首页 > 最新文献

2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)最新文献

英文 中文
The Jean-Claude Laprie Award Jean-Claude Laprie奖
{"title":"The Jean-Claude Laprie Award","authors":"","doi":"10.1109/dsn.2019.00012","DOIUrl":"https://doi.org/10.1109/dsn.2019.00012","url":null,"abstract":"","PeriodicalId":271955,"journal":{"name":"2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126307088","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Robust Anomaly Detection on Unreliable Data 基于不可靠数据的鲁棒异常检测
Zilong Zhao, Sophie Cerf, R. Birke, B. Robu, S. Bouchenak, Sonia Ben Mokhtar, L. Chen
Classification algorithms have been widely adopted to detect anomalies for various systems, e.g., IoT and cloud, under the common assumption that the data source is clean, i.e., features and labels are correctly set. However, data collected from the field can be unreliable due to careless annotations or malicious data transformation for incorrect anomaly detection. In this paper, we present a two-layer learning framework for robust anomaly detection (RAD) in the presence of unreliable anomaly labels. The first layer of quality model filters the suspicious data, where the second layer of classification model detects the anomaly types. We specifically focus on two use cases, (i) detecting 10 classes of IoT attacks and (ii) predicting 4 classes of task failures of big data jobs. Our evaluation results show that RAD can robustly improve the accuracy of anomaly detection, to reach up to 98% for IoT device attacks (i.e., +11%) and up to 83% for cloud task failures (i.e., +20%), under a significant percentage of altered anomaly labels. Index Terms—Unreliable Data; Anomaly Detection; Failures; Attacks; Machine Learning
分类算法被广泛用于检测各种系统的异常,例如物联网和云,通常假设数据源是干净的,即特征和标签是正确设置的。然而,由于粗心的注释或恶意的数据转换导致错误的异常检测,从现场收集的数据可能不可靠。在本文中,我们提出了一个两层学习框架,用于存在不可靠异常标签的鲁棒异常检测(RAD)。第一层质量模型对可疑数据进行过滤,第二层分类模型对异常类型进行检测。我们特别关注两个用例,(i)检测10类物联网攻击,(ii)预测4类大数据作业的任务失败。我们的评估结果表明,在异常标签发生显著改变的情况下,RAD可以显著提高异常检测的准确性,对物联网设备攻击的准确率高达98%(即+11%),对云任务失败的准确率高达83%(即+20%)。索引术语-不可靠数据;异常检测;失败;的攻击;机器学习
{"title":"Robust Anomaly Detection on Unreliable Data","authors":"Zilong Zhao, Sophie Cerf, R. Birke, B. Robu, S. Bouchenak, Sonia Ben Mokhtar, L. Chen","doi":"10.1109/DSN.2019.00068","DOIUrl":"https://doi.org/10.1109/DSN.2019.00068","url":null,"abstract":"Classification algorithms have been widely adopted to detect anomalies for various systems, e.g., IoT and cloud, under the common assumption that the data source is clean, i.e., features and labels are correctly set. However, data collected from the field can be unreliable due to careless annotations or malicious data transformation for incorrect anomaly detection. In this paper, we present a two-layer learning framework for robust anomaly detection (RAD) in the presence of unreliable anomaly labels. The first layer of quality model filters the suspicious data, where the second layer of classification model detects the anomaly types. We specifically focus on two use cases, (i) detecting 10 classes of IoT attacks and (ii) predicting 4 classes of task failures of big data jobs. Our evaluation results show that RAD can robustly improve the accuracy of anomaly detection, to reach up to 98% for IoT device attacks (i.e., +11%) and up to 83% for cloud task failures (i.e., +20%), under a significant percentage of altered anomaly labels. Index Terms—Unreliable Data; Anomaly Detection; Failures; Attacks; Machine Learning","PeriodicalId":271955,"journal":{"name":"2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)","volume":"28 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117021810","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 29
Fast Predictive Repair in Erasure-Coded Storage 擦除编码存储中的快速预测修复
Zhirong Shen, Xiaolu Li, P. Lee
Erasure coding offers a storage-efficient redundancy mechanism for maintaining data availability guarantees in large-scale storage clusters, yet it also incurs high performance overhead in failure repair. Recent developments in accurate disk failure prediction allow soon-to-fail (STF) nodes to be repaired in advance, thereby opening new opportunities for accelerating failure repair in erasure-coded storage. To this end, we present a fast predictive repair solution called FastPR, which carefully couples two repair methods, namely migration (i.e., relocating the chunks of an STF node) and reconstruction (i.e., decoding the chunks of an STF node through erasure coding), so as to fully parallelize the repair operation across the storage cluster. FastPR solves a bipartite maximum matching problem and schedules both migration and reconstruction in a parallel fashion. We show that FastPR significantly reduces the repair time over the baseline repair approaches via mathematical analysis, large-scale simulation, and Amazon EC2 experiments.
