waashk/dblp huggingface dataset:
spand: shared passive network performance discovery. in the internet today, users and applications must often make decisions based on the performance they expect to receive from other internet hosts. for example, users can often view many web pages in low-bandwidth or high-bandwidth versions, while other pages present users with long lists of mirror sites to chose from. current techniques to perform these decisions are often ad hoc or poorly designed. the most common solution used today is to require the user to manually make decisions based on their own experience and whatever information is provided by the application. previous efforts to automate this decision-making process have relied on isolated, active network probes from a host. unfortunately, this method of making measurements has several problems. active probing introduces unnecessary network traffic that can quickly become a significant part of the total traffic handled by busy web servers. probing from a single host results in less accurate information and more redundant network probes than a system that shares information with nearby hosts. in this paper, we propose a system called spand (shared passive network performance discovery) that determines network characteristics by making shared, passive measurements from a collection of hosts. in this paper, we show why using passive measurements from a collection of hosts has advantages over using active measurements from a single host. we also show that sharing measurements can significantly increase the accuracy and timeliness of predictions. in addition, we present a initial prototype design of spand, the current implementation status of our system, and initial performance results that show the potential benefits of spand.
exploiting result equivalence in caching dynamic web content. caching is currently the primary mechanism for reducing the latency as well as bandwidth requirements for delivering web content. numerous techniques and tools have been proposed, evaluated and successfully used for caching static content. recent studies show that requests for dynamic web content also contain substantial locality for identical requests. in this paper, we classify locality in dynamic web content into three kinds: identical requests, equivalent requests, and partially equivalent requests. equivalent requests are not identical to previous requests but result in generation of identical dynamic content. the documents generated for partially equivalent requests are not identical but can be used as temporary place holders for each other while the real document is being generated. we present a new protocol, which we refer to as dynamic content caching protocol (dccp), to allow individual content generating applications to exploit query semantics and specify how their results should be cached and/or delivered. we illustrate the usefulness of dccp for several applications and evaluate its effectiveness using traces from the alexandria digital library and nasa kennedy center as case studies.
tied, libsafeplus: tools for runtime buffer overflow protection. buffer overflow exploits make use of the treatment of strings in c as character arrays rather than as first-class objects. manipulation of arrays as pointers and primitive pointer arithmetic make it possible for a program to access memory locations which it is not supposed to access. there have been many efforts in the past to overcome this vulnerability by performing array bounds checking in c. most of these solutions are either inadequate, inefficient or incompatible with legacy code. in this paper, we present an efficient and transparent runtime approach for protection against all known forms of buffer overflow attacks. our solution consists of two tools: tied (type information extractor and depositor) and libsafeplus. tied extracts size information of all global and automatic buffers defined in the program from the debugging information produced by the compiler and inserts it back in the program binary as a data structure available at runtime. libsafeplus is a dynamic library which provides wrapper functions for unsafe c library functions such as strcpy. these wrapper functions check the source and target buffer sizes using the information made available by tied and perform the requested operation only when it is safe to do so. for dynamically allocated buffers, the sizes and starting addresses are recorded at runtime. with our simple design we are able to protect most applications with a performance overhead of less than 10%.
network-in-a-box: how to set up a secure wireless network in under a minute. combining effective security and usability is often considered impossible. for example, deploying effective security for wireless networks is a difficult task, even for skilled systems administrators - a fact that is impeding the deployment of many mobile systems. in this paper we describe a system that lets typical users easily build a highly secure wireless network. our main contribution is to show how gesture-based user interfaces can be applied to provide a complete solution for securing wireless networks. this allows users to intuitively manage the network security of their mobile devices, even those with limited user interfaces. we demonstrate through user studies that our secure implementation is considerably easier to use than typical commercially available options, even those that provide lower security. our gesture-based approach is quite general, and can be used to design a wide variety of systems that are simultaneously secure and easy to administer.
privtrans: automatically partitioning programs for privilege separation. privilege separation partitions a single program into two parts: a privileged program called the monitor and an unprivileged program called the slave. all trust and privileges are relegated to the monitor, which results in a smaller and more easily secured trust base. previously the privilege separation procedure, i.e., partitioning one program into the monitor and slave, was done by hand [18, 28]. we design techniques and develop a tool called privtrans that allows us to automatically integrate privilege separation into source code, provided a few programmer annotations. for instance, our approach can automatically integrate the privilege separation previously done by hand in openssh, while enjoying similar security benefits. additionally, we propose optimization techniques that augment static analysis with dynamic information. our optimization techniques reduce the number of expensive calls made by the slave to the monitor. we show privtrans is effective by integrating privilege separation into several open-source applications.
