Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Mitigating denial-of-service attacks in MANET by distributed packet
filtering: a game-theoretic approach
author:Xiaoxin Wu and
David K. Y. Yau
Mitigating Denial-of-Service Attacks in MANET by
Distributed Packet Filtering: A Game-theoretic Approach ∗
Intel China Research Center Ltd
Xiaoxin Wu
Beijing, China
xiaoxin.wu@intel.com
ABSTRACT
Defending against denial-of-service (DoS) in a mobile ad
hoc network (MANET) is challenging because the network
topology is dynamic and nodes are selﬁsh. In this paper, we
propose a DoS mitigation technique that uses digital signa-
tures to verify legitimate packets, and drop packets that do
not pass the veriﬁcation. Since nodes are selﬁsh, they may
not perform the veriﬁcation so that they can avoid paying
the overhead. A bad packet that escapes veriﬁcation along
the whole network path will bring a penalty to all its for-
warders. A network game can be formulated in which nodes
along a network path, in optimizing their own beneﬁts, are
encouraged to act collectively to ﬁlter out bad packets. An-
alytical results show that Nash equilibrium can be attained
for players in the proposed game, in which signiﬁcant ben-
eﬁts can be provided to forwarders such that many of the
bad packets will be eliminated by veriﬁcation.
1.
INTRODUCTION
The dependencies between dynamic, mutually untrusted
neighbors in a mobile ad hoc network (MANET) create im-
portant security concerns in such networks. Among the at-
tacks documented in the literature, denial-of-service (DoS)
attacks are particularly damaging since both communica-
tion bandwidth and node resources are scarce in MANETs.
In addition to their ability to take down a network quickly,
DoS attacks directed at bandwidth and end node resources
are easy to launch; e.g., by simply injecting useless traﬃc
into the network.
DoS mitigation techniques designed for wireline networks
will not work well in an ad hoc environment where the routes
and the set of forwarders on a routing path are highly dy-
...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Mitigating denial-of-service attacks in MANET by distributed packet
filtering: a game-theoretic approach
author:Xiaoxin Wu and
David K. Y. Yau
Mitigating Denial-of-Service Attacks in MANET by
Distributed Packet Filtering: A Game-theoretic Approach ∗
Intel China Research Center Ltd
Xiaoxin Wu
Beijing, China
xiaoxin.wu@intel.com
ABSTRACT
Defending against denial-of-service (DoS) in a mobile ad
hoc network (MANET) is challenging because the network
topology is dynamic and nodes are selﬁsh. In this paper, we
propose a DoS mitigation technique that uses digital signa-
tures to verify legitimate packets, and drop packets that do
not pass the veriﬁcation. Since nodes are selﬁsh, they may
not perform the veriﬁcation so that they can avoid paying
the overhead. A bad packet that escapes veriﬁcation along
the whole network path will bring a penalty to all its for-
warders. A network game can be formulated in which nodes
along a network path, in optimizing their own beneﬁts, are
encouraged to act collectively to ﬁlter out bad packets. An-
alytical results show that Nash equilibrium can be attained
for players in the proposed game, in which signiﬁcant ben-
eﬁts can be provided to forwarders such that many of the
bad packets will be eliminated by veriﬁcation.
1.
INTRODUCTION
The dependencies between dynamic, mutually untrusted
neighbors in a mobile ad hoc network (MANET) create im-
portant security concerns in such networks. Among the at-
tacks documented in the literature, denial-of-service (DoS)
attacks are particularly damaging since both communica-
tion bandwidth and node resources are scarce in MANETs.
In addition to their ability to take down a network quickly,
DoS attacks directed at bandwidth and end node resources
are easy to launch; e.g., by simply injecting useless traﬃc
into the network.
DoS mitigation techniques designed for wireline networks
will not work well in an ad hoc environment where the routes
and the set of forwarders on a routing path are highly dy-
...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:POSTER: Towards Highly Interactive Honeypots for Industrial Control
Systems
author:Stephan Lau and
Johannes Klick and
Stephan Arndt and
Volker Roth
POSTER: Towards Highly Interactive Honeypots for
Industrial Control Systems
Stephan Lau
Freie Universität Berlin
stephan.lau@fu-berlin.de
Johannes Klick
Freie Universität Berlin
johannes.klick@fu-
berlin.de
Stephan Arndt
Freie Universität Berlin
stephan.arndt@fu-
berlin.de
Volker Roth
Freie Universität Berlin
volker.roth@fu-berlin.de
ABSTRACT
Honeypots are a common tool to set intrusion alarms and to
study attacks against computer systems. In order to be con-
vincing, honeypots attempt to resemble actual systems that
are in active use. Recently, researchers have begun to develop
honeypots for programmable logic controllers (PLCs). The
tools of which we are aware have limited functionality com-
pared to genuine devices. Particularly, they do not support
running actual PLC programs.
In order to improve upon the interactive capabilities of
PLC honeypots we set out to develop a simulator for Siemens
S7-300 series PLCs. Our current prototype XPOT supports
PLC program compilation and interpretation, the proprietary
S7comm protocol and SNMP. While the supported feature
set is not yet comprehensive, it is possible to program it using
standard IDEs such as Siemens’ TIA portal. Additionally,
we emulate the characteristics of the network stack of our
reference PLC in order to resist OS ﬁngerprinting attempts
using tools such as Nmap.
Initial experiments with students whom we trained in PLC
programming indicate that XPOT may resist cursory in-
spection but still fails against knowledgeable and suspicious
adversaries. We conclude that high-interactive PLC hon-
eypots need to support a fairly complete feature set of the
genuine, simulated PLC.
Keywords
Honeypot; Programmable Logic Controller (PLC); Industrial
Control Systems (ICS); SCADA
1.
INTRODUCTION
Connecting devices to the Internet often increases their
utility – at the pr...


Instruction: 总结这篇安全研究的主要观点

Input:
title:POSTER: Towards Highly Interactive Honeypots for Industrial Control
Systems
author:Stephan Lau and
Johannes Klick and
Stephan Arndt and
Volker Roth
POSTER: Towards Highly Interactive Honeypots for
Industrial Control Systems
Stephan Lau
Freie Universität Berlin
stephan.lau@fu-berlin.de
Johannes Klick
Freie Universität Berlin
johannes.klick@fu-
berlin.de
Stephan Arndt
Freie Universität Berlin
stephan.arndt@fu-
berlin.de
Volker Roth
Freie Universität Berlin
volker.roth@fu-berlin.de
ABSTRACT
Honeypots are a common tool to set intrusion alarms and to
study attacks against computer systems. In order to be con-
vincing, honeypots attempt to resemble actual systems that
are in active use. Recently, researchers have begun to develop
honeypots for programmable logic controllers (PLCs). The
tools of which we are aware have limited functionality com-
pared to genuine devices. Particularly, they do not support
running actual PLC programs.
In order to improve upon the interactive capabilities of
PLC honeypots we set out to develop a simulator for Siemens
S7-300 series PLCs. Our current prototype XPOT supports
PLC program compilation and interpretation, the proprietary
S7comm protocol and SNMP. While the supported feature
set is not yet comprehensive, it is possible to program it using
standard IDEs such as Siemens’ TIA portal. Additionally,
we emulate the characteristics of the network stack of our
reference PLC in order to resist OS ﬁngerprinting attempts
using tools such as Nmap.
Initial experiments with students whom we trained in PLC
programming indicate that XPOT may resist cursory in-
spection but still fails against knowledgeable and suspicious
adversaries. We conclude that high-interactive PLC hon-
eypots need to support a fairly complete feature set of the
genuine, simulated PLC.
Keywords
Honeypot; Programmable Logic Controller (PLC); Industrial
Control Systems (ICS); SCADA
1.
INTRODUCTION
Connecting devices to the Internet often increases their
utility – at the pr...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Ether: malware analysis via hardware virtualization extensions
author:Artem Dinaburg and
Paul Royal and
Monirul I. Sharif and
Wenke Lee
Ether: Malware Analysis via
Hardware Virtualization Extensions
Artem Dinaburg∗†, Paul Royal†∗, Monirul Sharif∗†, Wenke Lee†∗
{artem, paul, msharif, wenke}@{gtisc.gatech.edu, damballa.com}
∗Georgia Institute of Technology, Atlanta, GA, USA
†Damballa, Inc., Atlanta, GA, USA
ABSTRACT
Malware has become the centerpiece of most security threats
on the Internet. Malware analysis is an essential technology
that extracts the runtime behavior of malware, and supplies
signatures to detection systems and provides evidence for re-
covery and cleanup. The focal point in the malware analysis
battle is how to detect versus how to hide a malware ana-
lyzer from malware during runtime. State-of-the-art analyz-
ers reside in or emulate part of the guest operating system
and its underlying hardware, making them easy to detect
and evade. In this paper, we propose a transparent and ex-
ternal approach to malware analysis, which is motivated by
the intuition that for a malware analyzer to be transparent,
it must not induce any side-eﬀects that are unconditionally
detectable by malware. Our analyzer, Ether, is based on a
novel application of hardware virtualization extensions such
as Intel VT, and resides completely outside of the target OS
environment. Thus, there are no in-guest software compo-
nents vulnerable to detection, and there are no shortcomings
that arise from incomplete or inaccurate system emulation.
Our experiments are based on our study of obfuscation tech-
niques used to create 25,000 recent malware samples. The
results show that Ether remains transparent and defeats the
obfuscation tools that evade existing approaches.
Categories and Subject Descriptors
D.4.6 [Operating Systems]: Security and Protection—In-
vasive software
General Terms
Security
Keywords
Malware Analysis, Dynamic Analysis, Virtualization, Emu-
lation, Unpacking
Per...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Ether: malware analysis via hardware virtualization extensions
author:Artem Dinaburg and
Paul Royal and
Monirul I. Sharif and
Wenke Lee
Ether: Malware Analysis via
Hardware Virtualization Extensions
Artem Dinaburg∗†, Paul Royal†∗, Monirul Sharif∗†, Wenke Lee†∗
{artem, paul, msharif, wenke}@{gtisc.gatech.edu, damballa.com}
∗Georgia Institute of Technology, Atlanta, GA, USA
†Damballa, Inc., Atlanta, GA, USA
ABSTRACT
Malware has become the centerpiece of most security threats
on the Internet. Malware analysis is an essential technology
that extracts the runtime behavior of malware, and supplies
signatures to detection systems and provides evidence for re-
covery and cleanup. The focal point in the malware analysis
battle is how to detect versus how to hide a malware ana-
lyzer from malware during runtime. State-of-the-art analyz-
ers reside in or emulate part of the guest operating system
and its underlying hardware, making them easy to detect
and evade. In this paper, we propose a transparent and ex-
ternal approach to malware analysis, which is motivated by
the intuition that for a malware analyzer to be transparent,
it must not induce any side-eﬀects that are unconditionally
detectable by malware. Our analyzer, Ether, is based on a
novel application of hardware virtualization extensions such
as Intel VT, and resides completely outside of the target OS
environment. Thus, there are no in-guest software compo-
nents vulnerable to detection, and there are no shortcomings
that arise from incomplete or inaccurate system emulation.
Our experiments are based on our study of obfuscation tech-
niques used to create 25,000 recent malware samples. The
results show that Ether remains transparent and defeats the
obfuscation tools that evade existing approaches.
Categories and Subject Descriptors
D.4.6 [Operating Systems]: Security and Protection—In-
vasive software
General Terms
Security
Keywords
Malware Analysis, Dynamic Analysis, Virtualization, Emu-
lation, Unpacking
Per...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Processor-Level Selective Replication
author:Nithin Nakka and
Karthik Pattabiraman and
Ravishankar K. Iyer
Processor-level Selective Replication
Nithin Nakka, Karthik Pattabiraman, Ravishankar Iyer
Center for Reliable and High Performance Computing
Coordinated Science Laboratory
{nakka, pattabir, iyer}@crhc.uiuc.edu
Abstract
that  only
it  can  be  ensured
We  propose  a  processor-level  technique  called
Selective  Replication,  by  which  the  application  can
choose  where  in  its  application  stream  and  to  what
degree  it  requires  replication.  Recent  work  on  static
analysis  and
fault-injection-based  experiments  on
applications  reveals  that  certain  variables  in  the
application  are  critical  to  its  crash-  and  hang-free
execution.  If
the
computation  of  these  variables  is  error-free,  then  a
high  degree  of  crash/hang  coverage  can  be  achieved
at a low performance overhead to the application. The
Selective  Replication  technique  provides  an  ideal
platform  for  validating  this  claim.  The  technique  is
compared against complete duplication as provided in
current architecture-level techniques. The results show
that  with  about  59%
full
duplication,  selective  replication  detects  97%  of  the
data  errors  and  87%  of  the  instruction  errors  that
were  covered  by  full  duplication.  It  also  reduces  the
detection of errors benign to the final outcome of the
application by 17.8% as compared to full duplication.
less  overhead
Keywords:  Application-aware,  Error  Detection,
Redundant Hardware, Critical Variable, Duplication.
1. Introduction
than
The
System-level  replication  has  been  widely  used  to
detect  and  possibly  tolerate  transient  errors  in  both
commercial systems and research prototypes. Recently,
processor-level  replication  has  emerged  as  a  viable
technique [1].
redundancy  and
two  basic  approaches  for  processor-level
replication  ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Processor-Level Selective Replication
author:Nithin Nakka and
Karthik Pattabiraman and
Ravishankar K. Iyer
Processor-level Selective Replication
Nithin Nakka, Karthik Pattabiraman, Ravishankar Iyer
Center for Reliable and High Performance Computing
Coordinated Science Laboratory
{nakka, pattabir, iyer}@crhc.uiuc.edu
Abstract
that  only
it  can  be  ensured
We  propose  a  processor-level  technique  called
Selective  Replication,  by  which  the  application  can
choose  where  in  its  application  stream  and  to  what
degree  it  requires  replication.  Recent  work  on  static
analysis  and
fault-injection-based  experiments  on
applications  reveals  that  certain  variables  in  the
application  are  critical  to  its  crash-  and  hang-free
execution.  If
the
computation  of  these  variables  is  error-free,  then  a
high  degree  of  crash/hang  coverage  can  be  achieved
at a low performance overhead to the application. The
Selective  Replication  technique  provides  an  ideal
platform  for  validating  this  claim.  The  technique  is
compared against complete duplication as provided in
current architecture-level techniques. The results show
that  with  about  59%
full
duplication,  selective  replication  detects  97%  of  the
data  errors  and  87%  of  the  instruction  errors  that
were  covered  by  full  duplication.  It  also  reduces  the
detection of errors benign to the final outcome of the
application by 17.8% as compared to full duplication.
less  overhead
Keywords:  Application-aware,  Error  Detection,
Redundant Hardware, Critical Variable, Duplication.
1. Introduction
than
The
System-level  replication  has  been  widely  used  to
detect  and  possibly  tolerate  transient  errors  in  both
commercial systems and research prototypes. Recently,
processor-level  replication  has  emerged  as  a  viable
technique [1].
redundancy  and
two  basic  approaches  for  processor-level
replication  ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:EnclavePDP: A General Framework to Verify Data Integrity in Cloud
Using Intel SGX
author:Yun He and
Yihua Xu and
Xiaoqi Jia and
Shengzhi Zhang and
Peng Liu and
Shuai Chang
EnclavePDP: A General Framework to Verify Data Integrity in Cloud
Using Intel SGX
Yun He1,2, Yihua Xu3, Xiaoqi Jia1,2∗
, Shengzhi Zhang3, Peng Liu4, and Shuai Chang1,2
1{CAS-KLONAT†, BKLONSPT‡}, Institute of Information Engineering, Chinese Academy of Sciences
2School of Cyber Security, University of Chinese Academy of Sciences
3Metropolitan College, Boston University
4Pennsylvania State University
Abstract
As the cloud storage service becomes pervasive, verifying the
integrity of their outsourced data on cloud remotely turns out
to be challenging for users. Existing Provable Data Posses-
sion (PDP) schemes mostly resort to a Third Party Auditor
(TPA) to verify the integrity on behalf of users, thus reducing
their communication and computation burden. However, such
schemes demand fully trusted TPA, that is, placing TPA in the
Trusted Computing Base (TCB), which is not always a rea-
sonable assumption. In this paper, we propose EnclavePDP, a
secure and general data integrity veriﬁcation framework that
relies on Intel SGX to establish the TCB for PDP schemes,
thus eliminating the TPA from the TCB. EnclavePDP sup-
ports both new and existing PDP schemes by integrating core
functionalities of cryptography libraries into Intel SGX. We
choose 10 existing representative PDP schemes, and port
them into EnclavePDP with reasonable effort. By deploy-
ing EnclavePDP in a real-world cloud storage platform and
running the 10 PDP schemes respectively, we demonstrate
that EnclavePDP can eliminate the dependence on TPA and
introduce reasonable performance overhead.
1 Introduction
Nowadays, many organizations demand to keep their data
records, and then perform deep analysis over the data us-
ing machine learning or other techniques for their business
purposes. For instance, e-health companies offer optimized
...


