Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Practical DIFC Enforcement on Android
author:Adwait Nadkarni and
Benjamin Andow and
William Enck and
Somesh Jha
Practical DIFC Enforcement on Android
Adwait Nadkarni, Benjamin Andow, and William Enck, North Carolina State University;
Somesh Jha, University of Wisconsin—Madison
 https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/nadkarni
This paper is included in the Proceedings of the 25th USENIX Security SymposiumAugust 10–12, 2016 • Austin, TXISBN 978-1-931971-32-4Open access to the Proceedings of the 25th USENIX Security Symposium is sponsored by USENIX Practical DIFC Enforcement on Android
Adwait Nadkarni, Benjamin Andow, William Enck
{anadkarni,beandow,whenck}@ncsu.edu
North Carolina State University
Somesh Jha
jha@cs.wisc.edu
University of Wisconsin-Madison
Abstract
Smartphone users often use private and enterprise data
with untrusted third party applications. The fundamen-
tal lack of secrecy guarantees in smartphone OSes, such
as Android, exposes this data to the risk of unauthorized
exﬁltration. A natural solution is the integration of se-
crecy guarantees into the OS. In this paper, we describe
the challenges for decentralized information ﬂow control
(DIFC) enforcement on Android. We propose context-
sensitive DIFC enforcement via lazy polyinstantiation
and practical and secure network export through domain
declassiﬁcation. Our DIFC system, Weir, is backwards
compatible by design, and incurs less than 4 ms over-
head for component startup. With Weir, we demonstrate
practical and secure DIFC enforcement on Android.
1
Introduction
Application-based modern operating systems, such as
Android, thrive on their rich application ecosystems. Ap-
plications integrate with each other to perform complex
user tasks, providing a seamless user experience. To
work together, applications share user data with one an-
other. Such sharing exposes the user’s private and en-
terprise information to the risk of exﬁltration from the
device....


Instruction: 总结这篇安全研究的主要观点

Input:
title:Practical DIFC Enforcement on Android
author:Adwait Nadkarni and
Benjamin Andow and
William Enck and
Somesh Jha
Practical DIFC Enforcement on Android
Adwait Nadkarni, Benjamin Andow, and William Enck, North Carolina State University;
Somesh Jha, University of Wisconsin—Madison
 https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/nadkarni
This paper is included in the Proceedings of the 25th USENIX Security SymposiumAugust 10–12, 2016 • Austin, TXISBN 978-1-931971-32-4Open access to the Proceedings of the 25th USENIX Security Symposium is sponsored by USENIX Practical DIFC Enforcement on Android
Adwait Nadkarni, Benjamin Andow, William Enck
{anadkarni,beandow,whenck}@ncsu.edu
North Carolina State University
Somesh Jha
jha@cs.wisc.edu
University of Wisconsin-Madison
Abstract
Smartphone users often use private and enterprise data
with untrusted third party applications. The fundamen-
tal lack of secrecy guarantees in smartphone OSes, such
as Android, exposes this data to the risk of unauthorized
exﬁltration. A natural solution is the integration of se-
crecy guarantees into the OS. In this paper, we describe
the challenges for decentralized information ﬂow control
(DIFC) enforcement on Android. We propose context-
sensitive DIFC enforcement via lazy polyinstantiation
and practical and secure network export through domain
declassiﬁcation. Our DIFC system, Weir, is backwards
compatible by design, and incurs less than 4 ms over-
head for component startup. With Weir, we demonstrate
practical and secure DIFC enforcement on Android.
1
Introduction
Application-based modern operating systems, such as
Android, thrive on their rich application ecosystems. Ap-
plications integrate with each other to perform complex
user tasks, providing a seamless user experience. To
work together, applications share user data with one an-
other. Such sharing exposes the user’s private and en-
terprise information to the risk of exﬁltration from the
device....

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Constructing internet coordinate system based on delay measurement
author:Hyuk Lim and
Jennifer C. Hou and
Chong-Ho Choi
Constructing Internet Coordinate System Based on Delay
Measurement ∗
†
Hyuk Lim
School of Electrical
Engineering and Computer
Science
Seoul National University
Seoul 151-744, Korea
hyuklim@csl.snu.ac.kr
Jennifer C. Hou
Department of Computer
Science
University of Illinois at
Urbana-Champaign
1304 W. Springﬁeld Avenue
Urbana, IL 61801
jhou@cs.uiuc.edu
Chong-Ho Choi
School of Electrical
Engineering and Computer
Science
Seoul National University
Seoul 151-744, Korea
chchoi@csl.snu.ac.kr
ABSTRACT
In this paper, we consider the problem of how to represent
the locations of Internet hosts in a Cartesian coordinate sys-
tem to facilitate estimate of the network distance between
two arbitrary Internet hosts. We envision an infrastructure
that consists of beacon nodes and provides the service of es-
timating network distance between two hosts without direct
delay measurement. We show that the principal component
analysis (PCA) technique can eﬀectively extract topologi-
cal information from delay measurements between beacon
hosts. Based on PCA, we devise a transformation method
that projects the distance data space into a new coordinate
system of (much) smaller dimensions. The transformation
retains as much topological information as possible and yet
enables end hosts to easily determine their locations in the
coordinate system. The resulting new coordinate system is
termed as the Internet Coordinate System (ICS). As com-
pared to existing work (e.g., IDMaps [1] and GNP [2]), ICS
incurs smaller computation overhead in calculating the co-
ordinates of hosts and smaller measurement overhead (re-
quired for end hosts to measure their distances to beacon
hosts). Finally, we show via experimentation with real-life
data sets that ICS is robust and accurate, regardless of the
number of beacon nodes (as long as it exceeds certain thresh-
old) and the complexit...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Constructing internet coordinate system based on delay measurement
author:Hyuk Lim and
Jennifer C. Hou and
Chong-Ho Choi
Constructing Internet Coordinate System Based on Delay
Measurement ∗
†
Hyuk Lim
School of Electrical
Engineering and Computer
Science
Seoul National University
Seoul 151-744, Korea
hyuklim@csl.snu.ac.kr
Jennifer C. Hou
Department of Computer
Science
University of Illinois at
Urbana-Champaign
1304 W. Springﬁeld Avenue
Urbana, IL 61801
jhou@cs.uiuc.edu
Chong-Ho Choi
School of Electrical
Engineering and Computer
Science
Seoul National University
Seoul 151-744, Korea
chchoi@csl.snu.ac.kr
ABSTRACT
In this paper, we consider the problem of how to represent
the locations of Internet hosts in a Cartesian coordinate sys-
tem to facilitate estimate of the network distance between
two arbitrary Internet hosts. We envision an infrastructure
that consists of beacon nodes and provides the service of es-
timating network distance between two hosts without direct
delay measurement. We show that the principal component
analysis (PCA) technique can eﬀectively extract topologi-
cal information from delay measurements between beacon
hosts. Based on PCA, we devise a transformation method
that projects the distance data space into a new coordinate
system of (much) smaller dimensions. The transformation
retains as much topological information as possible and yet
enables end hosts to easily determine their locations in the
coordinate system. The resulting new coordinate system is
termed as the Internet Coordinate System (ICS). As com-
pared to existing work (e.g., IDMaps [1] and GNP [2]), ICS
incurs smaller computation overhead in calculating the co-
ordinates of hosts and smaller measurement overhead (re-
quired for end hosts to measure their distances to beacon
hosts). Finally, we show via experimentation with real-life
data sets that ICS is robust and accurate, regardless of the
number of beacon nodes (as long as it exceeds certain thresh-
old) and the complexit...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Probabilistic Inference on Integrity for Access Behavior Based Malware
Detection
author:Weixuan Mao and
Zhongmin Cai and
Don Towsley and
Xiaohong Guan
Probabilistic Inference on Integrity
for Access Behavior Based Malware Detection
Weixuan Mao1, Zhongmin Cai1(B), Don Towsley2, and Xiaohong Guan1
1 MOE KLINNS Lab, Xi’an Jiaotong University, Xi’an, Shaanxi, China
{wxmao,zmcai,xhguan}@sei.xjtu.edu.cn
2 School of Computer Science, University of Massachusetts, Amherst, MA, USA
towsley@cs.umass.edu
Abstract. Integrity protection has proven an eﬀective way of malware
detection and defense. Determining the integrity of subjects (programs)
and objects (ﬁles and registries) plays a fundamental role in integrity
protection. However, the large numbers of subjects and objects, and
intricate behaviors place burdens on revealing their integrities either
manually or by a set of rules. In this paper, we propose a probabilis-
tic model of integrity in modern operating system. Our model builds on
two primary security policies, “no read down” and “no write up”, which
make connections between observed access behaviors and the inherent
integrity ordering between pairs of subjects and objects. We employ a
message passing based inference to determine the integrity of subjects
and objects under a probabilistic graphical model. Furthermore, by lever-
aging a statistical classiﬁer, we build an integrity based access behavior
model for malware detection. Extensive experimental results on a real-
world dataset demonstrate that our model is capable of detecting 7,257
malware samples from 27,840 benign processes at 99.88 % true positive
rate under 0.1 % false positive rate. These results indicate the feasibility
of our probabilistic integrity model.
