Most closely to our approach is Aurasium [39], as it deploys a similar redirection technique: it overwrites entries of the global offset table (GOT) – that holds runtime addresses of lazy and non-lazy symbols – with the start address of policy check functions.

in contrast to XiOS, it does not provide any mechanism to hide the actual runtime addresses in a shadow table.


For this, we support different policy enforcement options: allow, deny, log or modify.

the modify option allows the replacement of the arguments passed to an external function and public API return values.


R2: Require no changes to the operating system and current software stack architecture of iOS.

we need to ensure that private APIs are still accessible from public frameworks.


As described in Section 4.3, we intercept only calls to external functions.

the main application code and instructions from shared libraries execute with native performance.


Although PiOS revealed that many apps leak the device ID to application developers, it cannot detect Jekyll-like attacks [35] where the malicious behavior is only triggered at runtime.

moCFI [15] and PSiOS [37] could potentially prevent the mentioned attacks by enforcing control-flow integrity (CFI) and fine-grained sandboxing policies.


To test XiOS against previous attacks, we let our malicious application de-reference the runtime address of a public API.


Apple maintains an app store, first introduced in July 2008, that hosts in Sep. 2014 more than 1, 300, 000 applications (apps) [28].

the popularity, the high number of features and apps, as well as the large amount of sensitive and private information that are available on iOS devices make them attractive targets for attackers.


The computation outsourcing techniques [36] enable mobile devices to outsource large computation tasks in decrypting complicated ciphertexts.

these techniques require the mobile users to interact with a computing server for help to complete the computation tasks whenever the mobile users need to decrypt a ciphertext, which is inefficient due to the frequent interactions with the computing server.


Their scheme mainly focuses on the reduction of decryption computation and does not consider the access rights delegation from one to another.

the costs for conversion key generation and file conversion are also less for more powerful computing devices.


We can calculate the estimated probability of the event as the fraction of measurements containing this event within the whole observation history database HX for context X. I{Ci .

due to this same property, the prover and verifier need to be located relatively close to each other in order for their approach to work, limiting its practical applicability.


For example, a device might want to reveal its presence in a particular location only to those peer devices that are present in the same location [10].

the devices need to be able to verify that a location claim made by a peer device indicating proximity is indeed genuine.


We only know that this occurrence frequency is smaller than f.

we take f as the upper bound for the occurrence probability of the measurement.


It is difficult for external entities to determine whether the location claimed by a client device is in fact correct.

there is a need for location proofs: methods for verifying the correctness of location claims that clients present to the LBS.


For example, if an application registers as a broadcast receiver with the NEW_OUTGOING_CALL action, when an outgoing call event occurs, the Android system broadcasts the event, which notifies the event to the receivers registered with the NEW_OUTGOING_CALL action.

our malware can catch call actions without registering as a receiver.


Unlike static analysis which requires precise string values that particular variables may have, taint analysis simply tracks value flows between sources and sinks.

the taint analysis performs only a flow-insensitive analysis which provides sound analysis results.


Note that our fake malware does not send private user data to our server; it merely sends bogus values to our server.

it did not leak any private user data from anyone happened to download it.


Because ADB is originally for debugging purposes, the Android system assigns higher privileges to ADB than to third-party Android applications.

we could present powerful attacks of various kinds by leveraging ADB and its utility functions only with the INTERNET permission.


Effort has been taken to ensure that the core security strategies and underlying issues uncovered remain intact.

details such as IP addresses are anonymised.


In contrast, the private charging attack mainly utilizes a private charger, which focuses on a smaller ranger of targets.

the private charger may obtain a higher credence from people than the public chargers, so it is possible to discover more sensitive information through social networking (i.e., asking people to show something).


In this section, we thus develop juice filming attacks, which are a type of charging attacks but without the need to request for phone unlock and any permissions.

whether users trust or distrust the computer does not affect our attacks.


In Figure 4 (a), we present a full and explicit implementation of our attack by means of VGA2USB.

another requirement of our attack is that users have to interact with their phones during the charging, so that our attack can record all inputs.


The paper includes an appendix that introduces two additional protocols.

the BC sets the session number i, updates nodes secret keys, and creates a session key SK with header hdr.


The problem of key establishment and agreement for hardware-limited networks is widely discussed in the literature, and Kim et al. [10] proposed a systematization of security properties for these protocols.

a majority of the proposed methods provide security properties in the face of weaker adversaries than these considered in our work.


For our purpose multi-cloud is a cloud federation where all collaborating members are exclusively clouds.

we do not consider a cloud and an external identity provider to constitute a multi-cloud.


Backes et al. [5] and Gionta et al. [25] later proposed two execute-only memory solutions: XnR and HideM respectively.

these two approaches do not consider the threat of pointer harvesting.


That is, a function return is only allowed to return to its original caller.

several solutions use heuristics to compensate for the coarsegrained protection of returns, e.g., by monitoring the number of instructions executed between a pre-defined number of consecutive indirect branches [40, 13].


Davi et al. [18] conduct a systematic security analysis of the recently proposed CFI solutions including kBouncer [40], ROPecker [13], CFI for COTS binaries [58], ROPGuard [23], and Microsofts’ EMET tool [36].

they derive a combined CFI policy that, for each type of indirect indirect branch and behavioral heuristic (e.g., the number of instruction executed between two indirect branches), uses the most restrictive setting among the aforementioned policies.


The literature on control-flow integrity is substantial.

we limit our discussion to recent and unconventional approaches.


The assumption underlying all these works is that the disclosure of a single address no longer allows an adversary to launch a code reuse attack.

as will be explained in Section 2.1, more involved types of memory disclosure vulnerabilities can be exploited to bypass fine-grained code randomization.


As with many real-world ROP attacks, the disclosure of a single runtime memory address is sufficient.

in contrast to standard ROP attacks, JIT-ROP does not require the precise knowledge of the code part or function the memory address points to.


If such sensitive information is leaked out of the browser without protection, it can be used by unauthorized parties to illegally access users’ online accounts, steal their online identities, or track their online behaviors.

banning extensions that may leak users’ sensitive information is also necessary and important.


If such sensitive information is leaked out of the browser without protection, it can be used by unauthorized parties to illegally access users' online accounts, steal their online identities, or track their online behaviors.

because the execution traces only contain the call relations and do not contain any information from users, they can also be shared (e.g., in a repository along with the extensions)among the analysts to further cover more execution paths of the extension.


Thus even if the user Ui enters his/her wrong password and/or wrong identification, which may be the identification of another registered user, by mistake, both the login phase and authentication phase are still continued, and finally, at the end of authentication phase, S rejects the Ui login request.

it causes unnecessary extra communication and computational overheads during the login and authentication phase.


However, sharing may cause some undesirable phenomena such as unauthorized access and inconsistent status of shared resources.

password-based authentication schemes have been widely adopted to protect the resources from unauthorized access.


The attacker can replay the intercepted messages to fool the remote server Sj.

in our proposed scheme, we used to generate timestamp that makes synchronization between the user and the remote server.


In case, such signals are transmitted in analog from, recovery must be possible from the analog form, presumably at a minimum after the signal has been attenuated, distorted and transformed in the process of transmission and reproduction.

in the case of analog video signals with their high bandwidth requirements, the recovery must then either be possible given only a very limited high fidelity recording of the original signal, or from a significantly lower bandwidth recording at a later stage.


The image watermarking techniques that are available in the literature are reviewed in brief.


When a node comes up on a network and wants to assign a new address, it must first validate that no other node on the local-link uses this particular address.

the node should ensure that there is no duplicate of this IP address already live on the network.


The nature of most identity theft cases are caused due to a shortcoming in the security design, as it is not designed to verify the identity of a user remotely.

this leads to the compromise of identities causing malicious or fraudulent activities.


Some behaviorial patterns also .nd application in identity association such as voice modulation and acoustics, the mechanics of locomotion and one s penmanship.

the nature of a person s walk is contingent to various situations and scenarios, and it is extremely difficult to generate consistent results over a person s lifetime.


The proposed PHP-Sensor defensive model for discovering workflow violation attacks has two main phases: offline and recognition phase.

for the detection of XSS worms on the client-side user interface, PHP-Sensor operates only in recognition phase.


Grouping: Usually two web pages are possibly produced from the similar web page pattern if they consist of related set of possible crucial paths.

the malware of an XSS payload may possibly be transmitted in the shape of text message or in the form of a URI web link directing to the outward file kept on a remote location of server.


In the later phase, the deduced model is utilized to assess every incoming HTTP request and outgoing HTTP response and discover any variations.

for the detection of XSS vulnerabilities in PHP web applications, our defensive model circumvents the dissemination of XSS worms by observing the outgoing HTTP web request that transmit self-propagating payloads.


Mobile and embedded system software designer are often torn between choosing security and functionality.

the security of out-of-band execution environment is sensitive to rich functionality.


We report on a series of experiments in prediction for Windows post-release vulnerabilities.

vPMs operate on highly unbalanced datasets.


By reading the input validator code, the players can easily infer the input validator type (e.g., credit card number, email address, phone number, SSN, URL, and zip code) even if the type is not explicitly stated in the playervisible code segment.

the players may not immediately realize the exact expected behaviors of the given input validator for that type.