Erasure编码提供了一种存储效率高的冗余机制,用于在大规模存储集群中维护数据可用性保证,但它在故障修复时也会产生很高的性能开销。在精确的磁盘故障预测方面的最新发展允许提前修复即将故障(STF)节点,从而为加速擦除编码存储中的故障修复提供了新的机会。为此,我们提出了一种快速预测修复方案FastPR,它将迁移(即重新定位STF节点的块)和重构(即通过擦除编码解码STF节点的块)两种修复方法巧妙地结合在一起,从而使整个存储集群的修复操作完全并行化。FastPR解决了二部最大匹配问题,并以并行方式调度迁移和重建。我们通过数学分析、大规模模拟和Amazon EC2实验证明,FastPR比基线修复方法显著缩短了修复时间。
{"title":"Fast Predictive Repair in Erasure-Coded Storage","authors":"Zhirong Shen, Xiaolu Li, P. Lee","doi":"10.1109/DSN.2019.00062","DOIUrl":"https://doi.org/10.1109/DSN.2019.00062","url":null,"abstract":"Erasure coding offers a storage-efficient redundancy mechanism for maintaining data availability guarantees in large-scale storage clusters, yet it also incurs high performance overhead in failure repair. Recent developments in accurate disk failure prediction allow soon-to-fail (STF) nodes to be repaired in advance, thereby opening new opportunities for accelerating failure repair in erasure-coded storage. To this end, we present a fast predictive repair solution called FastPR, which carefully couples two repair methods, namely migration (i.e., relocating the chunks of an STF node) and reconstruction (i.e., decoding the chunks of an STF node through erasure coding), so as to fully parallelize the repair operation across the storage cluster. FastPR solves a bipartite maximum matching problem and schedules both migration and reconstruction in a parallel fashion. We show that FastPR significantly reduces the repair time over the baseline repair approaches via mathematical analysis, large-scale simulation, and Amazon EC2 experiments.","PeriodicalId":271955,"journal":{"name":"2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116548350","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 17
An Eventually Perfect Failure Detector for Networks of Arbitrary Topology Connected with ADD Channels Using Time-To-Live Values 基于活时值的任意拓扑网络故障检测器
Karla Vargas, S. Rajsbaum
We present an implementation of an eventually perfect failure detector in an arbitrarily connected, partitionable network. We assume ADD channels: for each one there exist constants K, D, not known to the processes, such that for every K consecutive messages sent in one direction, at least one is delivered within time D. The best previous implementation used messages of bounded size, but exponential in n, the number of nodes. The main contribution of this paper is a novel use of time-to-live values in the design of failure detectors, obtaining a flexible implementation that uses messages of size O(n log n)
我们提出了一个最终完美的故障检测器在任意连接,可分区的网络的实现。我们假设ADD通道:对于每个通道,存在进程不知道的常数K, D,这样对于在一个方向上发送的每K个连续消息,至少有一个在时间D内传递。以前最好的实现使用有界大小的消息,但节点数n呈指数增长。本文的主要贡献是在故障检测器的设计中新颖地使用了生存时间值,获得了使用大小为O(n log n)的消息的灵活实现。
{"title":"An Eventually Perfect Failure Detector for Networks of Arbitrary Topology Connected with ADD Channels Using Time-To-Live Values","authors":"Karla Vargas, S. Rajsbaum","doi":"10.1109/DSN.2019.00038","DOIUrl":"https://doi.org/10.1109/DSN.2019.00038","url":null,"abstract":"We present an implementation of an eventually perfect failure detector in an arbitrarily connected, partitionable network. We assume ADD channels: for each one there exist constants K, D, not known to the processes, such that for every K consecutive messages sent in one direction, at least one is delivered within time D. The best previous implementation used messages of bounded size, but exponential in n, the number of nodes. The main contribution of this paper is a novel use of time-to-live values in the design of failure detectors, obtaining a flexible implementation that uses messages of size O(n log n)","PeriodicalId":271955,"journal":{"name":"2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)","volume":"26 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125479324","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
