In this process model, WebCapsule could record multiple tabs independently.

all our results refer to experiments performed on one single tab.


These benchmarks include Web Standards Project's Acid3 [1, 32] and the Dromaeo Test Suite developed by Mozilla [10].

this is not an option for us, because it would violate our main goal of not altering any code outside of Blink (to completely inherit its portability) and of introducing only low overhead so that WebCapsule can be used as an "always on" forensic data collection system.


This is crucial to allow for a secure migration from an existing indexing system based on unique uidi s to our pseudonymous system.

such a verification must be explicitly allowed by the converter.


A dual-mode signature scheme consists of the algorithms (SigKGenG, SignG, EncSignG, DecSignG, VfG and also uses an encryption scheme (EncKGenG, EncG, DecG) that has the group G as message space.

encSignG(ssk, epk, C) : On input a signing key ssk, a public encryption key epk, and ciphertext C = EncG(epkX , EncG(epkB , xnymi,A))}(sid, qid).


For instance for the use case of a social security system, it might be allowed that the health care provider can request data from the tax authority but should not be able to access the criminal records of its registered users.

there is no need to learn for which particular user a request is made, or whether several requests belong together.


Pseudonymization of patient identifiers for translational research.

current solutions require the central authority to be a fully trusted party, as otherwise it can provide false conversions and exploit the data it learns from the requests.


An alternative approach is to use domain-specific pseudonyms, where only a central authority knows the crossdomain relation between the pseudonyms.


The tricky part is to make this whole pseudonym generation and conversion process verifiable and consistent, but without harming the unlinkability and blindness properties.

for pseudonym generation a server SA must be ensured that it receives correctly formed pseudonyms.


the algorithms working with encrypted messages or signatures also get the $ keys (epk, esk) .EncKGenG(1t ) of the encryption scheme as input.


It can of course be realized with a generic multiparty protocol, where the first server SA inputs the pseudonym to be converted and the converter inputs all its secret keys, and the output of the second server SB would be the converted pseudonym, provided that the input by SA was a indeed a valid pseudonym.

such a computation would be rather inefficient.


In a similar vein, it would be desirable to combine our pseudonym system with policy enforcement tools in a privacy-preserving manner.

allowing the user to specify which data exchanges are permitted and enable the converter to blindly check whether a received conversion request violates any user constraints.


We validated classification results with 10-fold cross-validation.

next, we discovered that the ratio of unreachable retweeters led to more errors than other features in CrowdTarget.


We observe that the crowdturfing and normal account groups have the same pattern: low retweet similarities.

the black-market account group has the highest retweet similarity.


From the results, we confirm that most crowdturning and blackmarket accounts perform retweets without clicking on contained links because they have no reason to visit the links to retweet them.

we use the click information as the final feature of crowdturng tweets.


Further, the smallest standard deviation of the black-market tweets shows that most of them are retweeted around the mean time.

we decide to use the standard deviation of a retweet time distribution as a feature.


Most of the black-market tweets collected have negative skewness, implying that the number of retweets gradually increases at first, but suddenly decreases later.

c finally pays virtual money for the tasks that W has conducted.


In contrast, the black-market account group has the highest retweet similarity.

on average, we paid $5.6 for 100 retweets and $13.4 for 1,000 retweets.


Malicious crowdsourcing, also known as crowdturfing, has become an important security problem.

detecting accounts performing crowdturfing tasks is challenging because human workers manage the crowdturfing accounts such that their characteristics are similar with the characteristics of normal accounts.


We manually analyzed the normal tweets classified as malicious by CrowdTarget (i.e., false positives).

figure 5b shows the standard deviation of the retweet time distribution of the three groups.


We note that in [26] and [7], the offline stage is independent of the circuit being evaluated in the online stage, whereas in our protocol, a single circuit is fixed for all computations.

they are better suited for settings in which the function to be computed is not known ahead of times.


The only modification needed is to commit on all the commitments of the input labels using a trapdoor commitment, so that in the simulation in case P1 is corrupted, the simulator could change the commitments on the input labels after it learns P1’s input.

(Note that once we model H as a random oracle, we can also use it as the statistically-hiding extractable commitment.)


If P2 asks to decommit (i.e., b = 1) then P1 simply decommits using the standard (canonical) decommiment and P2 checks that the XORs in all split commitments to a value are the same.

if b = 0, then P1 sends P2 the XORs of the split commitment values.


We use a scoring mechanism to improve the success rate of matching process.

algorithm 3 is leveraged to complete such process, it takes the predicted profiles as input, and then scores the similarity between the predicted profiles and the words in the dictionary with the same length.


On one hand, smaller k clusters less neighbors, reducing the chance of finding the right label.

larger k associates more labels to a movement, making the correct label less distinguishable.


In other words, only all the results of the 6 classifications are non-zero will lead to a non-zero final result.

k in this attack could not be determined by only testing a single classification.


8.2 Emanation-based Attacks The emanations produced by electrical devices were known to leak information regarding users activities.

various emanation attacks that aim to infer keystrokes have been proposed and proved to be effective.


The standard k-NN algorithm produces only one label for each input, which reduces the chance of success for adversary, since only all the 6 successive classifications were made correct decisions would result in the correct PIN code.

we modify the standard k-NN algorithm to output all the possible Labels with their corresponding probabilities.


However, the accuracy of our attack depends on all the 6 successive classifications.

only all the results of the 6 classifications are non-zero will lead to a non-zero final result.


Expectedly, the success rate should increase and we evaluate this hypothesis through a modified version of the prior experiment.

we constructed a dictionary using 4 news reports [4, 15, 9, 7] from BBC News, all were writ ten by Smitha Mundasad, a health reporter specialized in medical 7We replace the word obfuscating with obfuscation , since we could not .nd the word obfuscating in the dictionary.


In this paper, we make the first step of exploring such threat space, and we show it is feasible to infer user’s highly sensitive information, e.g., PINs and typed texts, through data collected from the built-in sensors, including accelerometer and microphone.

we propose a set of new techniques to model user’s hand movement and reduce the interference from noises, and our attack is able to achieve high accuracy in keystroke inference.


In contrast, software-based attestation [24, 29, 47, 48] require neither secure hardware nor cryptographic secrets.

security guarantees of software-based attestation methods rely on strong assumptions, such as the adversary being passive while the attestation protocol is executed and optimality of the attestation algorithm and its implementation.


This means that, although the adversary, denoted as ADV, can manipulate the software of (i.e., compromise) any device D in S, it cannot physically tamper with any device.

aDV can eavesdrop on, and manipulate, all messages between devices, as well as between devices and VRF.


Whereas the 32-bit x86 implementation uses memory segmentation to isolate the safe region, the fastest 64-bit x86 implementation uses information hiding.

it turns out that the hidden safe region was sufficiently large to be located and parsed using a modified version of the memory disclosure attack by Siebert et al.


With our proposed fix, IFCC uses three more instructions to validate each target which brings the total number of added instructions up to 15 per indirect call.

we assume the presence of an adequate shadow stack implementation.


This allows it to prevent access and leakage of the shadow stack address.

these security guarantees come with an average run time overhead of 19% which is considered impractical.


When a function (the caller) calls another function (the callee), the callee cannot determine which of the caller s registers are used at the moment of the call.

the callee saves all registers it needs to use during its execution temporarily on the stack.


On the other hand, isolating the stack can potentially mitigate our attacks.

once this address is known, the program can perform PC-relative references.


In principle, both CFI schemes provide strong protection, and even resist the latest code-reuse attack techniques such as COOP (counterfeit object-oriented programming) [40].

the implemented CFI checks contain weaknesses due to unanticipated interactions with optimizations applied by the compiler.


There is no clear definition in the literature with respect to the terms fine and coarse-grained CFI policy.

the general understanding of a fine-grained CFI policy is that only branches intended by the programmer are allowed.


The target program contains a memory-corruption vulnerability that allows the adversary to launch a run-time exploit.

we focus on vulnerabilities that allow the adversary to read (information disclosure) and write arbitrary memory.


As a result, active tags can be equipped with computational platforms that run cryptographic and security protocols to mitigate cloning attacks [5].

passive tags do not enjoy these luxuries and therefore are more prone to cloning attacks.


The rest of this paper is organized as follows.


Due to the existence of noise, no attacker whether using software or hardware to counter the physical challenges issued by PyCRA can instantaneously detect the change in the physical challenge.

there always exists a non-zero probability of the attacker missing the changes in the physical challenge.


The primary goal of an attack is to replace the true physical signal that a sensor aims to sense with a malicious signal.

an adversary will attempt to "inject" a signal into the physical medium that the sensor is measuring in order to jam or spoof the sensor.


Observe that we have not completed the run for A4.

we know by our previous analysis that if A2 is successful, so will A4 (if we complete the run of A4).


We note that whenever the communication partners exchange certificates in HMQV to authenticate their public keys this not only affects the message size but also the key derivation.

the time for key derivation is increased by the time for the additional certificate verification.


All participants learn the model and thus can use it locally and privately, without any communication with other participants and without revealing the input data or the model's output to anyone.

in contrast to conventional deep learning, there is absolutely no leakage while using the model.


The scenarios we consider - for example, collaborative learning of image recognition models between medical institutions - involve participants who are not actively malicious.

it is reasonable to assume a "passive" adversary model, in which the participants execute the protocol as designed but may attempt to learn or infer sensitive information from other participants' data.