Stakeholders of such systems demand maximum reliability and security.

the methodology must estimate the security of a system in terms of the loss that each stakeholder stands to sustain as a result of security breakdowns, the so-called mean failure cost (MFC) [810].


Next, we show how to perform homomorphic operations on this HTDF.

we view HTDFs as providing an interesting conceptual unification of homomorphic signatures and encryption.


One advantage of the SNARK-based scheme is that a signature can be verified very efficiently, independently of the complexity of the computation f being verified, as long as f has a short Turing-Machine description.

in this work, we will only get efficient verification in an amortized sense, when verifying a computation f over many different datasets.


Second, for concreteness we chose our construction to be in the Turing Machine model, however, we believe it could be fairly easily adjusted to a different model such as RAM by simply letting the next position be a function of the state into [0, S-1] as opposed to moving the head position.

our proof structure would remain the same with this minor change to the construction.


In the TLS PKI, a certificate authority (CA) signs a public-key certificate that binds a server name to a public key, and a client can verify this certificate during TLS connection setup.

As with CAs, vendors can change security indicators for specific non-deploying domains.


A vendor can add browser features that effectively deploy a proposal at all of its customers, and few vendors need to deploy a proposal to spur adoption among a majority of Internet users.

vendors should exert their strong influences over other parties to most effectively deploy a proposed PKI enhancement.


Domains that deploy a PKI proposal can incentivize clients to deploy the new scheme by offering a more secure service, particularly when the domain stores private user data.

unlike domains, they generally have no TLS public keys of their own and thus cannot even watch for suspicious certificates for even a single domain without knowing the domain's authentic key a priori.


In this section we provide background information on log-based PKI proposals for readers.

we describe the parties in these proposals and provide an overview of the general log-based approach.


Clients can also influence domains by switching to a different service that does offer the security benefits provided by deploying the new PKI, particularly if the domain provides a security-sensitive service such as e-banking.

if there is no similar service to switch to, then the clients cannot exert this influence, and thus we claim that clients have a weak influence on domains.


These documents should be believable and appear to be legitimate.

adversaries should have a difficult time discerning decoy files from authentic ones.


Decoys must also lack any shared attributes that an attacker could test for to discern true documents from fake ones.

there should be a high degree of variability between decoy documents.


Since the Panopticlick initiative [8] by EFF, users have become more aware of web tracking and how it affects their privacy.

there is some pressure on web browser developers to make tracking users more difficult, such as by removing unnecessary sources of entropy in the browser or by deliberately introducing randomness in properties typically used for fingerprinting [17].


The first block of declarations (lines 1-11) specifies the attributes of users, resources, and terminals.

the user attributes are organization and clearance (line 8): the former contains the name of the organization to which the user belongs, for simplicity, only two values are considered (line 7); the latter is the user clearance level (line 1).


Simple separation-of-duty constraints are user-independent, and it appears most constraints that are useful in practice are user-independent [7].

cardinality constraints and binding-of-duty constraints are userindependent.


Similar considerations arise very naturally when we consider workflows.

we may specify authorization policies and constraints that mean a workflow specification is unsatisfiable.


In this section, we describe the experimental work on Valued WSP that we have undertaken.

we will compare the performance of our PBB algorithm to that of the state-of-art commercial MIP solver in our computational experiments on Valued WSP.


In this paper, we describe our ReBAC implementation, discuss the system engineering lessons learnt as a result, and evaluate the experimental work we have undertaken.

we compare the performance of the various authorization schemes we implemented, thereby demonstrating the feasibility of ReBAC.


There is now a need for finer-grained access control: e.g., my patient record shall only be accessible by the clinicians who are actually treating me.

access is granted on the basis of how the requestors are related to me.


Yet, as we shall see below, ReBAC authorization checks also make use of such relationships when an authorization decision is computed.

these relationships constitute part of the protection state.


Of course, this raises the question of why existing PDPs are designed in the way they are.

we establish a new way of thinking about request evaluation and alternative designs for PDPs in ABAC systems.


Finally, a request may be malformed and policy evaluation may fail unexpectedly.

the PDP may return an inconclusive result, indeterminate results, or inconsistent results.


Let us also point out that the probability does not effectively appear in the request, which means that the previous evaluation functions can still be applied.

probabilities can always be ignored if they are not relevant.


Based on these observations, we can conclude that ACDM performs better than existing access control models in that it provides full protection from data leakages with lower efforts on the user side.

it minimizes the number of policies a user has to write while allowing full coverage of the intended protected set.


SNOMED-CT also provides a number of attribute relationships which define interrelationships between concepts.

an attribute relationship is an association between two concepts describing an intrinsic property of the concepts.


This is mainly due to the significant cognitive burden required by existing languages for policy authoring.

the access control model is based on a semantic approach which leverages knowledge about the application domain for access decision making.


In contrast, our approach enables to reason on information inference at any level of the data hierarchy.

we have tackled the problem of inference control by proposing an access control model that adopts semantic inference relationship among data and defines on top of these relationship authorization propagation rules that prevent inference of sensitive information.


First, we propose an access control model that prevents inference of sensitive information caused by the semantic relations between data.


Second, we demonstrate that the proposed access control model can be implemented using existing access control mechanisms.

we show that the model can be automatically translated in XACML [33], the de facto standard for the specification and enforcement of access control policies.


However, these negative authorizations are not correctly interpreted by ACDH2 and ACDH3 .

they are propagated both up and down the hierarchy in ACDH3 and up the hierarchy in ACDH2 , thus restricting the access to data elements which the user wants to disclose.


In this section we demonstrate how the proposed access control model can be implemented using existing access control mechanisms.

we present an encoding of the access control model in eXtensible Access Control Markup Language (XACML) [33], the de facto standard for the specification and enforcement of access control policies.


specificity can be implemented using the first-applicable combining algorithm.

the policies associated with a data element and with the data elements that can be inferred from it can be combined using deny-overrides.


If the original file spans several units, Ul must decode each unit separately in order to read the entire file.

for each unit, he uses the set of endorsed tokens he can fetch to recover the secret key via CRSS.Combine(·) and then uses the secret key to decode the unit via SFD.Decode(·).


Even though the cloud promises a convenient way for users to share files and effortlessly engage in collaborations, it still retains the notion of individual file ownership.

each file stored in the cloud is owned by a single user, who can unilaterally decide whether to grant or deny any access request to that file.


3.5 Commune: Protocol specification Recall that Commune leverages a shared repository, which is an abstraction of the owners storage space on S. The shared repository uses a versioning system so that content cannot be overwritten but only new content can be added.

commune optimizes performance by splitting a file in smaller units, and encoding/decoding each unit separately.


We note that the security of the underlying block-cipher prevents the adversary from recovering partial bits of any cleartext block.

the adversary can only learn entire blocks of cleartext.


Second, malicious writers (i.e., writers who have been granted write access by fewer than t owners) are unable to distribute a file without honest readers detecting it.

a file is considered as written if and only if it is correctly encoded in tokens and those tokens are distributed to and endorsed by at least t out of n owners.


The latter addresses the case where at a time t1 a user has access to t or more endorsed tokens of a file unit Fi, but at a time t2 > t1, his access rights are revoked.

at the time t2 , the user has access to fewer than t endorsed tokens.


As argued before, we cannot prevent users from caching a local copy of the file and reading it at later time when their read rights may have been revoked.

we still want to provide revocation of a user who only stored the encryption key at the time when he had read access to the file.


Kerschbaum [21] even used the memory (up to 64k) of tags to store the signatures during the movement of an object.

it is difficult to store business data in a tag due to the technical limitations and cost issue.


For example, Wal-Mart itself contains producers, carriers, warehouse managers, and wholesalers in a supply chain.

the proposed framework extended to MA-ABE can be used.


Especially, the tags must be attached with all merchandise, the cost of each tag is critical for a tracking system.

it is strongly motivated for a holder of a tracking system to reduce the technical features except for the identi.cation of RFID tags.


Recent advances in the Internet of Things (IoT for short) have enhanced the efficiency of current tracking systems [6][13].

these systems are now being widely deployed.


If a user has two permissions p1 and p2 among other permissions, and uses p1 far more often than p2, one optimization metric is to place p1 and p2 in different roles.

the optimization metric would be to generate roles that include permissions with similar usage patterns.


In this experiment, we changed the number of users and permissions, and initial roles used in data set generation.

none of the proposed methods in the literature allows the administrator to generate a customized RBAC state based on a customized metric.


In this example both function calls role_change_permission() in Listing 6.a and reset_role_capabilities() in listing 6.b insert information into the security sensitive table role_capabilities.


Two such groups may require different access control authorities even when they share some common SSOs.

from the perspective of a given SSO, it has different access control checks when it belongs to different groups.


In this paper, we want to shine a light on this concern by studying the feasibility of applying ABE on smartphone devices.

we implemented AndrABEn, an ABE library for Android operating system.


Similarly, the CP-ABE KeyGen operation requires less than 2 s to be executed.

adopting a security level of 112 or 128 bits, the time overhead imposed by CP-ABE on Android smartphone is much higher, while we argue being still usable for non-interactive applications (e.g., encrypted data to be uploaded to a cloud storage service).


