首页 > 最新文献

2014 10th International Conference on Information Assurance and Security最新文献

英文 中文
TWalker: An efficient taint analysis tool 一个有效的污染分析工具
Pub Date : 2014-11-01 DOI: 10.1109/ISIAS.2014.7064628
Jinxin Ma, Puhan Zhang, Guowei Dong, Shuai Shao, Jiangxiao Zhang
The taint analysis method is usually effective for vulnerabilities detection. Existing works mostly care about the accuracy of taint propagation, not considering the time cost. We proposed a novel method to improve the efficiency of taint propagation with indices. Based our method, we have implemented TWalker, an effective vulnerabilities detection tool that enables easy data flow analysis of the real world programs, providing faster taint analysis than other existing works. TWalker has four properties: first, it works directly on the programs without source code; second, it monitors the program's execution and records its necessary context; third, it delivers fine-grained taint analysis, providing fast taint propagation with indices; fourth, it could detect vulnerabilities effectively based on two security property rules. We have evaluated TWalker with several real world programs and compared it with a typical taint analysis tool. The experimental results show that our tool could perform taint propagation much faster than other tool, having better ability for vulnerabilities detection.
污点分析方法通常是有效的漏洞检测方法。现有的工作大多关心的是污染传播的准确性,而没有考虑时间成本。提出了一种新的方法来提高带指数的污染传播效率。基于我们的方法,我们实现了TWalker,这是一个有效的漏洞检测工具,可以轻松地对现实世界的程序进行数据流分析,提供比其他现有作品更快的污染分析。TWalker有四个特性:第一,它直接作用于程序而不需要源代码;其次,它监视程序的执行并记录其必要的上下文;第三,它提供细粒度的污染分析,提供快速的污染传播索引;第四,基于两个安全属性规则可以有效地检测漏洞。我们用几个真实世界的程序对TWalker进行了评估,并将其与典型的污染分析工具进行了比较。实验结果表明,该工具可以比其他工具更快地进行污染传播,具有更好的漏洞检测能力。
{"title":"TWalker: An efficient taint analysis tool","authors":"Jinxin Ma, Puhan Zhang, Guowei Dong, Shuai Shao, Jiangxiao Zhang","doi":"10.1109/ISIAS.2014.7064628","DOIUrl":"https://doi.org/10.1109/ISIAS.2014.7064628","url":null,"abstract":"The taint analysis method is usually effective for vulnerabilities detection. Existing works mostly care about the accuracy of taint propagation, not considering the time cost. We proposed a novel method to improve the efficiency of taint propagation with indices. Based our method, we have implemented TWalker, an effective vulnerabilities detection tool that enables easy data flow analysis of the real world programs, providing faster taint analysis than other existing works. TWalker has four properties: first, it works directly on the programs without source code; second, it monitors the program's execution and records its necessary context; third, it delivers fine-grained taint analysis, providing fast taint propagation with indices; fourth, it could detect vulnerabilities effectively based on two security property rules. We have evaluated TWalker with several real world programs and compared it with a typical taint analysis tool. The experimental results show that our tool could perform taint propagation much faster than other tool, having better ability for vulnerabilities detection.","PeriodicalId":146781,"journal":{"name":"2014 10th International Conference on Information Assurance and Security","volume":"19 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115384632","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 9
Towards secure end-to-end data aggregation in AMI through delayed-integrity-verification 通过延迟完整性验证实现AMI中安全的端到端数据聚合
Pub Date : 2014-11-01 DOI: 10.1109/ISIAS.2014.7064626
S. Keoh, Zhaohui Tang
The integrity and authenticity of the energy usage data in Advanced Metering Infrastructure (AMI) is crucial to ensure the correct energy load to facilitate generation, distribution and customer billing. Any malicious tampering to the data must be detected immediately. This paper introduces secure end-to-end data aggregation for AMI, a security protocol that allows the concentrators to securely aggregate the data collected from the smart meters, while enabling the utility back-end that receives the aggregated data to verify the integrity and data originality. Compromise of concentrators can be detected. The aggregated data is protected using Chameleon Signatures and then forwarded to the utility back-end for verification, accounting, and analysis. Using the Trapdoor Chameleon Hash Function, the smart meters can periodically send an evidence to the utility back-end, by computing an alternative message and a random value (m', r) such that m' consists of all previous energy usage measurements of the smart meter in a specified period of time. By verifying that the Chameleon Hash Value of (m', r) and that the energy usage matches those aggregated by the concentrators, the utility back-end is convinced of the integrity and authenticity of the data from the smart meters. Any data anomaly between smart meters and concentrators can be detected, thus indicating potential compromise of concentrators.