William C. Carter Award 威廉·c·卡特奖
{"title":"William C. Carter Award","authors":"","doi":"10.1109/dsn.2019.00011","DOIUrl":"https://doi.org/10.1109/dsn.2019.00011","url":null,"abstract":"","PeriodicalId":271955,"journal":{"name":"2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)","volume":"58 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133090603","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
1dVul: Discovering 1-Day Vulnerabilities through Binary Patches 1dVul:通过二进制补丁发现1天漏洞
Jiaqi Peng, Feng Li, Bingchang Liu, Lili Xu, Binghong Liu, Kai Chen, Wei Huo
Discovering 1-day vulnerabilities in binary patches is worthwhile but challenging. One of the key difficulties lies in generating inputs that could reach the patched code snippet while making the unpatched program crash. In this paper, we named it as a target-oriented input generation problem or a ToIG problem for clarity. Existing solutions for the ToIG problem either suffer from path explosion or may get stuck by complex checks. In the paper, we present a new solution to improve the efficiency of ToIG which leverage a combination of a distance-based directed fuzzing mechanism and a dominator-based directed symbolic execution mechanism. To demonstrate its efficiency, we design and implement 1dVul, a tool for 1-day vulnerability discovering at binary-level, based on the solution. Demonstrations show that 1dVul has successfully generated inputs for 130 targets from a total of 209 patch targets identified from applications in DARPA Cyber Grant Challenge, while the state-of-the-art solutions AFLGo and Driller can only reach 99 and 107 targets, respectively, within the same limited time budget. Further-more, 1dVul runs 2.2X and 3.6X faster than AFLGo and Driller, respectively, and has confirmed 96 vulnerabilities from the unpatched programs.
在二进制补丁中发现1天漏洞是值得的,但具有挑战性。关键的困难之一在于生成的输入可能到达补丁代码片段,同时使未修补的程序崩溃。在本文中,为了清晰起见,我们将其命名为面向目标的输入生成问题或ToIG问题。ToIG问题的现有解决方案要么遭受路径爆炸,要么可能被复杂的检查卡住。本文提出了一种利用基于距离的定向模糊机制和基于支配者的定向符号执行机制的组合来提高ToIG效率的新方案。为了证明其有效性,我们基于该解决方案设计并实现了1天二进制级漏洞发现工具1dVul。演示表明,1dVul已经成功地从DARPA网络挑战赛中确定的209个补丁目标中为130个目标生成了输入,而最先进的解决方案AFLGo和Driller在相同的有限时间预算内只能分别为99个和107个目标生成输入。此外,1dVul的运行速度分别比AFLGo和Driller快2.2倍和3.6倍,并从未修补的程序中确认了96个漏洞。
{"title":"1dVul: Discovering 1-Day Vulnerabilities through Binary Patches","authors":"Jiaqi Peng, Feng Li, Bingchang Liu, Lili Xu, Binghong Liu, Kai Chen, Wei Huo","doi":"10.1109/DSN.2019.00066","DOIUrl":"https://doi.org/10.1109/DSN.2019.00066","url":null,"abstract":"Discovering 1-day vulnerabilities in binary patches is worthwhile but challenging. One of the key difficulties lies in generating inputs that could reach the patched code snippet while making the unpatched program crash. In this paper, we named it as a target-oriented input generation problem or a ToIG problem for clarity. Existing solutions for the ToIG problem either suffer from path explosion or may get stuck by complex checks. In the paper, we present a new solution to improve the efficiency of ToIG which leverage a combination of a distance-based directed fuzzing mechanism and a dominator-based directed symbolic execution mechanism. To demonstrate its efficiency, we design and implement 1dVul, a tool for 1-day vulnerability discovering at binary-level, based on the solution. Demonstrations show that 1dVul has successfully generated inputs for 130 targets from a total of 209 patch targets identified from applications in DARPA Cyber Grant Challenge, while the state-of-the-art solutions AFLGo and Driller can only reach 99 and 107 targets, respectively, within the same limited time budget. Further-more, 1dVul runs 2.2X and 3.6X faster than AFLGo and Driller, respectively, and has confirmed 96 vulnerabilities from the unpatched programs.","PeriodicalId":271955,"journal":{"name":"2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130498237","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 18