Instruction: 总结这篇安全研究的主要观点

Input:
title:EnclavePDP: A General Framework to Verify Data Integrity in Cloud
Using Intel SGX
author:Yun He and
Yihua Xu and
Xiaoqi Jia and
Shengzhi Zhang and
Peng Liu and
Shuai Chang
EnclavePDP: A General Framework to Verify Data Integrity in Cloud
Using Intel SGX
Yun He1,2, Yihua Xu3, Xiaoqi Jia1,2∗
, Shengzhi Zhang3, Peng Liu4, and Shuai Chang1,2
1{CAS-KLONAT†, BKLONSPT‡}, Institute of Information Engineering, Chinese Academy of Sciences
2School of Cyber Security, University of Chinese Academy of Sciences
3Metropolitan College, Boston University
4Pennsylvania State University
Abstract
As the cloud storage service becomes pervasive, verifying the
integrity of their outsourced data on cloud remotely turns out
to be challenging for users. Existing Provable Data Posses-
sion (PDP) schemes mostly resort to a Third Party Auditor
(TPA) to verify the integrity on behalf of users, thus reducing
their communication and computation burden. However, such
schemes demand fully trusted TPA, that is, placing TPA in the
Trusted Computing Base (TCB), which is not always a rea-
sonable assumption. In this paper, we propose EnclavePDP, a
secure and general data integrity veriﬁcation framework that
relies on Intel SGX to establish the TCB for PDP schemes,
thus eliminating the TPA from the TCB. EnclavePDP sup-
ports both new and existing PDP schemes by integrating core
functionalities of cryptography libraries into Intel SGX. We
choose 10 existing representative PDP schemes, and port
them into EnclavePDP with reasonable effort. By deploy-
ing EnclavePDP in a real-world cloud storage platform and
running the 10 PDP schemes respectively, we demonstrate
that EnclavePDP can eliminate the dependence on TPA and
introduce reasonable performance overhead.
1 Introduction
Nowadays, many organizations demand to keep their data
records, and then perform deep analysis over the data us-
ing machine learning or other techniques for their business
purposes. For instance, e-health companies offer optimized
...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:DeTor: Provably Avoiding Geographic Regions in Tor
author:Zhihao Li and
Stephen Herwig and
Dave Levin
DeTor: Provably Avoiding Geographic
Regions in Tor
Zhihao Li, Stephen Herwig, and Dave Levin, University of Maryland
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/li
This paper is included in the Proceedings of the 26th USENIX Security SymposiumAugust 16–18, 2017 • Vancouver, BC, CanadaISBN 978-1-931971-40-9Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIXDeTor: Provably Avoiding Geographic Regions in Tor
Zhihao Li, Stephen Herwig, and Dave Levin
University of Maryland
Abstract
destination [19].
Large, routing-capable adversaries such as nation-
states have the ability to censor and launch powerful
deanonymization attacks against Tor circuits that traverse
their borders. Tor allows users to specify a set of coun-
tries to exclude from circuit selection, but this provides
merely the illusion of control, as it does not preclude
those countries from being on the path between nodes
in a circuit. For instance, we ﬁnd that circuits excluding
US Tor nodes deﬁnitively avoid the US 12% of the time.
This paper presents DeTor, a set of techniques for
proving when a Tor circuit has avoided user-speciﬁed ge-
ographic regions. DeTor extends recent work on using
speed-of-light constraints to prove that a round-trip of
communication physically could not have traversed cer-
tain geographic regions. As such, DeTor does not require
modiﬁcations to the Tor protocol, nor does it require a
map of the Internet’s topology. We show how DeTor can
be used to avoid censors (by never transiting the cen-
sor once) and to avoid timing-based deanonymization
attacks (by never transiting a geographic region twice).
We analyze DeTor’s success at ﬁnding avoidance circuits
through simulation using real latencies from Tor.
1
Introduction
Tor [8] has proven to be an effective tool at providing
anonymous communication ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:DeTor: Provably Avoiding Geographic Regions in Tor
author:Zhihao Li and
Stephen Herwig and
Dave Levin
DeTor: Provably Avoiding Geographic
Regions in Tor
Zhihao Li, Stephen Herwig, and Dave Levin, University of Maryland
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/li
This paper is included in the Proceedings of the 26th USENIX Security SymposiumAugust 16–18, 2017 • Vancouver, BC, CanadaISBN 978-1-931971-40-9Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIXDeTor: Provably Avoiding Geographic Regions in Tor
Zhihao Li, Stephen Herwig, and Dave Levin
University of Maryland
Abstract
destination [19].
Large, routing-capable adversaries such as nation-
states have the ability to censor and launch powerful
deanonymization attacks against Tor circuits that traverse
their borders. Tor allows users to specify a set of coun-
tries to exclude from circuit selection, but this provides
merely the illusion of control, as it does not preclude
those countries from being on the path between nodes
in a circuit. For instance, we ﬁnd that circuits excluding
US Tor nodes deﬁnitively avoid the US 12% of the time.
This paper presents DeTor, a set of techniques for
proving when a Tor circuit has avoided user-speciﬁed ge-
ographic regions. DeTor extends recent work on using
speed-of-light constraints to prove that a round-trip of
communication physically could not have traversed cer-
tain geographic regions. As such, DeTor does not require
modiﬁcations to the Tor protocol, nor does it require a
map of the Internet’s topology. We show how DeTor can
be used to avoid censors (by never transiting the cen-
sor once) and to avoid timing-based deanonymization
attacks (by never transiting a geographic region twice).
We analyze DeTor’s success at ﬁnding avoidance circuits
through simulation using real latencies from Tor.
1
Introduction
Tor [8] has proven to be an effective tool at providing
anonymous communication ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Measuring the state of ECN readiness in servers, clients, and routers
author:Steven J. Bauer and
Robert Beverly and
Arthur W. Berger
Measuring the State of ECN Readiness in Servers, Clients,
and Routers
Steven Bauer
MIT CSAIL
bauer@mit.edu
Robert Beverly
Naval Postgraduate School
rbeverly@nps.edu
Arthur Berger
MIT CSAIL / Akamai
awberger@csail.mit.edu
ABSTRACT
Better exposing congestion can improve traﬃc management
in the wide-area, at peering points, among residential broad-
band connections, and in the data center. TCP’s network
utilization and eﬃciency depends on congestion informa-
tion, while recent research proposes economic and policy
models based on congestion. Such motivations have driven
widespread support of Explicit Congestion Notiﬁcation (ECN)
in modern operating systems. We reappraise the Internet’s
ECN readiness, updating and extending previous measure-
ments. Across large and diverse server populations, we ﬁnd
a three-fold increase in ECN support over prior studies. Us-
ing new methods, we characterize ECN within mobile infras-
tructure and at the client-side, populations previously un-
measured. Via large-scale path measurements, we ﬁnd the
ECN feedback loop failing in the core of the network 40% of
the time, typically at AS boundaries. Finally, we discover
new examples of infrastructure violating ECN Internet stan-
dards, and discuss remaining impediments to running ECN
while suggesting mechanisms to aid adoption.
Categories and Subject Descriptors
C.2.3 [Computer Communication Networks]: Network
Operations—network monitoring; C.2.1 [Computer Com-
munication Networks]: Network Architecture and Design
General Terms
ECN, Measurement, Experimentation
Keywords
Explicit Congestion Notiﬁcation, Router-Assisted Conges-
tion Control
1.
INTRODUCTION
The Internet’s traditional end-to-end approach to conges-
tion control, TCP, attempts to simultaneously optimize ef-
ﬁciency and fairness between traﬃc ﬂows[14]. Cooperating
end host TCPs must infer conges...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Measuring the state of ECN readiness in servers, clients, and routers
author:Steven J. Bauer and
Robert Beverly and
Arthur W. Berger
Measuring the State of ECN Readiness in Servers, Clients,
and Routers
Steven Bauer
MIT CSAIL
bauer@mit.edu
Robert Beverly
Naval Postgraduate School
rbeverly@nps.edu
Arthur Berger
MIT CSAIL / Akamai
awberger@csail.mit.edu
ABSTRACT
Better exposing congestion can improve traﬃc management
in the wide-area, at peering points, among residential broad-
band connections, and in the data center. TCP’s network
utilization and eﬃciency depends on congestion informa-
tion, while recent research proposes economic and policy
models based on congestion. Such motivations have driven
widespread support of Explicit Congestion Notiﬁcation (ECN)
in modern operating systems. We reappraise the Internet’s
ECN readiness, updating and extending previous measure-
ments. Across large and diverse server populations, we ﬁnd
a three-fold increase in ECN support over prior studies. Us-
ing new methods, we characterize ECN within mobile infras-
tructure and at the client-side, populations previously un-
measured. Via large-scale path measurements, we ﬁnd the
ECN feedback loop failing in the core of the network 40% of
the time, typically at AS boundaries. Finally, we discover
new examples of infrastructure violating ECN Internet stan-
dards, and discuss remaining impediments to running ECN
while suggesting mechanisms to aid adoption.
Categories and Subject Descriptors
C.2.3 [Computer Communication Networks]: Network
Operations—network monitoring; C.2.1 [Computer Com-
munication Networks]: Network Architecture and Design
General Terms
ECN, Measurement, Experimentation
Keywords
Explicit Congestion Notiﬁcation, Router-Assisted Conges-
tion Control
1.
INTRODUCTION
The Internet’s traditional end-to-end approach to conges-
tion control, TCP, attempts to simultaneously optimize ef-
ﬁciency and fairness between traﬃc ﬂows[14]. Cooperating
end host TCPs must infer conges...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:CIPHERLEAKS: Breaking Constant-time Cryptography on AMD SEV
via the Ciphertext Side Channel
author:Mengyuan Li and
Yinqian Zhang and
Huibo Wang and
Kang Li and
Yueqiang Cheng
CipherLeaks: Breaking Constant-time Cryptography
on AMD SEV via the Ciphertext Side Channel
Mengyuan Li, The Ohio State University; Yinqian Zhang, Southern University
of Science and Technology; Huibo Wang and Kang Li, Baidu Security;
Yueqiang Cheng, NIO Security Research
https://www.usenix.org/conference/usenixsecurity21/presentation/li-mengyuan
This paper is included in the Proceedings of the 30th USENIX Security Symposium.August 11–13, 2021978-1-939133-24-3Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX.CIPHERLEAKS: Breaking Constant-time Cryptography on AMD SEV
via the Ciphertext Side Channel
Mengyuan Li∗
The Ohio State University
Yinqian Zhang† (cid:66)
Southern University of Science and Technology
Huibo Wang
Baidu Security
Kang Li
Baidu Security
Yueqiang Cheng‡
NIO Security Research
Abstract
AMD’s Secure Encrypted Virtualization (SEV) is a hard-
ware extension available in AMD’s EPYC server processors
to support conﬁdential cloud computing. While various prior
studies have demonstrated attacks against SEV by exploiting
its lack of encryption in the VM control block or the lack of
integrity protection of the encrypted memory and nested page
tables, these issues have been addressed in the subsequent
releases of SEV-Encrypted State (SEV-ES) and SEV-Secure
Nested Paging (SEV-SNP).
In this paper, we study a previously unexplored vulner-
ability of SEV, including both SEV-ES and SEV-SNP. The
vulnerability is dubbed ciphertext side channels, which allows
the privileged adversary to infer the guest VM’s execution
states or recover certain plaintext. To demonstrate the sever-
ity of the vulnerability, we present the CIPHERLEAKS attack,
which exploits the ciphertext side channel to steal private keys
from the constant-time implementation of the R...


