首页 > 最新文献

Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security最新文献

英文 中文
Poster: a geometric approach for multicast authentication in adversarial channels 海报:对抗信道中多播认证的几何方法
Seyed Ali Ahmadzadeh, G. Agnew
In this work, we investigate the application of geometric representation of hash vectors of the information packets in multicast authentication protocols. To this end, a new authentication approach based on geometric properties of hash vectors in an $n-$dimensional vector space is proposed. The proposed approach enables the receiver to authenticate the source packets and removes malicious packets that may have been injected by an adversary into the channel. A salient feature of the proposed scheme is that its bandwidth overhead is independent from the number of injected packets. Moreover, the performance analysis verifies that the proposed scheme significantly reduces the bandwidth overhead as compared to the well known multicast authentication protocols in the literature (e.g., PRABS).
在这项工作中,我们研究了信息包哈希向量的几何表示在组播认证协议中的应用。为此,提出了一种基于$n-$维向量空间中哈希向量几何性质的认证方法。所提出的方法使接收方能够对源数据包进行身份验证,并删除可能由攻击者注入到通道中的恶意数据包。该方案的一个显著特点是其带宽开销与注入数据包的数量无关。此外,性能分析验证了与文献中众所周知的多播认证协议(例如PRABS)相比,所提出的方案显着降低了带宽开销。
{"title":"Poster: a geometric approach for multicast authentication in adversarial channels","authors":"Seyed Ali Ahmadzadeh, G. Agnew","doi":"10.1145/2046707.2093479","DOIUrl":"https://doi.org/10.1145/2046707.2093479","url":null,"abstract":"In this work, we investigate the application of geometric representation of hash vectors of the information packets in multicast authentication protocols. To this end, a new authentication approach based on geometric properties of hash vectors in an $n-$dimensional vector space is proposed. The proposed approach enables the receiver to authenticate the source packets and removes malicious packets that may have been injected by an adversary into the channel. A salient feature of the proposed scheme is that its bandwidth overhead is independent from the number of injected packets. Moreover, the performance analysis verifies that the proposed scheme significantly reduces the bandwidth overhead as compared to the well known multicast authentication protocols in the literature (e.g., PRABS).","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"33 1","pages":"729-732"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"80270390","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Poster: SMURFEN: a rule sharing collaborative intrusion detection network 海报:SMURFEN:规则共享协同入侵检测网络
Carol J. Fung, Quanyan Zhu, R. Boutaba, T. Başar
Intrusion Detection Systems (IDSs) are designed to monitor network traffic and computer activities in order to alert users about suspicious intrusions. Collaboration among IDSs allows users to benefit from the collective knowledge and information from their collaborators and achieve more accurate intrusion detection. However, most existing collaborative intrusion detection networks rely on the exchange of intrusion data which raises privacy concerns. To overcome this problem, we propose SMURFEN: a knowledge-based intrusion detection network, which provides a platform for IDS users to effectively share their customized detection knowledge in an IDS community. An automatic knowledge propagation mechanism is proposed based on a decentralized two-level optimization problem formulation, leading to a Nash equilibrium solution which is proved to be scalable, incentive compatible, fair, efficient and robust.