Keywords: Probabilistic graphical model · Integrity protection ·
Malware
1 Introduction
In spite of considerate eﬀort by security researchers and engineers, attackers
continue to craft malicious code (malware). A recent security threat report by...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Probabilistic Inference on Integrity for Access Behavior Based Malware
Detection
author:Weixuan Mao and
Zhongmin Cai and
Don Towsley and
Xiaohong Guan
Probabilistic Inference on Integrity
for Access Behavior Based Malware Detection
Weixuan Mao1, Zhongmin Cai1(B), Don Towsley2, and Xiaohong Guan1
1 MOE KLINNS Lab, Xi’an Jiaotong University, Xi’an, Shaanxi, China
{wxmao,zmcai,xhguan}@sei.xjtu.edu.cn
2 School of Computer Science, University of Massachusetts, Amherst, MA, USA
towsley@cs.umass.edu
Abstract. Integrity protection has proven an eﬀective way of malware
detection and defense. Determining the integrity of subjects (programs)
and objects (ﬁles and registries) plays a fundamental role in integrity
protection. However, the large numbers of subjects and objects, and
intricate behaviors place burdens on revealing their integrities either
manually or by a set of rules. In this paper, we propose a probabilis-
tic model of integrity in modern operating system. Our model builds on
two primary security policies, “no read down” and “no write up”, which
make connections between observed access behaviors and the inherent
integrity ordering between pairs of subjects and objects. We employ a
message passing based inference to determine the integrity of subjects
and objects under a probabilistic graphical model. Furthermore, by lever-
aging a statistical classiﬁer, we build an integrity based access behavior
model for malware detection. Extensive experimental results on a real-
world dataset demonstrate that our model is capable of detecting 7,257
malware samples from 27,840 benign processes at 99.88 % true positive
rate under 0.1 % false positive rate. These results indicate the feasibility
of our probabilistic integrity model.
Keywords: Probabilistic graphical model · Integrity protection ·
Malware
1 Introduction
In spite of considerate eﬀort by security researchers and engineers, attackers
continue to craft malicious code (malware). A recent security threat report by...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Lessons Learned from the Analysis of System Failures at Petascale:
The Case of Blue Waters
author:Catello Di Martino and
Zbigniew T. Kalbarczyk and
Ravishankar K. Iyer and
Fabio Baccanico and
Joseph Fullop and
William Kramer
Lessons Learned From the Analysis of System
Failures at Petascale: The Case of Blue Waters
Catello Di Martino, Zbigniew Kalbarczyk,
Fabio Baccanico1, Joseph Fullop2, William Kramer2
Ravishankar K. Iyer
University of Illinois at Urbana-Champaign
Email: {dimart,kalbarcz,rkiyer}@illinois.edu
1Federico II University of Naples
2National Center for Supercomputing Applications
Email: fbaccanico@unina.it,{fullop,wkramer}@ncsa.illinois.edu
Abstract—This paper provides an analysis of failures and their
impact for Blue Waters, the Cray hybrid (CPU/GPU) supercom-
puter at the University of Illinois at Urbana-Champaign. The
analysis is based on both manual failure reports and automatically
generated event logs collected over 261 days. Results include i)
a characterization of the root causes of single-node failures; ii)
a direct assessment of the effectiveness of system-level failover
as well as memory, processor, network, GPU accelerator, and ﬁle
system error resiliency; and iii) an analysis of system-wide outages.
The major ﬁndings of this study are as follows. Hardware is
not the main cause of system downtime. This is notwithstanding
the fact that hardware-related failures are 42% of all failures.
Failures caused by hardware were responsible for only 23% of the
total repair time. These results are partially due to the fact that
processor and memory protection mechanisms (x8 and x4 Chipkill,
ECC, and parity) are able to handle a sustained rate of errors
as high as 250 errors/h while providing a coverage of 99.997%
out of a set of more than 1.5 million of analyzed errors. Only 28
multiple-bit errors bypassed the employed protection mechanisms.
Software, on the other hand, was the largest contributor to the
node repair hours (53%), despite being the cau...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Lessons Learned from the Analysis of System Failures at Petascale:
The Case of Blue Waters
author:Catello Di Martino and
Zbigniew T. Kalbarczyk and
Ravishankar K. Iyer and
Fabio Baccanico and
Joseph Fullop and
William Kramer
Lessons Learned From the Analysis of System
Failures at Petascale: The Case of Blue Waters
Catello Di Martino, Zbigniew Kalbarczyk,
Fabio Baccanico1, Joseph Fullop2, William Kramer2
Ravishankar K. Iyer
University of Illinois at Urbana-Champaign
Email: {dimart,kalbarcz,rkiyer}@illinois.edu
1Federico II University of Naples
2National Center for Supercomputing Applications
Email: fbaccanico@unina.it,{fullop,wkramer}@ncsa.illinois.edu
Abstract—This paper provides an analysis of failures and their
impact for Blue Waters, the Cray hybrid (CPU/GPU) supercom-
puter at the University of Illinois at Urbana-Champaign. The
analysis is based on both manual failure reports and automatically
generated event logs collected over 261 days. Results include i)
a characterization of the root causes of single-node failures; ii)
a direct assessment of the effectiveness of system-level failover
as well as memory, processor, network, GPU accelerator, and ﬁle
system error resiliency; and iii) an analysis of system-wide outages.
The major ﬁndings of this study are as follows. Hardware is
not the main cause of system downtime. This is notwithstanding
the fact that hardware-related failures are 42% of all failures.
Failures caused by hardware were responsible for only 23% of the
total repair time. These results are partially due to the fact that
processor and memory protection mechanisms (x8 and x4 Chipkill,
ECC, and parity) are able to handle a sustained rate of errors
as high as 250 errors/h while providing a coverage of 99.997%
out of a set of more than 1.5 million of analyzed errors. Only 28
multiple-bit errors bypassed the employed protection mechanisms.