Our approach is independent of the specific algorithm used to construct a model for a particular task.

it can easily accommodate future advances in neuralnetwork training without changing the core protocols.


To provide secure and efficient communication among components, SeCage follows the idea of separating control plane from data plane by using the VMFUNC feature from Intel's hardwareassisted virtualization support.

seCage first designates the security policy on which secret compartment is invokable by another compartment to the CPU, and allows such an invocation from being done without the hypervisor intervention.


When TrustOTP is running, the Rich OS will be suspended until TrustOTP exits.

if the OTPs are being displayed for a long time, the user cannot perform any operations in the Rich OS.


When the system boots up, the code and data of the OTP generator will be loaded into a secure memory region that can only be accessed in the secure domain.

the Rich OS cannot access the sensitive information directly from the memory.


It is flexible to support various OTP algorithms and multiple OTP instances on one smartphone.

besides protecting the OTP code integrity and the seed secrecy, we also need to protect the timer and the counter that are used as input to TOTP and HOTP, respectively.


It is reasonable because the same operation takes more time to complete in the Rich OS when TrustOTP is running.

the performance of CPU and RAM decrease more than that of the peripherals.


Due to the OTP standardization work, most OTP instances use the same algorithms but different seeds and other parameters such as counters.

we can support a large number of OTP instances in our system.


The interrupt handler of the NMI is in the secure domain, so the Rich OS cannot manipulate the handler either.

we can guarantee that the system will switch into the secure domain as soon as the NMI is triggered.


An alternative method to achieve a secure display is to reuse the Rich OS's IPU driver after verifying its integrity.

it cannot guarantee to provide a reliable display for OTP when the Rich OS crashes.


However, in contrast to the re-registration attack which involved addition and deletion of Sybil identities, the attacker does not fully control the process of obtaining new attack edges, since an honest user must accept or interact with a Sybil identity to establish a new edge.

careful attention is needed to model the capabilities of an attacker aiming to induce and exploit churn in attack edges (see Section 3.2 for a formal description of our dynamic attack edge model ).


If y marks the communication as unwanted, the balance B of (x, y) is lowered by one (from the sender s perspective).

sybilLimit is vulnerable to the re-registration attack discussed previously, since it allows the initiator of the random route to overwrite the public key registered at its tail.


If z marks the communication as unwanted, the credit balance of both edge (x, y) and edge (y, z) will be reduced by one.

if the victim z has less edges compared to the number of attack edges owned by the attacker, a user targeting attack becomes practical.


SumUp assumes that the number of the attack edges is bounded.

after examination, we find that the security guarantee of SumUp heavily relies on another underlying assumption, which is that the vote collector is placed far away from the attack edges.


In this section, we first introduce the SybilLimit protocol [35], and then present our novel temporal attacks that allow an adversary to break SybilLimit s security guarantees.

we show that an adversary can eventually register an unbounded number of Sybil identities in the SybilLimit protocol (at a single instant in time).


We first leveraged existing compiler optimizations to reduce the usage of push/pop.

modern compilers like gcc in most scenarios prefer using mov instruction for performance gain, as CPU can do pipeline scheduling for mov instructions.


We enforced the alignment by leveraging gcc's supports for multiple platforms.

on platforms like ARM, function invocations do not automatically save the return address on stack, so gcc already understands how to align stack when there is no return address on stack.


ASLR-GUARD can either prevent code pointer leaks or render their leaks harmless.

aSLR-GUARD makes it impossible to overwrite code pointers with values that point to or will hijack the control flow to a desired address when the code pointers are dereferenced.


Type-based CFIs [2, 24, 31, 42] reduce the average indirect targets (AIT) by checking indirect branches with type.

mCFI [31] checks type and number of parameters, Forward-edge CFI [42] checks the number of parameters, Safedispatch [24] and vfGuard [2] check class type for virtual function calls.


Next, we instrument the target program to correctly decrypt code locators.

we first instrument every indirect call with code address in register in the ways shown in Table 3.


In Linux, multi-thread feature is enabled with Native POSIX Thread Library (NPTL), which creates a new thread with the clone system call.

to create new thread, NPTL first allocates a new stack and stores thread descriptor at the end of the new stack.


Semantically secure encryption [12] guarantees that every encryption of the same message is very likely to map to a different ciphertext.

given two ciphertexts the adversary cannot distinguish whether they correspond to two encryptions of the same message or encryptions of two different messages.


This allows him to label columns of A with the corresponding attribute values.

given prior information about a specific record, such as its location in a dataset or the value of its attribute, he can infer other attributes for that record (i.e., the pick up day for a taxi ride.)


Though intuitively, batching makes it harder to extract precise information from the dataset, we show that it does not always suffice.

if the data is ordered by some attribute, the information about a batch will provide information conditional on values of that attribute.


Instead of a secret key, the attacker can directly use the implementation itself as a larger effective key.

he can isolate the program code where the key is embedded in order to copy the functionality of encryption/decryption routines and to utilize it in a stand-alone manner.


The function F is an T -secure weak white-box implementation of EK if it is computationally hard to obtain an equivalent key of size less than T given full access to F .

it should be computationally hard for an attacker to find any compact equivalent function which is smaller than T .


Indeed, although more layers make the construction more secure, recent cryptanalysis [6] suggests that even as many as 9 layers (SASASASAS) are susceptible to attacks.

the assurance on the security of (AS)i against decomposition is yet to be provided.


It seems unlikely that adversaries in practice will know all documents.

assuming knowledge of no documents is a step too far: the adversary may incidentally know that a user has one or more widely-circulated emails in her repository, for example.


This scheme supports not only keyword search queries, but also boolean and phrase searches.

stemming, wildcard, and approximate-match searching are not supported.


Their attacks, and the more general statistical attacks alluded to by Song et al., are possible even when a scheme has been proven secure under a standard assumption.

first we fix some notation from the SE literature.


This scheme differs from the above in that each row of the index is encrypted as a whole (say with a block cipher in some randomized chaining mode), so that no repeated document IDs can be read from the index before queries are issued.

the length of each row is not hidden; before any queries are issued, the server can observe the result count for every row.


Note that both the ILP and Nomad Greedy optimize the total InfoLeakage.

it is possible for Nomad Greedy to outperform the ILP solution w.r.t.


Then, the only InfoLeakage client pairs affected are clients whose VMs reside in machine 1 and 2 (i.e., only the co-residency between VM c,i and VMs in machine 1 and 2 are affected by this move).

we consider it inefficient to try the moves across all machines when the number of affected co-residency pair is bounded.


Lastly, Equation 16 models the migration budget such that the total number of migrations should not exceed PercentBudget of the total workloads (i.e., total number of VMs that currently have place assignments).

d was scaled such that the number of epochs, hence the number of migrations, in each experiment is roughly the same for both experiments (i.e., D = 4 min for 20 min completion time and D = 1 min for 3 4 min completion time).


Furthermore, with techniques like incremental diffs, the transfer size will be much less than the base VM memory image with 50% reduction (e.g., [18]).

we expect minimal network impact from Nomad, especially given that datacenters handle much larger (tens of GB) flows [17].


Unfortunately, solving this ILP is intractable and it takes more than a day to even solve a small problem instance with just 40 machines (Table 1 in §8).

while the ILP approach is an exact optimal solution in terms of the leakage subject to fixed migration budget, it is far from viable in terms of the scalability requirements.


Recomputing the benefit (Line 6 in Algorithm 1) is a large contributor to high run time of the baseline greedy.

we use an incremental benefit computation which computes the delta in the current value of the objective function by only updating information leakage for set of dependent client pairs whose InfoLeakage are affected by the move.


That said, extending the basic algorithm to support fairness goals is an interesting direction for future work.

defining suitable fairness objectives in a heterogeneous environment where different clients have varying number of VMs, degrees of replication, and sensitivity to migration is an interesting direction for future work.


Note that each move conceptually changes the state of the system and thus the benefit of future moves may decrease or increase depending on the moves we have already made; e.g., moving VM c,i may mean that all previously considered swaps involving this instance may no longer provide any value.

nomad offers a practical vector-agnostic and robust defense against arbitrary (and future) side channels.


Fast side-channel attacks, in principle, could be addressed by reducing D accordingly (i.e., for side-channel attacks capable of extracting the key in 2 3 min, we suggest D = 30 sec).

decreasing D comes at a cost of performance degradation.


This is in contrast to the Sum whose delta only depends on one input's value before and after an update.

equation 9 in Figure 10 states that the total number of VMs assigned to a machine should not exceed machine's capacity.


During the SSH handshake, the client and server select the client's highest priority mutually supported key exchange algorithm.

we cannot directly measure what algorithm servers will prefer in practice.


At first, we thought that it might have been a complete API Update since the changes were so drastic.

after computing the structural identity of x, the signature computation proceeds in the bottom-up fashion to compute signatures of the parent nodes.


Our whitelisting logic must guarantee that only the authorized scripts (scripts with legitimate signature) are allowed to enter the browser's JavaScript parser module, as mentioned in rule 1 in Section 3.2.

our whitelisting module must be placed in a location where it is exposed to all the interfaces JavaScript parser has with client-side web components like HTML parser and CSS parser. In Chromium, the right point to place our whitelisting log.


Furthermore, SI C I L I AN can be fully applied to 372 domains with updates required only once in a month.

sI C ILI A N covers five times more domains than SRI, which is based on raw signatures (69 domains).