on user choice in graphical password schemes. graphical password schemes have been proposed as an alternative to text passwords in applications that support graphics and mouse or stylus entry. in this paper we detail what is, to our knowledge, the largest published empirical evaluation of the effects of user choice on the security of graphical password schemes. we show that permitting user selection of passwords in two graphical password schemes, one based directly on an existing commercial product, can yield passwords with entropy far below the theoretical optimum and, in some cases, that are highly correlated with the race or gender of the user. for one scheme, this effect is so dramatic so as to render the scheme insecure. a conclusion of our work is that graphical password schemes of the type we study may generally require a different posture toward password selection than text passwords, where selection by the user remains the norm today.
fixing races for fun and profit: how to use access(2). it is well known that it is insecure to use the access(2) system call in a setuid program to test for the ability of the program's executor to access a file before opening said file. although the access(2) call appears to have been designed exactly for this use, such use is vulnerable to a race condition. this race condition is a classic example of a time-of-check-to-time-of-use (tocttou) problem. we prove the "folk theorem" that no portable, deterministic solution exists without changes to the system call interface, we present a probabilistic solution, and we examine the effect of increasing cpu speeds on the exploitability of the attack.
panalyst: privacy-aware remote error analysis on commodity software . remote error analysis aims at timely detection and remedy of software vulnerabilities through analyzing run-time errors that occur on the client. this objective can only be achieved by offering users effective protection of their private information and minimizing the performance impact of the analysis on their systems without undermining the amount of information the server can access for understanding errors. to this end, we propose in the paper a new technique for privacy-aware remote analysis, called panalyst. panalyst includes a client component and a server component. once a runtime exception happens to an application, panalyst client sends the server an initial error report that includes only public information regarding the error, such as the length of the packet that triggers the exception. using an input built from the report, panalyst server performs a taint analysis and symbolic execution on the application, and adjusts the input by querying the client about the information upon which the execution of the application depends. the client agrees to answer only when the reply does not give away too much user information. in this way, an input that reproduces the error can be gradually built on the server under the client's consent. our experimental study of this technique demonstrates that it exposes a very small amount of user information, introduces negligible overheads to the client and enables the server to effectively analyze an error.
tor: the second-generation onion router. we present tor, a circuit-based low-latency anonymous communication service. this second-generation onion routing system addresses limitations in the original design by adding perfect forward secrecy, congestion control, directory servers, integrity checking, configurable exit policies, and a practical design for location-hidden services via rendezvous points. tor works on the real-world internet, requires no special privileges or kernel modifications, requires little synchronization or coordination between nodes, and provides a reasonable tradeoff between anonymity, usability, and efficiency. we briefly describe our experiences with an international network of more than 30 nodes. we close with a list of open problems in anonymous communication.
to catch a predator: a natural language approach for eliciting malicious payloads. we present an automated, scalable, method for crafting dynamic responses to real-time network requests. specifically, we provide a flexible technique based on natural language processing and string alignment techniques for intelligently interacting with protocols trained directly from raw network traffic. we demonstrate the utility of our approach by creating a low-interaction web-based honeypot capable of luring attacks from search worms targeting hundreds of different web applications. in just over two months, we witnessed over 368, 000 attacks from more than 5, 600 botnets targeting several hundred distinct webapps. the observed attacks included several exploits detected the same day the vulnerabilities were publicly disclosed. our analysis of the payloads of these attacks reveals the state of the art in search-worm based botnets, packed with surprisingly modular and diverse functionality.
on gray-box program tracking for anomaly detection. many host-based anomaly detection systems monitor a process ostensibly running a known program by observing the system calls the process makes. numerous improvements to the precision of this approach have been proposed, such as tracking system call sequences, and various "gray-box" extensions such as examining the program counter or return addresses on the stack when system calls are made. in this paper, we perform the first systematic study of a wide spectrum of such methods. we show that prior approaches can be organized along three axes, revealing new possibilities for system-call-based program tracking. through an empirical analysis of this design space, we shed light on the benefits and costs of various points in the space and identify new regions that appear to outperform prior approaches. in separate contributions, we demonstrate novel mimicry attacks on a recent proposal using return addresses for system-call-based program tracking, and then suggest randomization techniques to make such attacks more difficult.