BorderPatrol: Securing BYOD using Fine-Grained Contextual Information BorderPatrol:使用细粒度上下文信息保护BYOD
Onur Zungur, Guillermo Suarez-Tangil, G. Stringhini, Manuel Egele
Companies adopt Bring Your Own Device (BYOD) policies extensively, for both convenience and cost management. The compelling way of putting private and business related applications (apps) on the same device leads to the widespread usage of employee owned devices to access sensitive company data and services. Such practices create a security risk as a legitimate app may send business-sensitive data to third party servers through detrimental app functions or packaged libraries. In this paper, we propose BorderPatrol, a system for extracting contextual data that businesses can leverage to enforce access control in BYOD-enabled corporate networks through fine-grained policies. BorderPatrol extracts contextual information, which is the stack trace of the app function that generated the network traffic, on provisioned user devices and transfers this data in IP headers to enforce desired policies at network routers. BorderPatrol provides a way to selectively prevent undesired functionalities, such as analytics activities or advertisements, and help enforce information dissemination policies of the company while leaving other functions of the app intact. Using 2,000 apps, we demonstrate that BorderPatrol is effective in preventing packets which originate from previously identified analytics and advertisement libraries from leaving the network premises. In addition, we show BorderPatrol's capability in selectively preventing undesirable app functions using case studies.
公司广泛采用自带设备办公(BYOD)政策,既方便又节约成本。将私人和业务相关的应用程序(app)放在同一设备上的引人注目的方式导致员工拥有的设备被广泛使用,以访问敏感的公司数据和服务。这种做法会产生安全风险,因为合法应用程序可能会通过有害的应用程序功能或打包库将业务敏感数据发送到第三方服务器。在本文中,我们提出了BorderPatrol,这是一个提取上下文数据的系统,企业可以利用这些数据通过细粒度策略在支持byod的企业网络中实施访问控制。BorderPatrol提取上下文信息,这是在已配置的用户设备上生成网络流量的应用程序函数的堆栈跟踪,并在IP报头中传输这些数据,以在网络路由器上执行所需的策略。BorderPatrol提供了一种有选择地阻止不需要的功能的方法,例如分析活动或广告,并帮助执行公司的信息传播政策,同时保持应用程序的其他功能不变。使用2000个应用程序,我们证明了BorderPatrol可以有效地防止来自先前识别的分析和广告库的数据包离开网络场所。此外,我们还通过案例研究展示了BorderPatrol在选择性防止不良应用功能方面的能力。
{"title":"BorderPatrol: Securing BYOD using Fine-Grained Contextual Information","authors":"Onur Zungur, Guillermo Suarez-Tangil, G. Stringhini, Manuel Egele","doi":"10.1109/DSN.2019.00054","DOIUrl":"https://doi.org/10.1109/DSN.2019.00054","url":null,"abstract":"Companies adopt Bring Your Own Device (BYOD) policies extensively, for both convenience and cost management. The compelling way of putting private and business related applications (apps) on the same device leads to the widespread usage of employee owned devices to access sensitive company data and services. Such practices create a security risk as a legitimate app may send business-sensitive data to third party servers through detrimental app functions or packaged libraries. In this paper, we propose BorderPatrol, a system for extracting contextual data that businesses can leverage to enforce access control in BYOD-enabled corporate networks through fine-grained policies. BorderPatrol extracts contextual information, which is the stack trace of the app function that generated the network traffic, on provisioned user devices and transfers