waashk/dblp huggingface dataset:
subvirt: implementing malware with virtual machines. attackers and defenders of computer systems both strive to gain complete control over the system. to maximize their control, both attackers and defenders have migrated to low-level, operating system code. in this paper, we assume the perspective of the attacker, who is trying to run malicious software and avoid detection. by assuming this perspective, we hope to help defenders understand and defend against the threat posed by a new class of rootkits. we evaluate a new type of malicious software that gains qualitatively more control over a system. this new type of malware, which we call a virtual-machine based rootkit (vmbr), installs a virtual-machine monitor underneath an existing operating system and hoists the original operating system into a virtual machine. virtual-machine based rootkits are hard to detect and remove because their state cannot be accessed by software running in the target system. further, vmbrs support general-purpose malicious services by allowing such services to run in a separate operating system that is protected from the target system. we evaluate this new threat by implementing two proof-of-concept vmbrs. we use our proof-of-concept vmbrs to subvert windows xp and linux target systems, and we implement four example malicious services using the vmbr platform. last, we use what we learn from our proof-of-concept vmbrs to explore ways to defend against this new threat. we discuss possible ways to detect and prevent vmbrs, and we implement a defense strategy suitable for protecting systems against this threat.
noninterference and intrusion detection. this paper presents an intrusion detection methodology based on the concept of noninterference for detecting race-condition attacks. in general, this type of attack occurs when an unprivilege process causes a privilege process to perform illegal operations by executing strategic operations in the appropriate timing window. we apply the non-interference model in a novel way that allows us to formally represent valid interleaving between privilege and unprivilege processes. instead of proving a system satis?es noninterference assertions, we derive an algorithm for checking the assertions at run-time based on the developed theory and a formal model of unix system calls. our methodology can detect unknown race-condition attacks. in addition, this work provides an example of the application of formal speci?cation and reasoning in intrusion detection.
execution monitoring of security-critical programs in distributed systems: a specification-based approach. abstract: we describe a specification-based approach to detect exploitations of vulnerabilities in security-critical programs. the approach utilizes security specifications that describe the intended behavior of programs and scans audit trails for operations that are in violation of the specifications. we developed a formal framework for specifying the security-relevant behavior of programs, on which we based the design and implementation of a real-time intrusion detection system for a distributed system. also, we wrote security specifications for 15 unix setuid root programs. our system detects attacks caused by monitored programs, including security violations caused by improper synchronization in distributed programs. our approach encompasses attacks that exploit previously unknown vulnerabilities in security-critical programs.
a practical revocation scheme for broadcast encryption using smart cards. we present an anti-pirate revocation scheme for broadcastencryption systems (e.g., pay tv), in which the data isencrypted to ensure payment by users. in the systems weconsider, decryption of keys is done on smartcards, and keymanagement is done in-band. our starting point is a recentscheme of naor and pinkas. the basic scheme uses secretsharing to remove up to t parties, is information theoreticsecure against coalitions of size t, and is capable of creatinga new group key. however, with current smartcard technology,this scheme is only feasible for small system parameters,allowing up to about 100 pirates to be revoked beforeall the smartcards need to be replaced.we first present a novel implementation method of theirbasic scheme that distributes the work in novel ways amongthe smartcard, set-top terminal, and center. based on this,we construct several improved schemes for many statefulrevocation rounds that scale to realistic system sizes. weallow up to about 10000 pirates to be revoked using currentsmartcard technology before re-carding is needed. thetransmission lengths of our constructions are on par withthose of the best tree-based schemes. however, our constructionshave much lower smartcard cpu complexity:only o (1) smartcard operations per revocation round, asopposed to a poly-logarithmic complexity of the best tree-basedschemes.we evaluate the system behavior via an exhaustive simulationstudy. our simulations show that with mild assumptionson the piracy discovery rate, our constructions canperform effective pirate revocation for realistic broadcastencryption scenarios.