Instruction: 总结这篇安全研究的主要观点

Input:
title:CIPHERLEAKS: Breaking Constant-time Cryptography on AMD SEV
via the Ciphertext Side Channel
author:Mengyuan Li and
Yinqian Zhang and
Huibo Wang and
Kang Li and
Yueqiang Cheng
CipherLeaks: Breaking Constant-time Cryptography
on AMD SEV via the Ciphertext Side Channel
Mengyuan Li, The Ohio State University; Yinqian Zhang, Southern University
of Science and Technology; Huibo Wang and Kang Li, Baidu Security;
Yueqiang Cheng, NIO Security Research
https://www.usenix.org/conference/usenixsecurity21/presentation/li-mengyuan
This paper is included in the Proceedings of the 30th USENIX Security Symposium.August 11–13, 2021978-1-939133-24-3Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX.CIPHERLEAKS: Breaking Constant-time Cryptography on AMD SEV
via the Ciphertext Side Channel
Mengyuan Li∗
The Ohio State University
Yinqian Zhang† (cid:66)
Southern University of Science and Technology
Huibo Wang
Baidu Security
Kang Li
Baidu Security
Yueqiang Cheng‡
NIO Security Research
Abstract
AMD’s Secure Encrypted Virtualization (SEV) is a hard-
ware extension available in AMD’s EPYC server processors
to support conﬁdential cloud computing. While various prior
studies have demonstrated attacks against SEV by exploiting
its lack of encryption in the VM control block or the lack of
integrity protection of the encrypted memory and nested page
tables, these issues have been addressed in the subsequent
releases of SEV-Encrypted State (SEV-ES) and SEV-Secure
Nested Paging (SEV-SNP).
In this paper, we study a previously unexplored vulner-
ability of SEV, including both SEV-ES and SEV-SNP. The
vulnerability is dubbed ciphertext side channels, which allows
the privileged adversary to infer the guest VM’s execution
states or recover certain plaintext. To demonstrate the sever-
ity of the vulnerability, we present the CIPHERLEAKS attack,
which exploits the ciphertext side channel to steal private keys
from the constant-time implementation of the R...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Comprehensive shellcode detection using runtime heuristics
author:Michalis Polychronakis and
Kostas G. Anagnostakis and
Evangelos P. Markatos
Comprehensive Shellcode Detection using Runtime
Heuristics
Michalis Polychronakis
Columbia University, USA
mikepo@cs.columbia.edu
Kostas G. Anagnostakis
Niometrics, Singapore
kostas@niometrics.com
Evangelos P. Markatos
FORTH-ICS, Greece
markatos@ics.forth.gr
ABSTRACT
A promising method for the detection of previously unknown code
injection attacks is the identiﬁcation of the shellcode that is part of
the attack vector using payload execution. Existing systems based
on this approach rely on the self-decrypting behavior of polymor-
phic code and can identify only that particular class of shellcode.
Plain, and more importantly, metamorphic shellcode do not carry
a decryption routine nor exhibit any self-modiﬁcations and thus
both evade existing detection systems.
In this paper, we present
a comprehensive shellcode detection technique that uses a set of
runtime heuristics to identify the presence of shellcode in arbitrary
data streams. We have identiﬁed fundamental machine-level oper-
ations that are inescapably performed by different shellcode types,
based on which we have designed heuristics that enable the detec-
tion of plain and metamorphic shellcode regardless of the use of
self-decryption. We have implemented our technique in Gene, a
code injection attack detection system based on passive network
monitoring. Our experimental evaluation and real-world deploy-
ment show that Gene can effectively detect a large and diverse set
of shellcode samples that are currently missed by existing detec-
tors, while so far it has not generated any false positives.
Categories and Subject Descriptors
K.6.5 [Security and Protection]: Invasive software
General Terms
Security
Keywords
Shellcode Detection, Payload Execution, Code Emulation
1.
INTRODUCTION
Code injection attacks have become one of the primary meth-
ods of malware spreading....


Instruction: 总结这篇安全研究的主要观点

Input:
title:Comprehensive shellcode detection using runtime heuristics
author:Michalis Polychronakis and
Kostas G. Anagnostakis and
Evangelos P. Markatos
Comprehensive Shellcode Detection using Runtime
Heuristics
Michalis Polychronakis
Columbia University, USA
mikepo@cs.columbia.edu
Kostas G. Anagnostakis
Niometrics, Singapore
kostas@niometrics.com
Evangelos P. Markatos
FORTH-ICS, Greece
markatos@ics.forth.gr
ABSTRACT
A promising method for the detection of previously unknown code
injection attacks is the identiﬁcation of the shellcode that is part of
the attack vector using payload execution. Existing systems based
on this approach rely on the self-decrypting behavior of polymor-
phic code and can identify only that particular class of shellcode.
Plain, and more importantly, metamorphic shellcode do not carry
a decryption routine nor exhibit any self-modiﬁcations and thus
both evade existing detection systems.
In this paper, we present
a comprehensive shellcode detection technique that uses a set of
runtime heuristics to identify the presence of shellcode in arbitrary
data streams. We have identiﬁed fundamental machine-level oper-
ations that are inescapably performed by different shellcode types,
based on which we have designed heuristics that enable the detec-
tion of plain and metamorphic shellcode regardless of the use of
self-decryption. We have implemented our technique in Gene, a
code injection attack detection system based on passive network
monitoring. Our experimental evaluation and real-world deploy-
ment show that Gene can effectively detect a large and diverse set
of shellcode samples that are currently missed by existing detec-
tors, while so far it has not generated any false positives.
Categories and Subject Descriptors
K.6.5 [Security and Protection]: Invasive software
General Terms
Security
Keywords
Shellcode Detection, Payload Execution, Code Emulation
1.
INTRODUCTION
Code injection attacks have become one of the primary meth-
ods of malware spreading....