collapsar: a vm-based architecture for network attack detention center. the honeypot has emerged as an effective tool to provide insights into new attacks and current exploitation trends. though effective, a single honeypot or multiple independently operated honeypots only provide a limited local view of network attacks. deploying and managing a large number of coordinating honeypots in different network domains will not only provide a broader and more diverse view, but also create potentials in global network status inference, early network anomaly detection, and attack correlation in large scale. however, coordinated honeypot deployment and operation require close and consistent collaboration across participating network domains, in order to mitigate potential security risks associated with each honeypot and the non-uniform level of security expertise in different network domains. it is challenging, yet desirable, to provide the two conflicting features of decentralized presence and uniform management in honeypot deployment and operation. to address these challenges, this paper presents collapsar, a virtual-machine-based architecture for network attack detention. a collapsar center hosts and manages a large number of high-interaction virtual honeypots in a local dedicated network. these honeypots appear, to potential intruders, as typical systems in their respective production networks. decentralized logical presence of honeypots provides a wide diverse view of network attacks, while the centralized operation enables dedicated administration and convenient event correlation, eliminating the need for honeypot experts in each production network domain. we present the design, implementation, and evaluation of a collapsar testbed. our experiments with several real-world attack incidences demonstrate the effectiveness and practicality of collapsar.
finding user/kernel pointer bugs with type inference. today's operating systems struggle with vulnerabilities from careless handling of user space pointers. user/kernel pointer bugs have serious consequences for security: a malicious user could exploit a user/kernel pointer bug to gain elevated privileges, read sensitive data, or crash the system. we show how to detect user/kernel pointer bugs using type-qualifier inference, and we apply this method to the linux kernel using cqual, a type-qualifier inference tool. we extend the basic type-inference capabilities of cqual to support context-sensitivity and greater precision when analyzing structures so that cqual requires fewer annotations and generates fewer false positives. with these enhancements, we were able to use cqual to find 17 exploitable user/kernel pointer bugs in the linux kernel. several of the bugs we found were missed by careful hand audits, other program analysis tools, or both.
autograph: toward automated, distributed worm signature detection. today's internet intrusion detection systems (idses) monitor edge networks' dmzs to identify and/or filter malicious flows. while an ids helps protect the hosts on its local edge network from compromise and denial of service, it cannot alone effectively intervene to halt and reverse the spreading of novel internet worms. generation of the worm signatures required by an ids--the byte patterns sought in monitored traffic to identify worms--today entails non-trivial human labor, and thus significant delay: as network operators detect anomalous behavior, they communicate with one another and manually study packet traces to produce a worm signature. yet intervention must occur early in an epidemic to halt a worm's spread. in this paper, we describe autograph, a system that automatically generates signatures for novel internet worms that propagate using tcp transport. autograph generates signatures by analyzing the prevalence of portions of flow payloads, and thus uses no knowledge of protocol semantics above the tcp level. it is designed to produce signatures that exhibit high sensitivity (high true positives) and high specificity (low false positives); our evaluation of the system on real dmz traces validates that it achieves these goals. we extend autograph to share port scan reports among distributed monitor instances, and using trace-driven simulation, demonstrate the value of this technique in speeding the generation of signatures for novel worms. our results elucidate the fundamental trade-off between early generation of signatures for novel worms and the specificity of these generated signatures.
static disassembly of obfuscated binaries. disassembly is the process of recovering a symbolic representation of a program's machine code instructions from its binary representation. recently, a number of techniques have been proposed that attempt to foil the disassembly process. these techniques are very effective against state-of-the-art disassemblers, preventing a substantial fraction of a binary program from being disassembled correctly. this could allow an attacker to hide malicious code from static analysis tools that depend on correct disassembler output (such as virus scanners). the paper presents novel binary analysis techniques that substantially improve the success of the disassembly process when confronted with obfuscated binaries. based on control flow graph information and statistical methods, a large fraction of the program's instructions can be correctly identified. an evaluation of the accuracy and the performance of our tool is provided, along with a comparison to several state-of-the-art disassemblers.
