waashk/dblp huggingface dataset:
intrusion detection via static analysis. abstract: one of the primary challenges in intrusion detection is modelling typical application behavior, so that we can recognize attacks by their atypical effects without raising too many false alarms. we show how static analysis may be used to automatically derive a model of application behavior. the result is a host-based intrusion detection system with three advantages: a high degree of automation, protection against a broad class of attacks based on corrupted code, and the elimination of false alarms. we report on our experience with a prototype implementation of this technique.
language-based generation and evaluation of nids signatures. we present a methodology to automatically construct robust signatures whose accuracy is based on formal reasoning so it can be systematically evaluated. our methodology is based on two formal languages that describe different properties of a given attack. the first language, called a session signature, describes temporal relations between the attack events. the second, called an attack invariant, describes semantic properties that hold in any instance of the attack. for example, an invariant may state that a given ftp attack must include a successful ftp login and can be launched only after the ftp representation mode has been set to ascii. we iteratively eliminate false positives and negatives from an initial session signature by comparing the signature language to the language of the invariant. we developed gard, a tool for session-signature construction, and used it to construct session signatures for multi-step attacks. we show that a session signature is more accurate than existing signatures.
a distributed secure system. we describe the design of a distributed general-purposecomputing system that enforces a multilevel security policy.the system is composed of standard unix systems and smalltrustworthy security mechanisms linked together in such a wayas to provide a total system which, is not only demonstrablysecure, but also highly efficient and cost effective. despite theheterogeneity of its components, the system as a whole appearsto be a single multilevel secure unix system, since the fact thatit is actually a distributed system is completely hidden from itsusers and their programs.this is achieved through the use ofthe "newcastle connection", a software subsystem that linkstogether multiple unix or unix-look-alike systems, withoutrequiring any changes to the source code of either the operatingsystem or any user programs. construction of a prototypeimplementation is in progress.
defending against denial-of-service attacks with puzzle auction. although client puzzles represent a promising approach to defend against certain classes of denial-of-service attacks, several questions stand in the way oftheir deployment in practice: e.g., how to set the puzzledifficulty in the presence of an adversary with unknowncomputing power, and how to integrate the approachwith existing mechanisms. in this paper, we attempt toaddress these questions with a new puzzle mechanismcalled the puzzle auction. our mechanism enables eachclient to "bid" for resources by tuning the difficulty ofthe puzzles it solves, and to adapt its bidding strategyin response to apparent attacks. we analyze the effectiveness of our auction mechanism and further demonstrate it using an implementation within the tcp protocol stack of the linux kernel. our implementationhas several appealing properties. it effectively defendsagainst syn ooding attacks, is fully compatible withtcp, and even provides a degree of interoperabilitywith clients with unmodified kernels: even without apuzzle-solving kernel, a client still can connect to a puzzle auction server under attack (albeit less effectivelythan those with puzzle-solving kernels, and at the costof additional server expense).
secure device pairing based on a visual channel (short paper). recently several researchers and practitioners have begun to address the problem of how to set up secure communication between two devices without the assistance of a trusted third party. mccune, et al. [4] proposed that one device displays the hash of its public key in the form of a barcode, and the other device reads it using a camera. mutual authentication requires switching the roles of the devices and repeating the above process in the reverse direction. in this paper, we show how strong mutual authentication can be achieved even with a unidirectional visual channel, without having to switch device roles. by adopting recently proposed improved pairing protocols, we propose how visual channel authentication can be used even on devices that have very limited displaying capabilities.
understanding trust management systems. abstract: this paper presents a mathematical framework for expressing trust management systems. the framework makes it easier to understand existing systems and to compare them to one another, as well as to design new systems. the framework defines the semantics of a trust management engine via a least fixpoint in a lattice, which, in some situations, leads to an efficient implementation. to demonstrate its flexibility, we present keynote and spki as instantiations of the framework.
statistical identification of encrypted web browsing traffic. encryption is often proposed as a tool for protecting the privacy ofworld wide web browsing.however, encryption--particularly astypically implemented in, or in concert with popular webbrowsers--does not hide all information aboutthe encryptedplaintext.specifically, http object count and sizes are oftenrevealed (or at least incompletely concealed). we investigate theidentifiability of world wide web traffic based on this unconcealedinformation in a large sample of web pages, and show that it sufficesto identify a significant fraction of them quite reliably.we alsosuggest some possible countermeasures against the exposure of thiskind of information and experimentally evaluate their effectiveness.
