首页 > 最新文献

2013 Eighth Asia Joint Conference on Information Security最新文献

英文 中文
Formal Analysis of ISO/IEC 9798-2 Authentication Standard Using AVISPA ISO/IEC 9798-2认证标准使用AVISPA的形式化分析
Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.25
Sheikh Ziauddin, Bruno Martin
Use of formal methods is considered as a useful and efficient technique for the validation of security properties of the protocols. In this paper, we analyze the protocols of ISO/IEC 9798-2 entity authentication standard using a state-of-the-art tool for automated analysis named AVISPA. Our analysis of the standard using AVISPA's OFMC and CL-AtSe back-ends shows that the two party protocols are secure against the specified security properties while the back-ends are able to find attacks against unilateral and mutual authentication protocols involving a trusted third party.
使用形式化方法被认为是验证协议安全属性的有效技术。在本文中,我们使用最先进的自动分析工具AVISPA来分析ISO/IEC 9798-2实体认证标准的协议。我们使用AVISPA的OFMC和CL-AtSe后端对标准进行的分析表明,双方协议对指定的安全属性是安全的,而后端能够发现针对涉及可信第三方的单边和相互认证协议的攻击。
{"title":"Formal Analysis of ISO/IEC 9798-2 Authentication Standard Using AVISPA","authors":"Sheikh Ziauddin, Bruno Martin","doi":"10.1109/ASIAJCIS.2013.25","DOIUrl":"https://doi.org/10.1109/ASIAJCIS.2013.25","url":null,"abstract":"Use of formal methods is considered as a useful and efficient technique for the validation of security properties of the protocols. In this paper, we analyze the protocols of ISO/IEC 9798-2 entity authentication standard using a state-of-the-art tool for automated analysis named AVISPA. Our analysis of the standard using AVISPA's OFMC and CL-AtSe back-ends shows that the two party protocols are secure against the specified security properties while the back-ends are able to find attacks against unilateral and mutual authentication protocols involving a trusted third party.","PeriodicalId":286298,"journal":{"name":"2013 Eighth Asia Joint Conference on Information Security","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2013-07-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132122220","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 14
On Zero-Knowledge Identification Based on Q-ary Syndrome Decoding 基于Q-ary综合征解码的零知识识别
Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.10
Rong Hu, Kirill Morozov, T. Takagi
Cayrel.et.al at SAC 2010 proposed a zero-knowledge identification scheme based on syndrome decoding of q-ary codes. It is a 5-pass scheme with soundness error q/2(q-1). We propose an alternative to this scheme by generalizing (binary) Stern zero-knowledge identification from CRYPTO 1993 directly to q-ary setting. Our proposal is a 3-pass scheme with soundness error 2/3. We show that it is superior to Cayrel et al scheme in terms of communication cost for the case q = {3, 4}. A possible application for q-ary code-based identification schemes with small q is a proof of plaintext knowledge for code-based public key encryption.
cayrel等在SAC 2010提出了一种基于q-ary码的综合征解码的零知识识别方案。该方案为5道方案,可靠性误差为q/2(q-1)。我们提出了一种替代方案,将(二进制)Stern零知识识别从CRYPTO 1993直接推广到q-ary设置。我们的建议是一个3-pass方案,可靠性误差为2/3。我们证明了在q ={3,4}的情况下,该方案在通信成本方面优于Cayrel等方案。具有小q的基于q-ary代码的识别方案的一个可能应用是对基于代码的公钥加密的明文知识的证明。
{"title":"On Zero-Knowledge Identification Based on Q-ary Syndrome Decoding","authors":"Rong Hu, Kirill Morozov, T. Takagi","doi":"10.1109/ASIAJCIS.2013.10","DOIUrl":"https://doi.org/10.1109/ASIAJCIS.2013.10","url":null,"abstract":"Cayrel.et.al at SAC 2010 proposed a zero-knowledge identification scheme based on syndrome decoding of q-ary codes. It is a 5-pass scheme with soundness error q/2(q-1). We propose an alternative to this scheme by generalizing (binary) Stern zero-knowledge identification from CRYPTO 1993 directly to q-ary setting. Our proposal is a 3-pass scheme with soundness error 2/3. We show that it is superior to Cayrel et al scheme in terms of communication cost for the case q = {3, 4}. A possible application for q-ary code-based identification schemes with small q is a proof of plaintext knowledge for code-based public key encryption.","PeriodicalId":286298,"journal":{"name":"2013 Eighth Asia Joint Conference on Information Security","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2013-07-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115705822","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
Search Engine Based Investigation on Misconfiguration of Zone Transfer 基于搜索引擎的区域转移错误配置研究
Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.16
Yin Minn Pa Pa, K. Yoshioka, Tsutomu Matsumoto
This study proposes how to investigate the existence of misconfigurations of zone transfer in any level of domain name system hierarchy using search engine based approach without the need to look at the zone file. The analysis has been conducted on 1,284 authoritative name servers of 314 top-level domains and 46,416 authoritative name servers of second level domain of 249 country code top-level domains. In case of top-level domains investigation, 84 name servers authoritative to answer for 53 top-level domains are misconfigured and allow zone transfer to us. In case of second level domains investigation, 5,394 authoritative name servers authoritative to answer for 6,234 second-level domains allow zone transfer. In particular, we found a serious misconfiguration case where the misconfigured DNS server was authoritative for not only its TLD but also SLD and lower level, exposing 83 % the DNS related information of the country to the public.