this data in IP headers to enforce desired policies at network routers. BorderPatrol provides a way to selectively prevent undesired functionalities, such as analytics activities or advertisements, and help enforce information dissemination policies of the company while leaving other functions of the app intact. Using 2,000 apps, we demonstrate that BorderPatrol is effective in preventing packets which originate from previously identified analytics and advertisement libraries from leaving the network premises. In addition, we show BorderPatrol's capability in selectively preventing undesirable app functions using case studies.","PeriodicalId":271955,"journal":{"name":"2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)","volume":"64 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123691507","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 6
Detecting "0-Day" Vulnerability: An Empirical Study of Secret Security Patch in OSS “0-Day”漏洞检测:OSS中秘密安全补丁的实证研究
Xinda Wang, Kun Sun, A. Batcheller, S. Jajodia
Security patches in open source software (OSS) not only provide security fixes to identified vulnerabilities, but also make the vulnerable code public to the attackers. Therefore, armored attackers may misuse this information to launch N-day attacks on unpatched OSS versions. The best practice for preventing this type of N-day attacks is to keep upgrading the software to the latest version in no time. However, due to the concerns on reputation and easy software development management, software vendors may choose to secretly patch their vulnerabilities in a new version without reporting them to CVE or even providing any explicit description in their change logs. When those secretly patched vulnerabilities are being identified by armored attackers, they can be turned into powerful "0-day" attacks, which can be exploited to compromise not only unpatched version of the same software, but also similar types of OSS (e.g., SSL libraries) that may contain the same vulnerability due to code clone or similar design/implementation logic. Therefore, it is critical to identify secret security patches and downgrade the risk of those "0-day" attacks to at least "n-day" attacks. In this paper, we develop a defense system and implement a toolset to automatically identify secret security patches in open source software. To distinguish security patches from other patches, we first build a security patch database that contains more than 4700 security patches mapping to the records in CVE list. Next, we identify a set of features to help distinguish security patches from non-security ones using machine learning approaches. Finally, we use code clone identification mechanisms to discover similar patches or vulnerabilities in similar types of OSS. The experimental results show our approach can achieve good detection performance. A case study on OpenSSL, LibreSSL, and BoringSSL discovers 12 secret security patches.
开源软件(OSS)中的安全补丁不仅为已识别的漏洞提供安全修复,而且还将易受攻击的代码公开给攻击者。因此,全副武装的攻击者可能会滥用这些信息,对未打补丁的OSS版本发动为期n天的攻击。防止这种类型的n天攻击的最佳实践是立即将软件升级到最新版本。然而,出于声誉和软件开发管理的考虑,软件供应商可能会选择在新版本中秘密地修补他们的漏洞,而不向CVE报告,甚至在他们的更改日志中提供任何明确的描述。当这些秘密修补的漏洞被装甲攻击者发现时,它们可以变成强大的“零日”攻击,不仅可以被利用来破坏未修补的相同软件版本,还可以破坏类似类型的OSS(例如SSL库),这些OSS可能由于代码克隆或类似的设计/实现逻辑而包含相同的漏洞。因此,识别秘密安全补丁并将这些“0天”攻击的风险降低到至少“n天”攻击是至关重要的。在本文中,我们开发了一个防御系统,并实现了一个工具集来自动识别开源软件中的秘密安全补丁。为了区分安全补丁和其他补丁,我们首先建立了一个安全补丁数据库,其中包含4700多个安全补丁映射到CVE列表中的记录。接下来,我们使用机器学习方法识别一组特征,以帮助区分安全补丁和非安全补丁。最后,我们使用代码克隆识别机制来发现类似类型OSS中的类似补丁或漏洞。实验结果表明,该方法具有良好的检测性能。以OpenSSL、LibreSSL和BoringSSL为例,发现了12个秘密安全补丁。