Along the same line of studies, we also proposed a system for efficient software updates distribution, over untrusted distribution networks in [5].

as we can see, the execution time for CP-ABE with AndrABEn is significantly lower compared to the results obtained with our Java based implementation, that in turn presents results that are consistent with the ones provided in [21].


They obtained an average decryption and encryption time of 254 ms and 926 ms respectively, considering access structures containing one to five attributes.

the authors did not provide an implementation of ABE on the Android smartphone.


How do we know that an email we received from a friend or colleague was actually sent by them?

most of the early gateways were rather restrictive in their model of access and development.


Embedding DRAM onto the package adds cost because eDRAM requires additional fab process steps compared with eSRAM.

when it comes to bandwidth-intense applications, eDRAM has proven to be beneficial for SoC as major area savings offset the process cost.


As it is shown, the middle plot performed at the selected write duty-cycle, Writeb, has a 50.15% average fractional Hamming weight, indicating that the PUF is perfectly unbiased.

the top plot performed at Writea has a higher average fractional Hamming weight, due to a longer write duty-cycle which results in fewer write failures.


There has been an influx of mobile phones and tablets onto today's market.

it is important for the purposes of the study to spread out the samples collected for neural network training over a large period of time, and this cannot be done when simply taking the first 8 samples.


Alternative approach is to use public-key cryptography for solving the inherent scalability problem with symmetric-key based schemes, as in [19, 20, 18].

the tag then sends {C1, C2, C3} to the reader.


Compared to [11], our work requires 2X the minimum frequency to process videos at a certain frame rate (15.6 MHz vs. 7 MHz, and 124.8 MHz vs. 56 MHz) than [11].

our architecture achieves 6X gate count reduction compared to [11].


The present study concentrates on the second view to assess regional development.

these proposals emphasize the complex nature of regional development by breaking the quality of life in a region in several dimensions.


c) object field manipulation instructions: these instructions are probably the most common instructions in an app.


After identifying sink methods, we search for invocations of those methods in the app.

we locate where those methods are called.


Our data set has 237 candidate apps in this category, and 121 (51.1%) of them were found to be vulnerable.

65 of these vulnerable apps were downloaded from Google Play with 11 apps having more than 50, 000 downloads.


If a mapping still cannot be decided, we preform the manual analysis as the last resort.

it is much easier to revoke individual credentials.


Recently, the extensive list of possible Android permissions (≈130 [36]) was restructured to a simpler set of permissions groups, together with a brief summary regarding the different kinds of data an application will have access to [45].

users must still review the list of permissions every time they install an application or update an application whose permissions have changed.


There is a clear change in privacy concerns in recent years, as it is easier to share data with others, especially on Facebook [34].

an open question remains whether users willingness to provide their location and Internet access to applications is in itself a privacy concern.


Our work has a similar motivation to Kepler [52], a browser extension that monitors and maps network data access, to raise users' awareness on widespread adware and spyware on desktop machines.

on smartphones, mobile applications are provided with structured APIs that supply a significantly larger amount of sensitive user and sensor data when compared with browsers on desktop platforms.


Securacy offered access to information previously inaccessible on the mobile phone: a crowdsourced mapping of mobile applications' network connections and their security status.

malware does exist for iOS, but only 5% of iOS vs 20% of Android users are concerned about their privacy [7].


Our participants are somewhat uncomfortable with sharing some data with applications, particularly their contact information (62.3%), profile data (61%) or access to their messages or call data (60%).

they expressed less discomfort providing access to their browser history (37.6%), Internet connectivity (38.5%) and calendar data (45.8%)(Kruskal-Wallis .2(8)=59.74, p<0.001).


Our participants are generally comfortable sharing some data and resources with applications, including Internet connectivity (83.3%), location (80.0%) and profile data (70.0%).

they are least comfortable sharing access to their messages or calls (6.6%), their user accounts and contact list (23.3%) or their documents (30.0%) (Kruskal-Wallis .2(8)=76.5, p<0.001).


Sellwood and Crampton [47] discovered that permissions on newer APIs (including those exclusive to Google developers) would be automatically granted if the application was installed on a device prior to upgrading Android to a newer version.

a malicious application could tentatively request future permissions (easily retrievable from Android’s open-source code) and wait until the phone is upgrade to support them.


On Android, users can check the volume of traffic sent but do not receive a breakdown of what and how data was sent and to where.

it is challenging for user to recognize a suspicious application that may be generating unwanted and potentially harmful traffic.


Since only exported components are accessible by external apps, these paths cannot be found without performing inter-component communication analysis.

the statement on line 20 removes d and d.f from the set, hence sink4 on line 23 would not give any warning.


Some service providers help developers advertise apps on their websites and charge for writing and publishing reviews.

such paid reviews are forbidden by app store vendors like Google and Apple.


In contrast, for random (i.e.,randomly chosen) apps, none of their reviewers have reviewed more than three apps in the chosen set (we do not show a .gure here).

active reviewers of promoted apps are likely recruited reviewers.


Compared to Fig. 11, the average rating distributions of suspicious reviewers are similar in both scenarios.

the suspicious reviewers reported by our tracer have the similar rating characteristics as recruited reviewers.


Those reviewers who have reviewed many promoted apps and given high rating scores are highly likely recruited reviewers.

given a set of recruited reviewers, the apps rated by many of them are also highly likely promoted apps.


On the other hand, compared to Fig. 6, the average rating distributions of known promoted apps and suspicious apps are nearly identical.

these suspicious apps have similar rating characteristics as known promoted apps, which indicates highly likely they are also promoted apps.


Based on these observations, we design an iterative algorithm to trace apps promoted by recruited reviewers.

one to three months after a new version release have been the common time for web promotion.


With over a million apps in an app store, it is extremely difficult for a new app to acquire initial reviews, while with no or few reviews an app would be ranked far behind and look much less attractive to app users.

their review promotion services could help app developers booster up their apps out of this difficult time.


As illustrated in Fig. 4(c), more than 80% apps have less than 10 reviewers in a week and more than 90% apps have less than 50 reviewers.

most promoted apps have few reviewers in weeks before promotion.


In our previous comparison between reviewers of promoted apps and reviewers of randomly chosen apps, we observed that no reviewers from randomly chosen apps have reviewed more than three apps from the app set.

reviewers of promoted apps have reviewed far more apps (up to 246).


In contrast, less than 30 random reviewers have reviewed at least 100 apps in the app store.

overall suspicious reviewers have reviewed significantly more apps than random reviewers.


Since a large number of packets typically need to be transmitted by the attacker before injection can be successful, a spike in network activity might be .agged by an Intrusion Detection System (IDS) as unusual, and the attacker could be blocked consequently.

in our experience, transmitting a large number of frames is not always necessary for the attack to succeed.


Section 3.6.1 gave an example of how our frame injection attack can be applied if the attacker has access to a service on the internal wireless network.

in practice this scenario is not very prevalent.


A similar vulnerability in these kind of aggregated frames would allow an attacker to craft their own MSDUs.

we determined that this aggregation method is not vulnerable to our injection attack.


However, the leakage of different bits could be affected by the other, for example cross-talk during the bit transition.

we would like the observe the result on different subspaces.


We introduce a new SCA profiling method based on Support Vector Regression (SVR).

sVR aims at building a precise leakage model with given training set.


We also use Dijkstra from MiBench [8], and parallel versions of Breadth First Search (BFS), Prefix Scan, and Matrix Multiply.

the SoftBound version has a much higher off-chip access rate because the shadow data structure for bounds metadata resides in the off-chip memory, and must be fetched each time a bound check is performed.


Bound checking prevents the buffer overflow attack.

it incurs performance overheads associated with managing the security metadata and checks.


This approach takes advantage of the fact that neural nets only need to be trained once per program, and although they have slow training, they have fast activation.

although training time is in the order of minutes, prediction can be done in about 210us on our setup.


Today, the scheduler has limited insights into the operation of the applications that it is scheduling, and detailed software-based analysis of programs may be prohibitively expensive.

a scheduler has to make best-effort decisions about how to schedule applications.


The attacker is the follower who selects an optimal attack plan based on (limited) knowledge about the defender's strategy.

we assume that the attacker learns the number and type of deployed HPs; however he does not know which specific hosts are HPs and which are real.


Secondly, our model can be further extended from the game-theoretical perspective and use additional uncertainty about the knowledge of the attacker, or model multiple types of the attacker using Bayesian variants of Stackelberg games.


Given the intrinsic nature of smartphones and tablet computers as mobile devices, their use is almost always linked to the actions of human individuals.

data stored on or transferred to or from such mobile devices automatically become personally identifiable information, meaning that a direct link can typically be drawn from the data to the individual user of the mobile device.


As a consequence, such data falls under the privacy and data protection regulations, and have to be processed in compliance with existing data protection laws.

legal domains are always bound to specific territorial areas (countries, federal states, etc.), which are not always following coherent lines when it comes to data protection regulations.


Malicious applications that target at the confidential information increase significantly.

second, make use of the APIs provided by Android SDK for data extraction and communication.


We will also analyze security activity changes and frequency change between companies after domestic security accidents.

security activity increased slightly in the industry of manufacturing and construction which have importance in industry of KOREA after domestic security accident but they had an insufficient support and investment of security activity.