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:SRFuzzer: an automatic fuzzing framework for physical SOHO router
devices to discover multi-type vulnerabilities
author:Yu Zhang and
Wei Huo and
Kunpeng Jian and
Ji Shi and
Haoliang Lu and
Longquan Liu and
Chen Wang and
Dandan Sun and
Chao Zhang and
Baoxu Liu
SRFuzzer: An Automatic Fuzzing Framework for
Physical SOHO Router Devices to Discover Multi-
Type Vulnerabilities
{Yu Zhang, Wei Huo, Kunpeng Jian, Ji Shi, Haoliang Lu, Longquan Liu, Chen Wang,
Dandan Sun} 1,2, Chao Zhang3, Baoxu Liu1,2
Institute of Information Engineering, Chinese Academy of Sciences1
School of Cyber Security, University of Chinese Academy of Sciences2
Institute for Network Science and Cyberspace, Tsinghua University3
1
ØSecurity of the SOHO Router is
ØHow to Find the Vulnerability
ØChallenge of Fuzzing the SOHO
Router
Outline
Introduction
Important
Example—— NTP configuration
SRFuzzer——Our Solution
ØSeed Generation
ØSeed Mutation
ØExceptional Behavior Triggering
and Monitoring
ØPower Control
Evaluation
ØExperiment Overview
ØAnalysis of Issues
ØPerformance of Monitors
ØComparison with Popular
Fuzzers
Discussion
Summary
Q&A
2
Security of the SOHO Router is Important
SOHO routers are in prominent position
in nowadays life.
SOHO routers are one of the essential
exploiting targets by adversaries.
ØVPNFilter infected at least 500,000 devices in
at least 54 countries [1]
ØSmart phone, personal computer, camera,
printer, etc
3
Find Vulnerabilities in Routers
Fuzzing is popular in discovering vulnerabilities of IoT devices
Technique
Technique
Emulation
Multi-Type
Vulnerability
Zero-Day
Detection
Coverage-guide
Andrei Costin et al.
Static and Dynamic
Analysis
YES
YES
YES
NO
FIRMADYNE
PoC
YES
NO
NO
NO
IoTFuzzer
Blackbox Fuzzing Blackbox Fuzzing Greybox Fuzzing
Muench et al.
FIRM-AFL
NO
NO
YES
NO
YES
NO
NO
NO
YES
NO
YES
YES
4
Challenge of Fuzzing the SOHO Router
Generator
Initial Seeds
2. How to fuzz dedicated systems?
•  obtain code coverage without emulation is diffcult
•  while emulation...


Instruction: 总结这篇安全研究的主要观点

Input:
title:SRFuzzer: an automatic fuzzing framework for physical SOHO router
devices to discover multi-type vulnerabilities
author:Yu Zhang and
Wei Huo and
Kunpeng Jian and
Ji Shi and
Haoliang Lu and
Longquan Liu and
Chen Wang and
Dandan Sun and
Chao Zhang and
Baoxu Liu
SRFuzzer: An Automatic Fuzzing Framework for
Physical SOHO Router Devices to Discover Multi-
Type Vulnerabilities
{Yu Zhang, Wei Huo, Kunpeng Jian, Ji Shi, Haoliang Lu, Longquan Liu, Chen Wang,
Dandan Sun} 1,2, Chao Zhang3, Baoxu Liu1,2
Institute of Information Engineering, Chinese Academy of Sciences1
School of Cyber Security, University of Chinese Academy of Sciences2
Institute for Network Science and Cyberspace, Tsinghua University3
1
ØSecurity of the SOHO Router is
ØHow to Find the Vulnerability
ØChallenge of Fuzzing the SOHO
Router
Outline
Introduction
Important
Example—— NTP configuration
SRFuzzer——Our Solution
ØSeed Generation
ØSeed Mutation
ØExceptional Behavior Triggering
and Monitoring
ØPower Control
Evaluation
ØExperiment Overview
ØAnalysis of Issues
ØPerformance of Monitors
ØComparison with Popular
Fuzzers
Discussion
Summary
Q&A
2
Security of the SOHO Router is Important
SOHO routers are in prominent position
in nowadays life.
SOHO routers are one of the essential
exploiting targets by adversaries.
ØVPNFilter infected at least 500,000 devices in
at least 54 countries [1]
ØSmart phone, personal computer, camera,
printer, etc
3
Find Vulnerabilities in Routers
Fuzzing is popular in discovering vulnerabilities of IoT devices
Technique
Technique
Emulation
Multi-Type
Vulnerability
Zero-Day
Detection
Coverage-guide
Andrei Costin et al.
Static and Dynamic
Analysis
YES
YES
YES
NO
FIRMADYNE
PoC
YES
NO
NO
NO
IoTFuzzer
Blackbox Fuzzing Blackbox Fuzzing Greybox Fuzzing
Muench et al.
FIRM-AFL
NO
NO
YES
NO
YES
NO
NO
NO
YES
NO
YES
YES
4
Challenge of Fuzzing the SOHO Router
Generator
Initial Seeds
2. How to fuzz dedicated systems?
•  obtain code coverage without emulation is diffcult
•  while emulation...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:SIRAJ: A Unified Framework for Aggregation of Malicious Entity
Detectors
author:Saravanan Thirumuruganathan and
Mohamed Nabeel and
Euijin Choo and
Issa Khalil and
Ting Yu
5
2
7
3
3
8
9
.
2
2
0
2
.
4
1
2
6
4
P
S
/
9
0
1
1
.
0
1
:
I
O
D
|
E
E
E
I
2
2
0
2
©
0
0
.
1
3
$
/
2
2
/
9
-
6
1
3
1
-
4
5
6
6
-
1
-
8
7
9
|
)
P
S
(
y
c
a
v
i
r
P
d
n
a
y
t
i
r
u
c
e
S
n
o
m
u
i
s
o
p
m
y
S
E
E
E
I
2
2
0
2
2022 IEEE Symposium on Security and Privacy (SP)
SIRAJ: A Uniﬁed Framework for Aggregation of
Malicious Entity Detectors
Saravanan Thirumuruganathan, Mohamed Nabeel, Euijin Choo, Issa Khalil, Ting Yu
Qatar Computing Research Institute
{sthirumuruganathan,mnabeel,echoo,ikhalil,tyu}@hbku.edu.qa
Abstract—High-quality intelligence of Internet threat (e.g.,
malware ﬁles, malicious domains, phishing URLs and malicious
IPs) are important
for both security practitioners and the
research community. Given the agility of attackers, the scale
of the Internet, and the fast-evolving landscape of threats, one
could not rely solely on a single source (such as an anti-malware
engine or an IP blacklist) for obtaining accurate, up-to-date,
and comprehensive threat analysis. Instead, we need to aggregate
the analysis from multiple sources. However, it is non-trivial to
do such aggregation effectively. A common practice is to label
an indicator (malware, domains, URLs, etc.) as malicious if it
is marked by a number of sources above an ad-hoc certain
threshold. Often, this results in sub-optimal performance as
it assumes that all sources are of similar quality/expertise,
independent, and temporally stable, which unfortunately are
often not true in practice. A natural alternative is to train
a supervised machine learning model. However, this approach
needs a sufﬁciently large amount of manually labeled ground
truth, which is time-consuming to collect and has to be updated
frequently, resulting in substantial recurring costs.
In this paper, we propose SIRAJ, a novel framework for
aggregating the de...


Instruction: 总结这篇安全研究的主要观点

Input:
title:SIRAJ: A Unified Framework for Aggregation of Malicious Entity
Detectors
author:Saravanan Thirumuruganathan and
Mohamed Nabeel and
Euijin Choo and
Issa Khalil and
Ting Yu
5
2
7
3
3
8
9
.
2
2
0
2
.
4
1
2
6
4
P
S
/
9
0
1
1
.
0
1
:
I
O
D
|
E
E
E
I
2
2
0
2
©
0
0
.
1
3
$
/
2
2
/
9
-
6
1
3
1
-
4
5
6
6
-
1
-
8
7
9
|
)
P
S
(
y
c
a
v
i
r
P
d
n
a
y
t
i
r
u
c
e
S
n
o
m
u
i
s
o
p
m
y
S
E
E
E
I
2
2
0
2
2022 IEEE Symposium on Security and Privacy (SP)
SIRAJ: A Uniﬁed Framework for Aggregation of
Malicious Entity Detectors
Saravanan Thirumuruganathan, Mohamed Nabeel, Euijin Choo, Issa Khalil, Ting Yu
Qatar Computing Research Institute
{sthirumuruganathan,mnabeel,echoo,ikhalil,tyu}@hbku.edu.qa
Abstract—High-quality intelligence of Internet threat (e.g.,
malware ﬁles, malicious domains, phishing URLs and malicious
IPs) are important
for both security practitioners and the
research community. Given the agility of attackers, the scale
of the Internet, and the fast-evolving landscape of threats, one
could not rely solely on a single source (such as an anti-malware
engine or an IP blacklist) for obtaining accurate, up-to-date,
and comprehensive threat analysis. Instead, we need to aggregate
the analysis from multiple sources. However, it is non-trivial to
do such aggregation effectively. A common practice is to label
an indicator (malware, domains, URLs, etc.) as malicious if it
is marked by a number of sources above an ad-hoc certain
threshold. Often, this results in sub-optimal performance as
it assumes that all sources are of similar quality/expertise,
independent, and temporally stable, which unfortunately are
often not true in practice. A natural alternative is to train
a supervised machine learning model. However, this approach
needs a sufﬁciently large amount of manually labeled ground
truth, which is time-consuming to collect and has to be updated
frequently, resulting in substantial recurring costs.
In this paper, we propose SIRAJ, a novel framework for
aggregating the de...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:The most dangerous code in the world: validating SSL certificates
in non-browser software
author:Martin Georgiev and
Subodh Iyengar and
Suman Jana and
Rishita Anubhai and
Dan Boneh and
Vitaly Shmatikov
The Most Dangerous Code in the World:
Validating SSL Certiﬁcates in Non-Browser Software
Martin Georgiev
The University of Texas
at Austin
Rishita Anubhai
Stanford University
Subodh Iyengar
Stanford University
Dan Boneh
Stanford University
Suman Jana
The University of Texas
at Austin
Vitaly Shmatikov
The University of Texas
at Austin
ABSTRACT
SSL (Secure Sockets Layer) is the de facto standard for secure In-
ternet communications. Security of SSL connections against an
active network attacker depends on correctly validating public-key
certiﬁcates presented when the connection is established.
We demonstrate that SSL certiﬁcate validation is completely bro-
ken in many security-critical applications and libraries. Vulnerable
software includes Amazon’s EC2 Java library and all cloud clients
based on it; Amazon’s and PayPal’s merchant SDKs responsible
for transmitting payment details from e-commerce sites to payment
gateways; integrated shopping carts such as osCommerce, ZenCart,
Ubercart, and PrestaShop; AdMob code used by mobile websites;
Chase mobile banking and several other Android apps and libraries;
Java Web-services middleware—including Apache Axis, Axis 2,
Codehaus XFire, and Pusher library for Android—and all applica-
tions employing this middleware. Any SSL connection from any of
these programs is insecure against a man-in-the-middle attack.
The root causes of these vulnerabilities are badly designed APIs
of SSL implementations (such as JSSE, OpenSSL, and GnuTLS)
and data-transport libraries (such as cURL) which present devel-
opers with a confusing array of settings and options. We analyze
perils and pitfalls of SSL certiﬁcate validation in software based on
these APIs and present our recommendations.
Categories and Subject Descriptors
C.2.0 [Computer-Co...