Simply using type and initialization value as the identity might lead to semantically different code having the same structural signature.

we propose to use the position set of the identifier in the statement to further refine its identity.


Such highly dynamic scripts include advertisements with customized scripts [28] or scripts from news websites.

such "non-static" scripts are scarce (0.62%) with respect to all the crawled scripts and used only in 69 domains.


In our study, 97.99% of the scripts remain mostly static: no new code is introduced in these scripts.

we believe whitelisting via signatures can be as effective in preventing script injection as it has been in securing desktop application in binary form.


For traditional currency systems, any payment whether or not it is based on secure computation requires trust in a third party (as the currency itself is based on a trusted party, such as a central bank).

the introduction of cryptocurrencies, such as Bitcoin [5], opens the possibility of handling payments in a decentralized manner [6, 7].


Once all the community cards are revealed, parties that wish to claim the pot start revealing their cards.

parties execute an additional stage where they take turns to reveal their cards, i.e., reveal their share hi,i (which reveals their hand).


Although we now handle a reactive functionality, we stress that the cash that is deposited at the beginning of the protocol is distributed only at the end (i.e., no cash distribution occurs in any intermediate stage).

secure cash distribution provides a means to keep the cash deposited in escrow while parties learn output from each stage's function evaluation, and thus can revise their inputs to a later stage.


When it's an honest party's turn to make a claim, it makes the claim if it possesses all the witnesses necessary for making the claim.

an honest party may go ahead and claim a deposit even if (1) some deposits were not made, and (2) some claims were not made.


In practice, a kernel exploit may depend on system con.gurations, address space layout, compiler options, etc..

to successfully root a device, multiple exploits are usually attempted in both the malware [43] and the root providers.


Due to its privileged position, targeting Linux Kernel is natural to achieve full control over an Android device.

a vulnerability in the kernel has a large impact as all devices that run the vulnerable kernel can potentially be affected.


It is important to realize the PC-side program and independent Android app contain duplicate functionality of reading device information and retrieving exploits from local or remote store.

as long as either one has a weak protection, the procedure can be revealed and exploits maliciously retrieved.


Note that we sort the table by the number of exploits we can find, yet it does not correspond to the same order presented in Table 1, therefore, not revealing the provider names.

provider 6 and 7 only equip some basic protection in their exploits, which is easy to bypass.


Vulnerable tamper-detection mechanism Signature or package name based tamper-detection can be found in many providers exploit files.

the detection is executed only one time at the beginning, which makes it easy to bypass modifying one conditional jump suffices and works in all cases.


Theoretically, a kernel vulnerability affects all kernel versions between when the vulnerability is introduced and when it is fixed.

simply counting the number of exploit binaries can be biased.


SafeDSA relies on a whole frame of the received samples to perform the cyclic prefix length estimation.

we are curious about how many samples are good enough for the cyclic prefix length estimation.


The mobile switching center (MSC) in the circuit-switching domain transfers voice calls, and the 3G gateways enable data communication in the packet-switching domain.

to call attention to this matter, this paper presents a systematic security analysis.


The CP only allows legitimate call related requests and blocks all other packets utilizing the VoLTE interface from the AP.

an adversary cannot send manipulated packets through the VoLTE interface.


Furthermore, data encryption (e.g. IPsec or TLS for signaling, and sRTP for media data) should be deployed as specified in the 3GPP specifications [4, 5].

even with strict binding and encryption, an adversary can still utilize tunneling since she has all permission for her phone.


In the case of Korea, video calls from operators cost 1.66 times the price of a voice call.

we utilize RTP tunneling as all the operators we tested encapsulated voice data with RTP.


Despite this fast-moving trend, little research has been conducted to systematically examine security issues in the upcoming VoLTE services, not only in terms of their end-facing interfaces but also their cellular infrastructure.

absence of authentication is one of the three threats originating from mis-implementation of the IMS network.


Therefore, cross-checking is a strong yet easy to implement solution.

it cannot prevent caller spoofing in cases where an adversary spoofs the victim's IMS registration procedure, such that the SIP server stores spoofed parameters.


In our analysis, however, some operators do not follow the standard for call related services.

this is another requirement for securing VoLTE.


We also found that when the call is initiated by the application, the calling state is not displayed on the phone.

a user would not be able to recognize that her phone is now calling.


In this case, when a UE sends an INVITE message to a SIP server, the UE receives a response message with the other UE s IP address.

a UE can collect another UE s IP address by randomly sending INVITE messages to the SIP server.


The throughput is adequate and there is still enough speed to transfer files as a torrent because there are many peers in the cellular network, and these peers do not usually shutdown their phones.

people can share movies or other content when they are sleeping.


In contrast, full GPU virtualization has to emulate accesses to all GPU objects of the VMs scheduled to access the GPU.

it has to emulate a wide variety of accesses to all GPU configuration registers7 and thus requires a large trusted code base.


However, once assigned to a SecApp, the GPU cannot be accessed by untrusted commodity OS/App code until the device is re-assigned to that code.

a commodity OS/App cannot display its content during SecApp's exclusive use of the trusted display, unless the OS/App trusts SecApps unconditionally.


supporting native GPU drivers/Apps requires emulating all accesses to all GPU con.guration registers for the VMs scheduled to access the GPU.

adopting full GPU virtualization for high-assurance trusted display would be impractical.


Glider [41] could also be used to provide a trusted display service since it isolates GPU objects in the security kernel.

these approaches are unsuitable for unmodi.ed commodity OSes, because security kernels are object-code incompatible with native commodity OSes.


Our system solves the problem by sharing only the GPU display function between the untrusted OS/Apps and the SecApps.

it needs to mediate only accesses to GPU objects that affect trusted display’s security.


Furthermore, only a small number of sensitive GPU objects require function emulation and this takes only a small amount of code, as shown in Section 5.1.

implementing the GPU functions themselves (e.g., the large and complex native GPU drivers) within the GSK becomes unnecessary.


As GPU page tables support read-write access control in many modern GPUs (e.g. Nvidia GPUs [4], AMD GPUs [6] and recent Intel GPUs [23, 2]), the TDK can protect GPU command buffers by mapping their read-only accesses to GPU local page tables.

some Intel GPUs provide different hardware protection mechanisms.


In our implementation, the fast channel takes 3.60 µs for the communication round-trip between mHV and TDK when they run on different cores.

when the mHV needs to switch to TDK and back on the same core, the overhead is 722.42 µs.


For example, instructions are executed on GPU processor cores, process input data, and produce results that are used by display engines.

commands are executed by dedicated command processors and are used to configure the GPU with correct parameters; e.g., specify stack base address used by instructions.


Intuitively, the security-sensitive GPU objects are those that can be programmed by untrusted software (e.g., malicious drivers, applications) to break the confidentiality or authenticity of trusted display output, and those which can be tainted by access to other sensitive GPU objects.

new hardware architectures make the trapper's overhead negligible.


The TDK has to mediate access to far fewer GPU configuration registers than full GPU virtualization.

access to 39 out of 625 GPU configuration registers require mediation, 13 of which are needed for hardware overlays.


Once a user has created an account for such a username-password combination with the LS, he can subsequently login by providing the correct username and password again.

the login server must be able to verify whether a password attempt pwd ' matches the stored password pwd or not.


Just recently, a novel probably approximately correct (PAC) learning framework has been developed, which ensures the ultimate delivery of a mathematical clone for pre-defined levels of confidence and accuracy [10].

arbiter PUF manufacturers have been forced to propose countermeasures including XOR arbiter PUFs as an effective technical action [34].


To explain our lattice basis reduction attack in an easier manner, we will assume a slightly different situation.

we emphasize that for the real distribution a more complex analysis can be performed that would yield an (asymptotically) equivalent result.


The total number of disclosed coefficients is counted separately in order to avoid having common disclosed vectors in the three centering groups.

we have observed that no common disclosed vector is found in the three groups.


We launched our attack on simulated CRPs, generated in Magma.

it is worth noting that our XOR arbiter PUF simulator implemented in Magma adopts only real experimental data obtained in [35].


Attack attribution to identify attackers is generally considered as a hard problem because attackers may employ various methods to conceal their identities, e.g., obfuscating or re-packing binaries, changing the URLs and domains of servers, launching attacks from geographicallydistributed compromised machines.

55.5% of malicious downloaders are signed, accounting for 73.8% of the malicious influence graphs.


However, node B downloads additional files, some of which (nodes C and F) are detected as malicious, suggesting that node B, and potentially node D downloaded from the same domain as node B, as well as all of the nodes reachable from them in the downloader graph, are likely involved in malware distribution.

by analyzing the downloader graphs on a host we can identify large parts of the malware download activity, which may otherwise remain undetected.


each trustee Ti performs the following: Round 1: 5Note that, during this step, any invalid ciphertexts and duplicated ciphertexts are removed.


Finally, A posts the election transcript info to the BB..

the adversary can still copy and re-randomize some honest voters ciphertexts as well as their attached NIZK proofs if the same CRS is used among all the voters.


It is easy to see that as long as the master CRS is of the perfectly sound type, the proofs that crs0/1 is an encryption of 1 will be perfect and hence the voters cannot stuff invalid ciphertexts in the virtual ballot box.

as mentioned above, the EA might attempt to use a master CRS of the second type (simulatable) and then collaborate with a voter to violate integrity.