This is likely because the control mechanism triggers more position perceptions regarding the app, including perceived fairness of the app developer, a better general attitude toward the app, more trust of the app, as well as an enhanced intention to use the app in the future.

giving users actual control over their own information greatly elevated their self-agency, thereby improving their perceptions of the app, which eventually led to more installation.


In sum, our results show that empowering users with control over information disclosure and informing them about how their information will be used by the mobile app can improve their overall impression of the app and increase their installation behavior.

such findings are not unidimensional; the effects of awareness may depend on whether users are allowed to control their own data flow.


Many users do not have a good understanding or awareness of how their personal information is shared through mobile apps.

they are unable to accurately assess the consequences associated with their app installation and usage.


When the number of key apps is within the range from 10 to 49, the average success rate reaches 95% and above.

when the key apps exceeds 50, the average success rate drops to 90%.


Issues with side channels: Under the assumptions that stackbase address randomization is not employed and that the key is not changed when restarting a program and Sovarel et al. [38] use timing side-channels to determine the key value on Intel x86 architectures.

one key factor in their attack was the assumption that the remote machine is running a certain version of an Apache server, whose behavior is used as a side-channel.


The proposed scheme uses Security Assertion Markup Language (SAML) to provide the Single Sign On functionality.

the scheme allows the users to register once at the IdP and avail services from another service provider or multiple service providers without registering individually at each Service Provider.


In the running example, a regular vehicle component may not want to share sensitive owner information with everyone the access should only be granted to police vehicles.

alternatively, the parameter may be required to be constant, which means that the value must be set at the time of deployment (lines 1, 4) in this case, the certificate for the component states not only its role, but also permitted values of the parameter.


Moreover, the user does not need to memorize the second secret because it is randomly generated by the CDial, and it is shared with the user at each authentication time.

the system vibrates briefly when the cursor approaches at a number slot.


Some of the schemes require an additional device.

then, we consider a secret input scheme that uses a fixed secret, while an observable input scene appears to be randomized over multiple sessions.


The input-state indicator represents the PIN input status.

this scheme increases the input operation load and also requires an additional device.


One method of realizing the idea is to use a one-time password.


During the stage of enumeration, an attacker will try guessing valid credentials for the systems on the network or even discover routing rules and can also collect more information about potential vulnerabilities of the nodes of the network.

choosing the Tomcat server was no random choice.


The result from the virustotal service is used as input to the report that is generated and sent to the administrator via email.

active defenses are promising techniques that are based on a proactive strategy where one anticipates attacks and prepares for the neutralization of the threats.


Then a linearSVC classifier model is built on these train feature vectors which consist of known malware and benign apps.

then an app X can be mapped to this space by constructing a vector f(X) , for each feature s extracted from X the corresponding dimension is set to 1 and all other dimensions are set to 0.


Misuse detector is specifically designed to detect known malware, leading to low number of false alarms.

misuse detector could not detect zero-day malware.


Similarly, the methods RiskRanker [7] and DroidAPIMiner [12] use machine learning techniques to detect malware with features statically extracted from Android applications.

also the analysis results of submitted app are stored in a database in our proposed method.


(Even when a VM is paused during live checkpointing, the network driver can still buffer incoming packets for that VM.)


The comparison between the user's input and the reference template can be performed by adopting standard gesture recognition techniques.

template-based gesture recognition algorithms, which are currently the dominant approach for interactive gesture recognition applications, rely on similarity measures which can be used to compare the two different gesture inputs.


In our case authentication is unidirectional, i.e., the device that wants to prove proximity is the one displaying the authentication gesture whereas the device verifying proximity is the one capturing the user gesture and internally comparing it against the expected checksum resulting from the key exchange protocol.

performing the gesture would require the user to move her position or even climb on to a table, which is obviously neither feasible to assume nor desirable.


Such a gesture is both difficult to recognize and perform.


The physical setup of the experiment corresponds to the one shown in Figure 1.

security proofs [20, 45] for SAS protocols show that regardless of the computational power of X, the probability of its winning is 2-l, where l is the length of the checksum in bits.


Protractor performs worst of all algorithms, which seems to be due to the design of the gestures.

the angles of the user's gestures are likely to vary significantly, causing Protractor difficulties in aligning them.


We teach the case study as an active learning exercise in class, although it could be used as homework.

the semester's work was rated highly by the community and students.


Problem-Based Learning is good for technical evaluations, such as teaching sniffing, testing/configuring computers/networks, and secure coding.

students also need to apply security within an organization.


In addition to publicly available logs, Attack Resilient Public-Key Infrastructure (ARPKI) allows certificates of multiple signatures to make them attack resilient [1].

we propose an alternative approach to reduce the damage of a compromised CA key by imposing multiple signatures on a certificate, especially on server certificates.


The basic reasoning is that a certificate is valid only if it is published in an audit log.

a domain owner must register a new certificate with an audit log in order to make this certificate valid.


It is simply speculative that it would provide the best defense at detecting and preventing the ARP attack used.

it is possible to transfer HTTP traffic over a different port if specificed by the traffic origin.


There is also no direct relation between the number of decisions that needs to be made and the total number of Activities an application has.

Agarwal et al. [4] implemented a similar crowdsourcing scheme for iOS.


The write_buffer argument points to a buffer that encodes all the information related to the requested operations.

the Request type field encodes the type of the request (BC_TRANSACTION, in this example), the InterfaceToken field specifies the remote service (com.android.internal.telephony.ISms), and the code field specifies which of its exported functions must be invoked (sendText).


In fact, the codebase of each application assumes to be executed within a very specific context that varies among different apps.

failing to provide such context will inevitably lead the app to crash or behave incorrectly.


How to avoid detection may be studied in future work, however, it is known that avoiding detection of monitoring systems is typically an arms race.

the possibility of integrating such mechanism with our approach represents one of the most promising and interesting future work direction.


To test the effectiveness of Njas, we first developed a simple application performing the sensitive operations that our current prototype is able to monitor and, if necessary, block.

this application attempts to perform the following operations: initiate several network connections, access sensitive files on the SD card (such as the user s photos), send text messages to premium numbers, and access the user s contact list.


Similarly, Njas patches the interactions with the services defined within an application.

monitor needs to patch the Binder transactions related to the startService and the scheduleCreateService methods that are the analogous for services of the startActivity and schedule-LaunchActivity methods.


As a second part of our evaluation, we used our prototype to sandbox the execution of 20 real-world applications.

we selected 7 real-world popular apps from the top-free lists of 7 different app categories on the Google Play market.


While this approach would be feasible from a theoretical point of view, it is a task that would require a significant engineering effort, and it would inevitably make the attack surface bigger.

note that this is possible only for free apps, as the APK files of paid apps are stored in a non-readable location.


Independently to our work, a recent paper [5] proposes a sandboxing mechanism that does not require modifications of the Android system.

this system requires the usage of an app granting all the possible Android permissions and the reimplementation of many of the security checks usually implemented by the Android operating system.


Several papers analyze the current Android permission system [13, 27, 4].

these works highlight the main problems that affect the current permission system (e.g., being too coarse-grained or not customizable by the user).


For this reason, monitor needs to patch the second Binder transaction as well.

monitor patches the info argument, an instance of the ActivityInfo class, which contains all the information on how an activity should be created.


A hidden, developmental feature called "AppOps", included with Android 4.3 and 4.4, allowed this to be done on a limited basis.

this feature was removed in subsequent Android versions.


Our system requires the installation of a single compatible stub for each orig application.

the same stub application can be used to enforce several different user-defined security policies.


Another area where Njas can enforce a fine-grained user-defined policy is related to the capability of sending text messages.

the user might want to block sending text messages to a specific set of phone numbers.


In addition, Linux kernel is compact and gradually stablized, and hence discovering new kernel vulnerabilities would be a challenging task, if not impossible.

vendor-specific kernels and device drivers would become the main targets of rooting apps in the future, as they are implemented by a single party and mostly closed source, without undergoing rigid security review.


Once the rootfs is mounted, the first Linux process init will be started to mount the rest of file systems from the devices, and then perform initialization procedures based on the configuration files (e.g., init.rc).

some rooting traits are present on all rooted devices (e.g., su binary, SuperSU app), while others only on some.


That is, when the API has been hooked, the hooking function will be presented on the top of the call stack, instead of the hooked API (e.g., Runtime.exec).

apps could determine whether the API call has been hooked by checking the function name on the top of an IO exception call stack.


For each hooked API, our analyzer logs the input parameters, and manipulates the output of the API attempting to evade the detection.

we manually analyzed the source code to identify the root detection methods employed by these apps.


If all lists were equal or generation methods open, this method would be acceptable.

because each list is different and largely non-overlapping, the ability to alter results by the choice of list leaves the evaluation process open to manipulation, since an author can choose the list that offers the best agreement.


Phase-two domain-name-based indicators do not provide unique value to CND between 2.63% and 3.84% of the time.

between 96.16% and 97.37% of domain-name-based indicators are uniquely provided by a single source.


A further difficulty with this situation is that there is no ready taxonomy or terminology for describing precisely what activity a malicious actor is performing.


In practice, it is not possible to hold two of these three aspects fixed.

list acquisition covers a consecutive date range of 30 months with some core methods common to both phases.


it appears that these lists do not converge on one set of malicious indicators.


If two organizations see events, we expect information sharing to be useful if those two events are somehow the same.

various similarity measures between incidents may be equally valid and yet contradictory.