privacy-preserving sharing and correlation of security alerts. we present a practical scheme for internet-scale collaborative analysis of information security threats which provides strong privacy guarantees to contributors of alerts. wide-area analysis centers are proving a valuable early warning service against worms, viruses, and other malicious activities. at the same time, protecting individual and organizational privacy is no longer optional in today's business climate. we propose a set of data sanitization techniques and correlation, while maintaining privacy for alert contributors. our approach is practical, scalable, does not rely on trusted third parties or secure multiparty computation schemes, and does not require sophisticated schemes, and does not require sophisticated key management.
avfs: an on-access anti-virus file system. viruses and other malicious programs are an ever-increasing threat to current computer systems. they can cause serious damage and consume countless hours of system administrators' time to combat. most current virus scanners perform scanning only when a file is opened, closed, or executed. such scanners are inefficient because they scan more data than is needed. worse, scanning on close may detect a virus after it had already been written to stable storage, opening a window for the virus to spread before detection. we developed avfs, a true on-access anti-virus file system that incrementally scans files and prevents infected data from being committed to disk. avfs is a stackable file system and therefore can add virus detection to any other file system: ext3, nfs, etc. avfs supports forensic modes that can prevent a virus from reaching the disk or automatically create versions of potentially infected files to allow safe recovery. avfs can also quarantine infected files on disk and isolate them from user processes. avfs is based on the open-source clamav scan engine, which we significantly enhanced for efficiency and scalability. whereas clamav's performance degrades linearly with the number of signatures, our modified clamav scales logarithmically. our linux prototype demonstrates an overhead of less than 15% for normal user-like workloads.
copilot - a coprocessor-based kernel runtime integrity monitor. copilot is a coprocessor-based kernel integrity monitor for commodity systems. copilot is designed to detect malicious modifications to a host's kernel and has correctly detected the presence of 12 real-world rootkits, each within 30 seconds of their installation with less than a 1% penalty to the host's performance. copilot requires no modifications to the protected host's software and can be expected to operate correctly even when the host kernel is thoroughly compromised - an advantage over traditional monitors designed to run on the host itself.
a virtual honeypot framework. a honeypot is a closely monitored network decoy serving several purposes: it can distract adversaries from more valuable machines on a network, provide early warning about new attack and exploitation trends, or allow in-depth examination of adversaries during and after exploitation of a honeypot. deploying a physical honeypot is often time intensive and expensive as different operating systems require specialized hardware and every honeypot requires its own physical system. this paper presents honeyd, a framework for virtual honeypots that simulates virtual computer systems at the network level. the simulated computer systems appear to run on unallocated network addresses. to deceive network fingerprinting tools, honeyd simulates the networking stack of different operating systems and can provide arbitrary routing topologies and services for an arbitrary number of virtual systems. this paper discusses honeyd's design and shows how the honeyd framework helps in many areas of system security, e.g. detecting and disabling worms, distracting adversaries, or preventing the spread of spam email.
design and implementation of a tcg-based integrity measurement architecture. we present the design and implementation of a secure integrity measurement system for linux. all executable content that is loaded onto the linux system is measured before execution and these measurements are protected by the trusted platform module (tpm) that is part of the trusted computing group (tcg) standards. our system is the first to extend the tcg trust measurement concepts to dynamic executable content from the bios all the way up into the application layer. in effect, we show that many of the microsoft ngscb guarantees can be obtained on today's hardware and today's software and that these guarantees do not require a new cpu mode or operating system but merely depend on the availability of an independent trusted entity, a tpm for example. we apply our trust measurement architecture to a web server application where we show how our system can detect undesirable invocations, such as rootkit programs, and that our measurement architecture is practical in terms of the number of measurements taken and the performance impact of making them.
side effects are not sufficient to authenticate software. kennell and jamieson [kj03] recently introduced the genuinity system for authenticating trusted software on a remote machine without using trusted hardware. genuinity relies on machine-specific computations, incorporating side effects that cannot be simulated quickly. the system is vulnerable to a novel attack, which we call a substitution attack. we implement a successful attack on genuinity, and further argue this class of schemes are not only impractical but unlikely to succeed without trusted hardware.