Instruction: 总结这篇安全研究的主要观点

Input:
title:The most dangerous code in the world: validating SSL certificates
in non-browser software
author:Martin Georgiev and
Subodh Iyengar and
Suman Jana and
Rishita Anubhai and
Dan Boneh and
Vitaly Shmatikov
The Most Dangerous Code in the World:
Validating SSL Certiﬁcates in Non-Browser Software
Martin Georgiev
The University of Texas
at Austin
Rishita Anubhai
Stanford University
Subodh Iyengar
Stanford University
Dan Boneh
Stanford University
Suman Jana
The University of Texas
at Austin
Vitaly Shmatikov
The University of Texas
at Austin
ABSTRACT
SSL (Secure Sockets Layer) is the de facto standard for secure In-
ternet communications. Security of SSL connections against an
active network attacker depends on correctly validating public-key
certiﬁcates presented when the connection is established.
We demonstrate that SSL certiﬁcate validation is completely bro-
ken in many security-critical applications and libraries. Vulnerable
software includes Amazon’s EC2 Java library and all cloud clients
based on it; Amazon’s and PayPal’s merchant SDKs responsible
for transmitting payment details from e-commerce sites to payment
gateways; integrated shopping carts such as osCommerce, ZenCart,
Ubercart, and PrestaShop; AdMob code used by mobile websites;
Chase mobile banking and several other Android apps and libraries;
Java Web-services middleware—including Apache Axis, Axis 2,
Codehaus XFire, and Pusher library for Android—and all applica-
tions employing this middleware. Any SSL connection from any of
these programs is insecure against a man-in-the-middle attack.
The root causes of these vulnerabilities are badly designed APIs
of SSL implementations (such as JSSE, OpenSSL, and GnuTLS)
and data-transport libraries (such as cURL) which present devel-
opers with a confusing array of settings and options. We analyze
perils and pitfalls of SSL certiﬁcate validation in software based on
these APIs and present our recommendations.
Categories and Subject Descriptors
C.2.0 [Computer-Co...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Greystar: Fast and Accurate Detection of SMS Spam Numbers in Large
Cellular Networks Using Gray Phone Space
author:Nan Jiang and
Yu Jin and
Ann Skudlark and
Zhi-Li Zhang
Greystar: Fast and Accurate Detection of
SMS Spam Numbers in Large Cellular Networks
using Grey Phone Space
Nan Jiang, University of Minnesota; Yu Jin and Ann Skudlark, AT&T Labs;
Zhi-Li Zhang, University of Minnesota
Open access to the Proceedings of the 22nd USENIX Security Symposium is sponsored by USENIXThis paper is included in the Proceedings of the 22nd USENIX Security Symposium.August 14–16, 2013 • Washington, D.C., USAISBN 978-1-931971-03-4Greystar: Fast and Accurate Detection of SMS Spam Numbers in Large
Cellular Networks using Grey Phone Space
Nan Jiang
University of Minnesota
Yu Jin
AT&T Labs
Ann Skudlark
AT&T Labs
Zhi-Li Zhang
University of Minnesota
Abstract
In this paper, we present the design of Greystar, an inno-
vative defense system for combating the growing SMS
spam trafﬁc in cellular networks. By exploiting the fact
that most SMS spammers select targets randomly from
the ﬁnite phone number space, Greystar monitors phone
numbers from the grey phone space (which are associ-
ated with data only devices like laptop data cards and
machine-to-machine communication devices like elec-
tricity meters) and employs a novel statistical model to
detect spam numbers based on their footprints on the
grey phone space. Evaluation using ﬁve month SMS
call detail records from a large US cellular carrier shows
that Greystar can detect thousands of spam numbers each
month with very few false alarms and 15% of the de-
tected spam numbers have never been reported by spam
recipients. Moreover, Greystar is much faster in detect-
ing SMS spam than existing victim spam reports, reduc-
ing spam trafﬁc by 75% during peak hours.
1 Introduction
The explosion of mobile devices in the past decade has
brought with it an onslaught of unwanted SMS (Short
Message Service) spam [1].
It has been reported t...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Greystar: Fast and Accurate Detection of SMS Spam Numbers in Large
Cellular Networks Using Gray Phone Space
author:Nan Jiang and
Yu Jin and
Ann Skudlark and
Zhi-Li Zhang
Greystar: Fast and Accurate Detection of
SMS Spam Numbers in Large Cellular Networks
using Grey Phone Space
Nan Jiang, University of Minnesota; Yu Jin and Ann Skudlark, AT&T Labs;
Zhi-Li Zhang, University of Minnesota
Open access to the Proceedings of the 22nd USENIX Security Symposium is sponsored by USENIXThis paper is included in the Proceedings of the 22nd USENIX Security Symposium.August 14–16, 2013 • Washington, D.C., USAISBN 978-1-931971-03-4Greystar: Fast and Accurate Detection of SMS Spam Numbers in Large
Cellular Networks using Grey Phone Space
Nan Jiang
University of Minnesota
Yu Jin
AT&T Labs
Ann Skudlark
AT&T Labs
Zhi-Li Zhang
University of Minnesota
Abstract
In this paper, we present the design of Greystar, an inno-
vative defense system for combating the growing SMS
spam trafﬁc in cellular networks. By exploiting the fact
that most SMS spammers select targets randomly from
the ﬁnite phone number space, Greystar monitors phone
numbers from the grey phone space (which are associ-
ated with data only devices like laptop data cards and
machine-to-machine communication devices like elec-
tricity meters) and employs a novel statistical model to
detect spam numbers based on their footprints on the
grey phone space. Evaluation using ﬁve month SMS
call detail records from a large US cellular carrier shows
that Greystar can detect thousands of spam numbers each
month with very few false alarms and 15% of the de-
tected spam numbers have never been reported by spam
recipients. Moreover, Greystar is much faster in detect-
ing SMS spam than existing victim spam reports, reduc-
ing spam trafﬁc by 75% during peak hours.
1 Introduction
The explosion of mobile devices in the past decade has
brought with it an onslaught of unwanted SMS (Short
Message Service) spam [1].
It has been reported t...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:WebWitness: Investigating, Categorizing, and Mitigating Malware Download
Paths
author:Terry Nelms and
Roberto Perdisci and
Manos Antonakakis and
Mustaque Ahamad
WebWitness: Investigating, Categorizing, and
Mitigating Malware Download Paths
Terry Nelms, Damballa, Inc. and Georgia Institute of Technology; Roberto Perdisci,
University of Georgia and Georgia Institute of Technology; Manos Antonakakis,
Georgia Institute of Technology; Mustaque Ahamad, Georgia Institute of Technology
and New York University Abu Dhabi
https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/nelms
This paper is included in the Proceedings of the
24th USENIX Security Symposium
August 12–14, 2015 • Washington, D.C.
ISBN  978-1-939133-11-3
Open access to the Proceedings of  the 24th USENIX Security Symposium is sponsored by USENIXWebWitness: Investigating, Categorizing, and Mitigating
Malware Download Paths
Terry Nelms1,2, Roberto Perdisci3,2, Manos Antonakakis2, and Mustaque Ahamad2,4
1Damballa, Inc.
4New York University Abu Dhabi
2Georgia Institute of Technology
3University of Georgia
tnelms@damballa.com, perdisci@cs.uga.edu, manos@gatech.edu, mustaq@cc.gatech.edu
Abstract
Most modern malware download attacks occur via the
browser, typically due to social engineering and drive-
by downloads.
In this paper, we study the “origin” of
malware download attacks experienced by real network
users, with the objective of improving malware down-
load defenses. Speciﬁcally, we study the web paths fol-
lowed by users who eventually fall victim to different
types of malware downloads. To this end, we propose a
novel incident investigation system, named WebWitness.
Our system targets two main goals: 1) automatically
trace back and label the sequence of events (e.g., visited
web pages) preceding malware downloads, to highlight
how users reach attack pages on the web; and 2) leverage
these automatically labeled in-the-wild malware down-
load paths to better understand ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:WebWitness: Investigating, Categorizing, and Mitigating Malware Download
Paths
author:Terry Nelms and
Roberto Perdisci and
Manos Antonakakis and
Mustaque Ahamad
WebWitness: Investigating, Categorizing, and
Mitigating Malware Download Paths
Terry Nelms, Damballa, Inc. and Georgia Institute of Technology; Roberto Perdisci,
University of Georgia and Georgia Institute of Technology; Manos Antonakakis,
Georgia Institute of Technology; Mustaque Ahamad, Georgia Institute of Technology
and New York University Abu Dhabi
https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/nelms
This paper is included in the Proceedings of the
24th USENIX Security Symposium
August 12–14, 2015 • Washington, D.C.
ISBN  978-1-939133-11-3
Open access to the Proceedings of  the 24th USENIX Security Symposium is sponsored by USENIXWebWitness: Investigating, Categorizing, and Mitigating
Malware Download Paths
Terry Nelms1,2, Roberto Perdisci3,2, Manos Antonakakis2, and Mustaque Ahamad2,4
1Damballa, Inc.
4New York University Abu Dhabi
2Georgia Institute of Technology
3University of Georgia
tnelms@damballa.com, perdisci@cs.uga.edu, manos@gatech.edu, mustaq@cc.gatech.edu
Abstract
Most modern malware download attacks occur via the
browser, typically due to social engineering and drive-
by downloads.
In this paper, we study the “origin” of
malware download attacks experienced by real network
users, with the objective of improving malware down-
load defenses. Speciﬁcally, we study the web paths fol-
lowed by users who eventually fall victim to different
types of malware downloads. To this end, we propose a
novel incident investigation system, named WebWitness.
Our system targets two main goals: 1) automatically
trace back and label the sequence of events (e.g., visited
web pages) preceding malware downloads, to highlight
how users reach attack pages on the web; and 2) leverage
these automatically labeled in-the-wild malware down-
load paths to better understand ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Characterizing the query behavior in peer-to-peer file sharing systems
author:Alexander Klemm and
Christoph Lindemann and
Mary K. Vernon and
Oliver P. Waldhorst
Characterizing the Query Behavior in
Peer-to-Peer File Sharing Systems*
Alexander Klemma     Christoph Lindemanna     Mary K. Vernonb     Oliver P. Waldhorsta
aUniversity of Dortmund
Department of Computer Science
August-Schmidt-Strasse 12
44227 Dortmund, Germany
http://mobicom.cs.uni-dortmund.de/
bUniversity of Wisconsin - Madison
Department of Computer Sciences
1210 West Dayton Street
Madison, WI 53706, USA
http://www.cs.wisc.edu/~vernon
ABSTRACT
This paper characterizes the query behavior of peers in a peer-to-
peer (P2P) file sharing system. In contrast to previous work, which
provides various aggregate workload statistics, we characterize peer
behavior in a form that can be used for constructing representative
synthetic  workloads  for  evaluating  new  P2P  system  designs.  In
particular, the analysis exposes heterogeneous behavior that occurs
on  different  days,  in  different  geographical  regions  (i.e.,  Asia,
Europe, and North America) or during different periods of the day.
The workload measures include the fraction of connected sessions
that  are  passive  (i.e.,  issue  no  queries),  the  duration  of  such
sessions, and for each active session, the number of queries issued,
time until first query, query interarrival time, time after last query,
and distribution of query popularity. Moreover, the key correlations
in these workload measures are captured in the form of conditional
distributions,  such
the  correlations  can  be  accurately
reproduced in a synthetic workload. The characterization is based
on trace data gathered in the Gnutella P2P system over a period of
40  days.  To  characterize  system-independent  user  behavior,  we
eliminate queries that are specific to the Gnutella system software,
such  as  re-queries  that  are  automatically ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Characterizing the query behavior in peer-to-peer file sharing systems