Software, on the other hand, was the largest contributor to the
node repair hours (53%), despite being the cau...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:NetHide: Secure and Practical Network Topology Obfuscation
author:Roland Meier and
Petar Tsankov and
Vincent Lenders and
Laurent Vanbever and
Martin T. Vechev
NetHide: Secure and Practical Network
Topology Obfuscation
Roland Meier and Petar Tsankov, ETH Zurich; Vincent Lenders, armasuisse;
Laurent Vanbever and Martin Vechev, ETH Zurich
https://www.usenix.org/conference/usenixsecurity18/presentation/meier
This paper is included in the Proceedings of the
27th USENIX Security Symposium.
August 15–17, 2018 • Baltimore, MD, USA
ISBN 978-1-939133-04-5
Open access to the Proceedings of the 27th USENIX Security Symposium is sponsored by USENIX.NetHide: Secure and Practical Network Topology Obfuscation
Roland Meier∗, Petar Tsankov∗, Vincent Lenders(cid:5), Laurent Vanbever∗, Martin Vechev∗
∗ ETH Zürich
(cid:5)armasuisse
nethide.ethz.ch
Abstract
Simple path tracing tools such as traceroute allow
malicious users to infer network topologies remotely and
use that knowledge to craft advanced denial-of-service
(DoS) attacks such as Link-Flooding Attacks (LFAs).
Yet, despite the risk, most network operators still allow
path tracing as it is an essential network debugging tool.
In this paper, we present NetHide, a network topol-
ogy obfuscation framework that mitigates LFAs while
preserving the practicality of path tracing tools. The key
idea behind NetHide is to formulate network obfuscation
as a multi-objective optimization problem that allows for
a ﬂexible tradeoff between security (encoded as hard
constraints) and usability (encoded as soft constraints).
While solving this problem exactly is hard, we show that
NetHide can obfuscate topologies at scale by only con-
sidering a subset of the candidate solutions and without
reducing obfuscation quality. In practice, NetHide obfus-
cates the topology by intercepting and modifying path
tracing probes directly in the data plane. We show that
this process can be done at line-rate, in a stateless fash-
ion, by leveraging the la...


Instruction: 总结这篇安全研究的主要观点

Input:
title:NetHide: Secure and Practical Network Topology Obfuscation
author:Roland Meier and
Petar Tsankov and
Vincent Lenders and
Laurent Vanbever and
Martin T. Vechev
NetHide: Secure and Practical Network
Topology Obfuscation
Roland Meier and Petar Tsankov, ETH Zurich; Vincent Lenders, armasuisse;
Laurent Vanbever and Martin Vechev, ETH Zurich
https://www.usenix.org/conference/usenixsecurity18/presentation/meier
This paper is included in the Proceedings of the
27th USENIX Security Symposium.
August 15–17, 2018 • Baltimore, MD, USA
ISBN 978-1-939133-04-5
Open access to the Proceedings of the 27th USENIX Security Symposium is sponsored by USENIX.NetHide: Secure and Practical Network Topology Obfuscation
Roland Meier∗, Petar Tsankov∗, Vincent Lenders(cid:5), Laurent Vanbever∗, Martin Vechev∗
∗ ETH Zürich
(cid:5)armasuisse
nethide.ethz.ch
Abstract
Simple path tracing tools such as traceroute allow
malicious users to infer network topologies remotely and
use that knowledge to craft advanced denial-of-service
(DoS) attacks such as Link-Flooding Attacks (LFAs).
Yet, despite the risk, most network operators still allow
path tracing as it is an essential network debugging tool.
In this paper, we present NetHide, a network topol-
ogy obfuscation framework that mitigates LFAs while
preserving the practicality of path tracing tools. The key
idea behind NetHide is to formulate network obfuscation
as a multi-objective optimization problem that allows for
a ﬂexible tradeoff between security (encoded as hard
constraints) and usability (encoded as soft constraints).
While solving this problem exactly is hard, we show that
NetHide can obfuscate topologies at scale by only con-
sidering a subset of the candidate solutions and without
reducing obfuscation quality. In practice, NetHide obfus-
cates the topology by intercepting and modifying path
tracing probes directly in the data plane. We show that
this process can be done at line-rate, in a stateless fash-
ion, by leveraging the la...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Aquila: a practically usable verification system for production-scale
programmable data planes
author:Bingchuan Tian and
Jiaqi Gao and
Mengqi Liu and
Ennan Zhai and
Yanqing Chen and
Yu Zhou and
Li Dai and
Feng Yan and
Mengjing Ma and
Ming Tang and
Jie Lu and
Xionglie Wei and
Hongqiang Harry Liu and
Ming Zhang and
Chen Tian and
Minlan Yu
Aquila: A Practically Usable Verification System for
Production-Scale Programmable Data Planes
Bingchuan Tian★†△, Jiaqi Gao§†△, Mengqi Liu†, Ennan Zhai†, Yanqing Chen★, Yu Zhou†, Li Dai†, Feng Yan†,
Mengjing Ma†, Ming Tang†, Jie Lu†, Xionglie Wei†, Hongqiang Harry Liu†, Ming Zhang†, Chen Tian★, Minlan Yu§
†Alibaba Group
§Harvard University
★Nanjing University
ABSTRACT
This paper presents Aquila, the first practically usable verification
system for Alibaba’s production-scale programmable data planes.
Aquila addresses four challenges in building a practically usable
verification: (1) specification complexity; (2) verification scalabil-
ity; (3) bug localization; and (4) verifier self validation. Specifically,
first, Aquila proposes a high-level language that facilitates easy ex-
pression of specifications, reducing lines of specification codes by
tenfold compared to the state-of-the-art. Second, Aquila constructs
a sequential encoding algorithm to circumvent the exponential
growth of states associated with the upscaling of data plane pro-
grams to production level. Third, Aquila adopts an automatic and
accurate bug localization approach that can narrow down suspects
based on reported violations and pinpoint the culprit by simulating
a fix for each suspect. Fourth and finally, Aquila can perform self
validation based on refinement proof, which involves the construc-
tion of an alternative representation and subsequent equivalence
checking. To this date, Aquila has been used in the verification of
our production-scale programmable edge networks for over half
a year, and it has successfully prevented many potential failures
resultin...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Aquila: a practically usable verification system for production-scale
programmable data planes
author:Bingchuan Tian and
Jiaqi Gao and
Mengqi Liu and
Ennan Zhai and
Yanqing Chen and
Yu Zhou and
Li Dai and
Feng Yan and
Mengjing Ma and
Ming Tang and
Jie Lu and
Xionglie Wei and
Hongqiang Harry Liu and
Ming Zhang and
Chen Tian and
Minlan Yu
Aquila: A Practically Usable Verification System for
Production-Scale Programmable Data Planes
Bingchuan Tian★†△, Jiaqi Gao§†△, Mengqi Liu†, Ennan Zhai†, Yanqing Chen★, Yu Zhou†, Li Dai†, Feng Yan†,
Mengjing Ma†, Ming Tang†, Jie Lu†, Xionglie Wei†, Hongqiang Harry Liu†, Ming Zhang†, Chen Tian★, Minlan Yu§
†Alibaba Group
§Harvard University
★Nanjing University
ABSTRACT
This paper presents Aquila, the first practically usable verification
system for Alibaba’s production-scale programmable data planes.