Our simulator is given as input the number of attackers to generate, as a percentage of population size.

as the population increases we assume a linear increase in attackers as well.


That information can be used for sorting/filtering a student list without additional metadata.

student ID will change when the student moves to another department or proceeds from undergraduate to graduate school, so he/she loses personal data when Student ID changes.


The manual surf exchanges enforce that one account be used only from one IP address at a time.

all the autosurf exchanges we studied allow an account to be used from multiple IP addresses simultaneously.


By contrast, Table 3 shows that traffic from the manual exchanges is predominantly directed at sites that advertise affiliate programs, other manual traffic exchanges, or pages advertising goods sold by the participants themselves.

pages visited in the manual exchanges appear directed at luring humans (the exchange participants) to upgrade, join other exchanges or affiliate programs, or purchase products that do not have mainstream appeal.


Javascript on this page automatically fetches the next site to be viewed periodically and opens it inside an iframe within the surf page.

we calculate that dispersed clicks can be produced at about $0.11 per thousand.


Table 7 presents a detailed comparison of the coverage of our seeded method to the coverage of the baseline method.

comparing columns four and six shows the total number of domainkeys selected by the two methods in each category, respectively.


In the case of email addresses, for example, 21% of domain-keys have all their values matching the rule (i.e., the ratio is 1) and over half (58%) of the domain-keys have at least 20% of their values matching the seed rule.

the name domain-key shows that the vast majority (over 90%) of domain-keys that have at least one matching value have less than 10% of all their values match.


The intuition behind this is that key names will likely be used coherently (i.e., for carrying the same type of information) within the same domain (e.g., google.com may use the keyword ggender to collect user s gender regardless the specific Google service).

a same key might be used in the context of different domains with a different meanings (e.g., the key id may be used dif- Dataset HTTP flows Tuples Domain-keys Lab traffic 9,227 20,810 8,372 ISP traffic 40,775,119 51,368,712 3,113,696  Table 2: High-level statistics of our two datasets.


The resulting infrastructure makes these services conveniently available anytime and anywhere, enabling them to become an integral part of daily life.

users explicitly and implicitly provide a wealth of Personal Information (PI) that reflects several aspects of their life.


For this dataset, we wanted to be able to examine the TLS/SSL encrypted traffic as well.

we collect data by tapping in to the connections with a middlebox that passes traffic through VPN/Man-In-The-Middle (MITM) transparent setup [15].


Table 1 contains the number of instructions for each function needed to create a new user.

an adversary with knowledge that the scheme has been used will be able to retrieve HDF(passwd username) by XOR ing the salt with the ersatzpassword.


One way to achieve that to check the binary of the authentication modules.

this will only inform an adversary that these modules have been changed without giving any details of how they have been changed unless they can be exfiltrated and disassembled.


Security administrators can easily configure their systems to forward adversaries to a fake account where they can be further monitored and observed.

our scheme comes with an intrinsic incentive that security administrators will not only enhance the security of password storage, but also detect when such files are leaked and cracked.


This property benefits not only the early adopters of the scheme, but also the overall security of other (non-adopting) systems.

in this case, an adversary has access to the system, where she can observe authentication attempts, has access to usernames/passwords files, and can query the hardware-dependent function HDF; the only thing an adversary does not have access to is plaintext passwords and the secret HSM key.


It would also look suspicious if all user passwords were crackable.

it would be wise to use some randomly-generated ersatzpasswords within a system to enhance the scheme's plausibility.


The Pin-based version of DynaGuard incurs an average overhead of 170.66%.

this overhead is dominated by the native DBI framework (Pin), with DynaGuard adding only 2.92% on top of that, on average.


The canary initialization that occurs during the creation of threads and processes is exactly the same in DynaGuard and in glibc, with the only difference being that the DynaGuard canary is stored at a different location in the TLS area.

the entropy of canaries is not affected, but now the TLS holds two different types of canaries: the standard glibc canary and the DynaGuard canary.


However, this is not feasible in current canary-based protectors, as hardened programs do not store any information regarding where (in their address space) their canaries are stored.

once a child process is forked, there is no way for it to access the canaries in the frames it inherited from its parent process, as it cannot differentiate canaries from random data that may be residing in the stack.


Thus the increased resilience to shoulder-surfing attacks comes at the price of additional storage and computation time.

with respect to the verification operation, the increased computation time can also be seen as an advantage.


The purpose of this study is to compress the images while ensuring their security.

we propose an ETC technique through which we can achieve good compression performance while ensuring the security of images.


Hence, as discussed above in Mishra et al [12] scheme any legal user can achieve the identity of any other legal user.

we can confirm that Mishra et al scheme fails to achieve user anonymity.


MUDFLOW is not the first work that uses machine learning techniques to detect malicious Android applications.

it is the only one, together with CHABADA, to train the model only on benign applications [12].


We use the data-flow differences to automatically identify malware based on its flow of sensitive data (Section V).

we train a model using data flows of benign apps only, and use it to detect novel malware even if no earlier malware samples are known.


If the resulting value is greater than a certain threshold, namely the two C-SI matrix is similar, indicates the user is currently in a static scene.


If there exists an attack (malicious client) who continuously reports forged CSI, the whole networks will be completely break down for UL MU-MIMO transmission.

this solution may slightly reduce the effective time of CSI, and drop the data transmission efficiency down.


Considering the nodes in office LAN often is stationary and the channel between clients and AP changed slowly, meanwhile the nodes in mobile LAN often is dynamic and the channel between clients and AP changed quickly.

the CSI's period of validity in stationary scenarios is longer than in dynamic scenarios.


In our view, the accuracy of CSI is more important than SNR even though it is useful in the process of decoding in MU-MIMO system.

cSI measurements are often subject to errors, induced by unreliable hardware, antenna connectors or even the hostilely forged CSI.


The idea is to perform self-benchmarking of critical portions of code in order to ensure that debugging breakpoints have not been inserted, and an attacker has not tampered with critical portions of the virtual processor such as the native system calls, using timing analysis from within the V-OS firmware to detect such an attack in progress.

while this concept works against some attacks, we have found this difficult to implement in production due to the native processor speed variation both between mobile devices as well as within an execution session due to multitasking.


Because the links between the application and its libraries are only resolved at load time and because they are stored in the form of easily readable symbol information, attackers can study which external functionality the program requires and influence the linking process to their own advantage.

attackers can hook a shared library, which means that run-time invocations to shared library functionality are redirected to code controlled by the attacker.


However, in a statically linked program, the program loader no longer performs any actions on behalf of the code that has been statically linked into the program.

our prototype then links those libraries into the application, after which instructions that indirectly refer to library symbols through the IAT are rewritten to refer directly to the now linked-in symbols instead.


To prevent attackers from easily reverse engineering the distributed binaries, a software vendor can obfuscate the binaries he distributes, i.e., transform them into semantically equivalent ones that are significantly harder to understand and reverse engineer.

when a vendor deploys an obfuscator tool on his software, this tool will only transform the code available at obfuscation time.


Thirdly, the details of the internal state kept by ntdll differ across versions.

the state initialized by the ntdll automatically loaded by Windows can differ from how the ntdll statically linked into the program expects it.


Custom Library Loader The original program entry point (point 1 in Figure 2 (a)) is replaced with a newly inserted library loader function (point 1 in Figure 2 (b)) that replaces the operating system s dynamic linker.


In spite of the fact that it is very important to evaluate the stealth of the protected code, the method for evaluating the code stealth is sorely lacking.

in this paper, we propose a metric for measuring code stealth.


The results of this case study show that optimization and static obfuscating transformations (e.g., replacing with fundamental instructions, embedding a specialized interpreter, flattening control flow and encoding arithmetic/data) have little effect on artificiality.

dynamic obfuscating transformations (e.g., instruction camouflage and code encryption), or a technique that inserts junk code fragments into the program, tend to increase the artificiality, which may have a significant impact on the stealth of the code.


In a simplified view, a license check can be seen as a predicate p, which either evaluates to true or false.

the output of the SMT solver that satisfy the constraints leading to the true branch of the license check represent a concrete license key value for the attacker.


Nowadays, the XACML (eXtensible Access Control Markup Language) [1] has become the de facto standard in the context of access control systems.

the second row reports the name of mutation operators, the first column the Sun PDP classes involved in the experiment while in each table entry there is the obtained mutation score (the dash indicates that the mutation operator is not applicable to the Sun PDP class).


It is necessary for the Matelas model to be accessible and understood by such platforms.

the Matelas model is translated into the Java Modelling Language (JML) [9].


In the first one, a framework-aware application is used, e.g. one that knows how to invoke the functionalities of the enforcement & publishing layer, which are exported through a set of layer API.

coco Cloud supports several deployment and service models, since its services may be offered in a public, private, or hybrid Cloud, and in IaaS or SaaS services.


Outsourcing data storage and management to the Cloud, usually for improved availability and sharing, entails an inherent loss of control by Cloud tenants.

additional means of data protection and usage control must be provided to allow organizations to safely share their data on the Cloud.


At run time, the value of each field that was labeled as a source of private data is logged.

the most basic extensions execute standard class behavior, but have code that allows Labyrinth to log all the private data entered by end users, such as user ID, password, and credit-card number, as well as data that the application retrieves from the environment, such as the device s location.