先进计量基础设施(AMI)中能源使用数据的完整性和真实性对于确保正确的能源负荷以促进发电、配电和客户计费至关重要。任何对数据的恶意篡改都必须立即检测出来。本文介绍了AMI的安全端到端数据聚合,这是一种安全协议,允许集中器安全地聚合从智能电表收集的数据,同时使接收聚合数据的公用事业后端能够验证数据的完整性和原创性。可以检测到浓缩器的损坏。使用变色龙签名保护聚合数据,然后将其转发到实用程序后端进行验证、记账和分析。使用Trapdoor变色龙哈希函数,智能电表可以通过计算替代消息和随机值(m', r)周期性地向公用事业后端发送证据,使得m'包含智能电表在指定时间段内所有以前的能源使用测量值。通过验证变色龙哈希值(m', r)和能源使用与集中器汇总的能源使用相匹配,公用事业后端确信来自智能电表的数据的完整性和真实性。智能电表和集中器之间的任何数据异常都可以被检测到,从而表明集中器的潜在危害。
{"title":"Towards secure end-to-end data aggregation in AMI through delayed-integrity-verification","authors":"S. Keoh, Zhaohui Tang","doi":"10.1109/ISIAS.2014.7064626","DOIUrl":"https://doi.org/10.1109/ISIAS.2014.7064626","url":null,"abstract":"The integrity and authenticity of the energy usage data in Advanced Metering Infrastructure (AMI) is crucial to ensure the correct energy load to facilitate generation, distribution and customer billing. Any malicious tampering to the data must be detected immediately. This paper introduces secure end-to-end data aggregation for AMI, a security protocol that allows the concentrators to securely aggregate the data collected from the smart meters, while enabling the utility back-end that receives the aggregated data to verify the integrity and data originality. Compromise of concentrators can be detected. The aggregated data is protected using Chameleon Signatures and then forwarded to the utility back-end for verification, accounting, and analysis. Using the Trapdoor Chameleon Hash Function, the smart meters can periodically send an evidence to the utility back-end, by computing an alternative message and a random value (m', r) such that m' consists of all previous energy usage measurements of the smart meter in a specified period of time. By verifying that the Chameleon Hash Value of (m', r) and that the energy usage matches those aggregated by the concentrators, the utility back-end is convinced of the integrity and authenticity of the data from the smart meters. Any data anomaly between smart meters and concentrators can be detected, thus indicating potential compromise of concentrators.","PeriodicalId":146781,"journal":{"name":"2014 10th International Conference on Information Assurance and Security","volume":"256 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114942167","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
Optimization of excerpt query process for Packet Attribution System 包归属系统摘录查询过程的优化
Pub Date : 2014-11-01 DOI: 10.1109/ISIAS.2014.7064618
Shesha Shila Bharadwaj Renukuntla, Shatrunjay Rawat
Internet and its applications have increased to an enormous extent in the past decade. As the usage increased, it has also exposed its users to various security threats. Network forensic techniques can be used to traceback the source and the path of an attack that can be used as a legal evidence in a court of law. Packet attribution techniques like Source Path Isolation (SPIE), Block Bloom Filter (BBF), Hierarchical Bloom Filter (HBF) are proposed to store the packet data into the bloom filters at each router present in the network. All the routers in the Autonomous System (AS) are queried for presence of excerpt in their bloom filters to traceback source and path of attack. Upon receiving the excerpt query, each router search their bloom filters for presence of excerpt and send the result to NMS. NMS receives the response from routers and determines the traceback path from victim to source of attack. In this process, all the routers are engaged in searching the bloom filters, causing possible delay in performing actual routing tasks. This degrades network performance and may adversely affect QoS of network. To address potential performance issues, in this paper, we propose query optimization techniques, reducing the number of routers to be searched to a great extent, without adversely affecting storage and processing requirements as compared to existing attribution methods.