author:Alexander Klemm and
Christoph Lindemann and
Mary K. Vernon and
Oliver P. Waldhorst
Characterizing the Query Behavior in
Peer-to-Peer File Sharing Systems*
Alexander Klemma     Christoph Lindemanna     Mary K. Vernonb     Oliver P. Waldhorsta
aUniversity of Dortmund
Department of Computer Science
August-Schmidt-Strasse 12
44227 Dortmund, Germany
http://mobicom.cs.uni-dortmund.de/
bUniversity of Wisconsin - Madison
Department of Computer Sciences
1210 West Dayton Street
Madison, WI 53706, USA
http://www.cs.wisc.edu/~vernon
ABSTRACT
This paper characterizes the query behavior of peers in a peer-to-
peer (P2P) file sharing system. In contrast to previous work, which
provides various aggregate workload statistics, we characterize peer
behavior in a form that can be used for constructing representative
synthetic  workloads  for  evaluating  new  P2P  system  designs.  In
particular, the analysis exposes heterogeneous behavior that occurs
on  different  days,  in  different  geographical  regions  (i.e.,  Asia,
Europe, and North America) or during different periods of the day.
The workload measures include the fraction of connected sessions
that  are  passive  (i.e.,  issue  no  queries),  the  duration  of  such
sessions, and for each active session, the number of queries issued,
time until first query, query interarrival time, time after last query,
and distribution of query popularity. Moreover, the key correlations
in these workload measures are captured in the form of conditional
distributions,  such
the  correlations  can  be  accurately
reproduced in a synthetic workload. The characterization is based
on trace data gathered in the Gnutella P2P system over a period of
40  days.  To  characterize  system-independent  user  behavior,  we
eliminate queries that are specific to the Gnutella system software,
such  as  re-queries  that  are  automatically ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Users get routed: traffic correlation on tor by realistic adversaries
author:Aaron Johnson and
Chris Wacek and
Rob Jansen and
Micah Sherr and
Paul F. Syverson
Trafﬁc Correlation on Tor by Realistic Adversaries
Users Get Routed:
Aaron Johnson1
Chris Wacek2
Rob Jansen1 Micah Sherr2
Paul Syverson1
1U.S. Naval Research Laboratory, Washington DC
{aaron.m.johnson, rob.g.jansen, paul.syverson}@nrl.navy.mil
2Georgetown University, Washington DC
{cwacek, msherr}@cs.georgetown.edu
ABSTRACT
We present the ﬁrst analysis of the popular Tor anonymity network
that indicates the security of typical users against reasonably realis-
tic adversaries in the Tor network or in the underlying Internet. Our
results show that Tor users are far more susceptible to compromise
than indicated by prior work. Speciﬁc contributions of the paper
include (1) a model of various typical kinds of users, (2) an adver-
sary model that includes Tor network relays, autonomous systems
(ASes), Internet exchange points (IXPs), and groups of IXPs drawn
from empirical study, (3) metrics that indicate how secure users are
over a period of time, (4) the most accurate topological model to
date of ASes and IXPs as they relate to Tor usage and network con-
ﬁguration, (5) a novel realistic Tor path simulator (TorPS), and (6)
analyses of security making use of all the above. To show that our
approach is useful to explore alternatives and not just Tor as cur-
rently deployed, we also analyze a published alternative path se-
lection algorithm, Congestion-Aware Tor. We create an empirical
model of Tor congestion, identify novel attack vectors, and show
that it too is more vulnerable than previously indicated.
Categories and Subject Descriptors
C.2.0 [Computer-Communication Networks]: General—Secu-
rity and protection
Keywords
Anonymity; metrics; onion routing
1.
INTRODUCTION
Tor is a volunteer-operated anonymity network that is estimated
to protect the privacy of hundreds of thousands of daily users [13,
22]. Howev...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Users get routed: traffic correlation on tor by realistic adversaries
author:Aaron Johnson and
Chris Wacek and
Rob Jansen and
Micah Sherr and
Paul F. Syverson
Trafﬁc Correlation on Tor by Realistic Adversaries
Users Get Routed:
Aaron Johnson1
Chris Wacek2
Rob Jansen1 Micah Sherr2
Paul Syverson1
1U.S. Naval Research Laboratory, Washington DC
{aaron.m.johnson, rob.g.jansen, paul.syverson}@nrl.navy.mil
2Georgetown University, Washington DC
{cwacek, msherr}@cs.georgetown.edu
ABSTRACT
We present the ﬁrst analysis of the popular Tor anonymity network
that indicates the security of typical users against reasonably realis-
tic adversaries in the Tor network or in the underlying Internet. Our
results show that Tor users are far more susceptible to compromise
than indicated by prior work. Speciﬁc contributions of the paper
include (1) a model of various typical kinds of users, (2) an adver-
sary model that includes Tor network relays, autonomous systems
(ASes), Internet exchange points (IXPs), and groups of IXPs drawn
from empirical study, (3) metrics that indicate how secure users are
over a period of time, (4) the most accurate topological model to
date of ASes and IXPs as they relate to Tor usage and network con-
ﬁguration, (5) a novel realistic Tor path simulator (TorPS), and (6)
analyses of security making use of all the above. To show that our
approach is useful to explore alternatives and not just Tor as cur-
rently deployed, we also analyze a published alternative path se-
lection algorithm, Congestion-Aware Tor. We create an empirical
model of Tor congestion, identify novel attack vectors, and show
that it too is more vulnerable than previously indicated.
Categories and Subject Descriptors
C.2.0 [Computer-Communication Networks]: General—Secu-
rity and protection
Keywords
Anonymity; metrics; onion routing
1.
INTRODUCTION
Tor is a volunteer-operated anonymity network that is estimated
to protect the privacy of hundreds of thousands of daily users [13,
22]. Howev...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Hummingbird: Privacy at the Time of Twitter
author:Emiliano De Cristofaro and
Claudio Soriente and
Gene Tsudik and
Andrew Williams
2012 IEEE Symposium on Security and Privacy
Hummingbird: Privacy at the time of Twitter
Emiliano De Cristofaro∗
PARC
edc@parc.com
Claudio Soriente†
ETH Zurich
Gene Tsudik
UC Irvine
Andrew Williams‡
UC Irvine
claudio.soriente@inf.ethz.ch
gene.tsudik@uci.edu
andrewmw@uci.edu
Abstract—In the last several years, micro-blogging Online
Social Networks (OSNs), such as Twitter, have taken the world
by storm, now boasting over 100 million subscribers. As an
unparalleled stage for an enormous audience, they offer fast
and reliable centralized diffusion of pithy tweets to great mul-
titudes of information-hungry and always-connected followers.
At the same time, this information gathering and dissemination
paradigm prompts some important privacy concerns about
relationships between tweeters, followers and interests of the
latter. In this paper, we assess privacy in today’s Twitter-like
OSNs and describe an architecture and a trial implementation
of a privacy-preserving service called Hummingbird. It is
essentially a variant of Twitter that protects tweet contents,
hashtags and follower interests from the (potentially) prying
eyes of the centralized server. We argue that, although in-
herently limited by Twitter’s mission of scalable information-
sharing, this degree of privacy is valuable. We demonstrate, via
a working prototype, that Hummingbird’s additional costs are
tolerably low. We also sketch out some viable enhancements
that might offer better privacy in the long term.
I. INTRODUCTION
Online Social Networks (OSNs) offer multitudes of peo-
ple a means to communicate, share interests, and update
others about their current activities. Social networking ser-
vices are progressively replacing more “traditional” one-
to-one communication systems, such as email and instant
messaging. Alas, as their proliferation increases, so do
privacy concer...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Hummingbird: Privacy at the Time of Twitter
author:Emiliano De Cristofaro and
Claudio Soriente and
Gene Tsudik and
Andrew Williams
2012 IEEE Symposium on Security and Privacy
Hummingbird: Privacy at the time of Twitter
Emiliano De Cristofaro∗
PARC
edc@parc.com
Claudio Soriente†
ETH Zurich
Gene Tsudik
UC Irvine
Andrew Williams‡
UC Irvine
claudio.soriente@inf.ethz.ch
gene.tsudik@uci.edu
andrewmw@uci.edu
Abstract—In the last several years, micro-blogging Online
Social Networks (OSNs), such as Twitter, have taken the world
by storm, now boasting over 100 million subscribers. As an
unparalleled stage for an enormous audience, they offer fast
and reliable centralized diffusion of pithy tweets to great mul-
titudes of information-hungry and always-connected followers.
At the same time, this information gathering and dissemination
paradigm prompts some important privacy concerns about
relationships between tweeters, followers and interests of the
latter. In this paper, we assess privacy in today’s Twitter-like
OSNs and describe an architecture and a trial implementation
of a privacy-preserving service called Hummingbird. It is
essentially a variant of Twitter that protects tweet contents,
hashtags and follower interests from the (potentially) prying
eyes of the centralized server. We argue that, although in-
herently limited by Twitter’s mission of scalable information-
sharing, this degree of privacy is valuable. We demonstrate, via
a working prototype, that Hummingbird’s additional costs are
tolerably low. We also sketch out some viable enhancements
that might offer better privacy in the long term.
I. INTRODUCTION
Online Social Networks (OSNs) offer multitudes of peo-
ple a means to communicate, share interests, and update
others about their current activities. Social networking ser-
vices are progressively replacing more “traditional” one-
to-one communication systems, such as email and instant
messaging. Alas, as their proliferation increases, so do
privacy concer...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:An Experience Developing an IDS Stimulator for the Black-Box Testing
of Network Intrusion Detection Systems
author:Darren Mutz and
Giovanni Vigna and
Richard A. Kemmerer
An Experience Developing an IDS Stimulator for the Black-Box Testing of
Network Intrusion Detection Systems
Darren Mutz
Giovanni Vigna
Richard Kemmerer
Reliable Software Group
Department of Computer Science
University of California, Santa Barbara
 dhm,vigna,kemm @cs.ucsb.edu
Abstract
Signature-based intrusion detection systems use a set of
attack descriptions to analyze event streams, looking for
evidence of malicious behavior.
If the signatures are ex-
pressed in a well-deﬁned language, it is possible to ana-
lyze the attack signatures and automatically generate events
or series of events that conform to the attack descriptions.
This approach has been used in tools whose goal is to force
intrusion detection systems to generate a large number of
detection alerts. The resulting “alert storm” is used to de-
sensitize intrusion detection system administrators and hide
attacks in the event stream. We apply a similar technique to
perform testing of intrusion detection systems. Signatures
from one intrusion detection system are used as input to
an event stream generator that produces randomized syn-
thetic events that match the input signatures. The resulting
event stream is then fed to a number of different intrusion
detection systems and the results are analyzed. This pa-
per presents the general testing approach and describes the
ﬁrst prototype of a tool, called Mucus, that automatically
generates network trafﬁc using the signatures of the Snort
network-based intrusion detection system. The paper de-
scribes preliminary cross-testing experiments with both an
open-source and a commercial tool and reports the results.
An evasion attack that was discovered as a result of analyz-
ing the test results is also presented.
Keywords: Evasion Attacks, Intrusion Detection, Software
Testing, Trafﬁc Generat...


