wireless protocols addresses the problems faced by the 2G systems, in addition to ful­.lling the higher 3G security requirements mandated from operating in IP networks as well as voice networks.
Sentence 2: the approach adopted by the two most popular 3G mobile system forerunners, UMTS and cdma2000, leaves many ar­eas for improvement.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: In the CardSpace framework, the claims to be asserted in the RP Security Policy are represented as attributes of an Attribute Statement, that is contained within SAML­Assertion requests and responses exchanged before the se­curity token can be retrieved from the IdP.
Sentence 2: in the Liberty ID-FF, the IdP does not expect any SAML Attribute Statements in the AuthenticationRequestEnvelope,  i.e.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: Indeed, (H)MQV is com­monly viewed as nearly optimal in the integrity of security and protocol e.ciency, and even a minor e.ciency improve­ment (while preserving provable security) is desirable and can be challenging.
Sentence 2: kEA and OPACITY enjoy the ad­vantages of optimal online e.ciency and honest-player de­niability (HP-deniability).
Relationship: contrasting
Domain: Security and privacy
Sentence 1: Table2reportsthevariouspredicatenotationsweuseinthe formaldefnitionspresentedinthispaper.
Sentence 2: predicatesenabled(rt)uassigned(urt)andpassigned (prt)refertothestatusofroles,anduser-roleandrole­permissionassignmentsattimet.Predicatecanactivate(u rt)impliesthatuserucanactivaterolerattimet.Ital­lowsustocapturethefactthatauserumaybeableto activaterolerwithoutbeingexplicitlyassignedtoit,asit ispossibleinahierarchythatincorporatestheactivation­inheritancesemantics.Inotherwords,ucanactivater" impliesthatuseruisimplicitlyorexplicitlyassignedtorole r.Italsodoesnotruleoutthepossibilitythatsomeactiva­tionorSoDconstraintsmaypreventtheactualactivationof rbyuattimet.Predicatecanacquire(upt)impliesthat ucanacquirepermissionpattimet,whereas,thepredi­catecanbeacquired(prt)impliesthatpermissionpcan beacquiredthroughrolerattimet.Itisimportanttonote thatpredicatescanactivate(urt),canacquire(upt)and canbeacquired(prt)donotassumeanythingaboutthe stateofarole.Thatis,theydonotsayinwhichstate rolerisattimet.Forexample,ifcanactivate(urt)and enabled(rt)holdthenauseru'srequesttoactivaterattime tisgrantedprovidedtherearenootheractivationorSoD constraintsprohibitingit.ifcanactivate(urt) holdsbutnotenabled(rt),thenu'srequesttoactivater attimetisdenied.Thus,predicatescanactivate(urt), canacquire(upt)andcanbeacquired(prt)indicatepos­sibilityratherthanwhatactualoccurs.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: Adding to this the Probe overhead of RSN IE maximum size of 255 octets, we get a total number of octets overhead as 2416 octets or 19.328 kbits.
Sentence 2: if the MAC payload is greater than 2312 octets (18.496 kb), the overhead per frame is added, albeit the percentage overhead dropping down.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: However, this added accuracy may not be fully useful, since enforcement of PDA models would require secure intercep­tion of all function calls made by a program, which is not possible for arbitrary binaries.
Sentence 2: one important advantage PDA have over FSA is their modularity, i.e., the PDA model of one procedure in a program does not depend on the models of other procedures invoked by it.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: McCamant and Morrisett, as part of their x86 Software Fault Isolation (SFI) design [19], propose an instruction alignment scheme that does this.
Sentence 2: their scheme has some downsides: .rst, code compiled for their scheme cannot call libraries not so compiled, so the switch must be all-or-nothing; second, the nop padding allows less code to .t in the instruction cache and the andl $0x...f0, (%esp); ret idiom imposes a data dependency that may in­troduce slowdowns that might be unacceptable in general­purpose software as opposed to the traditional, more lim­ited SFI usage scenarios.4 We stress, however, that while countermeasures of this sort would impede our attack, they would not necessarily prevent it.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: Table 5: JitterBug test scores Figure 6: EN test scores for JitterBug LEGIT-SSH JitterBug test mean stdev mean stdev KSTEST .270 .133 .273 .123 regularity 6.230 5.847 6.038 5.624 EN 19.422 1.856 9.432 1.253 CCE 1.779 0.261 1.837 0.220 Table 6: JitterBug detection rates LEGIT-SSH JitterBug test false positive true positive KSTEST = 0.63 .01 .01 regularity = 0.08 .01 .02 EN = 21.20 .01 1.00 CCE = 2.17 .01 .04   4.3 Discussion The detection tests that we present are all able to de­tect some covert timing channels under certain conditions.
Sentence 2: the previous methods fail for detecting most of the tested covert timing channels.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: Atimegap between the test and the training data sets might make it harder to de-anonymize the data, because the common content between the test and the train sets decreases with time.