ensuring assurance in mobile computing. abstract: this paper introduces a panel discussion on establishing assurance evidence that mobile code applications perform as expected by the user, without the side effects that have been demonstrated as possible in constructed examples of malicious or "rogue" applets. the paper's principal authors, schaefer and pinsky, have been engaged in cooperative research with the javasoft community to gain understanding of the complexities of assurance for mobile code applications. the paper discusses part of this on-going research. the panel adds the voices and experience of a continuing researcher, dean, and of active practitioners from the principal vendors of mobile-code-enabled (and enabling) products. the panel actively debates the issues of providing compelling assurance evidence relating to the control of such code.
cognitive authentication schemes safe against spyware (short paper). can we secure user authentication against eavesdropping adversaries, relying on human cognitive functions alone, unassisted by any external computational device? to accomplish this goal, we propose challenge response protocols that rely on a shared secret set of pictures. under the considered brute-force attack the protocols are safe against eavesdropping, in that a modestly powered adversary who fully records a series of successful interactions cannot compute the user's secret. moreover, the protocols can be tuned to any desired level of security against random guessing, where security can be traded-off with authentication time. the proposed protocols have two drawbacks: first, training is required to familiarize the user with the secret set of pictures. second, depending on the level of security required, entry time can be significantly longer than with alternative methods. we describe user studies showing that people can use these protocols successfully, and quantify the time it takes for training and for successful authentication. we show evidence that the secret can be maintained for a long time (up to a year) with relatively low loss.
evaluating security properties of computer systems. the department of defense hasrecently published trusted computer systemevaluation criteria that provide the basisfor evaluating the effectiveness ofsecurity controls built into computersystems. this paper summarizes basicsecurity requirements and the technicalcriteria that are used to classify systemsinto eight hierarchical classes ofenhanced security protection. thesecriteria are used in specifying securityrequirements during acquisition, guidingthe design and development of trustedsystems and evaluating systems used toprocess sensitive information.
open source in security: visiting the bizarre. although open-source software development has virtues, there is reason to believe that the approach would not have a significant effect on the security of today's systems. the lion's share of vulnerabilities caused by software bugs is easily dealt with by means other than source code inspections. in addition, the tenets of open-source development are inhospitable to business models whose success depends on promoting secure systems.
security properties and csp. security properties such as confidentiality and authenticity may be considered in terms of the flow of messages within a network. to the extent that this characterization is justified, the use of a process algebra such as communicating sequential processes (csp) seems appropriate to describe and analyze them. this paper explores ways in which security properties may be described as csp specifications, how security mechanisms may be captured, and how particular protocols designed to provide these properties may be analyzed within the csp framework. the paper is concerned with the theoretical basis for such analysis. a sketch verification of a simple example is carried out as an illustration.
analysis of a denial of service attack on tcp. this paper analyzes a network-based denial of service attack for ip (internet protocol) based networks. it is popularly called syn flooding. it works by an attacker sending many tcp (transmission control protocol) connection requests with spoofed source addresses to a victim's machine. each request causes the targeted host to instantiate data structures out of a limited pool of resources. once the target host's resources are exhausted, no more incoming tcp connections can be established, thus denying further legitimate access.the paper contributes a detailed analysis of the syn flooding attack and a discussion of existing and proposed countermeasures. furthermore, we introduce a new solution approach, explain its design, and evaluate its performance. our approach offers protection against syn flooding for all hosts connected to the same local area network, independent of their operating system or networking stack implementation. it is highly portable, configurable, extensible, and requires neither special hardware, nor modifications in routers or protected end systems.
data mining methods for detection of new malicious executables. abstract: a serious security threat today is malicious executables, especially new, unseen malicious executables often arriving as email attachments. these new malicious executables are created at the rate of thousands every year and pose a serious security threat. current anti-virus systems attempt to detect these new malicious programs with heuristics generated by hand. this approach is costly and oftentimes ineffective. in this paper, we present a data-mining framework that detects new, previously unseen malicious executables accurately and automatically. the data-mining framework automatically found patterns in our data set and used these patterns to detect a set of new malicious binaries. comparing our detection methods with a traditional signature-based method, our method more than doubles the current detection rates for new malicious executables.