本研究提出如何在不需要查看区域文件的情况下,使用基于搜索引擎的方法来调查域名系统层次结构中任何级别的区域传输错误配置的存在。对314个顶级域名的1284个权威域名服务器和249个国家代码顶级域名的46416个二级域名的权威域名服务器进行了分析。在顶级域名调查中,53个顶级域名的84个域名服务器配置错误,允许将区域转移给我们。在二级域名调查中,对6234个二级域名有应答权的5394个权威域名服务器允许区域转移。特别是,我们发现了一个严重的错误配置情况,错误配置的DNS服务器不仅对其TLD,而且对SLD和更低级别具有权威,将该国83%的DNS相关信息暴露给了公众。
{"title":"Search Engine Based Investigation on Misconfiguration of Zone Transfer","authors":"Yin Minn Pa Pa, K. Yoshioka, Tsutomu Matsumoto","doi":"10.1109/ASIAJCIS.2013.16","DOIUrl":"https://doi.org/10.1109/ASIAJCIS.2013.16","url":null,"abstract":"This study proposes how to investigate the existence of misconfigurations of zone transfer in any level of domain name system hierarchy using search engine based approach without the need to look at the zone file. The analysis has been conducted on 1,284 authoritative name servers of 314 top-level domains and 46,416 authoritative name servers of second level domain of 249 country code top-level domains. In case of top-level domains investigation, 84 name servers authoritative to answer for 53 top-level domains are misconfigured and allow zone transfer to us. In case of second level domains investigation, 5,394 authoritative name servers authoritative to answer for 6,234 second-level domains allow zone transfer. In particular, we found a serious misconfiguration case where the misconfigured DNS server was authoritative for not only its TLD but also SLD and lower level, exposing 83 % the DNS related information of the country to the public.","PeriodicalId":286298,"journal":{"name":"2013 Eighth Asia Joint Conference on Information Security","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2013-07-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126615764","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
An Efficient and Provable Secure Security-Mediated Identity-Based Identification Scheme 一种高效且可证明的安全安全的安全中介身份识别方案
Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.12
Ji-Jian Chin, R. Behnia, Swee-Huay Heng, R. Phan
In USENIX 2001, Boneh et al. introduced a new way of obtaining fast revocation for RSA keys with the help of a security mediator. In 2003, Boneh et al. also showed how to convert the security-mediated RSA encryption scheme into an identity-based mediated RSA encryption scheme. This new technique addressed the shortcoming of identity-based cryptography where revocation required appending the valid date for a user's keys together with his identity-string, allowing for instant revocation of invalid user keys. Subsequently, many security-mediated cryptographic primitives were proposed. Surprisingly however, no work has yet to be done to address security-mediated identity-based identification schemes despite more than a decade has passed since this feature was incorporated into encryption and signature primitives. In this paper, we provide that contribution by defining the appropriate security notions for achieving fast revocation for identity-based identification schemes. Subsequently we show a concrete scheme that achieves these security notions under provable security.