We propose that, when shared in bulk, even apparently low-value data without much structure, annotation, or context, can yield useful information.

even organizations that have low resources or high security requirements should not be discouraged from participating in sharing communities.


A compelling feature of their work is that the initial data mining approach they propose can be accomplished using privacy preserving data mining techniques without a third party.

one approach is to follow the principal of least disclosure , which states that systems should strive to disclose as little to others as possible, while still sharing [5].


Cyber crime, increasingly the work of large networks of individuals, is best countered with a similarly organized structure [7].

it clearly confirms that understanding and investigating cyber crime take a Network to Defeat a Network.


Benefits and specific solutions developed are discussed.


This poses a threat not directly related to the sources themselves, but to the APIs to access them.

an attacker can include a location provider reporting fake locations [24, 33], create a fake virtual GPS module [22], install an app providing bogus locations [14], or enable mock locations normally used for debugging purposes.


Anonymous credential systems have strong security properties.

unforgeability in the sense that users cannot show credentials that they never obtained, and consistency in the sense that each credential belongs to a welldefined user such that multiple users cannot collaborate to obtain privileges that one user alone would not have gotten.


In our mechanism, this property is achieved since information pertaining the mobile phone is only shared with the Service Provider in unintelligible form.

the phone identifier included in the User Credential is carried over from the Phone Credential without revealing its value to the issuing Service Provider.


For distance-based verification, we use (LC , δC ) as Reference Area, where LC corresponds to the center of the U.S. state of Colorado, i.e., the location obtained from the latitude-longitude pair (39°, −105.55°), and dC to 371 920m (the distance from LC to each of the four state corners).

(LC , dC ) corresponds to the smallest circular area that fully encompasses Colorado.


An extension to the Bitcoin protocol has been proposed for solving this problem7 .

at the time of writing, the proposed extension was not yet accepted and deployed at full nodes.


As in our proposal, the authors build upon cryptocurrency systems like Bitcoin for avoiding the dependence on TTPs.

the proposal is based on computation-intensive zero-knowledge proofs, making it less suited for more resource-constrained devices, and requires a TTP during the initial setup phase.


A genesis pseudonym is included in one of the outputs of a GPTx and might, dependent on the used access control approach, not be completely unlinkable to a user identity.

for ensuring the unlinkability of pseudonyms and allowing unlinkable pseudonym changes (satisfying properties 1 and 4), we adapt state of the art techniques for anonymizing cryptocurrency transactions for realizing pseudonym mixing.


Upon compromise of the TTP, large-scale sybil attacks become possible and the trustworthiness of issued pseudonyms is greatly reduced.

centralized pseudonym issuers become attractive targets for attacks, resulting in high operational costs for maintaining their security.


To do so, we need to construct authA such that a is bound to a specific evaluation of P * on partial input a.

this section describes basic system assumptions and the details of each phase.


However, this message is completely de-coupled from any of A's responses.

no matter what it sends, B * learns no any additional information.


The main idea is that this get introduced approach might lead a user not just to new contacts but possibly to new companies or jobs, as recommended by their connections.

a major goal for LinkedIn users is to discover and establish new connections based on criteria such as: common connections, interests, membership and educational or professinal experience.


OSN Connection Spillover: ability to later establish actual OSN connections, based on prior off-line interaction that resulted in mutual agreement to connect.

it should be possible for two peers to connect via the OSN at some point when they are online, if they have decided to do so as a result of sufficient degree of commonality among their profiles, e.g., at least k shared friends.


D2 Profile Privacy wrt Peers: ability to perform certain OSN profile operations (e.g., compare respective sets of friends/connections) with mutual privacy.

information learned from such operations must be limited to what is common to both peers.


The main conclusion is that K- Cloak is much worse than the other two, and Max-Ent is slightly better than Geo-Ind in terms of success probability.

geo-Ind was not specifically engineered against the same-origin attack, and there is no proof that Max-Ent, although intuitively appealing as a maximumentropy construction, optimally delays the attacker under a constraint on the magnitude of the noise.


Additional steps such as chip separation and micro-bumps assignment [9] are necessary to generate a practical 2.5D IC placement.

we neglect these steps in our placement algorithm since they do not affect the attack result.


In this section, we propose a privacy-preserving system using an algorithm from the same family as k-NN.

k-NN is a specific case of kernel density estimation (as discussed in Section 2.2).


Under certain threat conditions, we can extend existing single data owner solutions to secure the multi-data owner scenario.

now, wi ' is the encrypted basis for the i-th tuple s class, scaled by the kernel value.


Intuitively, the ability to observe plaintext query outputs can leak the classi.cation of data tuples.

the data host can observe what tuples are used in the output construction, and the query output associates classi.cations to those tuples.


Note that our threat model allows for one of the cloud parties to possess the querying role, so whichever party can observe the kernel value sums can conduct this attack.

the protocol must determine the classification without revealing the kernel value sums to any party.


The data owners may not be explicitly given querying permissions, say if the data owners and queriers are separate institutions.

miscreants in each party may collude together, providing a joint alliance with both roles.


The DO-Q threat model covers any situation where a single party can possess both the data owner and querier roles.


In figure 1, we show a snippet of output from our server s start up.

using a statically configured key brings with it a number of issues, including insecurity and the inability to scale.


We observe a range of qualitative strategic behaviors, which vary in clear patterns across environmental conditions.

we find that the efficacy of deterrent defense is critically sensitive to detection capability, and in the absence of perfect detection the defender is often driven to proactive moving-target actions.


The forensics analyst uses the collector programs to dump the contents of RAM and flash memory.

those collector programs are similar to the FTK imager and LiME forensics tools in terms of provided functionality.


An integer overflow is not exploitable directly as no buffers are overwritten.


This observation is also evident by a growing underground market for OSN abuse, where accounts with a large number of connections are sold at a premium.

we used the out-of-bag error estimates freely computed by the RF algorithm to numerically find the best number of decision trees and the number of features for each tree, so that the prediction variance and bias are controlled across the trees.


As shown in Figure 1, we performed parameter tuning to calibrate the RF classifier.


After that, we present background on defending OSNs against fake accounts.

we divide fake account defense mechanisms into two categories, based on how new accounts are admitted into the OSN.


Assuming that fakes can establish only a small number of attack edges, the subgraph induced by the set of real accounts is loosely connected to fakes.

topology-based approaches rely on a key assumption that the cut crossing over attack edges is sparse, and accordingly, they aim to find such a sparse cut with formal guarantees [2, 52, 59].


In the NTL library, the basic algorithm is used (with time complexity O(n 3 ) when all matrix dimensions are n).

because the computations in the offline phase happen over random data, the overall problem is embarrassingly parallelizable, making it faster than existing solutions for processors with an appropriate number of cores.


For instance, physical devices provide a realistic setting for the test execution so allowing specific observations, e.g., battery consumption.

emulated devices are more flexible as they permit to simulate events and state changes, e.g., rotation, GPS coordinates changes or incoming SMS.


For instance, an application might attempt an illegal access by triggering a system component, e.g., consider a browser permitting to change the cache location.

rA monitors the state of the entire file system and records every observed change.


These methods present outstanding results; however, the computation complex is high so that the power consumption of the target system significantly increases in some situations.

in this paper, we propose a secure energy consumption scheme, named the Secure Power Management (SPM for short) method, to control the power consumption of the WSN nodes by employing power management concept so that when they suffer malicious or insider attacks, the WSN nodes can still save power.


But it also causes higher performance penalty.

because of the extensive use of the WSNs, such as healthcare monitoring [17] and industrial monitoring [18], most previous studies focused on data leakage prevention and error detection [19-21].


Recently many studies have been proposed to monitor and detect the insider attacks.

implementing an effective detection system is a very challenging task.


Any malware can behave like an APT as the attackers mainly used malware to identify, segregate and try to do data exfiltration while using different methodologies during a cyber-attack.

quantifying the risk due to an APT is a big challenge as little has been understood about this security concern [3].


It is recommended that an SDN network employ switches from multiple manufacturers and companies.

it also increases the probability that one or few switches in the network are compromised and attack the rest of the network infrastructure.


A compromised switch may not only lose its normal functionality, but it may also maliciously paralyze the network by creating network congestions or packet loss.

it is important for the system to be able to detect and isolate malicious switches.


The switches report their status to the controller periodically, such as port statistics and flow statistics, according to their communication protocol.

switches may contain vulnerabilities that can be exploited by attackers.


However, the detection rates reflect the previous conclusions regarding the limited applicability of each method (the algorithms detected distinct malicious switches, according to the related type of malicious behavior).

in addition, each scenario consisted of 12 different cases in terms of the set of values for the following parameters: α,
β, and θ (see Table 1).


In this work, we study the intrinsic hardware characteristics of modern graphics processing units (GPUs) due to random manufacturing variations, and exploits the inherent randomness to generate devicespecific signatures.

we present a novel GPUbased hardware fingerprint scheme to generate a unique, stable, physically unclonable, unpredictable, and random bit string from the inherent hardware features of a general purpose GPU (GPGPU).


Inside the SMX, we further evenly distribute the number of cores into each execution cluster.

two cores (when m is set as 128) are randomly selected from each execution cluster to produce the .ngerprint in our investigated NVIDIA GPU Kepler Architecture.