Instruction: 总结这篇安全研究的主要观点

Input:
title:An Experience Developing an IDS Stimulator for the Black-Box Testing
of Network Intrusion Detection Systems
author:Darren Mutz and
Giovanni Vigna and
Richard A. Kemmerer
An Experience Developing an IDS Stimulator for the Black-Box Testing of
Network Intrusion Detection Systems
Darren Mutz
Giovanni Vigna
Richard Kemmerer
Reliable Software Group
Department of Computer Science
University of California, Santa Barbara
 dhm,vigna,kemm @cs.ucsb.edu
Abstract
Signature-based intrusion detection systems use a set of
attack descriptions to analyze event streams, looking for
evidence of malicious behavior.
If the signatures are ex-
pressed in a well-deﬁned language, it is possible to ana-
lyze the attack signatures and automatically generate events
or series of events that conform to the attack descriptions.
This approach has been used in tools whose goal is to force
intrusion detection systems to generate a large number of
detection alerts. The resulting “alert storm” is used to de-
sensitize intrusion detection system administrators and hide
attacks in the event stream. We apply a similar technique to
perform testing of intrusion detection systems. Signatures
from one intrusion detection system are used as input to
an event stream generator that produces randomized syn-
thetic events that match the input signatures. The resulting
event stream is then fed to a number of different intrusion
detection systems and the results are analyzed. This pa-
per presents the general testing approach and describes the
ﬁrst prototype of a tool, called Mucus, that automatically
generates network trafﬁc using the signatures of the Snort
network-based intrusion detection system. The paper de-
scribes preliminary cross-testing experiments with both an
open-source and a commercial tool and reports the results.
An evasion attack that was discovered as a result of analyz-
ing the test results is also presented.
Keywords: Evasion Attacks, Intrusion Detection, Software
Testing, Trafﬁc Generat...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Direct static enforcement of high-level security policies
author:Qihua Wang and
Ninghui Li
Direct Static Enforcement of High-Level Security Policies
Qihua Wang
wangq@cs.purdue.edu
Ninghui Li
ninghui@cs.purdue.edu
Center for Education and Research in Information Assurance and Security
and Department of Computer Science
Purdue University
ABSTRACT
A high-level security policy states an overall safety requirement for
a sensitive task. One example of a high-level security policy is a
separation of duty policy, which requires a sensitive task to be per-
formed by a team of at least k users. Recently, Li and Wang [6]
proposed an algebra for specifying a wide range of high-level se-
curity policies with both qualiﬁcation and quantity requirements on
users who perform a task. In this paper, we study the problem of di-
rect static enforcement of high-level security policies expressed in
this algebra. We formally deﬁne the notion of a static safety policy,
which requires that every set of users together having all permis-
sions needed to complete a sensitive task must contain a subset that
satisﬁes the corresponding security requirement expressed as a term
in the algebra. The static safety checking problem asks whether an
access control state satisﬁes a given high-level policy. We study
several computational problems related to the static safety check-
ing problem, and design and evaluate an algorithm for solving the
problem.
1.
INTRODUCTION
A high-level security policy states an overall safety requirement
for a sensitive task. One well-known high-level security policy is
Separation of Duty (SoD). In its simplest form, an SoD policy states
that a sensitive task should be performed by two different users act-
ing in cooperation. More generally, an SoD policy requires the co-
operation of at least k (k ≥ 2) different users to complete the task.
SoD is a high-level policy because it does not place restrictions on
which users are allowed to perform which individual steps in ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Direct static enforcement of high-level security policies
author:Qihua Wang and
Ninghui Li
Direct Static Enforcement of High-Level Security Policies
Qihua Wang
wangq@cs.purdue.edu
Ninghui Li
ninghui@cs.purdue.edu
Center for Education and Research in Information Assurance and Security
and Department of Computer Science
Purdue University
ABSTRACT
A high-level security policy states an overall safety requirement for
a sensitive task. One example of a high-level security policy is a
separation of duty policy, which requires a sensitive task to be per-
formed by a team of at least k users. Recently, Li and Wang [6]
proposed an algebra for specifying a wide range of high-level se-
curity policies with both qualiﬁcation and quantity requirements on
users who perform a task. In this paper, we study the problem of di-
rect static enforcement of high-level security policies expressed in
this algebra. We formally deﬁne the notion of a static safety policy,
which requires that every set of users together having all permis-
sions needed to complete a sensitive task must contain a subset that
satisﬁes the corresponding security requirement expressed as a term
in the algebra. The static safety checking problem asks whether an
access control state satisﬁes a given high-level policy. We study
several computational problems related to the static safety check-
ing problem, and design and evaluate an algorithm for solving the
problem.
1.
INTRODUCTION
A high-level security policy states an overall safety requirement
for a sensitive task. One well-known high-level security policy is
Separation of Duty (SoD). In its simplest form, an SoD policy states
that a sensitive task should be performed by two different users act-
ing in cooperation. More generally, an SoD policy requires the co-
operation of at least k (k ≥ 2) different users to complete the task.
SoD is a high-level policy because it does not place restrictions on
which users are allowed to perform which individual steps in ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:CrossLine: Breaking "Security-by-Crash" based Memory Isolation in
AMD SEV
author:Mengyuan Li and
Yinqian Zhang and
Zhiqiang Lin
CrossLine: Breaking “Security-by-Crash” based Memory
Isolation in AMD SEV
Mengyuan Li
The Ohio State University
li.7533@osu.edu
Yinqian Zhang✉
Southern University of Science &
Technology
yinqianz@acm.org
Zhiqiang Lin
The Ohio State University
zlin@cse.ohio-state.edu
ABSTRACT
AMD’s Secure Encrypted Virtualization (SEV) is an emerging secu-
rity feature of modern AMD processors that allows virtual machines
to run with encrypted memory and perform confidential comput-
ing even with an untrusted hypervisor. This paper first demystifies
SEV’s improper use of address space identifier (ASID) for control-
ling accesses of a VM to encrypted memory pages, cache lines,
and TLB entries. We then present the CrossLine attacks1, a novel
class of attacks against SEV that allow the adversary to launch an
attacker VM and change its ASID to that of the victim VM to imper-
sonate the victim. We present two variants of CrossLine attacks:
CrossLine V1 decrypts victim’s page tables or any memory blocks
conforming to the format of a page table entry; CrossLine V2 con-
structs encryption and decryption oracles by executing instructions
of the victim VM. We discuss the applicability of CrossLine attacks
on AMD’s SEV, SEV-ES, and SEV-SNP processors.
CCS CONCEPTS
• Security and privacy → Hardware security implementa-
tion; Hardware attacks and countermeasures; Trusted com-
puting.
KEYWORDS
Trusted execution environments; Secure Encrypted Virtualization;
Memory encryption; Cloud security
ACM Reference Format:
Mengyuan Li, Yinqian Zhang, and Zhiqiang Lin. 2021. CrossLine: Breaking
“Security-by-Crash” based Memory Isolation in AMD SEV. In Proceedings of
the 2021 ACM SIGSAC Conference on Computer and Communications Security
(CCS ’21), November 15–19, 2021, Virtual Event, Republic of Korea. ACM, New
York, NY, USA, 14 pages. https://doi.org/10.1145/3460120.3485253
1 I...


Instruction: 总结这篇安全研究的主要观点

Input:
title:CrossLine: Breaking "Security-by-Crash" based Memory Isolation in
AMD SEV
author:Mengyuan Li and
Yinqian Zhang and
Zhiqiang Lin
CrossLine: Breaking “Security-by-Crash” based Memory
Isolation in AMD SEV
Mengyuan Li
The Ohio State University
li.7533@osu.edu
Yinqian Zhang✉
Southern University of Science &
Technology
yinqianz@acm.org
Zhiqiang Lin
The Ohio State University
zlin@cse.ohio-state.edu
ABSTRACT
AMD’s Secure Encrypted Virtualization (SEV) is an emerging secu-
rity feature of modern AMD processors that allows virtual machines
to run with encrypted memory and perform confidential comput-
ing even with an untrusted hypervisor. This paper first demystifies
SEV’s improper use of address space identifier (ASID) for control-
ling accesses of a VM to encrypted memory pages, cache lines,
and TLB entries. We then present the CrossLine attacks1, a novel
class of attacks against SEV that allow the adversary to launch an
attacker VM and change its ASID to that of the victim VM to imper-
sonate the victim. We present two variants of CrossLine attacks:
CrossLine V1 decrypts victim’s page tables or any memory blocks
conforming to the format of a page table entry; CrossLine V2 con-
structs encryption and decryption oracles by executing instructions
of the victim VM. We discuss the applicability of CrossLine attacks
on AMD’s SEV, SEV-ES, and SEV-SNP processors.
CCS CONCEPTS
• Security and privacy → Hardware security implementa-
tion; Hardware attacks and countermeasures; Trusted com-
puting.
KEYWORDS
Trusted execution environments; Secure Encrypted Virtualization;
Memory encryption; Cloud security
ACM Reference Format:
Mengyuan Li, Yinqian Zhang, and Zhiqiang Lin. 2021. CrossLine: Breaking
“Security-by-Crash” based Memory Isolation in AMD SEV. In Proceedings of
the 2021 ACM SIGSAC Conference on Computer and Communications Security
(CCS ’21), November 15–19, 2021, Virtual Event, Republic of Korea. ACM, New
York, NY, USA, 14 pages. https://doi.org/10.1145/3460120.3485253
1 I...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Graph-theoretic analysis of structured peer-to-peer systems: routing
distances and fault resilience
author:Dmitri Loguinov and
Anuj Kumar and
Vivek Rai and
Sai Ganesh
Graph-Theoretic Analysis of Structured Peer-to-Peer
Systems: Routing Distances and Fault Resilience
Dmitri Loguinov, Anuj Kumar, Vivek Rai, Sai Ganesh
Department of Computer Science
Texas A&M University
College Station, TX 77843
dmitri,anujk,vivekr,ssai@cs.tamu.edu
ABSTRACT
This paper examines graph-theoretic properties of existing
peer-to-peer architectures and proposes a new infrastructure
based on optimal-diameter de Bruijn graphs. Since gener-
alized de Bruijn graphs possess very short average routing
distances and high resilience to node failure, they are well
suited for structured peer-to-peer networks. Using the ex-
ample of Chord, CAN, and de Bruijn, we ﬁrst study routing
performance, graph expansion, and clustering properties of
each graph. We then examine bisection width, path over-
lap, and several other properties that aﬀect routing and re-
silience of peer-to-peer networks. Having conﬁrmed that de
Bruijn graphs oﬀer the best diameter and highest connec-
tivity among the existing peer-to-peer structures, we oﬀer
a very simple incremental building process that preserves
optimal properties of de Bruijn graphs under uniform user
joins/departures. We call the combined peer-to-peer archi-
tecture ODRI – Optimal Diameter Routing Infrastructure.
Categories and Subject Descriptors
C.2.2 [Communication Networks]: Network Protocols
General Terms
Algorithms, Performance, Theory
Keywords
Peer-to-peer, Modeling, Graph Theory, DHT, de Bruijn
1.
INTRODUCTION
In the last few years, peer-to-peer networks have rapidly
evolved and have become an important part of the exist-
ing Internet culture. All current peer-to-peer proposals are
built using application-layer overlays, each with a set of
graph-theoretic properties that determine its routing eﬃ-
ciency and resilience to node failure. Graphs in peer-t...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Graph-theoretic analysis of structured peer-to-peer systems: routing
distances and fault resilience
author:Dmitri Loguinov and
Anuj Kumar and
Vivek Rai and
Sai Ganesh
Graph-Theoretic Analysis of Structured Peer-to-Peer
Systems: Routing Distances and Fault Resilience
Dmitri Loguinov, Anuj Kumar, Vivek Rai, Sai Ganesh
Department of Computer Science
Texas A&M University
College Station, TX 77843
dmitri,anujk,vivekr,ssai@cs.tamu.edu
ABSTRACT
This paper examines graph-theoretic properties of existing
peer-to-peer architectures and proposes a new infrastructure
based on optimal-diameter de Bruijn graphs. Since gener-
alized de Bruijn graphs possess very short average routing
distances and high resilience to node failure, they are well
suited for structured peer-to-peer networks. Using the ex-
ample of Chord, CAN, and de Bruijn, we ﬁrst study routing
performance, graph expansion, and clustering properties of
each graph. We then examine bisection width, path over-
lap, and several other properties that aﬀect routing and re-
silience of peer-to-peer networks. Having conﬁrmed that de
Bruijn graphs oﬀer the best diameter and highest connec-
tivity among the existing peer-to-peer structures, we oﬀer
a very simple incremental building process that preserves
optimal properties of de Bruijn graphs under uniform user
joins/departures. We call the combined peer-to-peer archi-
tecture ODRI – Optimal Diameter Routing Infrastructure.
Categories and Subject Descriptors
C.2.2 [Communication Networks]: Network Protocols
General Terms
Algorithms, Performance, Theory
Keywords
Peer-to-peer, Modeling, Graph Theory, DHT, de Bruijn
1.
INTRODUCTION
In the last few years, peer-to-peer networks have rapidly
evolved and have become an important part of the exist-
ing Internet culture. All current peer-to-peer proposals are
built using application-layer overlays, each with a set of
graph-theoretic properties that determine its routing eﬃ-
ciency and resilience to node failure. Graphs in peer-t...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:No attack necessary: the surprising dynamics of SSL trust relationships
author:B. Amann and
Robin Sommer and
Matthias Vallentin and
Seth Hall
The Surprising Dynamics of SSL Trust Relationships
No Attack Necessary:
Bernhard Amann1, Robin Sommer1,3, Matthias Vallentin2, Seth Hall1
1International Computer Science Institute
2UC Berkeley
3Lawrence Berkeley National Laboratory
ABSTRACT
Much of the Internet’s end-to-end security relies on the
SSL/TLS protocol along with its underlying X.509 certiﬁcate
infrastructure. However, the system remains quite brittle due
to its liberal delegation of signing authority: a single com-
promised certiﬁcation authority undermines trust globally.
Several recent high-proﬁle incidents have demonstrated this
shortcoming convincingly. Over time, the security commu-
nity has proposed a number of counter measures to increase
the security of the certiﬁcate ecosystem; many of these eﬀorts
monitor for what they consider tell-tale signs of man-in-the-
middle attacks. In this work we set out to understand to
which degree benign changes to the certiﬁcate ecosystem
share structural properties with attacks, based on a large-
scale data set of more than 17 billion SSL sessions. We ﬁnd
that common intuition falls short in assessing the malicious-
ness of an unknown certiﬁcate, since their typical artifacts
routinely occur in benign contexts as well. We also discuss
what impact our observations have on proposals aiming to
improve the security of the SSL ecosystem.
1.
INTRODUCTION
As a key building block of today’s Internet security, the
Secure Sockets Layer (SSL1) protocol provides secure end-to-
end channels and authentication through its underlying X.509
certiﬁcate infrastructure. In a nutshell, certiﬁcate authori-
ties (CAs) sign server certiﬁcates, which clients then verify
against a list of trusted root CA certiﬁcates shipping with
their operating system or client software. In most cases, root
CAs do not sign server certiﬁcates directly, but in...