在USENIX 2001中,Boneh等人引入了一种在安全中介的帮助下获得RSA密钥快速撤销的新方法。2003年,Boneh等人也展示了如何将安全介导的RSA加密方案转换为基于身份的介导的RSA加密方案。这种新技术解决了基于身份的密码学的缺点,在这种密码学中,撤销需要将用户密钥的有效日期与其身份字符串一起附加,从而允许立即撤销无效的用户密钥。随后,提出了许多安全中介的密码原语。然而令人惊讶的是,尽管这个特性被集成到加密和签名原语中已经有十多年了,但还没有人做任何工作来解决基于安全中介的身份识别方案。在本文中,我们通过定义适当的安全概念来实现基于身份的识别方案的快速撤销,从而提供了这一贡献。随后给出了在可证明安全性下实现这些安全概念的具体方案。
{"title":"An Efficient and Provable Secure Security-Mediated Identity-Based Identification Scheme","authors":"Ji-Jian Chin, R. Behnia, Swee-Huay Heng, R. Phan","doi":"10.1109/ASIAJCIS.2013.12","DOIUrl":"https://doi.org/10.1109/ASIAJCIS.2013.12","url":null,"abstract":"In USENIX 2001, Boneh et al. introduced a new way of obtaining fast revocation for RSA keys with the help of a security mediator. In 2003, Boneh et al. also showed how to convert the security-mediated RSA encryption scheme into an identity-based mediated RSA encryption scheme. This new technique addressed the shortcoming of identity-based cryptography where revocation required appending the valid date for a user's keys together with his identity-string, allowing for instant revocation of invalid user keys. Subsequently, many security-mediated cryptographic primitives were proposed. Surprisingly however, no work has yet to be done to address security-mediated identity-based identification schemes despite more than a decade has passed since this feature was incorporated into encryption and signature primitives. In this paper, we provide that contribution by defining the appropriate security notions for achieving fast revocation for identity-based identification schemes. Subsequently we show a concrete scheme that achieves these security notions under provable security.","PeriodicalId":286298,"journal":{"name":"2013 Eighth Asia Joint Conference on Information Security","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2013-07-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125027048","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
Adaptive Feature-Weighted Alert Correlation System Applicable in Cloud Environment 适用于云环境的自适应特征加权报警关联系统
Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.14
Chih-Hung Wang, Ji-Min Yang
Growing with the technology, there are many new attack techniques presented in the cloud environment. Different from the general server, once the cloud environment suffered from malicious attacks, people or companies will get caught in extreme dangers. Therefore, it is important for network security in cloud. Since there are a lot of packets in network traffic including malicious packets, huge amounts of alerts will be generated by the intrusion detection system. Analyzing these alert data is time-consuming and it is difficult to obtain the attack steps and strategies immediately by directly performing these analyses. We proposed an adaptive feature-weighted alert correlation system that employs a Bayesian Network to choose the features with high relevance and then adjusts the feature weights according to the statistics of Bayesian Network in a period of time. We estimate the correlation probability of two alerts with the relevant features by using the Feature Wight Matrix, and the correlation probability is recorded in Alert Correlation Matrix. Using the information in Alert Correlation Matrix, we can extract high level attack strategies and construct attack graphs. In our system, facing a great deal of network traffic, the administrator can accurately recognize intruders' intentions and learn about the attack probabilities and network security situations.
随着技术的发展,云环境中出现了许多新的攻击技术。与一般的服务器不同,云环境一旦受到恶意攻击,个人或企业将陷入极端的危险之中。因此,云环境下的网络安全至关重要。由于网络流量中存在大量的报文,其中包括恶意报文,入侵检测系统会产生大量的告警。分析这些警报数据非常耗时,并且很难通过直接执行这些分析来立即获得攻击步骤和策略。我们提出了一种自适应特征加权报警关联系统,该系统利用贝叶斯网络选择相关度较高的特征,然后根据贝叶斯网络在一段时间内的统计调整特征权重。我们利用特征权重矩阵估计两个警报与相关特征的相关概率,并将相关概率记录在警报相关矩阵中。利用预警关联矩阵中的信息,可以提取高级攻击策略,构造攻击图。在我们的系统中,面对巨大的网络流量,管理员可以准确地识别入侵者的意图,了解攻击概率和网络安全状况。
{"title":"Adaptive Feature-Weighted Alert Correlation System Applicable in Cloud Environment","authors":"Chih-Hung Wang, Ji-Min Yang","doi":"10.1109/ASIAJCIS.2013.14","DOIUrl":"https://doi.org/10.1109/ASIAJCIS.2013.14","url":null,"abstract":"Growing with the technology, there are many new attack techniques presented in the cloud environment. Different from the general server, once the cloud environment suffered from malicious attacks, people or companies will get caught in extreme dangers. Therefore, it is important for network security in cloud. Since there are a lot of packets in network traffic including malicious packets, huge amounts of alerts will be generated by the intrusion detection system. Analyzing these alert data is time-consuming and it is difficult to obtain the attack steps and strategies