Sentence 2: prior research[20]showsthat userstendtoposeexact samequeries overandover,asitis easier comparedto rememberingtheurlofthe search result, or more ef.cient than performing an internal search within the website.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: Briefly, self-adaptive security can be defined as the following capabilities of the system: i) System is capable to monitor its internal security state and external threat landscape in order to reveal possible security violations; and ii) System is capable to react to possible security violations and ongoing attacks by selecting alternative security mechanisms and parameters to keep the system on a secure state or move it back to the secure state.
Sentence 2: recognising security violations requires correct and timely situation-awareness, which is built especially for the self-adaptive security purposes.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: One very attractive notion of privacy is per­fect privacy a secret is expressed through a query QS , and a query QV is answered only if it discloses no informa­tion about the secret query QS.
Sentence 2: if QS and QV are arbitrary conjunctive queries, the problem of checking whether QV discloses any information about QS is known to be .p 2-complete.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: A static public key might be distributed openly, as part of a crypto­graphic software package, in which case it does not add any new risk of censorship; changing the encoding of the public key does nothing to hide the package from a censor.
Sentence 2: if a client already has all necessary crypto­graphic software, and a server broadcasts a series of static public keys by encoding those keys inside otherwise inno­cent web pages or other cover tra.c, then indistinguishabil­ity from uniform is exactly the tool needed to defend those public keys against a censor with an accurate model of the cover tra.c.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: Analysis of Virtual Machine System Policies Sandra Rueda, Hayawardh Vijayakumar, Trent Jaeger Systems and Internet Infrastructure Security Laboratory The Pennsylvania State University University Park, PA, 16802 {ruedarod,huv101,tjaeger}@cse.psu.edu ABSTRACT The recent emergence of mandatory access (MAC) enforce­ment for virtual machine monitors (VMMs) presents an op­portunity to enforce a security goal over all its virtual ma­chines (VMs).
Sentence 2: these VMs also have MAC en­forcement, so to determine whether the overall system (VM­system) is secure requires an evaluation of whether this com­bination of MAC policies, as a whole, complies with a given security goal.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: We call this feature as fmaxRepresent and add it into KIP F S.; 3: Delete all IP F Si which contains fmaxRepresent from FIPFS; 4: If FIPFS is not empty, go to step 1; 5: return KIP F S; C. Finding the Key IPFS Algorithm To protect data privacy, one natural way is to anonymize all possible features which could infer or directly release sensitive information.
Sentence 2: it inevitably degrades the following data analysis due to the information loss caused by the data anonymization techniques.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: 3.2.1 CSS String Injection One might expect that an HTML document, when parsed as a style sheet, would produce nothing but syntax errors.
Sentence 2: because of the predictable error recovery rules described in Section 3.1.3, it is possible to inject strings into a document that will cause the CSS parser to come out of error recovery mode at a predictable point, consume some chunk of the document as a valid rule, and then return to skipping.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: Manitou s use of execute bits prevents unauthorized code from ever executing a stronger guarantee than SBCFI.
Sentence 2: the approach, as proposed, only enforces that valid code pages are executed, not that execution pro­ceeds according to a valid CFG; this is similar to the .rst validation option presented in Section 3.2.4, and will miss at least some jump-to-libc -style attacks, even persistent ones.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: Currently, most of these approaches attempt to prevent web exploits on the server side [29], by inspecting and employing sanitization checks on the data exchanged between the web server and the browser.
Sentence 2: server side mitigation is not ade­quate for e.cient protection against all categories of web exploitation, and therefore protection mechanisms need to be also applied on the client-side (i.e., the web browser) as well.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: that are absolutely necessary for malware attempting to perform a speci.c task to de­clare (e.g., SMS trojans must ask for SMS permissions, or their malicious code simply will not run).
Sentence 2: if new classes of malware attempt to abuse other protected or unregulated [36] inter­ 4We exclude these apps from malware counts throughout the paper.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: In other words, each requester should receive a 1 share of the available nm +ng request channel ., regardless of whether that node is an attacker with a high request rate or a legitimate node with a low request rate.
Sentence 2: even with any reasonable fairness guarantee, the time re­quired to establish a setup packet is still necessarily dependent on the total number of users (nm + ng) and the amount of network ca­pacity available.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: Speci.cally, the capture thresh­old model leads to binary con.ict relationships among the wireless links (i.e., any two links either interfere with each other, or they can be active simultaneously, regardless of the other on-going signal transmissions).
Sentence 2: under the additive interference model, even though a set of links may each not interfere with a given link, they could still collectively cause a collision.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: We can restrict the shared secret x to be standard user passwords, and aid the user by performing a·x one-character at a time, displaying the results in a similar grid-like struc­ture.
Sentence 2: unlike the GridCode, the response bit de­pends on the position of each character in the password, e.g., is a the .rst character, second character, etc.
Relationship: contrasting
Domain: Security and privacy
Sentence 1: The HE-based schemes, on the other hand, achieve a performance of N K asymmetric cryptographic operations, compared to 4N K £2/o symmetric cryptographic operations in GSHADE.
Sentence 2: asymmet­ric cryptographic operations, i.e., modular exponentiations, are usually several orders of magnitudes slower than sym­metric cryptographic operations such as AES or SHA, espe­cially when increasing the security parameter.
Relationship: contrasting