Instruction: 总结这篇安全研究的主要观点

Input:
title:No attack necessary: the surprising dynamics of SSL trust relationships
author:B. Amann and
Robin Sommer and
Matthias Vallentin and
Seth Hall
The Surprising Dynamics of SSL Trust Relationships
No Attack Necessary:
Bernhard Amann1, Robin Sommer1,3, Matthias Vallentin2, Seth Hall1
1International Computer Science Institute
2UC Berkeley
3Lawrence Berkeley National Laboratory
ABSTRACT
Much of the Internet’s end-to-end security relies on the
SSL/TLS protocol along with its underlying X.509 certiﬁcate
infrastructure. However, the system remains quite brittle due
to its liberal delegation of signing authority: a single com-
promised certiﬁcation authority undermines trust globally.
Several recent high-proﬁle incidents have demonstrated this
shortcoming convincingly. Over time, the security commu-
nity has proposed a number of counter measures to increase
the security of the certiﬁcate ecosystem; many of these eﬀorts
monitor for what they consider tell-tale signs of man-in-the-
middle attacks. In this work we set out to understand to
which degree benign changes to the certiﬁcate ecosystem
share structural properties with attacks, based on a large-
scale data set of more than 17 billion SSL sessions. We ﬁnd
that common intuition falls short in assessing the malicious-
ness of an unknown certiﬁcate, since their typical artifacts
routinely occur in benign contexts as well. We also discuss
what impact our observations have on proposals aiming to
improve the security of the SSL ecosystem.
1.
INTRODUCTION
As a key building block of today’s Internet security, the
Secure Sockets Layer (SSL1) protocol provides secure end-to-
end channels and authentication through its underlying X.509
certiﬁcate infrastructure. In a nutshell, certiﬁcate authori-
ties (CAs) sign server certiﬁcates, which clients then verify
against a list of trusted root CA certiﬁcates shipping with
their operating system or client software. In most cases, root
CAs do not sign server certiﬁcates directly, but in...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:FANS: Fuzzing Android Native System Services via Automated Interface
Analysis
author:Baozheng Liu and
Chao Zhang and
Guang Gong and
Yishun Zeng and
Haifeng Ruan and
Jianwei Zhuge
FANS: Fuzzing Android Native System Services
via Automated Interface Analysis
Baozheng Liu1,2∗, Chao Zhang1,2, Guang Gong3,
Yishun Zeng1,2, Haifeng Ruan4, Jianwei Zhuge1,2
1Institute of Network Science and Cyberspace, Tsinghua University chaoz@tsinghua.edu.cn
2Beijing National Research Center for Information Science and Technology zhugejw@tsinghua.edu.cn
3Alpha Lab, 360 Internet Security Center 4Department of Computer Science and Technology, Tsinghua University
Abstract
1
Introduction
Android native system services provide essential supports and
fundamental functionalities for user apps. Finding vulnerabil-
ities in them is crucial for Android security. Fuzzing is one of
the most popular vulnerability discovery solutions, yet faces
several challenges when applied to Android native system
services. First, such services are invoked via a special inter-
process communication (IPC) mechanism, namely binder,
via service-speciﬁc interfaces. Thus, the fuzzer has to recog-
nize all interfaces and generate interface-speciﬁc test cases
automatically. Second, effective test cases should satisfy the
interface model of each interface. Third, the test cases should
also satisfy the semantic requirements, including variable
dependencies and interface dependencies.
In this paper, we propose an automated generation-based
fuzzing solution FANS to ﬁnd vulnerabilities in Android na-
tive system services. It ﬁrst collects all interfaces in target
services and uncovers deep nested multi-level interfaces to
test. Then, it automatically extracts interface models, includ-
ing feasible transaction code, variable names and types in the
transaction data, from the abstract syntax tree (AST) of target
interfaces. Further, it infers variable dependencies in transac-
tions via the variable name and type knowledge...


Instruction: 总结这篇安全研究的主要观点

Input:
title:FANS: Fuzzing Android Native System Services via Automated Interface
Analysis
author:Baozheng Liu and
Chao Zhang and
Guang Gong and
Yishun Zeng and
Haifeng Ruan and
Jianwei Zhuge
FANS: Fuzzing Android Native System Services
via Automated Interface Analysis
Baozheng Liu1,2∗, Chao Zhang1,2, Guang Gong3,
Yishun Zeng1,2, Haifeng Ruan4, Jianwei Zhuge1,2
1Institute of Network Science and Cyberspace, Tsinghua University chaoz@tsinghua.edu.cn
2Beijing National Research Center for Information Science and Technology zhugejw@tsinghua.edu.cn
3Alpha Lab, 360 Internet Security Center 4Department of Computer Science and Technology, Tsinghua University
Abstract
1
Introduction
Android native system services provide essential supports and
fundamental functionalities for user apps. Finding vulnerabil-
ities in them is crucial for Android security. Fuzzing is one of
the most popular vulnerability discovery solutions, yet faces
several challenges when applied to Android native system
services. First, such services are invoked via a special inter-
process communication (IPC) mechanism, namely binder,
via service-speciﬁc interfaces. Thus, the fuzzer has to recog-
nize all interfaces and generate interface-speciﬁc test cases
automatically. Second, effective test cases should satisfy the
interface model of each interface. Third, the test cases should
also satisfy the semantic requirements, including variable
dependencies and interface dependencies.
In this paper, we propose an automated generation-based
fuzzing solution FANS to ﬁnd vulnerabilities in Android na-
tive system services. It ﬁrst collects all interfaces in target
services and uncovers deep nested multi-level interfaces to
test. Then, it automatically extracts interface models, includ-
ing feasible transaction code, variable names and types in the
transaction data, from the abstract syntax tree (AST) of target
interfaces. Further, it infers variable dependencies in transac-
tions via the variable name and type knowledge...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Superset Disassembly: Statically Rewriting x86 Binaries Without Heuristics
author:Erick Bauman and
Zhiqiang Lin and
Kevin W. Hamlen
Superset Disassembly:
Statically Rewriting x86 Binaries Without Heuristics
Erick Bauman
University of Texas at Dallas
erick.bauman@utdallas.edu
Zhiqiang Lin
University of Texas at Dallas
zhiqiang.lin@utdallas.edu
Kevin W. Hamlen
University of Texas at Dallas
hamlen@utdallas.edu
Abstract—Static binary rewriting is a core technology for
many systems and security applications, including proﬁling, opti-
mization, and software fault isolation. While many static binary
rewriters have been developed over the past few decades, most
make various assumptions about the binary, such as requiring
correct disassembly, cooperation from compilers, or access to de-
bugging symbols or relocation entries. This paper presents MUL-
TIVERSE, a new binary rewriter that is able to rewrite Intel CISC
binaries without these assumptions. Two fundamental techniques
are developed to achieve this: (1) a superset disassembly that com-
pletely disassembles the binary code into a superset of instructions
in which all legal instructions fall, and (2) an instruction rewriter
that is able to relocate all instructions to any other location by
mediating all indirect control ﬂow transfers and redirecting them
to the correct new addresses. A prototype implementation of MUL-
TIVERSE and evaluation on SPECint 2006 benchmarks shows that
MULTIVERSE is able to rewrite all of the testing binaries with a rea-
sonable runtime overhead for the new rewritten binaries. Simple
static instrumentation using MULTIVERSE and its comparison with
dynamic instrumentation shows that the approach achieves better
average performance. Finally, the security applications of MUL-
TIVERSE are exhibited by using it to implement a shadow stack.
I.
INTRODUCTION
In many systems and security applications, there is a
need to statically transform COTS binaries. Software fault
isolation (SFI) [41], includ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Superset Disassembly: Statically Rewriting x86 Binaries Without Heuristics
author:Erick Bauman and
Zhiqiang Lin and
Kevin W. Hamlen
Superset Disassembly:
Statically Rewriting x86 Binaries Without Heuristics
Erick Bauman
University of Texas at Dallas
erick.bauman@utdallas.edu
Zhiqiang Lin
University of Texas at Dallas
zhiqiang.lin@utdallas.edu
Kevin W. Hamlen
University of Texas at Dallas
hamlen@utdallas.edu
Abstract—Static binary rewriting is a core technology for
many systems and security applications, including proﬁling, opti-
mization, and software fault isolation. While many static binary
rewriters have been developed over the past few decades, most
make various assumptions about the binary, such as requiring
correct disassembly, cooperation from compilers, or access to de-
bugging symbols or relocation entries. This paper presents MUL-
TIVERSE, a new binary rewriter that is able to rewrite Intel CISC
binaries without these assumptions. Two fundamental techniques
are developed to achieve this: (1) a superset disassembly that com-
pletely disassembles the binary code into a superset of instructions
in which all legal instructions fall, and (2) an instruction rewriter
that is able to relocate all instructions to any other location by
mediating all indirect control ﬂow transfers and redirecting them
to the correct new addresses. A prototype implementation of MUL-
TIVERSE and evaluation on SPECint 2006 benchmarks shows that
MULTIVERSE is able to rewrite all of the testing binaries with a rea-
sonable runtime overhead for the new rewritten binaries. Simple
static instrumentation using MULTIVERSE and its comparison with
dynamic instrumentation shows that the approach achieves better
average performance. Finally, the security applications of MUL-
TIVERSE are exhibited by using it to implement a shadow stack.
I.
INTRODUCTION
In many systems and security applications, there is a
need to statically transform COTS binaries. Software fault
isolation (SFI) [41], includ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。