immediately by directly performing these analyses. We proposed an adaptive feature-weighted alert correlation system that employs a Bayesian Network to choose the features with high relevance and then adjusts the feature weights according to the statistics of Bayesian Network in a period of time. We estimate the correlation probability of two alerts with the relevant features by using the Feature Wight Matrix, and the correlation probability is recorded in Alert Correlation Matrix. Using the information in Alert Correlation Matrix, we can extract high level attack strategies and construct attack graphs. In our system, facing a great deal of network traffic, the administrator can accurately recognize intruders' intentions and learn about the attack probabilities and network security situations.","PeriodicalId":286298,"journal":{"name":"2013 Eighth Asia Joint Conference on Information Security","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2013-07-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133659845","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Automatic Adding License Management Functionality for Android Applications Android应用自动添加License管理功能
Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.26
Ming-Chih Kao, W. Kuo, Yu-Hsuan Pan
With the growth of applications on mobile devices, developers can easy distribute their applications by the various software marketplaces. Generally, the applications need some code to execute license management functionality, and so developers must learn how to add such license management code for each software marketplace. This has resulted in increasing complexity and development time of applications. In order to prevent the potential errors or bugs resulted from adding functionality, we designed an automatic process of adding license management code for an application marketplace prototype. Experimental results show the automatic process can repackage hundreds of Android applications efficiently and meet the requirement of the marketplace prototype.
随着移动设备上应用程序的增长,开发人员可以很容易地通过各种软件市场分发他们的应用程序。通常,应用程序需要一些代码来执行许可证管理功能,因此开发人员必须学习如何为每个软件市场添加这样的许可证管理代码。这导致了应用程序的复杂性和开发时间的增加。为了防止由于添加功能而导致的潜在错误或bug,我们为应用程序市场原型设计了一个自动添加许可管理代码的过程。实验结果表明,该自动化过程可以有效地重新包装数百个Android应用程序,满足市场原型的要求。
{"title":"Automatic Adding License Management Functionality for Android Applications","authors":"Ming-Chih Kao, W. Kuo, Yu-Hsuan Pan","doi":"10.1109/ASIAJCIS.2013.26","DOIUrl":"https://doi.org/10.1109/ASIAJCIS.2013.26","url":null,"abstract":"With the growth of applications on mobile devices, developers can easy distribute their applications by the various software marketplaces. Generally, the applications need some code to execute license management functionality, and so developers must learn how to add such license management code for each software marketplace. This has resulted in increasing complexity and development time of applications. In order to prevent the potential errors or bugs resulted from adding functionality, we designed an automatic process of adding license management code for an application marketplace prototype. Experimental results show the automatic process can repackage hundreds of Android applications efficiently and meet the requirement of the marketplace prototype.","PeriodicalId":286298,"journal":{"name":"2013 Eighth Asia Joint Conference on Information Security","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2013-07-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133289394","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
An Efficient and Practical Fair Buyer-Anonymity Exchange Scheme Using Bilinear Pairings 一个高效实用的双线性对公平买方匿名交换方案
Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.11
Wen-Shenq Juang
A practical and efficient fair exchange scheme can be used in electronic commerce for exchanging digital goods with payment. In order to provide offline transaction, most of the practical and flexible fair exchange schemes need the involving of the trusted third parties to resolve the disputes and ensure the fairness in the exchange. Also, if a fair exchange service deals with the exchange between the payment and the digital goods, buyer-anonymity is a nice function to attract customers to use this service. In this paper, we propose a practical and efficient fair buyer-anonymity exchange scheme for electronic commerce. In our scheme, we use bilinear pairings in elliptic curves to reduce the computation and communication cost. Since only the customer and the merchant are involved during the exchange phase, our scheme can provide truly offline transaction. Also, the buyer anonymity is preserved in our scheme for attracting customers to use this service.