Aquila addresses four challenges in building a practically usable
verification: (1) specification complexity; (2) verification scalabil-
ity; (3) bug localization; and (4) verifier self validation. Specifically,
first, Aquila proposes a high-level language that facilitates easy ex-
pression of specifications, reducing lines of specification codes by
tenfold compared to the state-of-the-art. Second, Aquila constructs
a sequential encoding algorithm to circumvent the exponential
growth of states associated with the upscaling of data plane pro-
grams to production level. Third, Aquila adopts an automatic and
accurate bug localization approach that can narrow down suspects
based on reported violations and pinpoint the culprit by simulating
a fix for each suspect. Fourth and finally, Aquila can perform self
validation based on refinement proof, which involves the construc-
tion of an alternative representation and subsequent equivalence
checking. To this date, Aquila has been used in the verification of
our production-scale programmable edge networks for over half
a year, and it has successfully prevented many potential failures
resultin...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Anomaly? application change? or workload change? towards automated
detection of application performance anomaly and change
author:Ludmila Cherkasova and
Kivanc M. Ozonat and
Ningfang Mi and
Julie Symons and
Evgenia Smirni
International Conference on Dependable Systems &Networks: Anchorage, Alaska, June 24-27 2008
Anomaly? Application Change? or Workload Change?
Towards Automated Detection ofApplication Performance Anomaly and Change*
Ludmila Cherkasova 1, Kivanc Ozonat1, Ningfang Mi 2 Julie Symons 1, Evgenia Smimi 2
1 HPLabs Palo Alto &
2 College of William and Mary, Williamsburg
lucy. cherkasova@hp.com, kivan'c. ozonat@hp. com, ningfang@cs. wm. edu, julie. symons@hp.com, esmirni@cs. wm. edu
Abstract
Automated tools for understanding application behavior
and its changes during the application life-cycle are essen(cid:173)
tial for many performance analysis and debugging tasks. Ap(cid:173)
plication performance issues have an immediate impact on
customer experience and satisfaction. A sudden slowdown
of enterprise-wide application can effect a large population
of customers, lead to delayed projects and ultimately can re(cid:173)
sult in company financial loss. We believe that online perfor(cid:173)
mance modeling should be a part ofroutine application mon(cid:173)
itoring. Early,
informative warnings on significant changes
in application performance should help service providers t?
timely identify and prevent performance problems and thelr
negative impact on the service. We propose a novel frame(cid:173)
workfor automated anomaly detection and application change
It is based on integration of two complementary
analysis.
techniques: i) a regression-based transaction model that re-
flects a resource consumption model ofthe application, and ii)
an application performance signature that provides a compact
model of run-time behavior of the application. The proposed
integratedframework provides a simple and powerful solution
for anomaly detection and analysis of essen...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Anomaly? application change? or workload change? towards automated
detection of application performance anomaly and change
author:Ludmila Cherkasova and
Kivanc M. Ozonat and
Ningfang Mi and
Julie Symons and
Evgenia Smirni
International Conference on Dependable Systems &Networks: Anchorage, Alaska, June 24-27 2008
Anomaly? Application Change? or Workload Change?
Towards Automated Detection ofApplication Performance Anomaly and Change*
Ludmila Cherkasova 1, Kivanc Ozonat1, Ningfang Mi 2 Julie Symons 1, Evgenia Smimi 2
1 HPLabs Palo Alto &
2 College of William and Mary, Williamsburg
lucy. cherkasova@hp.com, kivan'c. ozonat@hp. com, ningfang@cs. wm. edu, julie. symons@hp.com, esmirni@cs. wm. edu
Abstract
Automated tools for understanding application behavior
and its changes during the application life-cycle are essen(cid:173)
tial for many performance analysis and debugging tasks. Ap(cid:173)
plication performance issues have an immediate impact on
customer experience and satisfaction. A sudden slowdown
of enterprise-wide application can effect a large population
of customers, lead to delayed projects and ultimately can re(cid:173)
sult in company financial loss. We believe that online perfor(cid:173)
mance modeling should be a part ofroutine application mon(cid:173)
itoring. Early,
informative warnings on significant changes
in application performance should help service providers t?
timely identify and prevent performance problems and thelr
negative impact on the service. We propose a novel frame(cid:173)
workfor automated anomaly detection and application change
It is based on integration of two complementary
analysis.
techniques: i) a regression-based transaction model that re-
flects a resource consumption model ofthe application, and ii)
an application performance signature that provides a compact
model of run-time behavior of the application. The proposed
integratedframework provides a simple and powerful solution
for anomaly detection and analysis of essen...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Themes and Highlights of the New Security Paradigms Workshop 2002
author:Cristina Serban and
O. Sami Saydjari
Themes and Highlights of the New Security Paradigms Workshop 2002
           O. Sami Saydjari
                    SRI Computer Science Laboratory
        ssaydjari@csl.sri.com
lively  exchanges  between  the  panelists  and  the  audience.
So  come  prepared  with  an  open  mind  and  ready  to
question and comment on what our panelists present!
Past NSPW conference panels have dealt with a wide
variety  of  subjects  including  the  following.  Software
engineering of secure systems; penetration tolerance; new
directions  in  cryptography  and  steganography;  alternative
models  of  trust  and  authorization;  user-centered  security
for  securing
and  end-user  defenses;  new  models
"boundless
traditional
definitions  of  security,  secrecy,  and  integrity;  security  in
PDA devices; attack modeling; and offensive information
warfare.
deficiencies
networks";
in
The  last  NSPW  panel  was  held  at  ACSAC  2001  and
was  well  received,  very  lively  and  highly  praised  by  the
audience, ACSAC organizers and panelists alike.
Here  are  some  of  the  latest  ideas  to  emerge  from
NSPW, aside from those you will hear from the rest of the
panelists.
•  The  idea  that  defensive  information  warfare  will
always fail, and that offensive information warfare is
necessary.
•  Optimistic  security  as  an  access  control  paradigm,
where  in  certain  situations  (e.g.,  hospitals)  users  are
permitted to violate standard access control paradigms
in the interests of safety.
•  An  examination  of  the  way  market  forces  may  drive
the use of protection profiles in the Common Criteria.
Protocol
enlarging their
assumptions to include environment and context.
•  A  case  was  made that  we  must  reconsider  our
approach to information security from the ground up if
we  are  to  deal  effectively  ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Themes and Highlights of the New Security Paradigms Workshop 2002
author:Cristina Serban and
O. Sami Saydjari
Themes and Highlights of the New Security Paradigms Workshop 2002
           O. Sami Saydjari
                    SRI Computer Science Laboratory
        ssaydjari@csl.sri.com
lively  exchanges  between  the  panelists  and  the  audience.
So  come  prepared  with  an  open  mind  and  ready  to
question and comment on what our panelists present!
Past NSPW conference panels have dealt with a wide
variety  of  subjects  including  the  following.  Software
engineering of secure systems; penetration tolerance; new
directions  in  cryptography  and  steganography;  alternative
models  of  trust  and  authorization;  user-centered  security
for  securing
and  end-user  defenses;  new  models
"boundless
traditional
definitions  of  security,  secrecy,  and  integrity;  security  in
PDA devices; attack modeling; and offensive information
warfare.
deficiencies
networks";
in
The  last  NSPW  panel  was  held  at  ACSAC  2001  and
was  well  received,  very  lively  and  highly  praised  by  the
audience, ACSAC organizers and panelists alike.
Here  are  some  of  the  latest  ideas  to  emerge  from
NSPW, aside from those you will hear from the rest of the
panelists.
•  The  idea  that  defensive  information  warfare  will
always fail, and that offensive information warfare is
necessary.
•  Optimistic  security  as  an  access  control  paradigm,
where  in  certain  situations  (e.g.,  hospitals)  users  are
permitted to violate standard access control paradigms
in the interests of safety.
•  An  examination  of  the  way  market  forces  may  drive
the use of protection profiles in the Common Criteria.
Protocol
enlarging their
assumptions to include environment and context.