入侵检测系统(ids)用于监控网络流量和计算机活动,以便提醒用户注意可疑的入侵。入侵检测系统之间的协作使用户能够从协作者的集体知识和信息中受益,并实现更准确的入侵检测。然而,大多数现有的协同入侵检测网络依赖于入侵数据的交换,这引起了隐私问题。为了克服这个问题,我们提出了SMURFEN:一个基于知识的入侵检测网络,它为IDS用户提供了一个平台,可以在IDS社区中有效地共享他们定制的检测知识。提出了一种基于去中心化两级优化问题表述的知识自动传播机制,得到了具有可扩展性、激励兼容、公平、高效和鲁棒性的纳什均衡解。
{"title":"Poster: SMURFEN: a rule sharing collaborative intrusion detection network","authors":"Carol J. Fung, Quanyan Zhu, R. Boutaba, T. Başar","doi":"10.1145/2046707.2093487","DOIUrl":"https://doi.org/10.1145/2046707.2093487","url":null,"abstract":"Intrusion Detection Systems (IDSs) are designed to monitor network traffic and computer activities in order to alert users about suspicious intrusions. Collaboration among IDSs allows users to benefit from the collective knowledge and information from their collaborators and achieve more accurate intrusion detection. However, most existing collaborative intrusion detection networks rely on the exchange of intrusion data which raises privacy concerns. To overcome this problem, we propose SMURFEN: a knowledge-based intrusion detection network, which provides a platform for IDS users to effectively share their customized detection knowledge in an IDS community. An automatic knowledge propagation mechanism is proposed based on a decentralized two-level optimization problem formulation, leading to a Nash equilibrium solution which is proved to be scalable, incentive compatible, fair, efficient and robust.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"6 1","pages":"761-764"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"84315793","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Poster: towards formal verification of DIFC policies 海报:对DIFC政策进行正式验证
Zhi Yang, Lihua Yin, Miyi Duan, Shuyuan Jin
Decentralized information flow control (DIFC) is a recent important innovation with flexible mechanisms to improve the availability of traditional information flow models. However, the flexibility of DIFC models also makes specifying and managing DIFC policies a challenging problem. The formal policy verification techniques can improve the current state of the art of policy specification and management. We show that in general these problems of policy verification of the main DIFC systems are NP-hard, and show that several subcases remain NP-complete. We also propose an approach of model checking to solve these problems. Experiments are presented to show that this approach is effective.
分散信息流控制(DIFC)是近年来的一项重要创新,它采用灵活的机制来提高传统信息流模型的可用性。然而,DIFC模型的灵活性也使得指定和管理DIFC策略成为一个具有挑战性的问题。正式的策略验证技术可以改善策略规范和管理的现状。我们证明了这些主要DIFC系统的策略验证问题通常是np困难的,并且证明了一些子案例仍然是np完全的。我们还提出了一种模型检验的方法来解决这些问题。实验结果表明,该方法是有效的。
{"title":"Poster: towards formal verification of DIFC policies","authors":"Zhi Yang, Lihua Yin, Miyi Duan, Shuyuan Jin","doi":"10.1145/2046707.2093515","DOIUrl":"https://doi.org/10.1145/2046707.2093515","url":null,"abstract":"Decentralized information flow control (DIFC) is a recent important innovation with flexible mechanisms to improve the availability of traditional information flow models. However, the flexibility of DIFC models also makes specifying and managing DIFC policies a challenging problem. The formal policy verification techniques can improve the current state of the art of policy specification and management. We show that in general these problems of policy verification of the main DIFC systems are NP-hard, and show that several subcases remain NP-complete. We also propose an approach of model checking to solve these problems. Experiments are presented to show that this approach is effective.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"44 1","pages":"873-876"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"81042108","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Protecting consumer privacy from electric load monitoring 保护消费者隐私免受电力负荷监控
Stephen E. McLaughlin, P. Mcdaniel, W. Aiello
The smart grid introduces concerns for the loss of consumer privacy; recently deployed smart meters retain and distribute highly accurate profiles of home energy use. These profiles can be mined by Non Intrusive Load Monitors (NILMs) to expose much of the human activity within the served site. This paper introduces a new class of algorithms and systems, called Non Intrusive Load Leveling (NILL) to combat potential invasions of privacy. NILL uses an in-residence battery to mask variance in load on the grid, thus eliminating exposure of the appliance-driven information used to compromise consumer privacy. We use real residential energy use profiles to drive four simulated deployments of NILL. The simulations show that NILL exposes only 1.1 to 5.9 useful energy events per day hidden amongst hundreds or thousands of similar battery-suppressed events. Thus, the energy profiles exhibited by NILL are largely useless for current NILM algorithms. Surprisingly, such privacy gains can be achieved using battery systems whose storage capacity is far lower than the residence's aggregate load average. We conclude by discussing how the costs of NILL can be offset by energy savings under tiered energy schedules.