To guarantee authentication and integrity of the protocol, R-CARP employs digital signatures.

we have selected the Boneh-Lynn-Shacham [9] (BLS) scheme, which produces short signatures of 160 bit providing a security level of 280.


There were also experiments [8, 11, 12, 14] carried out on character-based passwords.

as the scope of our work in this paper is on numerical PIN inputs, we will not discuss character-based experiments any further.


To reflect real world situations as much as possible, the demography of the subjects taking part in data collection should be as diverse as possible.

people from different age groups, of different genders and with different device usage frequencies (this indirectly correlates with device familiarity) should be represented as much as possible.


The garbled RAM construction and security proof above can be generalized to a setting in which the garbled RAM programs act on a persistent database.

the updates that a garbled RAM program makes to a database D are accessible to the next garbled program to be executed on that database.


As discussed in the introduction, in applications where the memory access pattern is known not to leak sensitive information, this notion of garbling may be significantly more efficient.

it preserves the efficacy of cache, for which real-world RAM programs are extensively '' ''' optimized.


Bitansky Garg et al. and Canetti Holmgren et al. construct a semi-succinct garbling scheme for RAM programs, assuming non-succinct Indistinguishability Obfuscation (IO) and injective one way functions [BGL+15, CHJV15].

they construct garbling schemes where the space and runtime of the garbled program are proportional to the space and runtime of the plaintext program, and where the size of the garbled program is proportional to the space complexity of the plaintext program.


When the plaintext program is a Turing machine, making sure that the memory access pattern is fixed incurs only small overhead in complexity.

hiding the memory access pattern in a RAM program in an efficiency-preserving way requires the memory access pattern to be randomized.


We construct the first fully succinct garbling scheme for RAM programs, assuming the existence of indistinguishability obfuscation for circuits and one-way functions.

the size, space requirements, and runtime of the garbled program are the same as those of the input program, up to poly-logarithmic factors and a polynomial in the security parameter.


Koppula, Lewko and Waters [KLW15] devise a fully succinct garbling scheme for Turing machines from non-succinct IO and one way functions, using techniques that extend those of [CHJV15].

in their garbling scheme the runtime, space and description size of the garbled program are proportional to those of the Turing machine representation of the plaintext program.


The client would want both storage and computation required for secure delegation to be significantly less than the actual data and computation.

the server, who is actually storing the data and performing the computation, would like to operate on the (private) data as a PRAM program, and not to perform too much work when compared to computation on the plaintext data.


Note that a memory block is the smallest unit of operation in CP ORAM, which consists of a fixed small number of memory cells.

a position map pos (stored in CPU state) records where each memory block is stored in the tree, i.e., a node somewhere along a path from the root to the leaf indexed by pos[g].


To handle the full-fledged PRAM computation, we introduce several techniques to tackle the challenges in the parallel setting.

we avoid the dependency on the number of CPUs to achieve full succinctness.


So, we can view these pj's as public states of OPAccess, and do not erase its content in the hybrids.

we generate simulated path pj for each CPU, and store them as public states to simulate the access pattern of OPAccess.


Note that normal signatures and Merkle tree cannot guarantee functional equivalence as forgeries exist information-theoretically.

more importantly, we show how to use our (fully succinct) CiO-PRAM to construct the .rst fully succinct randomized encoding (RE) for PRAM computation.


To argue for the indistinguishability between Hybi and Hyb ' i, we note that the i-th decryption key is not used in the honest evaluation, since the computation after time step i is erased.

we can puncture the random ness and erase the decryption key from the program (which uses CiO security as well), and reach a hybrid (from Hybi) where semantic security holds for the output ciphertext at time step i.


Toward that end, we propose a scale development study to specify the components of H and I in Figure 1 and subsequently test the entire model (i.e., letters A through I in Figure 1).

we propose a study aimed at specifying perception-based trust in a way that is quite novel because it is grounded in the trust requirements and perceptions of system administrators.


We will operationalize important trust items as items with high factor loadings on factors with large eigenvalues.3 What will not be immediately clear is exactly which items are the strongest indicators of trust.

for these reasons, we will analyze our data focusing on items with high factor loadings on factors with large eigenvalues.


For the Sancus-based design of Soteria we thought of two possible concepts: (1) Putting a loader stub together with the code that should be encrypted into one module and decrypting it in-place, and (2) designing a separate loader module.

we give upper bounds for the actual performance results which are expected to be even less than those shown in Table 2.


Currently, many electronic door access control systems use RFID smartcard as part of its authentication process [4][5][6][7].

for normal RFID smartcard process, when the UID is available in the database system, the user is granted authorisation to access the door and this can be easily breached.


LPP is obtained by finding the optimal linear approximations to the organ functions of the Laplace Betrami operator of the manifold [21] [22].

lPP is a linear technique to recover important aspects of the intrinsic nonlinear manifold structure by preserving local structure.


Since, if it happens it can cause loss of properties, traumatized, and most worst is can threat human life.

the development of this system is significant where it is able to prevent from the fire hazard.


This sensor is not only sensitive to smoke, but also to flammable gas [6].

it is suitable to implement at home for surveillance security.


In this implementation, it can be used only for unlocking screen of personal computers since the accuracy of personal identification is not good.

if signs are managed as a part of password like the method by Chahar et al., the accuracy may extremely increase.


In their method, individuals are identified by four types of verification with a multi-touch panel.

phase Registration of information is required before users use the system.


The sign to be registered can be not only a sequence of characters but also everything e.g. an illustration since just motion of fingers are used for identification.

complex images take long time to be drawn and the details of complex images are hard to be drawn with the same way in every time.


In their research, examinees write a mark of plus in the air.

the software can be used only for unlocking the screen of a smart phone.


To achieve this, DRM-protected files are securely encrypted with a cryptographic key, which can only be decrypted by authorized DRM agents under specific usage rules and conditions.

the effectiveness of these DRM technologies in practice is still controversial.


The main motivation of our experiments is to analyze potential risks of OMA DRM services and to suggest reasonable countermeasures to mitigate such risks.

we evaluated whether DRM protection can be disabled through a case study of MelOn.


Also, the DRM content can be re-distributed in a local network through a distribution mechanism called super-distribution.

the roles of these components are very important since the overall security of a DRM system depends on the secure implementation of a DRM agent and its relationship to the other components.


we should replace this instruction with other instructions that are also two bytes long in order to keep the other instructions at the same positions in the original code.


In this paper, we demonstrate how to bypass the integrity checking of the rights object in the OMA DRM system through a case study of MelOn (a well-known music distribution service in South Korea) by reverse engineering its media player equipped with a DRM agent.

we need to disable the integrity check of the rights object in the OMA DCF files if we want to use it without any usage constraint.


As we already described in Section 2.1, however, the integrity of the rights object in a DCF file is securely protected by its MAC.

the DRM agent, embedded in the MelOn music player, always checks if any of the permissions and constraints included in a DCF have been maliciously modi.ed before playing the DCF file.


With a user accessed domain, as the dashed graph, the DSG graph shows a large flux variation, higher AWS, with many folding point.

the DSG graph of an auto-ware accessed domain has just shown a little variation, lower AWS, as the solid graph.


Group having smallest centroid is auto-ware accessed domain, in other side, group having biggest centroid is user accessed domain.


Finally, HTTP polling activity is pointed out by computing the standard deviation of the cluster.

normal auto-ware (e.g. updater and downloader) transmits a similar periodic pattern of traffic that has been generated within a short period of time.


The remaining producers are honest-butcurious.

these producers faithfully follow their protocols, but may try to exploit additional information that can be learned in doing so.


Federated identity services have gained widespread popularity among users as a simplifying means for managing their online identities.

federated identity providers (e.g., Facebook and PayPal) employ authentication protocols such as OAuth [20, 21] and OpenID [34] to offer their users the convenience of using single identity and thus a single credential  to log into and access various third-party applications (e.g., Wiki and StackOverflow).


Penetration testing, and security assessments in general, are critical for any company that relies on an IT infrastructure.

a penetration test procedure can take several weeks or months, depending on the size and complexity of the network being targeted and the level of the details that the client wants.


This system relies on a miniaturized computer to host the necessary components to conduct a security assessment.

in another scenario, for a company of several thousand users and with a great variance in their infrastructure, the penetration testing process could take several weeks or even months to complete due to the complexity of the network/application architectures and many different attack avenues available.


For example, Google has developed most of its major products using this set of technologies (Gmail, Google Groups, Google Maps etc.).

if a browsers leaves the system, the remaining actions will simply be distributed among the remaining browsers.


When our tool is able to guess immediately what user action was performed next, having several browsers working on the problem is not helping (although it doesn t hurt either).

when finding the next action is problematic (which is the time-consuming scenario that is presented in Figure 4), D-ForenRIA fully benefits from having several browsers working in parallel.


DECAF relies on VMI to retrieve the running processes and loaded modules inside a virtual machine to analyze the behaviors of specified processes or kernel modules, for automatic malware detection and analysis.

by adopting the strategy one in discussed in Section 4.3, the correct offsets can still be found by filtering the false offset values from the false 10 ORIs.


With the base register identified, flow-insensitive forwarddata-flow analysis on the base register reveals all the ORIs present in the function.

in Figure 4, an ORI source at 0x402 is first identified via dynamic analysis.


In Proceedings of the 2010 workshop on New security paradigms, pages 1 6.

in some cases defenders may also become active defenders by taking proactive measures to subvert the attacker's control while simultaneously executing their own mission objectives.