•  A  case  was  made that  we  must  reconsider  our
approach to information security from the ground up if
we  are  to  deal  effectively  ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Eliminating Handoff Latencies in 802.11 WLANs Using Multiple Radios:
Applications, Experience, and Evaluation
author:Vladimir Brik and
Arunesh Mishra and
Suman Banerjee
Eliminating handoff latencies in 802.11 WLANs using Multiple Radios:
Applications, Experience, and Evaluation
Vladimir Brik, Arunesh Mishra, Suman Banerjee ∗
Abstract
Deployment of Voice-over IP (VoIP) and other real-time
streaming applications has been somewhat limited in wire-
less LANs today, partially because of the high handoff la-
tencies experienced by mobile users. Our goal in this work
is to eliminate handoff latency by exploiting the potential
of multiple radios in WLAN devices. Our proposed ap-
proach, called MultiScan, is implemented entirely on the
client-side, and, unlike prior work, MultiScan requires nei-
ther changing the Access Points (APs), nor having knowl-
edge of wireless network topology. MultiScan nodes rely
on using their (potentially idle) second wireless interface to
opportunistically scan and pre-associate with alternate APs
and eventually seamlessly handoff ongoing connections. In
this paper we describe our implementation of MultiScan,
present detailed evaluations of its effect on handoff latency
and evaluate performance gains for MultiScan-enhanced
wireless clients running Skype, a popular commercial VoIP
application.
1 Introduction
IEEE 802.11 [1] based wireless LAN (WLAN) technolo-
gies have been experiencing an unprecedented growth in
the recent years fueled partly by decreasing costs and in-
creasing data rates available through them. From the users’
perspective, the key advantage of such networks is unteth-
ered access: users can freely move within their area of cov-
erage and stay connected.
In 802.11 WLANs clients connect to the Internet via Ac-
cess Points (APs). Due to design choices and requirements
of the 802.11 standard, the communication range of 802.11
devices is rather limited, and it is not uncommon for an
AP to have an effective communication range...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Eliminating Handoff Latencies in 802.11 WLANs Using Multiple Radios:
Applications, Experience, and Evaluation
author:Vladimir Brik and
Arunesh Mishra and
Suman Banerjee
Eliminating handoff latencies in 802.11 WLANs using Multiple Radios:
Applications, Experience, and Evaluation
Vladimir Brik, Arunesh Mishra, Suman Banerjee ∗
Abstract
Deployment of Voice-over IP (VoIP) and other real-time
streaming applications has been somewhat limited in wire-
less LANs today, partially because of the high handoff la-
tencies experienced by mobile users. Our goal in this work
is to eliminate handoff latency by exploiting the potential
of multiple radios in WLAN devices. Our proposed ap-
proach, called MultiScan, is implemented entirely on the
client-side, and, unlike prior work, MultiScan requires nei-
ther changing the Access Points (APs), nor having knowl-
edge of wireless network topology. MultiScan nodes rely
on using their (potentially idle) second wireless interface to
opportunistically scan and pre-associate with alternate APs
and eventually seamlessly handoff ongoing connections. In
this paper we describe our implementation of MultiScan,
present detailed evaluations of its effect on handoff latency
and evaluate performance gains for MultiScan-enhanced
wireless clients running Skype, a popular commercial VoIP
application.
1 Introduction
IEEE 802.11 [1] based wireless LAN (WLAN) technolo-
gies have been experiencing an unprecedented growth in
the recent years fueled partly by decreasing costs and in-
creasing data rates available through them. From the users’
perspective, the key advantage of such networks is unteth-
ered access: users can freely move within their area of cov-
erage and stay connected.
In 802.11 WLANs clients connect to the Internet via Ac-
cess Points (APs). Due to design choices and requirements
of the 802.11 standard, the communication range of 802.11
devices is rather limited, and it is not uncommon for an
AP to have an effective communication range...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Road traffic estimation using in-situ acoustic sensing
author:C. Viven Rajendra and
Purushottam Kulkarni
Road Trafﬁc Estimation using In-situ Acoustic Sensing
C Viven Rajendra and Purushottam Kulkarni
Department of Computer Science and Engineering
Indian Institute of Technology Bombay
email: {viven, puru}@cse.iitb.ac.in
Abstract— In this paper, we explore the eﬃcacy of curb-
side acoustic sensing to estimate road traﬃc conditions. We
formulated a set of hypotheses which attempted to correlate
traﬃc conditions with the ambient traﬃc noise. We present
the evaluation of our hypotheses under various traﬃc condi-
tions. Our threshold-based-classiﬁcation yields 70-90% ac-
curacy in distinguishing congested from free-ﬂowing traﬃc.
Categories and Subject Descriptors: C.3 [Special-Purpose
and Application-Based Systems] : Signal processing systems
General Terms: Design, Experimentation, Veriﬁcation
1.
INTRODUCTION
Rapid urbanization and increase in number of automo-
biles (two, three and four wheelers) are characteristics of
developing countries like India. Coupled with adverse road
conditions, driving behavior and lack of lane discipline, sev-
eral cities experience severe traﬃc congestion. In such con-
ditions, a traﬃc estimation system can be a valuable tool,
both for road users and infrastructure planners. Knowledge
of current and historical/typical traﬃc conditions can help
users plan travel routes and governing bodies to better man-
age traﬃc and in planning for new infrastructure. Traﬃc
monitoring systems used in the developed world are normally
deployed on freeways and intersections, assume structured
traﬃc and explicitly count vehicles[2][4]. These systems will
most likely fail when applied to the Indian scenario, primar-
ily due to lack of lane discipline[1][3].
The problem we address is estimation of road traﬃc condi-
tion in near real-time. Our quest is challenging because we
want the estimation system to be minimally intrusive and
low-cost. We envision a sy...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Road traffic estimation using in-situ acoustic sensing
author:C. Viven Rajendra and
Purushottam Kulkarni
Road Trafﬁc Estimation using In-situ Acoustic Sensing
C Viven Rajendra and Purushottam Kulkarni
Department of Computer Science and Engineering
Indian Institute of Technology Bombay
email: {viven, puru}@cse.iitb.ac.in
Abstract— In this paper, we explore the eﬃcacy of curb-
side acoustic sensing to estimate road traﬃc conditions. We
formulated a set of hypotheses which attempted to correlate
traﬃc conditions with the ambient traﬃc noise. We present
the evaluation of our hypotheses under various traﬃc condi-
tions. Our threshold-based-classiﬁcation yields 70-90% ac-
curacy in distinguishing congested from free-ﬂowing traﬃc.
Categories and Subject Descriptors: C.3 [Special-Purpose
and Application-Based Systems] : Signal processing systems
General Terms: Design, Experimentation, Veriﬁcation
1.
INTRODUCTION
Rapid urbanization and increase in number of automo-
biles (two, three and four wheelers) are characteristics of
developing countries like India. Coupled with adverse road
conditions, driving behavior and lack of lane discipline, sev-
eral cities experience severe traﬃc congestion. In such con-
ditions, a traﬃc estimation system can be a valuable tool,
both for road users and infrastructure planners. Knowledge
of current and historical/typical traﬃc conditions can help
users plan travel routes and governing bodies to better man-
age traﬃc and in planning for new infrastructure. Traﬃc
monitoring systems used in the developed world are normally
deployed on freeways and intersections, assume structured
traﬃc and explicitly count vehicles[2][4]. These systems will
most likely fail when applied to the Indian scenario, primar-
ily due to lack of lane discipline[1][3].