The public key and certificate of the server are included in our application or  Figure 3: Comparative evaluation pre-installed in a displayer.

memory attacks are a technique that reads and modi.es the memory of a target device using the vulnerability of application or framework of the device.


The public key and certificate of the server are included in our application or pre-installed in a displayer.

attackers can't decrypt the encrypted messages in the polynomial time.


Unless attackers compromise both a displayer and a receiver at the same time, our method is secure against the memory attacks because the password doesn't exist on the device.

our method is secure against key logging and memory attacks.


IoT applications need new cryptographic algorithms and protocols.

the tiers have different processors, run different operating systems, and use different programming languages.


However, the accuracy was less than 0.9, except for Jan. - Mar. 2013.

retraining the classifier is essential, but when to do so cannot be decided only by the results.


To detect malicious web pages used by drive-by download attacks, the paths of redirections from compromised web pages to attackers web pages are important, and divarications of redirections are not important.

we focus on the paths of redirections from the first accessed URL to the last accessed URLs.


To detect a huge variety of malicious web pages correctly, a large number of web pages is needed for training data.

to prepare the training data of Prophiler, we used the discrimination results of web pages identified by high-interaction honeyclients [1] as the labels of the content on web pages without manual inspections.


Programs such as the CubeSat Launch Initiative [7] in the United States and the European Space Agency's Fly Your Satellite [4] program encourage students and researchers to build and launch small satellites.

in Section 3.5, it was required to choose 2 values from the initial array values.


To the best of our knowledge, these approaches do not consider all (possible) observations an adversary can make: in addition to performing first-last correlations, a network-level adversary can gain information by only observing parts of a circuit.

our goal is to extend existing approaches by formally quantifying the advantage of a network-level adversary.


In this case, return-oriented programming (ROP) which is done by combining a chain of code fragments can be considered to circumvent the prevention [6].

we can obtain that information through dmesg command.


Our method implements a four-step procedure to solve these problems.

through the two steps above, we get a sequence of groups, which is consisted of a set of patch blocks and a source file related to them.


Each component of PIC service is detailed as the following: PI: PI should be well chosen to reveal the least privacy about Internet client.

it should be the least relevant to the client's location, ISP, identity, and other sensitive characteristics.


The DNS authoritative servers can pose privacy threats because they are able to observe, collect, process, and transfer privacy-relevant DNS information (such as incoming DNS traffic) about clients either for the surveillance purposes of themselves or for facilitating an outside censor by passing him the data.

the source IP address of client is of great interest to adversaries because it can be associated with the client s DNS messages to re.ect the end user s Internet activities.


While offline analysis remains unaffected by the new Android Runtime (ART), dynamic approaches which instrument the Dalvik Virtual Machine suffer from the fact that the interpreter is replaced by an ahead-of-time compiler suite.

systems like TaintDroid [1] lack their instrumentation target and thus are not applicable anymore as of Android 5.


For Android versions up to 5.1, those permissions are requested and granted only once at installation time, while the approaching Android M release will feature dynamic permission revocation for a selected subset of permissions.

the actual usage of those privacy-sensitive resources remains completely opaque to the user.


In our examples, data authentication processes walked through the complete authentication paths defined by the trust schema.

note that even with key caching, the first authentication process may still involve several round trips of retrieving intermediate keys.


To explicitly link rules, we assign each rule a unique identifier to be used in a function-like way as part of the key name pattern, as shown on Figure 5(b).

invoking such rules is similar to invoking a function: invocation substitutes the key name pattern with the data name pattern from the invoked rule, specializing it with the supplied pat-terns or references to the indexed sub-patterns.


Every successful authentication path must end at a trust anchor.

a trust schema must always include a way for trust rules to establish the link(s) from data or key names down to a trust anchor.


We believe this syntax is sufficiently general to capture complex trust model frameworks, allowing reuse of trust models by different application instances.

the trust schema for our blog example can be used by any other blog website that shares the same trust model.


To do so, we assume a key size of 1024b, batch size of 10, and signature size of 512KB.

to help guide the decision about which variation to use, we make the following claims based on the application needs and assumptions.


Obfuscation is based on knowledge of the encryption key and the content name under IBAC protection.

even if an adversary knows the name N, it cannot generate N ' since it does not possess the appropriate key.


Thus far, we assumed that name encryption (obfuscation) keys are known to all authorized consumers in U(N).


Therefore, consumers must provide sufficient authentication information, e.g., via an interest signature.

to implement authorized disclosure (in the presence of router caches), any entity serving content must (a) possess the information necessary to perform authentication and authorization checks and (b) actually verify the provided authentication information.


However, cached content needs to contain every authorization signature verification key that could be used to access said content.

producers need to provide all possible public keys that can be used to access the content under IBAC protection.


For example, malicious insiders can harm their organizations by stealing intellectual property, sabotaging corporate IT systems, or misusing IT systems to execute financial fraud.

in spite of rigorous researches, it still remains one of the most difficult challenges in the areas of security to prevent, detect, and respond to insider threats and attacks [2, 3].


As its name implies, the most striking attribute of GSPR is that it supports probabilistic revocation.

gSPR's revocation check procedure does not produce deterministic results, but instead produces probabilistic results, which may include false positive (i.e., false alarm) results but no false negative results.


This theorem prescribes that GSPR satisfies the anonymity property in the random oracle model when the DLIN assumption is presumed.


This drawback can be mitigated in a number of ways, including the use of time-stamped parameters [16] or the use of accumulators [21].

these methods incur additional overhead that may be unacceptable in many applications.


Specifically, we utilize the “Type A” internal described in pairing-based cryptography (PBC) library available at [1].

to minimize the computational overhead, the verifier only runs RevCheck for a segments.


This mechanism is far from applicable within the environment of existing OSNs, as it leverages the multi-hop routing protocol of the specific OSN.

our approach is designed for easy integration with existing social networks, relying on technological capabilities widely available to such services.


The users that had selected a neutral stance, recognized the need that other users may have for preserving their privacy, but did not have a strong motivation in using such a mechanism.

these users were also not aware of the true visibility of their photos.


Al Bouna et al. presented a system for preserving privacy regarding multimedia objects [21], which can be specifically used for photos [20].

furthermore, the participants knew that the hidden users were friends of theirs.


The result of this phase is a processed photo that can be rendered selectively according to who is viewing it.

when a photo is accessed, the system will automatically blur the faces of the users that have restricted access.


The enclave participates in attestation by invoking ereport, which generates a hardware-signed report of the enclave's measurement, and then sending the report to the verifying party.

due to certain scalability challenges, we implement the following optimizations.


Furthermore, extending traditional type systems to enclave programs is non-trivial because the analysis must faithfully model the semantics of SGX instructions and infer information flows to individual addresses within enclave memory.

we develop a static verifier called Moat that analyzes the instruction-level behavior of the enclave binary program.


However, establishing such a guarantee requires precise understanding of the contract between the hardware and software.

it requires specifying a formal API-level semantics of SGX instructions, an adversary model, and a verification methodology (with tool support) to detect insecure use of SGX instructions.


In FaceLive, the classification algorithm can be chosen from Bayesian Network, Binomial Logistic Regression, and Multilayer Perceptron.

bayesian network (BN) is a probabilistic graphical model of joint multivariate probability distributions [13].


Finally, the real-time response can be used as a liveness indicator in the assumption that legitimate users can interact with the system in real time while it is difficult for fake faces to do so.

eye blink and head rotation are two typical real-time response based liveness indicators which have been used in popular face authentication systems such as Google's FaceUnlock [16].


Figure 14 show that FaceLive achieves the EER rate in the range of [7.2%,7.5%] when the detection of a single type of facial landmarks is unsuccessful and the coordinate information of the facial landmarks is missing.

the missing localization of nose has a slightly more significant impact on FaceLive than the missing localization of eyes Figure 13: Face photos in ideal lighting condition and under illumination in varied environments [18] and mouth.


When a user holds and moves a mobile device in front of a real face over a distance, the changes of the views of the face can be observed in the facial video.

the horizontal movement of the device (along axis X of the device) leads to changes in yaw while the vertical movement of the device (along axis Y of the device) leads to changes in pitch.


In the third part, we record the inertial sensor data about the MFF-based attacks performed by participants.

the participants are asked to perform the random-move attacks first and then the imitation-move attacks.


Finally, in Section 5 we provide an in-depth analysis of the 3 We stress that McOE-G, COPA and POET do not achieve full misuse resistance, and only achieve a weaker notion called online authenticated encryption .

it is immediate that nonce-based misuse-resistant encryption implies IV misuse-resistant encryption by simply using a random IV (and noting that for q encryptions the probability that an IV repeats is q 2/2£ where f is length of the IV).


As previously mentioned, we also use this p-value computation in Stage 2 as a rough heuristic for deciding which disjunctions to keep and pass on to Stage 3.

we stress that these Stage 2 p-value computations are not valid because the disjunctions are formed using the profiles from the training set, and hence are not independent of these same training set profiles.


To estimate regression coefficients in this model, we use a variant of Lasso called L1-regularized logistic regression [23], whose effectiveness has been established in several empirical studies across multiple domains (e.g., [5, 28]).

they also show that favoring high precision algorithms can yield better recall at high confidence, and that scaling output numbers may require to accept lower statistical guarantees to find sufficient hypotheses.