a fast automaton-based method for detecting anomalous program behaviors. abstract: forrest et al. introduced a new intrusion detection approach that identifies anomalous sequences of system calls executed by programs. since their work, anomaly detection on system call sequences has become perhaps the most successful approach for detecting novel intrusions. a natural way for learning sequences is to use a finite-state automaton (fsa). however, previous research seemed to indicate that fsa-learning is computationally expensive, that it cannot be completely automated, or that the space usage of the fsa may be excessive. we present a new approach in this paper that overcomes these difficulties. our approach builds a compact fsa in a fully automatic and efficient manner, without requiring access to source code for programs. the space requirements for the fsa is low--of the order of a few kilobytes for typical programs. the fsa uses only a constant time per system call during the learning as well as detection period. this factor leads to low overheads for intrusion detection. unlike many of the previous techniques, our fsa-technique can capture both short term and long term temporal relationships among system calls, and thus perform more accurate detection. for instance, the fsa can capture common program structures such as branches, joins, loops etc. this enables our approach to generalize and predict future behaviors from past behaviors. for instance, if a program executed a loop once in an execution, the fsa approach can generalize and predict that the same loop may be executed zero or more times in subsequent executions. as a result, the training periods needed for our fsa based approach are shorter. moreover, false positives are reduced without increasing the likelihood of missing attacks. this paper describes our fsa based technique and presents a comprehensive experimental evaluation of the technique.
extending ina jo with temporal logic. the authors give both informal and formal descriptions of both the current ina jo specification language and ina jo enhanced with temporal logic. they include details of a simple example to demonstrate the use of the proof system and details of an extended example to demonstrate the expressiveness of the enhanced language. the authors discuss their language design goals, decisions, and their implications.
run-time security evaluation (rtse) for distributed applications. formal security specifications for a distributed application can be checked for compliance at run-time using executable security assertions. we propose the run-time security evaluation (rtse) method which makes use of histories/traces of events, assertions and operational evaluation in the distributed environment to ensure the security specifications for the application are fulfilled at run-time. a model problem is used to aid in developing the security requirements formally.
safety in automated trust negotiation. exchange of attribute credentials is a means to establish mutual trust between strangers wishing to share resources or conduct business transactions. automated trust negotiation (atn) is an approach to regulate the exchange of sensitive information during this process. it treats credentials as potentially sensitive resources, access to which is under policy control. negotiations that correctly enforce policies have been called &ldquo;safe&rdquo; in the literature. prior work on atn lacks an adequate definition of this safety notion. in large part, this is because fundamental questions such as &ldquo;what needs to be protected in atn?&rdquo; and &ldquo;what are the security requirements?&rdquo; are not adequately answered. as a result, many prior methods of atn have serious security holes. we introduce a formal framework for atn in which we give precise, usable, and intuitive definitions of correct enforcement of policies in atn. we argue that our chief safety notion captures intuitive security goals. we give precise comparisons of this notion with two alternative safety notions that may seem intuitive, but that are seen to be inadequate under closer inspection. we prove that an approach to atn from the literature meets the requirements set forth in the preferred safety definition, thus validating the safety of that approach, as well as the usability of the definition.
kronos: a scalable group re-keying approach for secure multicast. in this paper, we describe a novel approach to scalable group re-keying for secure multicast. our approach, which we call kronos, is based upon the idea of periodic group re-keying. we first motivate our approach by showing that if a group is re-keyed on each membership change, as the size of the group increases and/or the rate at which members leave and join the group increases, the frequency of re-keying becomes the primary bottleneck for scalable group re-keying. in contrast, kronos can scale to handle large and dynamic groups because the frequency of re-keying is independent of the size and membership dynamics of the group. next, we describe how kronos can be used in conjunction with distributed key management frameworks such as igkmp, that use a single group-wide session key for encrypting communications between members of the group. using a detailed simulation, we compare the performance tradeoffs between kronos and other key management protocols.
active mapping: resisting nids evasion without altering traffic. a critical problem faced by a network intrusion detectionsystem (nids) is that of ambiguity.thenidscannot always determine what traffic reaches a givenhost nor how that host will interpret the traffic, and attackersmay exploit this ambiguity to avoid detection orcause misleading alarms. we present a lightweight solution,active mapping, which eliminates tcp/ip-basedambiguity in a nids' analysis with minimal runtimecost. active mapping efficiently builds profiles of thenetwork topology and the tcp/ip policies of hosts onthe network; a nids may then use the host profiles todisambiguate the interpretation of the network traffic ona per-host basis. active mapping avoids the semanticand performance problems of traffic normalization,inwhich traffic streams are modified to remove ambiguities.we have developed a prototype implementation ofactive mapping and modified a nids to use the activemapping-generated profile database in our tests. wefound wide variation across operating systems' tcp/ipstack policies in real-world tests (about 6,700 hosts), underscoringthe need for this sort of disambiguation.