智能电网带来了对消费者隐私丧失的担忧;最近部署的智能电表保留和分发家庭能源使用的高度精确的概况。这些配置文件可以由非侵入式负载监视器(nilm)挖掘,以暴露服务站点内的大部分人类活动。本文介绍了一类新的算法和系统,称为非侵入性负载均衡(NILL),以对抗潜在的隐私侵犯。NILL使用内置电池来掩盖电网上负载的变化,从而消除了用于损害消费者隐私的设备驱动信息的暴露。我们使用真实的住宅能源使用概况来驱动NILL的四个模拟部署。模拟表明,NILL每天只暴露1.1到5.9个有用的能量事件,隐藏在数百或数千个类似的电池抑制事件中。因此,nil所显示的能量分布在很大程度上对当前的NILM算法毫无用处。令人惊讶的是,这样的隐私收益可以通过电池系统来实现,其存储容量远低于住宅总负荷的平均水平。最后,我们讨论了在分层能源计划下,NILL的成本如何被节约的能源所抵消。
{"title":"Protecting consumer privacy from electric load monitoring","authors":"Stephen E. McLaughlin, P. Mcdaniel, W. Aiello","doi":"10.1145/2046707.2046720","DOIUrl":"https://doi.org/10.1145/2046707.2046720","url":null,"abstract":"The smart grid introduces concerns for the loss of consumer privacy; recently deployed smart meters retain and distribute highly accurate profiles of home energy use. These profiles can be mined by Non Intrusive Load Monitors (NILMs) to expose much of the human activity within the served site. This paper introduces a new class of algorithms and systems, called Non Intrusive Load Leveling (NILL) to combat potential invasions of privacy. NILL uses an in-residence battery to mask variance in load on the grid, thus eliminating exposure of the appliance-driven information used to compromise consumer privacy. We use real residential energy use profiles to drive four simulated deployments of NILL. The simulations show that NILL exposes only 1.1 to 5.9 useful energy events per day hidden amongst hundreds or thousands of similar battery-suppressed events. Thus, the energy profiles exhibited by NILL are largely useless for current NILM algorithms. Surprisingly, such privacy gains can be achieved using battery systems whose storage capacity is far lower than the residence's aggregate load average. We conclude by discussing how the costs of NILL can be offset by energy savings under tiered energy schedules.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"12 1","pages":"87-98"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"82135689","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 251
Process out-grafting: an efficient "out-of-VM" approach for fine-grained process execution monitoring 进程外嫁接:一种用于细粒度进程执行监控的高效“虚拟机外”方法
D. Srinivasan, Zhi Wang, Xuxian Jiang, Dongyan Xu
Recent rapid malware growth has exposed the limitations of traditional in-host malware-defense systems and motivated the development of secure virtualization-based out-of-VM solutions. By running vulnerable systems as virtual machines (VMs) and moving security software from inside the VMs to outside, the out-of-VM solutions securely isolate the anti-malware software from the vulnerable system. However, the presence of semantic gap also leads to the compatibility problem in not supporting existing defense software. In this paper, we present process out-grafting, an architectural approach to address both isolation and compatibility challenges in out-of-VM approaches for fine-grained process-level execution monitoring. Specifically, by relocating a suspect process from inside a VM to run side-by-side with the out-of-VM security tool, our technique effectively removes the semantic gap and supports existing user-mode process monitoring tools without any modification. Moreover, by forwarding the system calls back to the VM, we can smoothly continue the execution of the out-grafted process without weakening the isolation of the monitoring tool. We have developed a KVM-based prototype and used it to natively support a number of existing tools without any modification. The evaluation results including measurement with benchmark programs show it is effective and practical with a small performance overhead.