The time bound of the permutation-based overwriting comes from the performance characteristics of rotational drives, which are optimized for sequential file accesses but performs relatively poorly for random accesses.

different from the previous works, KMF-based methods do not involve any third party to manage the data keys.


In this experiment, we consider a honestly cloud and a malicious cloud.

if a malicious cloud performs the deletion operations on the fly without extra storage, it is practical infeasible for the cloud to pass the challenge-response protocol.


Logically, n500 does not affect scan_enable's function but the presence of an extra logic gate and a signal is unusual and needs to be examined by the user.

a report of suspicious internal signals is generated.


Although [2] overcomes the major drawbacks of the recombined fingerprinting approach, it still exhibits the following shortcomings: (1) the system still requires a two-layer anticollusion encoding of the fingerprint, which results in long fingerprints; and (2) the hash of the fingerprint is used to trace an illegal re-distributor in case of collusion of several buyers and, hence, such a hash must be a valid codeword of some anti-collusion code.

the transaction monitor still requires the cooperation of the proxies to construct a valid hash-level codeword.


Software-based attestation [22, 28, 34, 45, 46] does not require any hardware and involves no cryptographic keys.

other similar attack scenarios are possible, where the common feature is the ability of malware (which is resident on compromised devices) to manipulate their clocks.


Such attacks start with full or partial de-capsulation (i.e., removal of packaging using mechanical or chemical means, or mixture of both), followed by de-processing.

static network techniques can not be extended to dynamic networks.


To achieve this, we need to make some minimal assumptions about hardware security features of the underlying devices.

the integrity measurement mechanism (attestation code) residing on Di must be immune to software attacks.


The second issue has not been considered at all in the context of remote attestation.

the first issue has been noticed and progress has been made, to some extent, by Asokan et al. [4] in the design of SEDA– a technique for efficient and scalable attestation of a network of provers.


Android's permission system empowers informed privacy decisions when installing third-party applications.

examining the access permissions is not enough to assess privacy exposure; even seemingly harmless applications can severely expose user data.


Viber keeps a configuration file with information on the user identity, profile picture and phone number.

inside the Viber directory, the hidden file .userdata contains the username specified when registering with the messaging service.


As we can see, it is relatively easy to detect the user gender from user photos.

the gender detection algorithm correctly identi.ed all photos of female users and misclassified only one male.


SEDA is based on neighbors verification and hop-by-hop MACs for authentication.

every device in SEDA is supposed to be equipped with the minimal hardware required for attestation.


The security of a password for example generally increases with its length, but so does the effort required to recall and enter it.

a trade-off exists between security and cost which depends on the particular risk to defend against.


Writing in a noisy environment can significantly increase the difficulty of eavesdropping.

it is still possible to segregate the sound of handwriting by using multiple microphones [26].


The features of sound fragments are calculated by Java.

before the test they were not aware that their data are used for testing an eavesdropping system.


However, this increases the space of candidate words for word recognizer and thus would reduce the accuracy even if the word has hit the database.

if the database is too small, it is highly probable that the word written by the victim does not exist in the database, which leads to the failure of recognition directly.


A naive method is setting a constant threshold and once the sound signal magnitude or instantaneous power exceeds the threshold, a stroke is detected.

since noise levels are usually different in different environments, and the average noise power varies over time, it is hard to assign such a threshold.


Koppel et al. [31] identify 31 unique causes where healthcare professionals use workarounds to BCMA processes that they consider impractical (e.g., time).

these workarounds can result in the wrong administration of medication which impacts patient safety.


Finally, we will discuss the open research problems about the security and privacy of genomic data.

we will discuss (i) genomic data sharing between different entities, (ii) privacy vs. utility of genomic data, (iii) integrating genomic data in individuals electronic health records, (iv) access control issues, (v) credibility and liability issues of genomic data, and (vi) standardization efforts by Global Alliance for Genomics and Health (GA4GH).


Such wide usage of genomic data also raises serious privacy-related concerns on the data.

we will discuss some well-known and important attacks on privacy of genomic data.


To address zero day attacks, others approaches are needed.

knowledge about common behavior of malware may be needed such as dynamic behavior of the attack.


We remark that KEA is non-falsifiable (cf. [42]), and it is indeed a strong assumption.

one can argue that non-falsifiability might be inherent for extractable hash functions, and thus L-more extractability.


Each access control server is responsible for verifying the access control requirements bound to specific object/permission combinations, issuing signed tokens attesting to such verification, and verifying the signatures of the tokens it receives.

each AC server must faithfully store a private token signing key in a secure manner and verify both the access control requirements governing specific token requests and the signatures and claims on all incoming tokens.


It is encompassing because an edge is defined to be clean only in case all of the files are clean.

even one malware file out of a thousand clean files, for instance, classifies an edge as malware, and thus, the edge would be added to Gm t .


Unfortunately, neither the length nor the content of the padding are checked for integrity during decryption.

we cannot exclude that an attacker which sits on the same client and shares resources (such as memory, CPU, etc.)


This is achieved by exploiting the address book syncing feature in OTT messaging applications.

in addition, social information about the caller can be displayed, like number of mutual friends, presence on social networks etc.


Instructing them to focus on the toolbars in the browser did not make much difference since participants reported assessing the legitimacy of the website by how it looked and felt.

the locus of attention and strongest cue was the page itself, not the chrome surrounding it.


For privacy, the situation is rather different: even an accurate privacy warning may still be dismissible depending on the user s specific privacy preferences.

security is a yes or no, privacy is a spectrum.


The reason is that the (absolute) ai values obtained from SVM learning are bounded by the corresponding value of the SVM parameter C.

if we set a lower C value for the malicious samples, their ai values will decrease.


In the case of evasion attacks, only malicious data at test time is affected.

despite these techniques have been shown to be effective in some adversarial learning tasks, their adoption in practice is hindered by different factors, including the difficulty of meeting specific theoretical requirements, the complexity of implementation, and scalability issues, in terms of computational time and space required during training.


A query sent to a DNS revolver is resolved from the root of the hierarchy going down to the delegation system involving several servers in the world.

introducing DNSSEC impacts several areas of the operation of an Authoritative DNS server [18].


The tickets are stored in the Request Manager linked to a particular request.

results Collector's handlers can work on each particular request by using this ticketrequest association.


We claim that implementation diversity is a reasonable way to justify the standard adversarial model in threshold cryptography.

our solution provides by now implementations for the nodes in Java and Phyton, however the presented modular design allows to implement nodes in others programming languages.


The experiment results show that the algorithm is strongly robust against attacks from JPEG compression, cropping, noise and so on.

as choosing the pixels in the least important point, the watermark information is destroyed easily by filter, image quantization, and geometric distortion.


In our study, we test both compare-and-confirm and compare-and-select.

we explore compare-and-select due to its potential benefits for inattentive users.


This means, our fingerprints are being saved somewhere by the mobile phone operators.

support for the Biometric Registration System A total of 36 people (20.9% of comments in the open-ended box) said that they supported the biometric registration program.


Our data shows that the situated idea of privacy among participants often made them resist the biometric registration program.

the origin, nature, and characteristics of privacy in the Bangladeshi context has not been studied enough to explicate this resistance.


With the rapid growth of ICT adoption in the Global South, crimes over and through digital technologies have also increased.

governments have begun to undertake a variety of different surveillance programs, which in turn provoke questions regarding citizens’ privacy rights.


One participant described: Do you think police do not know who the criminals are in a neighborhood?

when the devices leave these stable environments, a whole new set of designs and policies are required to understand privacy in different scenarios.


Several studies on technology and gender in the Global South have shown how the relationship between technology and women is affected by the male-dominated cultural norms [3,5,36].

we know little about their impact on the notion of privacy and implications for biometric identification.


Many participants were concerned about where their fingerprint data would be stored and how it might be used in the future.

this deadline was subsequently extended for one month since, on the day of the deadline, the majority of SIM cards were still not registered [65].


Unable to register these customers, the registration person suggested that they go and talk to their Ward Commissioners to obtain new IDs.

several people reported that they had already talked to their Ward Commissioners but had failed to get new ID cards since they were not originally registered in their current Wards.


For example, the registration system required that the owner of a SIM card identify themselves with a valid ID, which could be their national ID card or passport.

another said that he burnt his hand working with hot oil.


Similarly, different citizen groups monitor and criticize government surveillance programs [45].

many countries in the Global South are struggling to maintain a stable democracy and are embarking on mass surveillance programs with little external oversight.


Despite this upgrade, we demonstrate that it is possible to accurately identify Netflix videos from passive traffic capture in real-time with very limited hardware requirements.

we developed a system that can report the Netflix video being delivered by a TCP connection using only the information provided by TCP/IP headers.


Currently, communication between nodes is made in plain text because there is no encryption process.

in this paper, we have performed in a private IP environment, but it can attack any number of URIs only in public IP environment.


There is no authentication procedure for communication between master and node.

if the attacker matches only the environment variable ROS_MASTER_URI with the IP address and port number of the master, communication with all nodes connected to the master is possible, which can be exploited for various attacks.


However, since no separate encryption processing is performed, the communication history is directly exposed to the attacker.

if an attacker catches a packet in the middle, the robot can be controlled by manipulating the communication details freely from the remote.


Currently, there is no authentication procedure for ROS network in constructing distributed environment.

it is necessary to introduce a user request system in the process of communicating with the first master.