remote physical device fingerprinting. we introduce the area of remote physical device fingerprinting, or fingerprinting a physical device, as opposed to an operating system or class of devices, remotely, and without the fingerprinted device's known cooperation. we accomplish this goal by exploiting small, microscopic deviations in device hardware: clock skews. our techniques do not require any modification to the fingerprinted devices. our techniques report consistent measurements when the measurer is thousands of miles, multiple hops, and tens of milliseconds away from the fingerprinted device, and when the fingerprinted device is connected to the internet from different locations and via different access technologies. further, one can apply our passive and semi-passive techniques when the fingerprinted device is behind a nat or firewall, and also when the device's system time is maintained via ntp or sntp. one can use our techniques to obtain information about whether two devices on the internet, possibly shifted in time or ip addresses, are actually the same physical device. example applications include: computer forensics; tracking, with some probability, a physical device as it connects to the internet from different public access points; counting the number of devices behind a nat even when the devices use constant or random ip ids; remotely probing a block of addresses to determine if the addresses correspond to virtual hosts, e.g., as part of a virtual honeynet; and unanonymizing anonymized network traces.
stateful intrusion detection for high-speed networks. as networks become faster there is an emerging need for security analysistechniques that can keep up with the increased network throughput. existingnetwork-based intrusion detection sensors can barely keep up withbandwidthsof a few hundred mbps. analysis tools that can deal with higher throughputareunable to maintain state between different steps of an attack or they arelimited to the analysis of packet headers. we propose a partitioningapproachto network security analysis that supports in-depth, stateful intrusiondetection on high-speed links. the approach is centered around a "slicing"mechanism that divides the overall network traffic into subsets ofmanageablesize. the traffic partitioning is done so that a single slice contains alltheevidence necessary to detect a specific attack, making sensor-to-sensorinteractions unnecessary. this paper describes the approach and presents afirst experimental evaluation of its effectiveness.
optical time-domain eavesdropping risks of crt displays. a new eavesdropping technique can be used to read cathode-ray tube(crt) displays at a distance. the intensity of the light emitted by araster-scan screen as a function of time corresponds to the videosignal convolved with the impulse response of the phosphors.experiments with a typical personal computer color monitor show thatenough high-frequency content remains in the emitted light to permitthe reconstruction of readable text by deconvolving the signalreceived with a fast photosensor. these optical compromisingemanations can be received even after diffuse reflection from a wall.shot noise from background light is the critical performance factor.in a sufficiently dark environment and with a large enough sensoraperture, practically significant reception distances are possible.this information security risk should be considered in applicationswith high confidentiality requirements, especially in those thatalready require "tempest"-shielded equipment designed to minimizeradio-frequency emission-security concerns.
information-theoretic measures for anomaly detection. abstract: anomaly detection is an essential component of the protection mechanisms against novel attacks. in this paper, we propose to use several information-theoretic measures, namely, entropy, conditional entropy, relative conditional entropy, information gain, and information cost for anomaly detection. these measures can be used to describe the characteristics of an audit data set, suggest the appropriate anomaly detection model(s) to be built, and explain the performance of the model(s). we use case studies on unix system call data, bsm data, and network tcpdump data to illustrate the utilities of these measures.
an efficient, dynamic and trust preserving public key infrastructure. nested certification is a methodology for efficient certificate path verification. nested certificates can be used together with classical certificates in the public key infrastructures (pkis). such a pki, which is called nested certificate based pki (npki), is proposed in this paper as alternative to classical pki. the npki formation model is a transition from an existing pki by issuing nested certificates. thus, we can extract efficiently verifiable nested certificate paths instead of classical certificate paths. npki is a dynamic system and involves several authorities in order to add a new user to the system. this uses the authorities idle time to the benefit of the verifiers. in this paper, we analyze the trade-off between the nested certification overhead and the time improvement on the certificate path verification. this trade-off is acceptable in order to generate quickly verifiable certificate paths. moreover, pki-to-npki transition preserves the existing hierarchy and trust relationships in the pki, so that it can be used for strictly hierarchical pkis.
protocol-independent secrecy. inductive proofs of secrecy invariants for cryptographic protocols can be facilitated by separating the protocol-dependent part from the protocol-independent part. our secrecy theorem encapsulates the use of induction so that the discharge of protocol-specific proof obligations is reduced to first-order reasoning. in addition, the verification conditions are modularly associated with the protocol messages. secrecy proofs for otway-rees and the corrected needham-schroeder protocol are given.