The problem we address is estimation of road traﬃc condi-
tion in near real-time. Our quest is challenging because we
want the estimation system to be minimally intrusive and
low-cost. We envision a sy...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Back To The Epilogue: Evading Control Flow Guard via Unaligned Targets
author:Andrea Biondo and
Mauro Conti and
Daniele Lain
Back To The Epilogue:
Evading Control Flow Guard via Unaligned Targets
Andrea Biondo
University of Padua, Italy
andrea.biondo.1@studenti.unipd.it
Mauro Conti
University of Padua, Italy
conti@math.unipd.it
Daniele Lain
University of Padua, Italy
dlain@math.unipd.it
Abstract—Attackers use memory corruption vulnerabilities
to compromise systems by hijacking control ﬂow towards
attacker-controlled code. Over time, researchers proposed sev-
eral countermeasures, such as Address Space Layout Random-
ization, Write XOR Execute and Control Flow Integrity (CFI).
CFI is one of the most promising solutions, enforcing control
ﬂow to adhere to statically determined valid execution paths.
To trade with the execution and storage overhead, practical CFI
implementations enforce coarser version of CFI. One of the most
widely deployed implementations of CFI is the one proposed by
Microsoft, named Control Flow Guard (CFG). CFG is currently in
place on all Windows operating systems, from Windows 8.1 to
the most recent update of Windows 10 (at the time of writing),
accounting for more than 500 million machines.
in particular,
In this paper, we show a signiﬁcant design vulnerability in
Windows CFG and propose a speciﬁc attack to exploit it: the
Back to The Epilogue (BATE) attack. We show that with BATE
an attacker can completely evade from CFG and transfer control
to any location, thus obtaining arbitrary code execution. BATE
leverages the tradeoff of CFG between precision, performance,
and backwards compatibility;
the latter one
motivates 16-byte address granularity in some circumstances.
This vulnerability, inherent to the CFG design, allows us to
call portions of code (gadgets) that should not be allowed,
and that we can chain together to escape CFG. These gadgets
are very common: we ran a thorough evaluation of Windows
system libraries, and found many high...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Back To The Epilogue: Evading Control Flow Guard via Unaligned Targets
author:Andrea Biondo and
Mauro Conti and
Daniele Lain
Back To The Epilogue:
Evading Control Flow Guard via Unaligned Targets
Andrea Biondo
University of Padua, Italy
andrea.biondo.1@studenti.unipd.it
Mauro Conti
University of Padua, Italy
conti@math.unipd.it
Daniele Lain
University of Padua, Italy
dlain@math.unipd.it
Abstract—Attackers use memory corruption vulnerabilities
to compromise systems by hijacking control ﬂow towards
attacker-controlled code. Over time, researchers proposed sev-
eral countermeasures, such as Address Space Layout Random-
ization, Write XOR Execute and Control Flow Integrity (CFI).
CFI is one of the most promising solutions, enforcing control
ﬂow to adhere to statically determined valid execution paths.
To trade with the execution and storage overhead, practical CFI
implementations enforce coarser version of CFI. One of the most
widely deployed implementations of CFI is the one proposed by
Microsoft, named Control Flow Guard (CFG). CFG is currently in
place on all Windows operating systems, from Windows 8.1 to
the most recent update of Windows 10 (at the time of writing),
accounting for more than 500 million machines.
in particular,
In this paper, we show a signiﬁcant design vulnerability in
Windows CFG and propose a speciﬁc attack to exploit it: the
Back to The Epilogue (BATE) attack. We show that with BATE
an attacker can completely evade from CFG and transfer control
to any location, thus obtaining arbitrary code execution. BATE
leverages the tradeoff of CFG between precision, performance,
and backwards compatibility;
the latter one
motivates 16-byte address granularity in some circumstances.
This vulnerability, inherent to the CFG design, allows us to
call portions of code (gadgets) that should not be allowed,
and that we can chain together to escape CFG. These gadgets
are very common: we ran a thorough evaluation of Windows
system libraries, and found many high...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Measuring What is Not Ours: A Tale of 3\(^\mboxrd\) Party
Performance
author:Utkarsh Goel and
Moritz Steiner and
Mike P. Wittie and
Martin Flack and
Stephen Ludin
Measuring What is Not Ours:
A Tale of 3rd Party Performance
Utkarsh Goel1(B), Moritz Steiner2, Mike P. Wittie1, Martin Flack2,
and Stephen Ludin2
1 Montana State University, Bozeman, USA
{utkarsh.goel,mwittie}@cs.montana.edu
2 Akamai Technologies, Inc., San Francisco, USA
{moritz,mflack,sludin}@akamai.com
Abstract. Content Providers make use of, so called 3rd Party (3P) ser-
vices, to attract large user bases to their websites, track user activities
and interests, or to serve advertisements. In this paper, we perform an
extensive investigation on how much such 3Ps impact the Web perfor-
mance in mobile and wired last-mile networks. We develop a new Web
Party Trailing Ratio, to represent the frac-
performance metric, the 3
tion of the critical path of the webpage load process that comprises of
only 3P downloads. Our results show that 3Ps inﬂate the webpage load
time (PLT) by as much as 50% in the extreme case. Using URL rewrit-
ing to redirect the downloads of 3P assets on 1st Party infrastructure,
we demonstrate speedups in PLTs by as much as 25%.
rd
1 Introduction
Content Providers (CPs) such as Facebook, Google, and others seek to attract
large number of users to their websites and to generate high revenue. As a result,
CPs strive to develop attractive and interactive websites that keep their users
engaged. JavaScript libraries from online social networks, advertisements, and
user tracking beacons allow CPs to personalize webpages based on end-users’
interests, while various CSS frameworks make websites aesthetically pleasing [8,
10]. Further, webpage analytic APIs and performance monitoring tools allow CPs
to monitor the user-perceived performance of their websites [9]. However, as CPs
continue to evolve their websites with increasing number of features, the webpage
load time (PLT) starts to incre...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Measuring What is Not Ours: A Tale of 3\(^\mboxrd\) Party
Performance
author:Utkarsh Goel and
Moritz Steiner and
Mike P. Wittie and
Martin Flack and
Stephen Ludin
Measuring What is Not Ours:
A Tale of 3rd Party Performance
Utkarsh Goel1(B), Moritz Steiner2, Mike P. Wittie1, Martin Flack2,
and Stephen Ludin2
1 Montana State University, Bozeman, USA
{utkarsh.goel,mwittie}@cs.montana.edu
2 Akamai Technologies, Inc., San Francisco, USA
{moritz,mflack,sludin}@akamai.com
Abstract. Content Providers make use of, so called 3rd Party (3P) ser-
vices, to attract large user bases to their websites, track user activities
and interests, or to serve advertisements. In this paper, we perform an
extensive investigation on how much such 3Ps impact the Web perfor-
mance in mobile and wired last-mile networks. We develop a new Web
Party Trailing Ratio, to represent the frac-
performance metric, the 3
tion of the critical path of the webpage load process that comprises of
only 3P downloads. Our results show that 3Ps inﬂate the webpage load
time (PLT) by as much as 50% in the extreme case. Using URL rewrit-
ing to redirect the downloads of 3P assets on 1st Party infrastructure,
we demonstrate speedups in PLTs by as much as 25%.