在过去的十年里,互联网及其应用得到了极大的发展。随着使用量的增加,它也给用户带来了各种安全威胁。网络取证技术可用于追溯攻击的来源和路径,可作为法庭上的法律证据。提出了源路径隔离(SPIE)、块布隆过滤器(BBF)、分层布隆过滤器(HBF)等包属性技术,将包数据存储到网络中每个路由器的布隆过滤器中。通过查询自治系统中所有路由器的布隆过滤器是否存在摘录,追溯攻击源和攻击路径。接收到摘录查询后,每个路由器在各自的bloom过滤器中搜索是否存在摘录,并将结果发送给NMS。NMS接收来自路由器的响应,并确定从受害者到攻击源的回溯路径。在这个过程中,所有的路由器都在搜索布隆过滤器,这可能会导致实际路由任务的执行延迟。这会降低网络性能,并可能影响网络的QoS。为了解决潜在的性能问题,在本文中,我们提出了查询优化技术,在很大程度上减少了要搜索的路由器数量,与现有的归属方法相比,不会对存储和处理需求产生不利影响。
{"title":"Optimization of excerpt query process for Packet Attribution System","authors":"Shesha Shila Bharadwaj Renukuntla, Shatrunjay Rawat","doi":"10.1109/ISIAS.2014.7064618","DOIUrl":"https://doi.org/10.1109/ISIAS.2014.7064618","url":null,"abstract":"Internet and its applications have increased to an enormous extent in the past decade. As the usage increased, it has also exposed its users to various security threats. Network forensic techniques can be used to traceback the source and the path of an attack that can be used as a legal evidence in a court of law. Packet attribution techniques like Source Path Isolation (SPIE), Block Bloom Filter (BBF), Hierarchical Bloom Filter (HBF) are proposed to store the packet data into the bloom filters at each router present in the network. All the routers in the Autonomous System (AS) are queried for presence of excerpt in their bloom filters to traceback source and path of attack. Upon receiving the excerpt query, each router search their bloom filters for presence of excerpt and send the result to NMS. NMS receives the response from routers and determines the traceback path from victim to source of attack. In this process, all the routers are engaged in searching the bloom filters, causing possible delay in performing actual routing tasks. This degrades network performance and may adversely affect QoS of network. To address potential performance issues, in this paper, we propose query optimization techniques, reducing the number of routers to be searched to a great extent, without adversely affecting storage and processing requirements as compared to existing attribution methods.","PeriodicalId":146781,"journal":{"name":"2014 10th International Conference on Information Assurance and Security","volume":"68 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128638555","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Context-aware intrusion alerts verification approach 上下文感知的入侵警报验证方法
Pub Date : 2014-11-01 DOI: 10.1109/ISIAS.2014.7064620
Sherif Saad, I. Traoré, Marcelo Luiz Brocardo
Intrusion detection systems (IDSs) produce a massive number of intrusion alerts. A huge number of these alerts are false positives. Investigating false positive alerts is an expensive and time consuming process, and as such represents a significant problem for intrusion analysts. This shows the needs for automated approaches to eliminate false positive alerts. In this paper, we propose a novel alert verification and false positives reduction approach. The proposed approach uses context-aware and semantic similarity to filter IDS alerts and eliminate false positives. Evaluation of the approach with an IDS dataset that contains massive number of IDS alerts yields strong performance in detecting false positive alerts.