{"title":"Detecting \"0-Day\" Vulnerability: An Empirical Study of Secret Security Patch in OSS","authors":"Xinda Wang, Kun Sun, A. Batcheller, S. Jajodia","doi":"10.1109/DSN.2019.00056","DOIUrl":"https://doi.org/10.1109/DSN.2019.00056","url":null,"abstract":"Security patches in open source software (OSS) not only provide security fixes to identified vulnerabilities, but also make the vulnerable code public to the attackers. Therefore, armored attackers may misuse this information to launch N-day attacks on unpatched OSS versions. The best practice for preventing this type of N-day attacks is to keep upgrading the software to the latest version in no time. However, due to the concerns on reputation and easy software development management, software vendors may choose to secretly patch their vulnerabilities in a new version without reporting them to CVE or even providing any explicit description in their change logs. When those secretly patched vulnerabilities are being identified by armored attackers, they can be turned into powerful \"0-day\" attacks, which can be exploited to compromise not only unpatched version of the same software, but also similar types of OSS (e.g., SSL libraries) that may contain the same vulnerability due to code clone or similar design/implementation logic. Therefore, it is critical to identify secret security patches and downgrade the risk of those \"0-day\" attacks to at least \"n-day\" attacks. In this paper, we develop a defense system and implement a toolset to automatically identify secret security patches in open source software. To distinguish security patches from other patches, we first build a security patch database that contains more than 4700 security patches mapping to the records in CVE list. Next, we identify a set of features to help distinguish security patches from non-security ones using machine learning approaches. Finally, we use code clone identification mechanisms to discover similar patches or vulnerabilities in similar types of OSS. The experimental results show our approach can achieve good detection performance. A case study on OpenSSL, LibreSSL, and BoringSSL discovers 12 secret security patches.","PeriodicalId":271955,"journal":{"name":"2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)","volume":"176 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121793114","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 40
Pupillography as Indicator of Programmers' Mental Effort and Cognitive Overload 学生地理作为程序员脑力劳动和认知超载的指标
R. Couceiro, G. Duarte, J. Durães, J. Castelhano, C. Duarte, C. Teixeira, M. Castelo‐Branco, P. Carvalho, H. Madeira
Our research explores a recent paradigm called Biofeedback Augmented Software Engineering (BASE) that introduces a strong new element in the software development process: the programmers' biofeedback. In this Practical Experience Report we present the results of an experiment to evaluate the possibility of using pupillography to gather biofeedback from the programmers. The idea is to use pupillography to get meta information about the programmers' cognitive and emotional states (stress, attention, mental effort level, cognitive overload,...) during code development to identify conditions that may precipitate programmers making bugs or bugs escaping human attention, and tag the corresponding code locations in the software under development to provide online warnings to the programmer or identify code snippets that will need more intensive testing. The experiments evaluate the use of pupillography as cognitive load predictor, compare the results with the mental effort perceived by programmers using NASATLX, and discuss different possibilities for the use of pupillography as biofeedback sensor in real software development scenarios.