In the ROS, data messages exchanged between the master and the node, called a Bag, Bag file can be used to play this back when you need it and repeat the same action to the Robot.

the configuration environment for the ROS authentication scheme is ROS Indigo version, and Fig. 1 shows the Raspberry pi 2 environment running the master, and Fig. 2 shows the attacker's environment.


Completion of connection with KOBUKI and Raspberry Run the keyop package in the victim s environment to control KOBUKI with the keyboard.

we have analyzed the vulnerability of the most representative robot platform .


In the RSA-SW scheme, a maximum of 500 POR responses can be performed within the same time lapse, resulting in a modest peak throughout of 10 operations per second.

the provider can scale approximately 4 times better in SPORT when compared to the RSA-SW scheme of [30].


Notice that a static adversary can still collude with corrupted users but these are under the control of the attacker right from the start.

the attacker can create both honest and corrupted users but cannot corrupt honest users.


The task of the environment is to play the role of all honest users and to challenge the adversary.

whenever we say that an honest user executes a certain protocol, we mean that the environment honestly executes the protocol on behalf of this user.


As defined in Section 2.1, the system model is an abstraction of the system under attack and defines all the possible interactions of the attacker with the system.

the first step for the definition of a general system modeling technique for any CPS is the identification of the relevant aspects and components of the system.


The tool can automatically security argument graphs describing: the workflow of a CPS (i.e., how the system provides its functionalities), the security goals, and an attacker model.

we first present their terminology (relevant for our work) and then we use those definitions to informally describe their attacker model framework.


In general, the attacker framework proposed in [31] can be applied to several security techniques, e.g. from risk analysis to model checking.

in this work we focus on modelchecking based techniques.


There are a number of different work in the literature for the definition of a system model for CPS, e.g., [15].

the problem has been often studies from an engineering point of view, with no (or little) attention for the security aspects [12].


In our notation, a system model is formally represented by the following main concepts.


In order to concretely exploit on the real system the attacks (or attack traces) found with a formal assessment, one has to concretize those attacks.

one has to bridge the abstraction gap between the formalized system and the real system.


For the same reason they did not have access to the L0 ring.

the analysis tool gives the user the possibility to tune the parameter used during the analysis.


Therefore, only the communication between the upper-entities can be seen by the attacker.

by giving/removing to the attacker knowledge encryption and decryption keys, it is possible to grant/restrict the attacker to a sub-part of the network of the CPS.


Information-theoretically hiding commitments can only be computationally binding [4].

commitments are renewed on a regular basis.


They utilize timestamp chains to prolong the validity of complexity-based digital signatures thereby protecting integrity and authenticity for any length of time.

these solutions prohibit long-term confidentiality protection.


Password policies were originally designed to make users pick stronger passwords.

research has shown that they often fail to achieve this goal.


Those password composition policies make users come up with new passwords in case their preferred option is disqualified.

users continue to create new passwords until they have a sufficient set to fulfill most policies [8].


Thus, neither complexity nor length requirements prevent password reuse.

only the diverse range of character sets can be a limiting factor regarding non-modified reuse of a single password.


Mix-based countermeasures for Tor can be considered satisfactory if they reduce the success of attacks on Tor, e.g., passive traffic analysis attacks like confirmation, and preserve acceptable performance rates at the same time.

on average nearly half of Tor circuits are vulnerable to attacks that allow for the de-anonymization of users.


For state-level adversaries or in case of collusion, this can be increased to a coverage of up to 85 %.

in contrast to Tor, classical mix networks [4] and anonymous remailers [5] disrupt metadata relations by adding arti.cial delays during the transmission process.


A file is written to the shared repository if and only if the writer successfully distributes the file’s tokens onto at least t owners’ accounts.

a write access granted to the shared repository is equivalent to write access to at least t of the owners’ accounts.


Similar to other MLE instantiations, convergent encryption suffers from a number of attacks such as dictionary attacks [7]; here, if the cloud server can predict the content of a message/file, then it can derive the corresponding encryption key and decrypt the message.

one generic mitigation of side channels in the cloud is frequent migration, i.e. switching to a separate set of the underlying resources.


For instance, performing access control using data encryption alone is not sufficient, since shared ownership demonstrates the need for higher-level isolation mechanisms.

shared ownership should be resistant to key leakage and collusion attempts.


Physical keys and scannable personal IDs are examples of possession-based authentication.

the Levenshtein distance indicates how close the guess is to the original password [1, 19, 38].


This is due to the time it takes to perform a gaze gesture, look to the front again, then perform another gaze gesture.

guesses against GazeEnd are the closest to the actual password.


For the proposed protocol we make use of a secure key derivation function (KDF) to derive cryptographic keys using a secret input data, e.g., a password, with sufficient min-entropy.

we use a KDF to generate keys for an IND-CPA-secure symmetric encryption and a strongly-unforgeable digital signature scheme.


Motivated by the aforementioned research findings over respiratory sounds, we hypothesized that acoustic features derived from different breathing patterns, measured by a microphone sensor, should provide an effective approach for authenticating people.

we needed to discover the key features (e.g., amount of air, forcefulness, time duration of inhalation and exhalation, etc.)


Physiological Context: Our studies in Section 5.4 demon strate the robustness of the system under certain short-term extrinsic contextual factors, such as physical activity.

breathing-related features are also likely to exhibit longer timescale changes, due to intrinsic physiological changes, such as aging and decrease in the lung capacity.


These works report a very low EER (Equal Error Rate) in the range of 1%-5%.

all these works fail to test the security of touch gestures in the presence of sophisticated attacks such as shoulder surfing or video based observation attacks.


This is because for the VBS video, the various partition modes can be fully utilized to quantize the quantization distortion, and it can also be considered to increase the feature diversity.

a compact distribution will be helpful to capture more statistical information with a small threshold.


2.2 Efects of MV Based Steganography on Video Statistics According to current MV based steganography [1, 3, 6, 10, 27, 29], one or two components of a MV can be modified during e emmbeding.

the features in [20] and [26] are based on the first-order distributions (histograms) of NMVDs and the joint distributions of NMVDs.


The difference calibrated features can be completely derived from Cartesian calibrated features, but not vice versa.

the Cartesian calibrated features contain more discriminative information than difference calibrated features.


Stego signal is a high-frequency noise modulated by content.

to force the network to pay attention to this signal (and to converge), images need to be pre-filtered to incease the SNR between the signal of interest (the weak stego noise) and the noise – the image content.


For the first task, 11 children were able to request login without help, while remaining completed with some help.

apart from design improvements and suggestions for additional features, the user studies provided additional insight.


We found that participants were engaged and able to envision themselves using the product when they could interact with a prototype, enabling them to consider additional features and consider what would make the most sense for their family.

we found that children were more engaged when interacting with the prototype versus when being interviewed.


The UAF service authenticates a device and then trusts local authorization to verify the user from that device.

the Universal 2nd Factor (U2F) [30], offers secure second factor authentication.


Completely eliminating control-flow inference attacks that we model in Section 3 is extremely challenging.

our study of SSL/TLS implementations’ sensitive control-flow vulnerabilities is not completely addressed by any of these specific defense techniques.


We need to adopt neural network algorithms within limitations of homomorphic encryption.

the computation performed over sensitive data by neural network algorithms is very complex and neural networks cannot simply be translated to encrypted versions without modification.


Based on one of the latter, we analyze the current IDE support for receiving code changes, finding that historical information is neither visible nor easily accessible.

we devise and qualitatively evaluate BE L L E V U E, the design of an IDE extension to make received changes always visible and code history accessible in the editor.


Despite this, the TS stack is linearizable with respect to stack semantics.

theorem 1 points towards fundamental constraints on the structure of concurrent stacks.


For example, the rule for an if expression type checks each branch under the assumption that the condition is true or false.

it will then examine the congruence equivalence class of these expressions to see if they contain any suitable values any value v is suitable for a, a function value rec f x.a0 for f, and a value headed by a data constructor for b and then unfold the resulting expression (rec f x.a0) v. (If there are several suitable values, one is selected arbitrarily).


The total-store-ordering semantics [23] provides that all instructions are executed in program order (or, more precisely, cannot be observed to be executed out of program order), each write is visible either globally or only to its own thread, and writes become globally visible in program order.

visibility and execution-order edges compile away to nothing, and pushes can be implemented by mfences.


Alternatively, rather than restricting the setting in such ways, we can instead constrain the programs under consideration.

we can restrict ourselves to so-called recursive coalgebras [6] those that by definition yield unique solutions to the hylo equation, whatever the algebra.


More formally, suppose we have some restricted programming language T such that programs of this language can run on the decentralized components.

there is a subtle local-versus-global issue that is a frequent cause of errors in SDN implementations.


This problem can be difficult and error prone even for experienced programmers.


For an integer k, we say that a policy F has k-bounded causality if for any event e and history H, if e is relevant with respect to F and H then it is also k-relevant.

a policy F has k-bounded causality if whenever an event e is relevant, it can cause a change after at most k additional events.


Similarly, if a load immediately follows a store to the same location, then it is always possible for the load to get the value from that store.

it is always possible to remove the load.


Sakunkonchak et al. [33] apply CEGAR optimizations to software model checking and speed up the search for predicates that make the counterexample spurious.

they do not use interpolants and instead search the counterexample for conflicting predicates.