入侵检测系统(ids)产生大量的入侵警报。这些警报中有大量是误报。调查假阳性警报是一个昂贵且耗时的过程,因此对入侵分析人员来说是一个重大问题。这表明需要自动化方法来消除误报警报。在本文中,我们提出了一种新的警报验证和误报减少方法。所建议的方法使用上下文感知和语义相似性来过滤IDS警报并消除误报。使用包含大量IDS警报的IDS数据集对该方法进行评估,在检测误报警报方面产生了很强的性能。
{"title":"Context-aware intrusion alerts verification approach","authors":"Sherif Saad, I. Traoré, Marcelo Luiz Brocardo","doi":"10.1109/ISIAS.2014.7064620","DOIUrl":"https://doi.org/10.1109/ISIAS.2014.7064620","url":null,"abstract":"Intrusion detection systems (IDSs) produce a massive number of intrusion alerts. A huge number of these alerts are false positives. Investigating false positive alerts is an expensive and time consuming process, and as such represents a significant problem for intrusion analysts. This shows the needs for automated approaches to eliminate false positive alerts. In this paper, we propose a novel alert verification and false positives reduction approach. The proposed approach uses context-aware and semantic similarity to filter IDS alerts and eliminate false positives. Evaluation of the approach with an IDS dataset that contains massive number of IDS alerts yields strong performance in detecting false positive alerts.","PeriodicalId":146781,"journal":{"name":"2014 10th International Conference on Information Assurance and Security","volume":"43 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128018722","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Cluster Head election in Wireless Sensor Networks 无线传感器网络中的簇头选举
Pub Date : 2014-11-01 DOI: 10.1109/ISIAS.2014.7064625
Sara El-Refaay, Marianne A. Azer, Nashwa Abdelbaki
Wireless Sensor Networks (WSNs) consist of a collection of cheap, easy to deploy Sensor nodes arranged together to fulfill a specific purpose (monitoring, tracking ...etc.). A WSN network is composed of a Base Station (BS) and collection of sensors. There are a lot of approaches for the network construction. Amongst them is the hierarchical structure, where the network is divided into clusters and the node inside this cluster communicates with BS through a chosen leader called Cluster Head (CH). In this paper, we present cluster-Head election algorithms for WSNs. We will discuss the operations of these algorithms, and compare their performance.
无线传感器网络(wsn)由一组便宜、易于部署的传感器节点组成,这些传感器节点排列在一起,以实现特定的目的(监控、跟踪等)。WSN网络由基站(Base Station, BS)和传感器集合组成。网络建设的途径有很多。其中一种是分层结构,在这种结构中,网络被分成集群,集群中的节点通过一个被选中的称为簇头(CH)的领导者与BS通信。本文提出了一种用于无线传感器网络的簇头选择算法。我们将讨论这些算法的操作,并比较它们的性能。
{"title":"Cluster Head election in Wireless Sensor Networks","authors":"Sara El-Refaay, Marianne A. Azer, Nashwa Abdelbaki","doi":"10.1109/ISIAS.2014.7064625","DOIUrl":"https://doi.org/10.1109/ISIAS.2014.7064625","url":null,"abstract":"Wireless Sensor Networks (WSNs) consist of a collection of cheap, easy to deploy Sensor nodes arranged together to fulfill a specific purpose (monitoring, tracking ...etc.). A WSN network is composed of a Base Station (BS) and collection of sensors. There are a lot of approaches for the network construction. Amongst them is the hierarchical structure, where the network is divided into clusters and the node inside this cluster communicates with BS through a chosen leader called Cluster Head (CH). In this paper, we present cluster-Head election algorithms for WSNs. We will discuss the operations of these algorithms, and compare their performance.","PeriodicalId":146781,"journal":{"name":"2014 10th International Conference on Information Assurance and Security","volume":"11 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132248708","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 17
A novel psychovisual model on an independent video frame for an almost lossless compression 一种基于独立视频帧的几乎无损压缩的心理视觉模型
Pub Date : 2014-11-01 DOI: 10.1109/ISIAS.2014.7064621
N. A. Abu, M. Ariffin
A psychoacoustic model is well established in an audio coding. From the beginning of computer audio era since the previous century, an audio coding has already operated on a large one-dimensional fast Fourier transform(FFT) as a basic industrial coding. This paper investigates a quantitative experimental impact on almost lossless image compression based on the concept of psychovisual threshold. This paper proposes a practical image coding on large two-dimensional discrete cosine transform(DCT). A psychovisual model is presented following the psychoacoustic quite threshold as a just noticeable difference instead of a quantization table. An experimental result on large rectangular images shall be presented. This framework can easily produce higher quality images at a competitive compression rate in addition to an extended adaptive JPEG compression standard.