一种实用高效的公平交换方案可以用于电子商务中进行数字商品的支付交换。为了提供线下交易,大多数实用灵活的公平交易方案都需要可信第三方的参与来解决纠纷,保证交易的公平性。此外,如果一个公平的交换服务处理支付和数字商品之间的交换,买家匿名是一个很好的功能,以吸引客户使用这项服务。本文提出了一种实用、高效、公平的电子商务买方匿名交换方案。在我们的方案中,我们使用椭圆曲线上的双线性配对来减少计算和通信开销。因为在交易阶段只有客户和商家参与,所以我们的方案可以提供真正的线下交易。此外,为了吸引客户使用此服务,我们的方案中保留了买方的匿名性。
{"title":"An Efficient and Practical Fair Buyer-Anonymity Exchange Scheme Using Bilinear Pairings","authors":"Wen-Shenq Juang","doi":"10.1109/ASIAJCIS.2013.11","DOIUrl":"https://doi.org/10.1109/ASIAJCIS.2013.11","url":null,"abstract":"A practical and efficient fair exchange scheme can be used in electronic commerce for exchanging digital goods with payment. In order to provide offline transaction, most of the practical and flexible fair exchange schemes need the involving of the trusted third parties to resolve the disputes and ensure the fairness in the exchange. Also, if a fair exchange service deals with the exchange between the payment and the digital goods, buyer-anonymity is a nice function to attract customers to use this service. In this paper, we propose a practical and efficient fair buyer-anonymity exchange scheme for electronic commerce. In our scheme, we use bilinear pairings in elliptic curves to reduce the computation and communication cost. Since only the customer and the merchant are involved during the exchange phase, our scheme can provide truly offline transaction. Also, the buyer anonymity is preserved in our scheme for attracting customers to use this service.","PeriodicalId":286298,"journal":{"name":"2013 Eighth Asia Joint Conference on Information Security","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2013-07-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123114220","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 6
Detecting HTTP-Based Botnet Based on Characteristic of the C & C Session Using by SVM 基于http特性的僵尸网络检测C会话使用SVM
Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.17
Kazumasa Yamauchi, Y. Hori, K. Sakurai
With the spread of computer, the increase of malwareis a serious problem. In some malware, damage caused by bot net is a serious problem. Botnets perform the attack by remote control. The purpose of the present work is to suppress the bot net activity by detecting the C&C traffic through well-suited observations. There already exists many detection techniques, most of which focus on IRC-based bot net, and very little focus on HTTP-based bot net, even less, which include comparisons between both detection techniques. In this work, we focus on the HTTP-based bot net, and in order to classify normal HTTP session and C&C session, we make use of Support Vector Machine.
随着计算机的普及,恶意软件的增加成为一个严重的问题。在一些恶意软件中,僵尸网络造成的损害是一个严重的问题。僵尸网络通过远程控制执行攻击。本工作的目的是通过适当的观察来检测C&C流量,从而抑制僵尸网络的活动。目前已有的检测技术很多,但大部分都是针对基于irc的僵尸网络,而针对基于http的僵尸网络的检测技术很少,对两种检测技术的比较更是少之又少。本文主要研究基于HTTP的bot网络,利用支持向量机对正常HTTP会话和C&C会话进行分类。
{"title":"Detecting HTTP-Based Botnet Based on Characteristic of the C & C Session Using by SVM","authors":"Kazumasa Yamauchi, Y. Hori, K. Sakurai","doi":"10.1109/ASIAJCIS.2013.17","DOIUrl":"https://doi.org/10.1109/ASIAJCIS.2013.17","url":null,"abstract":"With the spread of computer, the increase of malwareis a serious problem. In some malware, damage caused by bot net is a serious problem. Botnets perform the attack by remote control. The purpose of the present work is to suppress the bot net activity by detecting the C&C traffic through well-suited observations. There already exists many detection techniques, most of which focus on IRC-based bot net, and very little focus on HTTP-based bot net, even less, which include comparisons between both detection techniques. In this work, we focus on the HTTP-based bot net, and in order to classify normal HTTP session and C&C session, we make use of Support Vector Machine.","PeriodicalId":286298,"journal":{"name":"2013 Eighth Asia Joint Conference on Information Security","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2013-07-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128209518","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 7
Histogram-Based Reversible Information Hiding Improved by Prediction with the Variance to Enhance Image Quality 利用方差预测改进基于直方图的可逆信息隐藏,提高图像质量
Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.23
C. Weng, Cheng-Hsing Yang, Chun-I Fan, Kuan-Liang Liu, Hung-Min Sun
Reversible data hiding based on prediction-based is a good technique that can hide message bits into digital images with low distortion. In this paper, we propose a reversible data hiding method based on interleaving prediction and local complexity for enhancing stego-image quality. The thresholds and local complexity are used to determine which predicted error should join the group of pixel shifting or message concealing. If the local complexity is smaller than thresholds, the predicted error will be taken for message hiding or pixel shifting, otherwise, if the local complexity is larger than thresholds, the predicted error will quit joining the process of data concealing and pixel shifting. Therefore, more pixels will avoid executing the process of pixel shifting, resulting to images with lower distortion. The experimental results show that our image quality is superior to other approaches at the same payload.