rd
1 Introduction
Content Providers (CPs) such as Facebook, Google, and others seek to attract
large number of users to their websites and to generate high revenue. As a result,
CPs strive to develop attractive and interactive websites that keep their users
engaged. JavaScript libraries from online social networks, advertisements, and
user tracking beacons allow CPs to personalize webpages based on end-users’
interests, while various CSS frameworks make websites aesthetically pleasing [8,
10]. Further, webpage analytic APIs and performance monitoring tools allow CPs
to monitor the user-perceived performance of their websites [9]. However, as CPs
continue to evolve their websites with increasing number of features, the webpage
load time (PLT) starts to incre...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:TCP revisited: a fresh look at TCP in the wild
author:Feng Qian and
Alexandre Gerber and
Zhuoqing Morley Mao and
Subhabrata Sen and
Oliver Spatscheck and
Walter Willinger
TCP Revisited: A Fresh Look at TCP in the Wild
Feng Qian
University of Michigan
Subhabrata Sen
AT&T Labs Research
Alexandre Gerber
AT&T Labs Research
Oliver Spatscheck
AT&T Labs Research
Z. Morley Mao
University of Michigan
Walter Willinger
AT&T Labs Research
ABSTRACT
Since the last in-depth studies of measured TCP trafﬁc some 6-
8 years ago, the Internet has experienced signiﬁcant changes, in-
cluding the rapid deployment of backbone links with 1-2 orders
of magnitude more capacity, the emergence of bandwidth-intensive
streaming applications, and the massive penetration of new TCP
variants. These and other changes beg the question whether the
characteristics of measured TCP trafﬁc in today’s Internet reﬂect
these changes or have largely remained the same. To answer this
question, we collected and analyzed packet traces from a number of
Internet backbone and access links, focused on the “heavy-hitter”
ﬂows responsible for the majority of trafﬁc. Next we analyzed their
within-ﬂow packet dynamics, and observed the following features:
(1) in one of our datasets, up to 15.8% of ﬂows have an initial con-
gestion window (ICW) size larger than the upper bound speciﬁed
by RFC 3390. (2) Among ﬂows that encounter retransmission rates
of more than 10%, 5% of them exhibit irregular retransmission be-
havior where the sender does not slow down its sending rate during
retransmissions. (3) TCP ﬂow clocking (i.e., regular spacing be-
tween ﬂights of packets) can be caused by both RTT and non-RTT
factors such as application or link layer, and 60% of ﬂows stud-
ied show no pronounced ﬂow clocking. To arrive at these ﬁndings,
we developed novel techniques for analyzing unidirectional TCP
ﬂows, including a technique for inferring ICW size, a method for
detecting irregular retransmissions, and a new approach for ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:TCP revisited: a fresh look at TCP in the wild
author:Feng Qian and
Alexandre Gerber and
Zhuoqing Morley Mao and
Subhabrata Sen and
Oliver Spatscheck and
Walter Willinger
TCP Revisited: A Fresh Look at TCP in the Wild
Feng Qian
University of Michigan
Subhabrata Sen
AT&T Labs Research
Alexandre Gerber
AT&T Labs Research
Oliver Spatscheck
AT&T Labs Research
Z. Morley Mao
University of Michigan
Walter Willinger
AT&T Labs Research
ABSTRACT
Since the last in-depth studies of measured TCP trafﬁc some 6-
8 years ago, the Internet has experienced signiﬁcant changes, in-
cluding the rapid deployment of backbone links with 1-2 orders
of magnitude more capacity, the emergence of bandwidth-intensive
streaming applications, and the massive penetration of new TCP
variants. These and other changes beg the question whether the
characteristics of measured TCP trafﬁc in today’s Internet reﬂect
these changes or have largely remained the same. To answer this
question, we collected and analyzed packet traces from a number of
Internet backbone and access links, focused on the “heavy-hitter”
ﬂows responsible for the majority of trafﬁc. Next we analyzed their
within-ﬂow packet dynamics, and observed the following features:
(1) in one of our datasets, up to 15.8% of ﬂows have an initial con-
gestion window (ICW) size larger than the upper bound speciﬁed
by RFC 3390. (2) Among ﬂows that encounter retransmission rates
of more than 10%, 5% of them exhibit irregular retransmission be-
havior where the sender does not slow down its sending rate during
retransmissions. (3) TCP ﬂow clocking (i.e., regular spacing be-
tween ﬂights of packets) can be caused by both RTT and non-RTT
factors such as application or link layer, and 60% of ﬂows stud-
ied show no pronounced ﬂow clocking. To arrive at these ﬁndings,
we developed novel techniques for analyzing unidirectional TCP
ﬂows, including a technique for inferring ICW size, a method for
detecting irregular retransmissions, and a new approach for ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:"Why 6?" Defining the Operational Limits of Stide, an Anomaly-Based
Intrusion Detector
author:Kymie M. C. Tan and
Roy A. Maxion
\Why 6?"
De(cid:12)ig he eaia ii f ide
a Aay	Baed 	i Deec
yie .C. T aad Ry A. axi
kc@c.c	.ed	 ad axi@c.c	.ed
Deedabe Sye abay
C	e Sciece Deae
Caegie e Uiveiy
ib	gh eyvaia 15213 / USA
Abac
1 d	ci
A ay	deeci echi	e have
cideabe
ie f w diÆc	 ad ciica be i i
fai ec	iy ad i	i dee ci: dee cig
ve aack ad deecig a	eade. e f he
be	kw aay dee c 	ed i i	i deec
i i ide1. Deveed a he Uiveiy f ew
exic ide ai  dee c aack ha exi
cee ha 	 wih  ivie ge.The igia wk
 ide eee d eiica e	 idicaig ha daa
e	ece f egh ix ad abve wee e	i ed f ef
fecive i	i deeci. Thi bevai ha give
ie  he g	adig 	ei \Why ix?" acc
aied by eae d 	ei ega dig he cdii
de which ix ay  ay  be aiae.
Thi ae add ee he \Why Six" i	e by e
eig a eva	ai faewk ha a 	 ide
e(cid:11)ecive eaig ac e ad idei(cid:12)e he cdii
ha cib	e  dee ci c a abiiyaic	ay de
eci bide. A heeica j	i(cid:12)c ai exai
he e(cid:11)ecivee f e	ece egh f ix ad abve
a we a he ce 	ece f 	ig he va	e.
addii e	 f a iveigai ae eeed c
aig ide aay	deeci caabiiie wih he
f a ceig deec.
1Rahe ha STDE  Side  	ide we have che \ide"
i keeig wih he way he deec wa efeed  i he ece
ad fe	e y	cied ae by Waede e a. [12].
Proceedings of the 2002 IEEE Symposium on Security and Priv...


Instruction: 总结这篇安全研究的主要观点

Input:
title:"Why 6?" Defining the Operational Limits of Stide, an Anomaly-Based
Intrusion Detector
author:Kymie M. C. Tan and
Roy A. Maxion
\Why 6?"
De(cid:12)ig he eaia ii f ide
a Aay	Baed 	i Deec
yie .C. T aad Ry A. axi
kc@c.c	.ed	 ad axi@c.c	.ed
Deedabe Sye abay
C	e Sciece Deae
Caegie e Uiveiy
ib	gh eyvaia 15213 / USA
Abac
1 d	ci
A ay	deeci echi	e have
cideabe
ie f w diÆc	 ad ciica be i i
fai ec	iy ad i	i dee ci: dee cig
ve aack ad deecig a	eade. e f he
be	kw aay dee c 	ed i i	i deec
i i ide1. Deveed a he Uiveiy f ew
exic ide ai  dee c aack ha exi
cee ha 	 wih  ivie ge.The igia wk
 ide eee d eiica e	 idicaig ha daa
e	ece f egh ix ad abve wee e	i ed f ef
fecive i	i deeci. Thi bevai ha give
ie  he g	adig 	ei \Why ix?" acc
aied by eae d 	ei ega dig he cdii
de which ix ay  ay  be aiae.
Thi ae add ee he \Why Six" i	e by e
eig a eva	ai faewk ha a 	 ide
e(cid:11)ecive eaig ac e ad idei(cid:12)e he cdii
ha cib	e  dee ci c a abiiyaic	ay de
eci bide. A heeica j	i(cid:12)c ai exai
he e(cid:11)ecivee f e	ece egh f ix ad abve
a we a he ce 	ece f 	ig he va	e.
addii e	 f a iveigai ae eeed c
aig ide aay	deeci caabiiie wih he
f a ceig deec.