在音频编码中建立了心理声学模型。从上个世纪计算机音频时代开始,音频编码就以一维快速傅里叶变换(FFT)为基础,作为一种基本的工业编码。本文研究了一种基于心理视觉阈值的定量实验方法对图像几乎无损压缩的影响。提出了一种基于二维大离散余弦变换(DCT)的图像编码方法。在心理声学相当阈值之后,提出了一个心理视觉模型,作为一个仅仅明显的差异,而不是量化表。在大矩形图像上的实验结果。除了扩展的自适应JPEG压缩标准外,该框架还可以轻松地以具有竞争力的压缩率生成更高质量的图像。
{"title":"A novel psychovisual model on an independent video frame for an almost lossless compression","authors":"N. A. Abu, M. Ariffin","doi":"10.1109/ISIAS.2014.7064621","DOIUrl":"https://doi.org/10.1109/ISIAS.2014.7064621","url":null,"abstract":"A psychoacoustic model is well established in an audio coding. From the beginning of computer audio era since the previous century, an audio coding has already operated on a large one-dimensional fast Fourier transform(FFT) as a basic industrial coding. This paper investigates a quantitative experimental impact on almost lossless image compression based on the concept of psychovisual threshold. This paper proposes a practical image coding on large two-dimensional discrete cosine transform(DCT). A psychovisual model is presented following the psychoacoustic quite threshold as a just noticeable difference instead of a quantization table. An experimental result on large rectangular images shall be presented. This framework can easily produce higher quality images at a competitive compression rate in addition to an extended adaptive JPEG compression standard.","PeriodicalId":146781,"journal":{"name":"2014 10th International Conference on Information Assurance and Security","volume":"52 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116197968","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Improving Web Application Firewalls to detect advanced SQL injection attacks 改进Web应用防火墙以检测高级SQL注入攻击
Pub Date : 2014-11-01 DOI: 10.1109/ISIAS.2014.7064617
Abdelhamid Makiou, Y. Begriche, A. Serhrouchni
Injections flaws which include SQL injection are the most prevalent security threats affecting Web applications[1]. To mitigate these attacks, Web Application Firewalls (WAFs) apply security rules in order to both inspect HTTP data streams and detect malicious HTTP transactions. Nevertheless, attackers can bypass WAF's rules by using sophisticated SQL injection techniques. In this paper, we introduce a novel approach to dissect the HTTP traffic and inspect complex SQL injection attacks. Our model is a hybrid Injection Prevention System (HIPS) which uses both a machine learning classifier and a pattern matching inspection engine based on reduced sets of security rules. Our Web Application Firewall architecture aims to optimize detection performances by using a prediction module that excludes legitimate requests from the inspection process.
注入漏洞(包括SQL注入)是影响Web应用程序的最普遍的安全威胁[1]。为了减轻这些攻击,Web应用防火墙(waf)应用安全规则来检查HTTP数据流和检测恶意HTTP事务。然而,攻击者可以通过使用复杂的SQL注入技术绕过WAF的规则。在本文中,我们介绍了一种新的方法来剖析HTTP流量和检测复杂的SQL注入攻击。我们的模型是一个混合注入预防系统(HIPS),它使用机器学习分类器和基于简化安全规则集的模式匹配检查引擎。我们的Web应用防火墙架构旨在通过使用一个预测模块来优化检测性能,该模块将合法请求排除在检查过程之外。
{"title":"Improving Web Application Firewalls to detect advanced SQL injection attacks","authors":"Abdelhamid Makiou, Y. Begriche, A. Serhrouchni","doi":"10.1109/ISIAS.2014.7064617","DOIUrl":"https://doi.org/10.1109/ISIAS.2014.7064617","url":null,"abstract":"Injections flaws which include SQL injection are the most prevalent security threats affecting Web applications[1]. To mitigate these attacks, Web Application Firewalls (WAFs) apply security rules in order to both inspect HTTP data streams and detect malicious HTTP transactions. Nevertheless, attackers can bypass WAF's rules by using sophisticated SQL injection techniques. In this paper, we introduce a novel approach to dissect the HTTP traffic and inspect complex SQL injection attacks. Our model is a hybrid Injection Prevention System (HIPS) which uses both a machine learning classifier and a pattern matching inspection engine based on reduced sets of security rules. Our Web Application Firewall architecture aims to optimize detection performances by using a prediction module that excludes legitimate requests from the inspection process.","PeriodicalId":146781,"journal":{"name":"2014 10th International Conference on Information Assurance and Security","volume":"56 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114357736","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 39
Secure firmware architecture using virtual hard disks 使用虚拟硬盘的安全固件架构
Pub Date : 2014-11-01 DOI: 10.1109/ISIAS.2014.7064622
J. Sim, Jungchan Na
Recently, smart devices have rapidly become ubiquitous; however, vulnerability attacks that target the devices' firmware have increased apace. Despite efforts to defend against such attacks, embedded devices have not been applied because the devices have restricted resources. In this paper, we describe an architecture that can rapidly verify integrity and enables delta updates that only include the data modifications of the original data using virtual hard disks.