基于预测的可逆数据隐藏是一种很好的将信息位隐藏到低失真的数字图像中的技术。为了提高隐写图像的质量,提出了一种基于交错预测和局部复杂度的可逆数据隐藏方法。使用阈值和局部复杂度来确定哪些预测错误应该加入像素移动或消息隐藏组。如果局部复杂度小于阈值,则采用预测误差进行消息隐藏或像素移动,如果局部复杂度大于阈值,则预测误差退出数据隐藏和像素移动过程。因此,更多的像素将避免执行像素移位过程,从而使图像具有更低的失真。实验结果表明,在相同载荷下,我们的图像质量优于其他方法。
{"title":"Histogram-Based Reversible Information Hiding Improved by Prediction with the Variance to Enhance Image Quality","authors":"C. Weng, Cheng-Hsing Yang, Chun-I Fan, Kuan-Liang Liu, Hung-Min Sun","doi":"10.1109/ASIAJCIS.2013.23","DOIUrl":"https://doi.org/10.1109/ASIAJCIS.2013.23","url":null,"abstract":"Reversible data hiding based on prediction-based is a good technique that can hide message bits into digital images with low distortion. In this paper, we propose a reversible data hiding method based on interleaving prediction and local complexity for enhancing stego-image quality. The thresholds and local complexity are used to determine which predicted error should join the group of pixel shifting or message concealing. If the local complexity is smaller than thresholds, the predicted error will be taken for message hiding or pixel shifting, otherwise, if the local complexity is larger than thresholds, the predicted error will quit joining the process of data concealing and pixel shifting. Therefore, more pixels will avoid executing the process of pixel shifting, resulting to images with lower distortion. The experimental results show that our image quality is superior to other approaches at the same payload.","PeriodicalId":286298,"journal":{"name":"2013 Eighth Asia Joint Conference on Information Security","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2013-07-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"120873890","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Efficient Malware Packer Identification Using Support Vector Machines with Spectrum Kernel 基于谱核支持向量机的恶意软件高效识别
Pub Date : 2013-07-25 DOI: 10.1109/ASIAJCIS.2013.18
Tao Ban, Ryoichi Isawa, Shanqing Guo, D. Inoue, K. Nakao
Packing is among the most popular obfuscation techniques to impede anti-virus scanners from successfully detecting malware. Efficient and automatic packer identification is an essential step to perform attack on ever increasing malware databases. In this paper we present a p-spectrum induced linear Support Vector Machine to implement an automated packer identification with good accuracy and scalability. The efficacy and efficiency of the method is evaluated on a dataset composed of 3228 packed files created by 25 packers with near-perfect identification results reported. This method can help to improve the scanning efficiency of anti-virus products and ease efficient back-end malware research.
打包是最流行的混淆技术之一,以阻止反病毒扫描仪成功检测恶意软件。高效、自动的封包识别是对日益增长的恶意软件数据库进行攻击的必要步骤。本文提出了一种p谱诱导线性支持向量机来实现具有良好精度和可扩展性的自动封隔器识别。该方法的有效性和效率在由25个封隔器创建的3228个打包文件组成的数据集上进行了评估,报告了近乎完美的识别结果。该方法有助于提高杀毒产品的扫描效率,方便高效的后端恶意软件研究。
{"title":"Efficient Malware Packer Identification Using Support Vector Machines with Spectrum Kernel","authors":"Tao Ban, Ryoichi Isawa, Shanqing Guo, D. Inoue, K. Nakao","doi":"10.1109/ASIAJCIS.2013.18","DOIUrl":"https://doi.org/10.1109/ASIAJCIS.2013.18","url":null,"abstract":"Packing is among the most popular obfuscation techniques to impede anti-virus scanners from successfully detecting malware. Efficient and automatic packer identification is an essential step to perform attack on ever increasing malware databases. In this paper we present a p-spectrum induced linear Support Vector Machine to implement an automated packer identification with good accuracy and scalability. The efficacy and efficiency of the method is evaluated on a dataset composed of 3228 packed files created by 25 packers with near-perfect identification results reported. This method can help to improve the scanning efficiency of anti-virus products and ease efficient back-end malware research.","PeriodicalId":286298,"journal":{"name":"2013 Eighth Asia Joint Conference on Information Security","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2013-07-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132828585","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 8
期刊
2013 Eighth Asia Joint Conference on Information Security
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1