The first algorithm is Set Intersection, which orders inputs by the fraction of profiles where the output is present they are covering.

the best candidates for targeted inputs are the one present in the largest fraction of the profiles with the output.


identification prior to (mutual) authentication is a problem that crops up in other systems as well, such as in e-passports [28] and RFID tags [29].

3.2 SIM card The SIM is extended to store the new shared secret key κ next to two PMSIs; the currently active PMSI (PMSI) and the future PMSI (Pnew).


Over time, the commercial IMSI catchers were extended with a lot of additional functionality such as eavesdropping on wireless calls.

they are still, rather euphemistically, called IMSI catchers.


The data bearer throughput rapidly shrinks to zero when the downlink resource is captured by the signaling bearer.

the data session cannot affect the throughput of the signaling bearer.


Compared with other spamming attacks [18,23,24], this threat readily bypasses the firewall and security boxes.

the overhead of these schemes is definitely beyond that of the free XOR technique.


Moreover, the VoLTE signaling and voice bearers use the same IP allocated to the VoLTE interface, and the packets for these two bearers are differentiated based on their corresponding ports.

only the packets with the RTP and RTCP ports of the session ID are delivered to the voice bearer, whereas the others are to the signaling bearer.


VoLTE is still at its early phase for global rollout.

the network infrastructure also lacks proper access control and runtime check.


We discover several vulnerabilities in both its control-plane and dataplane functions, which can be exploited to disrupt both data and voice in operational networks.

we find that the adversary can easily gain free data access, shut down continuing data access,or subdue an ongoing call, etc.


Ultimately, voice and data operate in the same, connection-less IP network.

this paradigm shift is double-edged, exposing LTE networks and users to unanticipated vulnerabilities.


Since VoLTE continues to offer call service, it is natural to adopt the time-based charging, following the common practice for traditional CS voice.

only the call duration on the data plane is collected for billing.


Moreover, some signals are even exchanged before the call is established, for example, SIP-INVITE, SIP-INVITE-OK, SIP-INVITE-ACK messages are used to set up a call.

the practice to supply free VoLTE signaling does have loopholes.


VoLTE carries both its control signaling and voice message over IP packets.

both planes can be tricked to transmit or receive non-VoLTE packets.


Reductions in garbled-circuit size [21, 22, 24]: Historically, the most expensive part of any secure protocol was the cryptographic operations.

significant algorithmic improvements to secure protocols together with much faster implementations of cryptographic primitives (e.g., due to better hardware) have considerably changed the equation.


1.3 Our Results We construct fast garbling methods solely under the assumption that AES behaves like a pseudorandom function.

medium circuits: In the larger SHA-256 circuit, where the majority of the gates are AND gates, there was a difference between the results in the two communication settings.


Recent research [15, 18] has shown that those mechanisms are indeed effective in increasing password entropy.

advanced attackers are still finding ways to efficiently crack such passwords offline using various forms of hybrid attacks (marrying dictionary attacks with brute-force attacks).


Clients who care about privacy prefer to have their data encrypted on the client-side using semantically secure encryption schemes.

naïve application of encryption thwarts deduplication since identical files are uploaded as completely independent ciphertexts.


We note that using Sphinx also for data forwarding would result in low throughput due to prohibitively expensive per-hop asymmetric cryptographic operations.

we use Sphinx only for session setup packets, which are amortized over the subsequent data transmission packets.


Sessions are in particular not related to any long term secret or identifier of the host that creates them.

two sessions from the same host are unlinkable, i.e., they are cryptographically indistinguishable from sessions of two different hosts.


To reduce setup delay, HORNET uses only two setup packets within a single round trip between the source and the destination.

session setup only incurs O(n) propagation delay in comparison to O(n 2) by the telescopic setup method used in Tor (where n is the number of anonymity nodes traversed on the path).


Admittedly, the use of tagging, especially in conjunction with replay attacks, allows the adversary to improve the effectiveness of confirmation attacks.

end-to-end MACs protect the integrity of the data, making such attacks (at a large scale) detectable by the end hosts.


Consequently, L3 Tor s and HORNET s goodput is 32% less than that of LAP and Dovetail.

with the FSes for all nodes on both paths,FSf andFSb , S ii is ready to start the data transmission phase.


Furthermore, it is difficult for attackers to perform active attacks (e.g., packet replay) at scale while remaining undetected.

our testbed contains an Intel software router connected to a Spirent TestCenter packet generator and analyzer [10].


The experiments demonstrate the scalability and generality of the proposal.

the experimental analysis reports evaluations on a wide range of password strengths, and of state-of-the-art attacks on very large datasets, including attacks that would have been prohibitively expensive to handle with existing simulation-based approaches.


Many passwords can only be guessed with significant effort, and motivated attackers may be willing to invest resources to obtain valuable passwords.

it is eminently impractical for the defender to simulate expensive attacks against each user to accurately characterize their password strength.


However, in the case of DNS rerouting, this is achieved by hiding the origin’s IP address and relying on redirection through the use of the website’s domain name.

as illustrated in Figure 2, the website is only protected against trac that uses the domain name to initiate the connection.


When a web server initiates an outgoing connection on its own accord, the CBSP is not used as a proxy.

the origin establishes a direct connection with an external host, effectively exposing its IP address to that particular host.


Additionally, the results of our large-scale analysis are lower bounds.

as mentioned in Section 2.2, several CBSPs are CDNs that offer additional security services, and vice versa.


However, this certificate lists the domain name as the subject, and therefore identifies itself as the origin.

if an attacker is able to scan all IP addresses and retrieve all SSL certificates, he can find the IP addresses of hosts with certificates that are associated with the domain he is trying to expose.


The most popular Cloud-based Security Providers do not require the purchase of dedicated traffic-rerouting hardware, but rely solely on changing the DNS settings of a domain name to reroute a website's traffic through their security infrastructure.

this rerouting mechanism can be completely circumvented by directly attacking the website's hosting IP address.


This enables the CBSP to provide all the necessary DNS records in order for rerouting to take place.

the configuration of additional custom records, such as the MX records to identify the domain's mail server, has to be managed through the CBSP's own custom interface where these additional records need to be added by the client.


For the domains under the protection of CloudFlare, the DNS records are managed by the CBSP.

we excluded CloudFlare customers that were exposed through their A record, as this indicates that the administrator has deliberately paused the CBSP rerouting through CloudFlare's web interface.


Instead of storing the entire position map in the client s local memory, the client can store it in a smaller ORAM on the server.

this position map ORAM needs to store N labels each of log N bits.


In an MPC scenario, the ORAM client s computation will be expressed as circuits that will be securely evaluated between the multiple parties.

an ORAM s circuit complexity is the total circuit size of the ORAM client algorithm over all rounds of interaction [53].


The key insight is to maintain the invariant (Fact 2 in Appendix 9) that if some bucket in the real ORAM has an available slot, then during the post-processing of 1-ORAM, no blocks can be pushed through this bucket towards the root.

to formalize this argument requires an intricate induction proof that is presented in Appendix 9.


If the limitation on the occupation of the physmap is for every active task, attackers can create many independent processes and each of them follows the restriction but however the total amount of the memory mapped by the physmap in these processes is enough to cover the SLAB caches storing the target vulnerable objects and the protection is bypassed by the attacker.

the attention should be put on the memory usage of all the active tasks owned by every user logging on the system.


And it needs extra memory for spraying vulnerable objects and making them dispersedly allocated in kernel space.

attackers can operate on this file descriptor in a user program and make the kernel reuse the freed PING sock object, which leads to code execution in the kernel.


Functional encryption can be used to implement audit over encrypted logs: The declassification function can perform the audit and return the outcome.

cl initiates the audit process by choosing a policy.


No other information about the log can be recovered by an adversary looking at the log's encryption.

a log's encryption reveals neither the actual values on the log (other than constants occurring in the policy), nor the equality between values in non-joinable columns.


The general idea is that the neighborhood can be formulated by some constraints of data or distance (metric) functions instead of adding or removing a record.

applying these neighborhood based differential privacy is not feasible in our model because there is only one sole tuple (location) at each timestamp without any "neighbors ".


Figures 10c and 10d show the precision drops when k ' rises because of a larger returned set.

figures 10e and 10f indi cate recall increases with large k ' .


LPPMs generally use obfuscation methods, such as spatial cloaking, cell merging, location precision reduction or dummy cells, to achieve anonymity based privacy or uncertainty based privacy.

anonymity or ad hoc uncertainty based techniques do not always provide sufficient privacy protection [22, 37].


The hardware virtualization makes it possible to execute most of the malware instructions as native CPU instructions on the real hardware without any interception.

it does not suffer from inaccurate or incomplete system emulation.


During the alignment process, two meta-nodes are recursively processed to compute the similarity score.

to compute the similarity score between two meta-nodes, we first perform sequence alignment of the sequences corresponding to the meta-nodes.


This approach is e.ective when large portions of the sequences have unique alphabets, such as the lines of a source code.

a system call sequence has a limited alphabet, while the sequence itself is usually long.


Potentially, malware can have multiple evasion points.

a malware can perform multiple evasion checks at different sections of the system call sequence.