最近,智能设备迅速普及;然而,针对设备固件的漏洞攻击正在迅速增加。尽管人们努力防御这种攻击,但嵌入式设备还没有得到应用,因为这些设备的资源有限。在本文中,我们描述了一种架构,它可以快速验证完整性,并支持增量更新,仅包括使用虚拟硬盘对原始数据的数据修改。
{"title":"Secure firmware architecture using virtual hard disks","authors":"J. Sim, Jungchan Na","doi":"10.1109/ISIAS.2014.7064622","DOIUrl":"https://doi.org/10.1109/ISIAS.2014.7064622","url":null,"abstract":"Recently, smart devices have rapidly become ubiquitous; however, vulnerability attacks that target the devices' firmware have increased apace. Despite efforts to defend against such attacks, embedded devices have not been applied because the devices have restricted resources. In this paper, we describe an architecture that can rapidly verify integrity and enables delta updates that only include the data modifications of the original data using virtual hard disks.","PeriodicalId":146781,"journal":{"name":"2014 10th International Conference on Information Assurance and Security","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130436658","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Automatic generation of correlation rules to detect complex attack scenarios 自动生成关联规则,检测复杂攻击场景
Pub Date : 2014-11-01 DOI: 10.1109/ISIAS.2014.7064615
E. Godefroy, Eric Totel, M. Hurfin, Frédéric Majorczyk
In large distributed information systems, alert correlation systems are necessary to handle the huge amount of elementary security alerts and to identify complex multi-step attacks within the flow of low level events and alerts. In this paper, we show that, once a human expert has provided an action tree derived from an attack tree, a fully automated transformation process can generate exhaustive correlation rules that would be tedious and error prone to enumerate by hand. The transformation relies on a detailed description of various aspects of the real execution environment (topology of the system, deployed services, etc.). Consequently, the generated correlation rules are tightly linked to the characteristics of the monitored information system. The proposed transformation process has been implemented in a prototype that generates correlation rules expressed in an attack description language.