最近恶意软件的快速增长暴露了传统的主机内恶意软件防御系统的局限性,并推动了基于虚拟机外安全虚拟化解决方案的开发。通过将易受攻击的系统作为虚拟机运行,并将安全软件从虚拟机内部移动到外部,out- vm解决方案可以安全地将反恶意软件与易受攻击的系统隔离开来。然而,语义缺口的存在也导致了不支持现有防御软件的兼容性问题。在本文中,我们提出了进程外嫁接,这是一种架构方法,用于解决细粒度进程级执行监视的虚拟机外方法中的隔离和兼容性挑战。具体来说,通过将可疑进程从VM内部重新定位到与VM外安全工具并排运行,我们的技术有效地消除了语义差距,并支持现有的用户模式进程监控工具,而无需进行任何修改。此外,通过将系统调用转发回VM,我们可以在不削弱监控工具的隔离性的情况下,顺利地继续执行接出的进程。我们已经开发了一个基于kvm的原型,并使用它来本地支持许多现有的工具,而无需进行任何修改。通过对基准程序的测试,验证了该方法的有效性和实用性,且性能开销小。
{"title":"Process out-grafting: an efficient \"out-of-VM\" approach for fine-grained process execution monitoring","authors":"D. Srinivasan, Zhi Wang, Xuxian Jiang, Dongyan Xu","doi":"10.1145/2046707.2046751","DOIUrl":"https://doi.org/10.1145/2046707.2046751","url":null,"abstract":"Recent rapid malware growth has exposed the limitations of traditional in-host malware-defense systems and motivated the development of secure virtualization-based out-of-VM solutions. By running vulnerable systems as virtual machines (VMs) and moving security software from inside the VMs to outside, the out-of-VM solutions securely isolate the anti-malware software from the vulnerable system. However, the presence of semantic gap also leads to the compatibility problem in not supporting existing defense software. In this paper, we present process out-grafting, an architectural approach to address both isolation and compatibility challenges in out-of-VM approaches for fine-grained process-level execution monitoring. Specifically, by relocating a suspect process from inside a VM to run side-by-side with the out-of-VM security tool, our technique effectively removes the semantic gap and supports existing user-mode process monitoring tools without any modification. Moreover, by forwarding the system calls back to the VM, we can smoothly continue the execution of the out-grafted process without weakening the isolation of the monitoring tool. We have developed a KVM-based prototype and used it to natively support a number of existing tools without any modification. The evaluation results including measurement with benchmark programs show it is effective and practical with a small performance overhead.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"26 1","pages":"363-374"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"76400829","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 101
Poster: DIEGO: a fine-grained access control for web browsers 海报:DIEGO:一种针对web浏览器的细粒度访问控制
Ashar Javed
Modern web applications combine content from several sources (with varying security characteristics), and incorporate significant portion of user-supplied contents to enrich browsing experience. However, the de facto web protection model, the same-origin policy (SOP), has not adequately evolved to manage the security consequences of this additional complexity. As a result, making web applications subject to a broad sphere of attacks (cross-site scripting, cross-site request forgery and others). The fundamental problem is the failure of access control. To solve this, in this work, we present DIEGO, a new fine-grained access control model for web browsers. Our overall design approach is to combine mandatory access-control (MAC) principles of operating system with tag pairing isolation technique in order to provide stealthy protection. To support backwards compatibility, DIEGO defaults to the same-origin policy (SOP) for web applications.