In this result, we can see that with ω > 83 we achieved 100% recall rate.

all evasion calls of the ground truth dataset are captured when ω > 83.


The afine gap penalty combines both constant and linear gap penalties, taking the form ga + (gb * L).

it assigns an opening gap penalty ga, which increases with the rate of gb.


The Power of Procrastination: Detection and Mitigation of Execution-stalling Malicious Code.

the clustering of evasion signatures as described in Section 4.4 can help improve this manual process.


this schema gives too much freedom for sequence alignment, resulting in unnecessary long gaps.


Different tools are available to help malware analysts in this process.

these tools in practice require considerable manual input along with auxiliary information.


Automated dynamic malware analysis is a common approach for detecting malicious software.

many malware samples identify the presence of the analysis environment and evade detection by not performing any malicious activity.


On Linux, signal handlers are usually not invoked by any application code5, so they do not return to the application code.

as mentioned by the authors of COOP, CFI solutions that generate fine-grained CFGs based on class hierarchies tend to be immune to COOP.


However, since addr has already been activated, the current ECFG allows an indirect branch to target addr through newly added edges.

address activation accommodates dynamic linking.


In addition, each pCFI-protected application runs with instrumented libraries.

we also modi.ed and instrumented standard C/C++ libraries, including the musl libc, libc++, libc++abi, and libunwind.


At runtime, the program adds edges on the .y, but pCFI disallows addition of any edge not included in the static, all-input CFG.

the all-input CFG serves as the upper bound for what edges can be added to the enforced CFG during runtime.


When we merge all benchmark's results, about 30% of indirect branch targets are activated in total, slightly more than the result triggered by Octane 2.

as can be seen, the address activation shows steep growth even at the end; on the other hand, it does not activate more target addresses compared to other input data sets, which trigger similar ECFG growth as 400.perlbench.


Besides, functions' addresses can also be explicitly taken at runtime by the libc function dlsym.

we changed dlsym's implementation so that before dlsym returns a valid function address, a pCFI runtime trampoline is called to activate the function's address.


Coarsegrained CFI (e.g., CCFIR [34], binCFI [35], and kBouncer [21]) enforces a coarse-grained CFG in which there are a few equivalence classes of target addresses (or even just one equivalence class) and an indirect branch is allowed to target one of the equivalence classes.

pCFI starts executing a program with the empty CFG and lets the program itself lazily add edges to the enforced CFG if such edges are required for the concrete input.


We consider an exception handler s address activated when the function where the exception handler resides gets executed for the first time.

same as how pCFI instruments and patches C++ constructors, pCFI also instruments those functions that have exception handlers when loading the code into memory and patches the code back to its original bytes when such functions are executed for the first time.


An idempotent operation is designed so that the effect of performing it twice is the same as the effect of performing it only once.

after the first time, there is no need to perform it again.


For code-injection attacks, pCFI enforces DEP (Data Execution Prevention) at all times; its runtime enforces this by intercepting and checking all systems calls that may change memory protection, including mmap, mprotect and munmap.

code injection attacks are impossible for programs that do not generate code at runtime.


This can be achieved by code instrumentation; that is, by inserting extra code that adds edges into the original program.

such instrumentation can be costly since every time the indirect branch gets executed, the edgeaddition operation needs to be performed.


[29] proposed an approach to .ne-grained CFI with (partial) modularity support.

it does not protect return instructions, and its modularity support introduces time windows for attacks during dynamic module linking.


This paper considers side-channel attacks exploiting statistics values exported by procfs from co-located applications running within the same OS.

we consider the default settings of procfs, which do not restrict accesses to a process' private directories in procfs by other processes.


The second line of research generalizes the definition of differential privacy for statistical databases.

chatzikokolakis et al. [13] broadened the definition of differential privacy by parameterizing the definition with a distance metric d, and requiring that the degree of indistinguishability of two databases be a function of their distance.


Moreover, the domain of storage side-channel defense introduces important differences that require innovation.

ince the values that our system must perturb to interfere with side channels are ones that are used by other software, it is important that our modifications do not violate invariants on which that software depends.


IFCC may limit the number of available ACICS, but it cannot prevent the Control Jujutsu attack in general.

using our ACICS discovery tool, we were able to easily expand on our original exploit for Apache and develop an additional full exploit based on an ACICS with an arity that matches its ICS with its target function.


The liveness of an ACICS allows us to reason about its exploitability; if the liveness persists across the program lifecycle, the ICS can be attacked by almost any memory read/write vulnerability, regardless of where it occurs temporarily.

a context-insensitive analysis, in contrast, does not distinguish between different invocations of a function, i.e., analysis results for local variables, arguments, and the return values from different invocations of the function are merged together.


This is in fact an O(n) operation if full anonymity in the set is desired, as any row skipped by the server leaks information about the query.

the cost of computation may be traded off by being anonymous in a proportionally smaller set of the users.


We show the impact of the implementation on the speed of polynomial multiplication on Section 6.

the Fast Fourier Transform strategy outlined in Section 5.4 significantly reduces the evaluation time per column (over an order of magnitude gain).


Specififically, an app may query another app's content provider by directly referring to its authority, one or more URIs formatted in a Javastyle naming convention: e.g., com.example.provider.ima geprovider.

just like what happens to other attributes, such a reference (to the authority) can also become hanging, when the related provider is in absence on a device.


GUITAR must rebuild the recovered objects function dispatch tables to allow the windowing system to invoke any inherited drawing functions.

due to lack of type and symbol infor 2This mapping is done using a newly started stub process in the emulator, before any heap or data segments are allocated, to avoid con.icts with new live memory usage.


This login is cached and a timer is used to automatically log the user out after some time of inactivity.

if someone later opened the app it would again ask for login credentials.


GUITAR requires no modification to the Android framework code but leverages the (open-source) data structure definitions of its windowing system.

android always tries to save memory, and when an app is backgrounded its GUI tree will be deallocated and critical pointers within it (in particular the ones from TreeNodes to their DrawOpLists) will be set to NULL (a good programming practice, but bad for memory forensics).


A single drawing function may create multiple draw ops and store them in one or more leaves.

whenever the app is visible, a GUI tree of parent TreeNodes (describing relative geometric positions and screen layout hierarchy) and leaf TreeNodes (containing actual graphical draw ops) will be created in the process heap memory.


However, each leaf only describes its coordinates relative to its parent TreeNode.

to find the neighboring leaves and compute each leaf's true (full screen) coordinates, GUITAR must look backwards through the tree's hierarchy.


When we performed the LG G3 s WhatsApp experiment, the last GUI we viewed was the app s Friends List window.

finally, GUITAR recreates the runtime environment to redraw the GUI using an unmodi.ed Android windowing system binary, and outputs the app s redrawn GUI as it would have appeared had it been displayed on-screen when the memory image was taken.


We therefore need to strengthen the previous composition result for multi-stage key exchange protocols [17] to cover, first, key exchange sessions and stages which are only unilaterally authenticated or completely unauthenticated, and, second, protocols that do not allow for a public session matching, but for one where session partnering at a certain stage i is deducible given all stage-j keys for j < i. Jumping ahead, knowledge of earlier stages keys can be taken for granted as such keys can be revealed without impairing the chances of winning in a key-independent setting, which is in any case required for composition.

as both achieve key independence, the analyzed TLS 1.3 handshake drafts are amenable to our composition result.


They do not consider the draft-dh draft, nor do they cover the resumption step.

our approach of integrating resumption via composition may also be viable for their model.


The scale of the window may vary from thousands to millions of instructions.

mimicry attacks on host-based intrusion detection systems.


Besides normal program behaviors ground truth (Sect. 6.1), we generate four types of synthetic aberrant path anomalies.

small n (local feature analysis) makes it possible for attackers to evade the detection by constructing a malicious trace of which any small fragment is normal.


This approach detects aberrant path attacks because long n-grams are large execution windows.

it results in exponential training convergence complexity and storage complexity.


Malware classi.cation aims at extracting abstract malware behavior signatures and identi.es a piece of malware using one or multiple signatures.

program anomaly detection models normal behaviors and exams an entire profile to decide whether it is normal.


The essence of n-gram is to model and analyze local features of program traces with a small n. Enlarging n results in exponential convergence and storage issues.


However, the underlying detection paradigms restrict the solutions from correlating arbitrary events in a long trace.

their solutions do not detect general aberrant path attacks.


To reconstruct web-based attacks, forensic analysts typically rely on browser cache files and system logs.

cache files and logs provide only sparse information often lacking adequate detail to reconstruct a precise view of the incident.


Lastly, it replaces the value of the Platform::current() pointer with the address of the newly created PlatformWrapper.

as shown by the results reported in Section 6, WebCapsule performed remarkably well on a large variety of sites, considering that our implementation is an academic-level prototype system.


At this point, the analyst would need to explore the detailed browsing history of these users, in an attempt to reconstruct how the credentials were actually leaked and learn how the phishing attack unfolded.

permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for pro.t or commercial advantage and that copies bear this notice and the full citation on the first page.


For example, when JavaScript Date() objects are instantiated to retrieve the current system time, V8 calls OS::TimeCurrent-Millis() (via a call to RuntimeDateCurrentTime).

using this technique, we are able to return the desired network response to Blink.