在大型分布式信息系统中,警报关联系统需要处理大量的初级安全警报,并在低级事件和警报流中识别复杂的多步骤攻击。在本文中,我们表明,一旦人类专家提供了从攻击树派生的动作树,完全自动化的转换过程可以生成详尽的相关规则,而手工枚举这些规则将是繁琐且容易出错的。转换依赖于实际执行环境的各个方面的详细描述(系统的拓扑结构、部署的服务等)。因此,生成的相关规则与被监测信息系统的特征紧密相连。所提出的转换过程已在一个原型中实现,该原型生成用攻击描述语言表示的相关规则。
{"title":"Automatic generation of correlation rules to detect complex attack scenarios","authors":"E. Godefroy, Eric Totel, M. Hurfin, Frédéric Majorczyk","doi":"10.1109/ISIAS.2014.7064615","DOIUrl":"https://doi.org/10.1109/ISIAS.2014.7064615","url":null,"abstract":"In large distributed information systems, alert correlation systems are necessary to handle the huge amount of elementary security alerts and to identify complex multi-step attacks within the flow of low level events and alerts. In this paper, we show that, once a human expert has provided an action tree derived from an attack tree, a fully automated transformation process can generate exhaustive correlation rules that would be tedious and error prone to enumerate by hand. The transformation relies on a detailed description of various aspects of the real execution environment (topology of the system, deployed services, etc.). Consequently, the generated correlation rules are tightly linked to the characteristics of the monitored information system. The proposed transformation process has been implemented in a prototype that generates correlation rules expressed in an attack description language.","PeriodicalId":146781,"journal":{"name":"2014 10th International Conference on Information Assurance and Security","volume":"53 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124658590","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 11
Extraction method of Region of Interest from hand palm: Application with contactless and touchable devices 手掌感兴趣区域的提取方法:在非接触和可触摸设备上的应用
Pub Date : 2014-11-01 DOI: 10.1109/ISIAS.2014.7064624
Saliha Artabaz, K. Benatchba, M. Koudil, D. Nabil, A. Bouridane
Palmprint is one of the modalities that offer high recognition accuracy. The recognition process depends on an optimized ROI (Region of Interest) extraction. This extraction is affected by several factors including the device used and the acquisition conditions. The acquisition mode can alter some image properties like rotation, translation and scale. Some devices are designed to maintain hand in a fixed position and delimit a subspace of the hand. On the other hand, contactless devices offer more convenience and flexibility but lead to altered images. ROI extraction methods must consider the acquisition device (with contact or contactless). In this paper, we propose a ROI extraction method that addresses this issue. We test our method on two databases PolyU and CASIA which illustrate the impact of using contactless device unlike the PolyU device. Then, we test performances of the palmprint biometric system. We use a Fisher Linear Discriminant projection (FLD) to extract features from ROI transformed into the frequency domain. Our proposed method can significantly cover a great portion of the palm in the two databases. Performances obtained with the proposed palmprint system are promising.
掌纹是一种具有较高识别精度的识别方式。识别过程依赖于一个优化的感兴趣区域(ROI)提取。这种提取受到几个因素的影响,包括使用的设备和采集条件。采集模式可以改变一些图像属性,如旋转、平移和比例。一些装置被设计成保持手在一个固定的位置,并划定手的子空间。另一方面,非接触式设备提供了更多的便利和灵活性,但会导致图像的改变。ROI提取方法必须考虑采集设备(有接触或无接触)。在本文中,我们提出了一种ROI提取方法来解决这个问题。我们在两个数据库PolyU和CASIA上测试了我们的方法,这说明了使用非接触式设备与使用理大设备不同的影响。然后,我们测试了掌纹生物识别系统的性能。我们使用Fisher线性判别投影(FLD)从转换到频域的ROI中提取特征。我们提出的方法可以显著地覆盖两个数据库中的大部分手掌。所提出的掌纹系统取得了良好的性能。
{"title":"Extraction method of Region of Interest from hand palm: Application with contactless and touchable devices","authors":"Saliha Artabaz, K. Benatchba, M. Koudil, D. Nabil, A. Bouridane","doi":"10.1109/ISIAS.2014.7064624","DOIUrl":"https://doi.org/10.1109/ISIAS.2014.7064624","url":null,"abstract":"Palmprint is one of the modalities that offer high recognition accuracy. The recognition process depends on an optimized ROI (Region of Interest) extraction. This extraction is affected by several factors including the device used and the acquisition conditions. The acquisition mode can alter some image properties like rotation, translation and scale. Some devices are designed to maintain hand in a fixed position and delimit a subspace of the hand. On the other hand, contactless devices offer more convenience and flexibility but lead to altered images. ROI extraction methods must consider the acquisition device (with contact or contactless). In this paper, we propose a ROI extraction method that addresses this issue. We test our method on two databases PolyU and CASIA which illustrate the impact of using contactless device unlike the PolyU device. Then, we test performances of the palmprint biometric system. We use a Fisher Linear Discriminant projection (FLD) to extract features from ROI transformed into the frequency domain. Our proposed method can significantly cover a great portion of the palm in the two databases. Performances obtained with the proposed palmprint system are promising.","PeriodicalId":146781,"journal":{"name":"2014 10th International Conference on Information Assurance and Security","volume":"59 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125104069","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
期刊
2014 10th International Conference on Information Assurance and Security
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1