a practically implementable and tractable delegation logic. we address the goal of making delegation logic (dl) into a practically implementable and tractable trust-management system. dl is a logic-based knowledge representation (i.e., language) for authorization in large-scale, open, distributed systems.as introduced in [li, feigenbaum, and grosof 1999], dl inferencing is computationally intractable and highly impractical to implement. we introduce a new version of delegation logic that remedies these difficulties. to achieve this, we impose a syntactic restriction and redefine the semantics somewhat. we show that, for this revised version of dl, inferencing is computationally tractable under the same commonly met restrictions for which ordinary logic programs (olp) inferencing is tractable (e.g., datalog and bounded number of logical variables per rule).we give implementation architecture for this version of dl; it uses a delegation compiler from dl to olp and can modularly exploit a variety of existing olp inference engines. as proof of concept, we have implemented a large expressive subset of this version of dl, using this architecture.
graph-based authentication of digital streams. abstract: we consider the authentication of digital streams over a lossy network. the overall approach taken is graph-based, as this yields simple methods for controlling overhead, delay, and the ability to authenticate, while serving to unify many previously known hash- and mac-based techniques. the loss pattern of the network is defined probabilistically, allowing both bursty and random packet loss to be modeled. our authentication schemes are customizable by the sender of the stream; that is, within reasonable constraints on the input parameters, we provide schemes that achieve the desired authentication probability while meeting the input upper bound on the overhead per packet. in addition, we demonstrate that some of the shortcomings of previously known schemes correspond to easily identifiable properties of a graph, and hence, may be more easily avoided by taking a graph-based approach to designing authentication schemes.
practical inference control for data cubes (extended abstract). the fundamental problem for inference control in data cubes is how to efficiently calculate the lower and upper bounds for each cell value given the aggregations of cell values over multiple dimensions. in this paper, we provide the first practical solution for estimating exact bounds in two-dimensional irregular data cubes (i.e., data cubes in which certain cell values are known to a snooper). our results imply that the exact bounds cannot be obtained by a direct application of the fréchet bounds in some cases. we then propose a new approach to improve the classic fréchet bounds for any high-dimensional data cube in the most general case. the proposed approach improves upon the fréchet bounds in the sense that it gives bounds that are at least as tight as those computed by fréchet, yet is simpler in terms of time complexity. based on our solutions to the fundamental problem, we discuss two security applications, privacy protection of released data and fine-grained access control and auditing.
design of a role-based trust-management framework. we introduce the rt framework, a family of role-based trust-managementlanguages for representing policies and credentials in distributedauthorization. rt combines the strengths of role-based access controland trust-management systems and is especially suitable forattribute-based access control. using a few simple credential forms, rtprovides localized authority over roles, delegation in role definition,linked roles, and parameterized roles. rt also introduces manifoldroles, which can be used to express threshold and separation-of-dutypolicies, and delegation of role activations. we formally define thesemantics of credentials in the rt framework by presenting a translationfrom credentials to datalog rules.this translation also shows thatthis semantics is algorithmically tractable.
tamper-evident, history-independent, subliminal-free data structures on prom storage-or-how to store ballots on a voting machine (extended abstract). we enumerate requirements and give constructions for the vote storage unit of an electronic voting machine. in this application, the record of votes must survive even an unexpected failure of the machine; hence the data structure should be durable. at the same time, the order in which votes are cast must be hidden to protect the privacy of voters, so the data structure should be history-independent. adversaries may try to surreptitiously add or delete votes from the storage unit after the election has concluded, so the storage should be tamper-evident. finally, we must guard against an adversarial voting machine's attempts to mark ballots through the representation of the data structure, so we desire a subliminal-free representation. we leverage the properties of programmable read only memory (prom), a special kind of write-once storage medium, to meet these requirements. we give constructions for data structures on prom storage that simultaneously satisfy all our desired properties. our techniques can significantly reduce the need to verify code running on a voting machine.
on safety in discretionary access control. an apparently prevailing myth is that safety is undecidable in discretionary access control (dac); therefore, one needs to invent new dac schemes in which safety analysis is decidable. in this paper, we dispel this myth. we argue that dac should not be equated with the harrison-ruzzo-ullman access matrix scheme, in which safety is undecidable. we present an efficient (running time cubic in its input size) algorithm for deciding safety in the graham-denning dac scheme, which subsumes the dac schemes used in the literature on comparing dac with other access control models. we also counter several claims made in recent work by solworth and sloan, in which the authors present a new access control scheme based on labels and relabelling and assert that it can implement the full range of dac models. we present a precise characterization of their access control scheme and show that it does not adequately capture a relatively simple dac scheme.