现代web应用程序将来自多个来源(具有不同的安全特性)的内容组合在一起,并合并了很大一部分用户提供的内容,以丰富浏览体验。然而,事实上的web保护模型,同源策略(SOP),并没有充分发展到管理这种额外复杂性的安全后果。因此,使web应用程序受到广泛的攻击(跨站点脚本、跨站点请求伪造等)。根本的问题是访问控制的失败。为了解决这个问题,在这项工作中,我们提出了DIEGO,一个新的细粒度的web浏览器访问控制模型。我们的总体设计方法是将操作系统的强制访问控制(MAC)原理与标签配对隔离技术相结合,以提供隐形保护。为了支持向后兼容性,DIEGO默认为web应用程序使用同源策略(SOP)。
{"title":"Poster: DIEGO: a fine-grained access control for web browsers","authors":"Ashar Javed","doi":"10.1145/2046707.2093494","DOIUrl":"https://doi.org/10.1145/2046707.2093494","url":null,"abstract":"Modern web applications combine content from several sources (with varying security characteristics), and incorporate significant portion of user-supplied contents to enrich browsing experience. However, the de facto web protection model, the same-origin policy (SOP), has not adequately evolved to manage the security consequences of this additional complexity. As a result, making web applications subject to a broad sphere of attacks (cross-site scripting, cross-site request forgery and others). The fundamental problem is the failure of access control. To solve this, in this work, we present DIEGO, a new fine-grained access control model for web browsers. Our overall design approach is to combine mandatory access-control (MAC) principles of operating system with tag pairing isolation technique in order to provide stealthy protection. To support backwards compatibility, DIEGO defaults to the same-origin policy (SOP) for web applications.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"61 1","pages":"789-792"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"76843188","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Predictive mitigation of timing channels in interactive systems 交互系统中时序信道的预测缓解
Danfeng Zhang, Aslan Askarov, A. Myers
Timing channels remain a difficult and important problem for information security. Recent work introduced predictive mitigation, a new way to mitigating leakage through timing channels; this mechanism works by predicting timing from past behavior, and then enforcing the predictions. This paper generalizes predictive mitigation to a larger and important class of systems: systems that receive input requests from multiple clients and deliver responses. The new insight is that timing predictions may be a function of any public information, rather than being a function simply of output events. Based on this insight, a more general mechanism and theory of predictive mitigation becomes possible. The result is that bounds on timing leakage can be tightened, achieving asymptotically logarithmic leakage under reasonable assumptions. By applying it to web applications, the generalized predictive mitigation mechanism is shown to be effective in practice.
时序信道仍然是信息安全的一个难点和重要问题。最近的工作介绍了预测缓解,这是一种通过定时通道缓解泄漏的新方法;这种机制的工作原理是根据过去的行为预测时间,然后执行预测。本文将预测性缓解推广到更大、更重要的一类系统:从多个客户端接收输入请求并交付响应的系统。新的见解是,时间预测可能是任何公开信息的函数,而不仅仅是输出事件的函数。基于这一见解,预测缓解的更一般的机制和理论成为可能。结果表明,在合理的假设下,可以收紧时间泄漏的边界,实现渐近对数泄漏。通过将其应用于web应用,证明了广义预测缓解机制在实践中的有效性。
{"title":"Predictive mitigation of timing channels in interactive systems","authors":"Danfeng Zhang, Aslan Askarov, A. Myers","doi":"10.1145/2046707.2046772","DOIUrl":"https://doi.org/10.1145/2046707.2046772","url":null,"abstract":"Timing channels remain a difficult and important problem for information security. Recent work introduced predictive mitigation, a new way to mitigating leakage through timing channels; this mechanism works by predicting timing from past behavior, and then enforcing the predictions. This paper generalizes predictive mitigation to a larger and important class of systems: systems that receive input requests from multiple clients and deliver responses. The new insight is that timing predictions may be a function of any public information, rather than being a function simply of output events. Based on this insight, a more general mechanism and theory of predictive mitigation becomes possible. The result is that bounds on timing leakage can be tightened, achieving asymptotically logarithmic leakage under reasonable assumptions. By applying it to web applications, the generalized predictive mitigation mechanism is shown to be effective in practice.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"62 1","pages":"563-574"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"74119985","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 126
Cloak and dagger: dynamics of web search cloaking 隐蔽与匕首:网络搜索隐蔽的动态
David Y. Wang, S. Savage, G. Voelker
Cloaking is a common 'bait-and-switch' technique used to hide the true nature of a Web site by delivering blatantly different semantic content to different user segments. It is often used in search engine optimization (SEO) to obtain user traffic illegitimately for scams. In this paper, we measure and characterize the prevalence of cloaking on different search engines, how this behavior changes for targeted versus untargeted advertising and ultimately the response to site cloaking by search engine providers. Using a custom crawler, called Dagger, we track both popular search terms (e.g., as identified by Google, Alexa and Twitter) and targeted keywords (focused on pharmaceutical products) for over five months, identifying when distinct results were provided to crawlers and browsers. We further track the lifetime of cloaked search results as well as the sites they point to, demonstrating that cloakers can expect to maintain their pages in search results for several days on popular search engines and maintain the pages themselves for longer still.