Unlike the programming model in this paper, streaming based programming models are not analyzable nor do they break data dependencies to expose data parallelism like we do in this work.

streaming languages can only run as fast as hardware can expose a stream.


In this section we describe how to run k-SFTs on data-parallel hardware.

we demonstrate an end to end compilation of k-SFTs to a data parallel version capable of exploiting multiple cores via threads.


Over the course of 6 assignments, students complete substantial portions of core system components, including the memory manager, scheduler, file system, shell, and network driver.

jOS requires students to program x86 hardware including configuring the page tables, context switching the CPU, handling interrupts, and writing an e1000 network card driver.


The process ABI includes higherlevel abstractions, such as file descriptors, signals, and network sockets, whereas a VM manipulates emulated hardware abstractions, such as a virtual disk, CPU interrupts, and a virtual network card.

adding VM support to a legacy OS, such as adding KVM to Linux, requires replacing the system call table with a hypercall table, the ability to trap accesses to privileged hardware, and a PC hardware model, generally running as a separate process.


This example uses a filter to test how well a class is encapsulated.

the test looks for public fields that are not declared as const by applying a filter to the getFieldNames method (see Figure 8).


ParTE [5] is a new refactoring tool built on top of Wrangler and RefactorErl.

wrangler's API and DSL support for scripting is used in ParTE to build refactorings [6], whereas RefactorErl's program analysis support is used to find parallelisable code candidates.


In formal notations, we use API to denote { CLAPI }, and operations on APIs are naturally set operations (e.g. API1 - API2 is set substraction, which excludes class declarations in API2 from API1 ).

we use the notation APIs to denote the source API, CLAPI , and APId to denote the target API, CL'API , respectively.


We found that for all assignments in each program the types we observed formed a subset of the inferred type sets.

the type analysis was able to infer all types observed at run-time, providing an empirical approximation to soundness.


An important limitation of our technique is that it requires knowledge of the construction of the higher order attribute.

when a higher order attribute a is used to construct a new value of a higher order attribute, a path needs to be constructed to indicate in which part of the new AST a ends up.


In order for our technique to work we therefore require the construction of higher order attributes to be of a restricted form in which only constructors, attribute references, and constants are used.

pattern matching is not allowed as it would highly complicate dependency analysis.


Actions have priority according to their order in the list.

if a process is enabled to execute Action B1, it may not execute any other action; if a process is enabled to execute Action B2, it may not execute Actions B3 through B7, and so forth.


Splitting the heap into two generations enables the GC to use a run-time-efficient collection strategy for objects that are likely to die (i.e., young objects) and a more memory-efficient strategy for objects that are unlikely to die (i.e., old objects).

the run-time-efficient Scavenge algorithm (minor GC) is used for the young generation, whereas the Mark and Compact algorithm (major GC) is used if all spaces need collecting.


Because of the nature of this system being an internal business system, it is possible that the number of unhappy users who do not complain is smaller.

regardless of the actual factor involved, the number of complaints is a good indicator of user satisfaction.


In particular, one key constraint in quantum computation is the no cloning theorem [33], which states that a superposition state cannot be perfectly copied from one qubit to another qubit, without destroying the first one.

in order to use the state of a qubit in another part of the architecture, that qubit must be physically moved.


Note that the functionality of a device is not broken if it is disabled after finishing one task and enabled before handling the next one, as long as the driver preserves and then restores the device context, respectively.

this incurs unnecessary overhead due to power-state transition.


We face a trade off in choosing Tthreshold: with a smaller value of Tthreshold, the software approach can infer in a more timely manner if a device has pending tasks and can capture shorter periods in which a device has no pending task.

a smaller Tthreshold leads to more aggressive PM; however, to avoid false report of no pending task, Tthreshold needs to be greater than the largest possible interval between register accesses when a device has pending tasks.


ICEM [48] integrates PM code into locks for device drivers.

the approach only focuses on a specific class of device drivers ( "shared drivers" ) which is uncommon in Linux for modern SoCs, according to our observation.


Instead, it indicates the device has been busy at least once since the last read of the busy/idle register.

if the register shows idle, the device must have been idle since the last read of the busy/idle register.


Following the Spark developers' advice, we use the remaining RAM to mount an in-memory file system tmpfs for Spark's intermediate results.

these experiments make use of all the available RAM.


Upon colliding with b, ball a may speed up and collide with c before c can collide with d, invalidating task (c, d).

a task graph is an acyclic graph whose nodes correspond to some subset of W .


Many complex Ziria processing blocks will need to both push and pull data during their execution.

this vectorization candidate is nevertheless incorrect because c1 could stop after reading the first ain inputs from t s output, leaving t with extra ain values which should have been processed by c2.


The acceptable data widths of a component may depend in complex ways on the rest of the pipeline (Section 3).

a programmer needs to jointly optimize all the data widths in a pipeline, which is error-prone and tedious.


Attaching NVMs directly to processors will produce non-volatile main memories (NVMMs), exposing the performance, flexibility, and persistence of these memories to applications.

taking full advantage of NVMMs potential will require changes in system software [3].


These high-performance storage systems would be especially useful in large-scale data center environments where reliability and availability are critical.

providing reliability and availability to NVMM is challenging, since the latency of data replication can overwhelm the low latency that NVMM should provide.


Another problem with fixed parallelism is that it targets all requests equally.

long requests have a greater impact on tail latency than short ones.


However, when a request arrives, we do not know its service demand (and it is difficult to predict if the request is short or long [26]).

we determine demand as the request executes.


For example, assuming the aggregator has 10 ISNs, if we want to process 90% of user requests within 100 ms, then each ISN needs to reply within 100 ms with probability around 0.99.

for a total latency of 100 ms at the 90th-percentile response time, the response time of each ISN must be at most 100 ms at the 99th-percentile.


Long requests have over 2 times speedup with 3 threads.

short requests have limited speedup, a factor of 1.2 with 3 threads.


OS designers are experts in how their systems work: they represent the best opportunity to enhance the security of the system.

by selecting this abstraction, the outer kernel still manages all aspects of the virtual memory subsystem; however, the nested kernel interposes on all pMMU updates, thereby allowing the nested kernel to isolate the pMMU and enforce any other access control policy in the system, such as the one used to protect nested kernel code and data.


After the preliminary analysis has been completed, the next step is to select targets for testing.

we aim to select specific instructions in the program under test that are more likely to trigger a bug, so we can guide our testing towards those instructions.


Xposed runs only on rooted devices, and it is not possible to install AlarmScope on non-rooted devices.

xposed allows us to apply the functionality directly, without modifying the system platform, and this enables the smooth implementation of our prototype.


On the other hand, Pandora, sent out at regular 1-second intervals 166 bytes while sending and receiving during long time intervals large packets.

we can conclude that Pandora consumed more energy than iTunes because it kept the Wi-Fi radio at high power state for most of the test duration.


Finally, out of the three, last chunk strategy performs the worst in terms of stall and switch statistics.

harmonic-based strategy has commensurate stall and switching statistics.


So in most cases we believe post-deployment testing will be required.

second, per-maybe strategy defeats the flexibility inherent to the maybe approach and would devolve into the fragile decision-making we are trying to avoid.


Nowadays the rapid development of technology can be observed in every aspect of human life, with no exception to the educational world.

implementation of secure online examination system is a hot topic.


Therefore, distinct EXAM (Best) of Heuristic III (c) was not effective because EFL eliminated duplicated additional test data before calculating the suspiciousness.

we also excluded version 9 of schedule2 because there is no fail TC.


If consistency-control scheme is designed based on WAL scheme, the file system reflects the updates from the logging area to the file system area, whenever read request is issued.

since MinL2R reflects the updates to the file system area directly with rollback-recovery scheme, the application can read the requested data from file system area of SCM storage, regardless of logged data.


Facial expressions can be used to enhance conversation, show empathy, and acknowledge the actions of others.

robot behavior that includes at least some rudimentary, human-like facial expressions can enrich the interaction between humans and robots, and add to a robot's ability to convey intention.


Further, these approaches do not provide practical evidence that the particular visualization and/or hardcoded abstraction is actually useful.

debugging and bug isolation strategies have seen significant attention [15, 27].


Participants found the possibility to interact “directly” with the data compelling and thought that it allows them to more quickly reconcile their mental model of the structure with the rendering on-screen.

participants often simple changed the visual layout of the graph in order to better understand the program state.


In summary the experimental data suggests that visualizing the heap graph of a running program does benefit debugging efficiency (H1) and that our mechanisms for automatic abstraction and concretization alongside the possibility to directly interact with the heap graph are indeed useful.

our tool outperforms the baseline interfaces in the hard task suggesting that the utility of our mechanism increases with task difficulty.


The flowlet API is also similar to Hadoop MapReduce one for easy use.

the internal mechanism is considerably different.


The option we chose was to remove the key scheduling from the signature to keep a unique signature for both versions.

this requirement is illustrated on the left hand side of Figure 4 where two consecutive additions involving constant variables can be simplified if they are rearranged.


The thought process to have a reusable and generic system was implemented with a lot of rigor when the initial core classes were designed.

the study revealed that the practices are ignored due to various business reasons.


Conducting regression testing after every change or some changes to the code is a solution to immediately detect source code changes with side effects.

regression testing is an expensive process because it becomes very time consuming to run a large number of test-cases or an entire test-suite, covering all the functionalities of a large and complex software.