cryptographic key generation from voice. abstract: we propose a technique to reliably generate a crypto-graphic key from a user's voice while speaking a password. the key resists cryptanalysis even against an attacker who captures all system information related to generating or verifying the cryptographic key. moreover, the technique is sufficiently robust to enable the user to reliably regenerate the key by uttering her password again. we describe an empirical evaluation of this technique using 250 utterances recorded from 50 users.
secure software architectures. abstract: the computer industry is increasingly dependent on open architectural standards for their competitive success. this paper describes a new approach to secure system design in which the various representations of the architecture of a software system are described formally and the desired security properties of the system are proven to hold at the architectural level. the main ideas are illustrated by means of the x/open distributed transaction processing reference architecture, which is formalized and extended for secure access control as defined by the bell-lapadula model. the extension allows vendors to develop individual components independently and with minimal concern about security. two important observations were gleaned on the implications of incorporating security into software architectures.
low-cost traffic analysis of tor. tor is the second generation onion router, supporting the anonymous transport of tcp streams over the internet. its low latency makes it very suitable for common tasks, such as web browsing, but insecure against traffic-analysis attacks by a global passive adversary. we present new traffic-analysis techniques that allow adversaries with only a partial view of the network to infer which nodes are being used to relay the anonymous streams and therefore greatly reduce the anonymity provided by tor. furthermore, we show that otherwise unrelated streams can be linked back to the same initiator. our attack is feasible for the adversary anticipated by the tor designers. our theoretical attacks are backed up by experiments performed on the deployed, albeit experimental, tor network. our techniques should also be applicable to any low latency anonymous network. these attacks highlight the relationship between the field of traffic-analysis and more traditional computer security issues, such as covert channel analysis. our research also highlights that the inability to directly observe network links does not prevent an attacker from performing traffic-analysis: the adversary can use the anonymising network as an oracle to infer the traffic load on remote nodes in order to perform traffic-analysis.
factors affecting distributed system security. recent work examining distributed system security requirements. is critiqued. a notion of trust based on distributed system topology and distributed system node evaluation levels proposed in that work is shown to be deficient. the notion fails to make allowances for the distributed system physical security environment, security factors related to the management of distributed systems by more than one jurisdictive authority, and the interactions that can occur between nodes supporting different mandatory and discretionary security mechanisms.
robust nonproprietary software. our ultimate goal here is to be able to develop robust systems and applications that are capable of satisfying serious requirements, not merely for security but also for reliability, fault tolerance, human safety, and survivability in the face of a wide range of realistic adversities - including hardware malfunctions, software glitches, inadvertent human actions, massive coordinated attacks, and acts of god. also relevant are additional operational requirements such as interoperability, evolvability and maintainability, as well as discipline in the software development process.
polygraph: automatically generating signatures for polymorphic worms. it is widely believed that content-signature-based intrusion detection systems (idses) are easily evaded by polymorphic worms, which vary their payload on every infection attempt. in this paper, we present polygraph, a signature generation system that successfully produces signatures that match polymorphic worms. polygraph generates signatures that consist of multiple disjoint content substrings. in doing so, polygraph leverages our insight that for a real-world exploit to function properly, multiple invariant substrings must often be present in all variants of a payload; these substrings typically correspond to protocol framing, return addresses, and in some cases, poorly obfuscated code. we contribute a definition of the polymorphic signature generation problem; propose classes of signature suited for matching polymorphic worm payloads; and present algorithms for automatic generation of signatures in these classes. our evaluation of these algorithms on a range of polymorphic worms demonstrates that polygraph produces signatures for polymorphic worms that exhibit low false negatives and false positives.
an authorization scheme for distributed object systems. this paper addresses the problem of distributed object system protection. a new authorization scheme is presented and described. it is based on the collaboration between a central authorization server and security kernels located on each site of the system. a novel approach to access rights management for such an architecture is detailed: it is based on a new kind of access rights and a new scheme of privilege delegation. this authorization scheme can be adapted to various security policies, including multilevel policies such as bell-lapadula. an extension of the bell-lapadula model to distributed object systems is presented and its implementation using the authorization scheme is described.
modified architecture for the sub-keys model. a secure implementation for subkeydatabase encryption is presented. bothvertical and horizontal accessto thecontrolencrypted date are defined anddescribed. communication protocolsbetween user and system are alsoprovided.