我们的研究探索了一种最近的范式,称为生物反馈增强软件工程(BASE),它在软件开发过程中引入了一个强大的新元素:程序员的生物反馈。在这篇实践经验报告中,我们提出了一项实验的结果,以评估使用瞳孔地理来收集程序员生物反馈的可能性。这个想法是使用瞳孔学来获得关于程序员在代码开发过程中的认知和情绪状态(压力、注意力、精神努力水平、认知过载等)的元信息,以识别可能导致程序员产生错误或逃避人们注意的错误的条件,并标记开发软件中相应的代码位置,向程序员提供在线警告或识别需要更密集测试的代码片段。实验评估了瞳孔定位作为认知负荷预测器的使用,将结果与程序员使用NASATLX感知到的脑力劳动进行了比较,并讨论了在实际软件开发场景中使用瞳孔定位作为生物反馈传感器的不同可能性。
{"title":"Pupillography as Indicator of Programmers' Mental Effort and Cognitive Overload","authors":"R. Couceiro, G. Duarte, J. Durães, J. Castelhano, C. Duarte, C. Teixeira, M. Castelo‐Branco, P. Carvalho, H. Madeira","doi":"10.1109/DSN.2019.00069","DOIUrl":"https://doi.org/10.1109/DSN.2019.00069","url":null,"abstract":"Our research explores a recent paradigm called Biofeedback Augmented Software Engineering (BASE) that introduces a strong new element in the software development process: the programmers' biofeedback. In this Practical Experience Report we present the results of an experiment to evaluate the possibility of using pupillography to gather biofeedback from the programmers. The idea is to use pupillography to get meta information about the programmers' cognitive and emotional states (stress, attention, mental effort level, cognitive overload,...) during code development to identify conditions that may precipitate programmers making bugs or bugs escaping human attention, and tag the corresponding code locations in the software under development to provide online warnings to the programmer or identify code snippets that will need more intensive testing. The experiments evaluate the use of pupillography as cognitive load predictor, compare the results with the mental effort perceived by programmers using NASATLX, and discuss different possibilities for the use of pupillography as biofeedback sensor in real software development scenarios.","PeriodicalId":271955,"journal":{"name":"2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)","volume":"135 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116040808","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 11
Demystifying Soft Error Assessment Strategies on ARM CPUs: Microarchitectural Fault Injection vs. Neutron Beam Experiments ARM cpu软错误评估策略揭密:微架构故障注入与中子束实验
Athanasios Chatzidimitriou, Pablo Bodmann, G. Papadimitriou, D. Gizopoulos, P. Rech
Fault injection in early microarchitecture-level simulation CPU models and beam experiments on the final physical CPU chip are two established methodologies to access the soft error reliability of a microprocessor at different stages of its design flow. Beam experiments, on one hand, estimate the devices expected soft error rate in realistic physical conditions by exposing it to accelerated particles fluxes. Fault injection in microarchitectural models of the processor, on the other hand, provides deep insights on faults propagation through the entire system stack, including the operating system. Combining beam experiments and fault injection data can deliver deep insights about the devices expected reliability when deployed in the field. However, it is yet largely unclear if the fault injection error rates can be compared to those reported by beam experiments and how this comparison can lead to informed soft error protection decisions in early stages of the system design.
早期微架构级仿真CPU模型中的故障注入和最终物理CPU芯片上的波束实验是两种常用的方法,用于获取微处理器在设计流程不同阶段的软误差可靠性。束流实验一方面通过将器件暴露在加速粒子流中来估计其在现实物理条件下预期的软错误率。另一方面,处理器微体系结构模型中的故障注入可以深入了解故障在整个系统堆栈(包括操作系统)中的传播情况。结合波束实验和故障注入数据,可以深入了解设备在现场部署时的预期可靠性。然而,目前还不清楚是否可以将故障注入错误率与光束实验报告的错误率进行比较,以及这种比较如何在系统设计的早期阶段导致知情的软错误保护决策。
{"title":"Demystifying Soft Error Assessment Strategies on ARM CPUs: Microarchitectural Fault Injection vs. Neutron Beam Experiments","authors":"Athanasios Chatzidimitriou, Pablo Bodmann, G. Papadimitriou, D. Gizopoulos, P. Rech","doi":"10.1109/DSN.2019.00018","DOIUrl":"https://doi.org/10.1109/DSN.2019.00018","url":null,"abstract":"Fault injection in early microarchitecture-level simulation CPU models and beam experiments on the final physical CPU chip are two established methodologies to access the soft error reliability of a microprocessor at different stages of its design flow. Beam experiments, on one hand, estimate the devices expected soft error rate in realistic physical conditions by exposing it to accelerated particles fluxes. Fault injection in microarchitectural models of the processor, on the other hand, provides deep insights on faults propagation through the entire system stack, including the operating system. Combining beam experiments and fault injection data can deliver deep insights about the devices expected reliability when deployed in the field. However, it is yet largely unclear if the fault injection error rates can be compared to those reported by beam experiments and how this comparison can lead to informed soft error protection decisions in early stages of the system design.","PeriodicalId":271955,"journal":{"name":"2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)","volume":"110 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121297198","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 32
期刊
2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1