vulnerabilities in synchronous ipc designs. recent advances in interprocess communication (ipc)performance have been exclusively based on thread-migratingipc designs. thread-migrating designs assumethat ipc interactions are synchronous, and that user-levelexecution will usually resume with the invoked process(modulo preemption). this ipc design approach offersshorter instruction path lengths, requires fewer locks, hassmaller instruction and data cache footprints, dramaticallyreduces tlb overheads, and consequently offershigher performance and lower timing variance than previousipc designs. with care, it can be performed as anatomic unit of operation.while the performance of thread-migrating ipc hasbeen examined in detail, the vulnerabilities implicit insynchronous ipc designs have not been examined indepth in the archival literature, and their implications foripc design have been actively misunderstood in at leastone recent publication. in addition to performance, asound ipc design must address concerns of asymmetrictrust and reproducibility and provide support for dynamicpayload lengths. previous ipc designs, including thoseof eros, mach, l4, flask, and pebble, satisfy only two ofthese three requirements.in this paper, we show how these three design objectivescan be met simultaneously. we identify the conflictof requirements and illustrate how their collision arisesin two well-documented ipc architectures: l4 and eros.we then show how all three design objectives are simultaneouslymet in the next generation eros ipc system.
security enhancement through product evaluation. this paper describes a major goal ofthe dod computer security center, which isto encouraqe the easy availability ofcomputer products with enhanced securityfeatures. the mechanisms by which this isto be accomplished are described. thereare detailed explanations of thepreliminary and final product evaluationprocesses. the paper then takes apragmatic view, from three perspectives,of how the process is actually working.finally, an update is included, whichdescribes the present status of theevaluation efforts underway. the acm portal is published by the association for computing machinery. copyright © 2010 acm, inc. terms of usage privacy policy code of ethics contact us useful downloads: adobe acrobat quicktime windows media player real player
verifying the eros confinement mechanism. capability systems can be used to implement higher-level security policies including the property if a mechanism exists to ensure confinement. the implementation can be efficient if the ¿weak¿ access restriction described in this paper is introduced. in the course of developing eros, a pure capability system, it became clear that verifying the correctness of the confinement mechanism was necessary in establishing the security of the operating system. this paper presents a verification of the eros confinement mechanism with respect to a broad class of capability architectures (including eros). we give a formal statement of the requirements, construct a model of the architecture's security policy and operational semantics, and show that architectures covered by this model enforce the confinement requirements if a small number of initial static checks on the confined subsystem are satisfied. the method used generalizes to any capability system.
p5: a protocol for scalable anonymous communication. we present a protocol for anonymous communication over the internet. our protocol, called p5 (peer-to-peer personal privacy protocol) provides sender-, receiver-, and sender-receiver anonymity. p5 is designed to be implemented over the current internet protocols, and does not require any special infrastructure support. a novel feature of p5 is that it allows individual participants to trade-off degree of anonymity for communication efficiency, and hence can be used to scalably implement large anonymous groups. we present a description of p5 an analysis of its anonymity and communication efficiency, and evaluate its performance using detailed packet-level simulations.
automated generation and analysis of attack graphs. an integral part of modeling the global view of network security isconstructing attack graphs.in practice, attack graphs areproduced manually by red teams.construction by hand, however, istedious, error-prone, and impractical for attack graphs larger than ahundred nodes.in this paper we present an automated technique forgenerating and analyzing attack graphs.we base our technique onsymbolic model checking algorithms,letting us construct attack graphs automatically and efficiently.wealso describe two analyses to help decide which attacks would be mostcost-effective to guard against.we implemented our technique in atool suite and tested it on a small network example, which includesmodels of a firewall and an intrusion detection system.
defending anonymous communications against passive logging attack. we study the threat that passive logging attacks poseto anonymous communications. previous work analyzedthese attacks under limiting assumptions. we first describea possible defense that comes from breaking the assumptionof uniformly random path selection. our analysisshows that the defense improves anonymity in the staticmodel, where nodes stay in the system, but fails in a dynamicmodel, in which nodes leave and join. additionally,we use the dynamic model to show that the intersectionattack creates a vulnerability in certain peer-to-peer systemsfor anonymous communciations. we present simulationresults that show that attack times are significantlylower in practice than the upper bounds given by previouswork. to determine whether users' web traffic has communicationpatterns required by the attacks, we collectedand analyzed the web requests of users. we found that,for our study, frequent and repeated communication to thesame web site is common.