伪装是一种常见的“诱饵转换”技术,用于通过向不同的用户群提供明显不同的语义内容来隐藏Web站点的真实本质。它经常被用于搜索引擎优化(SEO)中,以非法获取用户流量进行诈骗。在本文中,我们测量和描述了不同搜索引擎上伪装的流行程度,这种行为在目标广告和非目标广告中是如何变化的,以及最终搜索引擎提供商对网站伪装的反应。使用一个名为Dagger的自定义爬虫,我们跟踪流行搜索词(例如,由Google, Alexa和Twitter识别)和目标关键字(专注于药品)超过五个月,确定何时向爬虫和浏览器提供不同的结果。我们进一步跟踪隐藏搜索结果的生命周期,以及它们指向的网站,证明在流行的搜索引擎上,隐藏者可以期望在搜索结果中保留他们的页面数天,并且页面本身可以保持更长时间。
{"title":"Cloak and dagger: dynamics of web search cloaking","authors":"David Y. Wang, S. Savage, G. Voelker","doi":"10.1145/2046707.2046763","DOIUrl":"https://doi.org/10.1145/2046707.2046763","url":null,"abstract":"Cloaking is a common 'bait-and-switch' technique used to hide the true nature of a Web site by delivering blatantly different semantic content to different user segments. It is often used in search engine optimization (SEO) to obtain user traffic illegitimately for scams. In this paper, we measure and characterize the prevalence of cloaking on different search engines, how this behavior changes for targeted versus untargeted advertising and ultimately the response to site cloaking by search engine providers. Using a custom crawler, called Dagger, we track both popular search terms (e.g., as identified by Google, Alexa and Twitter) and targeted keywords (focused on pharmaceutical products) for over five months, identifying when distinct results were provided to crawlers and browsers. We further track the lifetime of cloaked search results as well as the sites they point to, demonstrating that cloakers can expect to maintain their pages in search results for several days on popular search engines and maintain the pages themselves for longer still.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"14 1","pages":"477-490"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"74354458","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 102
The power of procrastination: detection and mitigation of execution-stalling malicious code 拖延的力量:检测和减轻执行拖延的恶意代码
C. Kolbitsch, E. Kirda, Christopher Krügel
Malware continues to remain one of the most important security problems on the Internet today. Whenever an anti-malware solution becomes popular, malware authors typically react promptly and modify their programs to evade defense mechanisms. For example, recently, malware authors have increasingly started to create malicious code that can evade dynamic analysis. One recent form of evasion against dynamic analysis systems is stalling code. Stalling code is typically executed before any malicious behavior. The attacker's aim is to delay the execution of the malicious activity long enough so that an automated dynamic analysis system fails to extract the interesting malicious behavior. This paper presents the first approach to detect and mitigate malicious stalling code, and to ensure forward progress within the amount of time allocated for the analysis of a sample. Experimental results show that our system, called HASTEN, works well in practice, and that it is able to detect additional malicious behavior in real-world malware samples.
恶意软件仍然是当今互联网上最重要的安全问题之一。每当反恶意软件解决方案流行起来时,恶意软件作者通常会迅速做出反应并修改其程序以逃避防御机制。例如,最近,恶意软件作者越来越多地开始创建可以逃避动态分析的恶意代码。最近一种针对动态分析系统的规避形式是拖延代码。拖延代码通常在任何恶意行为之前执行。攻击者的目标是将恶意活动的执行延迟足够长的时间,以便自动动态分析系统无法提取出有趣的恶意行为。本文提出了检测和减轻恶意拖延代码的第一种方法,并确保在分配给样本分析的时间内取得进展。实验结果表明,我们的系统(称为accelerate)在实践中运行良好,并且能够在真实的恶意软件样本中检测到额外的恶意行为。
{"title":"The power of procrastination: detection and mitigation of execution-stalling malicious code","authors":"C. Kolbitsch, E. Kirda, Christopher Krügel","doi":"10.1145/2046707.2046740","DOIUrl":"https://doi.org/10.1145/2046707.2046740","url":null,"abstract":"Malware continues to remain one of the most important security problems on the Internet today. Whenever an anti-malware solution becomes popular, malware authors typically react promptly and modify their programs to evade defense mechanisms. For example, recently, malware authors have increasingly started to create malicious code that can evade dynamic analysis.\u0000 One recent form of evasion against dynamic analysis systems is stalling code. Stalling code is typically executed before any malicious behavior. The attacker's aim is to delay the execution of the malicious activity long enough so that an automated dynamic analysis system fails to extract the interesting malicious behavior. This paper presents the first approach to detect and mitigate malicious stalling code, and to ensure forward progress within the amount of time allocated for the analysis of a sample. Experimental results show that our system, called HASTEN, works well in practice, and that it is able to detect additional malicious behavior in real-world malware samples.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"11 1","pages":"285-296"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"78363735","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 107
Televisions, video privacy, and powerline electromagnetic interference 电视,视频隐私,电力线电磁干扰
Miro Enev, Sidhant Gupta, Tadayoshi Kohno, Shwetak N. Patel
We conduct an extensive study of information leakage over the powerline infrastructure from eight televisions (TVs) spanning multiple makes, models, and underlying technologies. In addition to being of scientific interest, our findings contribute to the overall debate of whether or not measurements of residential powerlines reveal significant information about the activities within a home. We find that the power supplies of modern TVs produce discernible electromagnetic interference (EMI) signatures that are indicative of the video content being displayed. We measure the stability of these signatures over time and across multiple instances of the same TV model, as well as the robustness of these signatures in the presence of other noisy electronic devices connected to the same powerline.
我们对跨越多个品牌、型号和底层技术的8台电视的电力线基础设施上的信息泄漏进行了广泛的研究。除了具有科学意义外,我们的发现还有助于对住宅电力线的测量是否揭示了家庭活动的重要信息的全面辩论。我们发现,现代电视的电源会产生可识别的电磁干扰(EMI)信号,这表明正在显示的视频内容。我们测量了这些信号随时间的稳定性,以及同一电视型号的多个实例,以及在连接到同一电力线的其他嘈杂电子设备存在时这些信号的稳健性。
{"title":"Televisions, video privacy, and powerline electromagnetic interference","authors":"Miro Enev, Sidhant Gupta, Tadayoshi Kohno, Shwetak N. Patel","doi":"10.1145/2046707.2046770","DOIUrl":"https://doi.org/10.1145/2046707.2046770","url":null,"abstract":"We conduct an extensive study of information leakage over the powerline infrastructure from eight televisions (TVs) spanning multiple makes, models, and underlying technologies. In addition to being of scientific interest, our findings contribute to the overall debate of whether or not measurements of residential powerlines reveal significant information about the activities within a home. We find that the power supplies of modern TVs produce discernible electromagnetic interference (EMI) signatures that are indicative of the video content being displayed. We measure the stability of these signatures over time and across multiple instances of the same TV model, as well as the robustness of these signatures in the presence of other noisy electronic devices connected to the same powerline.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"9 1","pages":"537-550"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"82097373","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 66
期刊
Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1