1Rahe ha STDE  Side  	ide we have che \ide"
i keeig wih he way he deec wa efeed  i he ece
ad fe	e y	cied ae by Waede e a. [12].
Proceedings of the 2002 IEEE Symposium on Security and Priv...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:You Are How You Click: Clickstream Analysis for Sybil Detection
author:Gang Wang and
Tristan Konolige and
Christo Wilson and
Xiao Wang and
Haitao Zheng and
Ben Y. Zhao
You Are How You Click: Clickstream Analysis
for Sybil Detection
Gang Wang and Tristan Konolige, University of California, Santa Barbara;
Christo Wilson, Northeastern University; Xiao Wang, Renren Inc.;
Haitao Zheng and Ben Y. Zhao, University of California, Santa Barbara
Open access to the Proceedings of the 22nd USENIX Security Symposium is sponsored by USENIXThis paper is included in the Proceedings of the 22nd USENIX Security Symposium.August 14–16, 2013 • Washington, D.C., USAISBN 978-1-931971-03-4You are How You Click: Clickstream Analysis for Sybil Detection
Gang Wang, Tristan Konolige, Christo Wilson†, Xiao Wang‡,
‡Renren Inc.
UC Santa Barbara
{gangw, tkonolige, htzheng, ravenben}@cs.ucsb.edu, cbw@ccs.neu.edu, xiao.wang@renren-inc.com
Haitao Zheng and Ben Y. Zhao
†Northeastern University
Abstract
Fake identities and Sybil accounts are pervasive in to-
day’s online communities. They are responsible for a
growing number of threats, including fake product re-
views, malware and spam on social networks, and as-
troturf political campaigns. Unfortunately, studies show
that existing tools such as CAPTCHAs and graph-based
Sybil detectors have not proven to be effective defenses.
In this paper, we describe our work on building a prac-
tical system for detecting fake identities using server-side
clickstream models. We develop a detection approach
that groups “similar” user clickstreams into behavioral
clusters, by partitioning a similarity graph that cap-
tures distances between clickstream sequences. We vali-
date our clickstream models using ground-truth traces of
16,000 real and Sybil users from Renren, a large Chinese
social network with 220M users. We propose a practical
detection system based on these models, and show that it
provides very high detection accuracy on our clickstream
tra...


Instruction: 总结这篇安全研究的主要观点

Input:
title:You Are How You Click: Clickstream Analysis for Sybil Detection
author:Gang Wang and
Tristan Konolige and
Christo Wilson and
Xiao Wang and
Haitao Zheng and
Ben Y. Zhao
You Are How You Click: Clickstream Analysis
for Sybil Detection
Gang Wang and Tristan Konolige, University of California, Santa Barbara;
Christo Wilson, Northeastern University; Xiao Wang, Renren Inc.;
Haitao Zheng and Ben Y. Zhao, University of California, Santa Barbara
Open access to the Proceedings of the 22nd USENIX Security Symposium is sponsored by USENIXThis paper is included in the Proceedings of the 22nd USENIX Security Symposium.August 14–16, 2013 • Washington, D.C., USAISBN 978-1-931971-03-4You are How You Click: Clickstream Analysis for Sybil Detection
Gang Wang, Tristan Konolige, Christo Wilson†, Xiao Wang‡,
‡Renren Inc.
UC Santa Barbara
{gangw, tkonolige, htzheng, ravenben}@cs.ucsb.edu, cbw@ccs.neu.edu, xiao.wang@renren-inc.com
Haitao Zheng and Ben Y. Zhao
†Northeastern University
Abstract
Fake identities and Sybil accounts are pervasive in to-
day’s online communities. They are responsible for a
growing number of threats, including fake product re-
views, malware and spam on social networks, and as-
troturf political campaigns. Unfortunately, studies show
that existing tools such as CAPTCHAs and graph-based
Sybil detectors have not proven to be effective defenses.
In this paper, we describe our work on building a prac-
tical system for detecting fake identities using server-side
clickstream models. We develop a detection approach
that groups “similar” user clickstreams into behavioral
clusters, by partitioning a similarity graph that cap-
tures distances between clickstream sequences. We vali-
date our clickstream models using ground-truth traces of
16,000 real and Sybil users from Renren, a large Chinese
social network with 220M users. We propose a practical
detection system based on these models, and show that it
provides very high detection accuracy on our clickstream
tra...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Formal Reasoning About Intrusion Detection Systems
author:Tao Song and
Calvin Ko and
Jim Alves-Foss and
Cui Zhang and
Karl N. Levitt
Formal Reasoning
About Intrusion Detection Systems
Tao Song1, Calvin Ko2, Jim Alves-Foss3, Cui Zhang4, and Karl Levitt1
1 Computer Security Laboratory, University of California, Davis
{tsong,knlevitt}@ucdavis.edu
2 NAI Labs, Network Associates Inc., Santa Clara, CA
3 Center for secure and dependable system, University of Idaho
calvin ko@nai.com
4 Computer Science Department, California State University, Sacramento
jimaf@cs.uidaho.edu
zhangc@ecs.csus.edu
Abstract. We present a formal framework for the analysis of intrusion
detection systems (IDS) that employ declarative rules for attack recog-
nition, e.g. speciﬁcation-based intrusion detection. Our approach allows
reasoning about the eﬀectiveness of an IDS. A formal framework is built
with the theorem prover ACL2 to analyze and improve detection rules
of IDSs. SHIM (System Health and Intrusion Monitoring) is used as an
exemplary speciﬁcation-based IDS to validate our approach. We have
formalized all speciﬁcations of a host-based IDS in SHIM which together
with a trusted ﬁle policy enabled us to reason about the soundness and
completeness of the speciﬁcations by proving that the speciﬁcations sat-
isfy the policy under various assumptions. These assumptions are prop-
erties of the system that are not checked by the IDS. Analysis of these
assumptions shows the beneﬁcial role of SHIM in improving the security
of the system. The formal framework and analysis methodology will pro-
vide a scientiﬁc basis for one to argue that an IDS can detect known and
unknown attacks by arguing that the IDS detects all attacks that would
violate a policy.
Keywords: Intrusion detection, veriﬁcation, formal method, security
policy
1 Introduction
Intrusion detection is an eﬀective technology to supplement traditional security
mechanisms, such as access control, to improve the security of computer system...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Formal Reasoning About Intrusion Detection Systems
author:Tao Song and
Calvin Ko and
Jim Alves-Foss and
Cui Zhang and
Karl N. Levitt
Formal Reasoning
About Intrusion Detection Systems
Tao Song1, Calvin Ko2, Jim Alves-Foss3, Cui Zhang4, and Karl Levitt1
1 Computer Security Laboratory, University of California, Davis
{tsong,knlevitt}@ucdavis.edu
2 NAI Labs, Network Associates Inc., Santa Clara, CA
3 Center for secure and dependable system, University of Idaho
calvin ko@nai.com
4 Computer Science Department, California State University, Sacramento
jimaf@cs.uidaho.edu
zhangc@ecs.csus.edu
Abstract. We present a formal framework for the analysis of intrusion
detection systems (IDS) that employ declarative rules for attack recog-
nition, e.g. speciﬁcation-based intrusion detection. Our approach allows
reasoning about the eﬀectiveness of an IDS. A formal framework is built
with the theorem prover ACL2 to analyze and improve detection rules
of IDSs. SHIM (System Health and Intrusion Monitoring) is used as an
exemplary speciﬁcation-based IDS to validate our approach. We have
formalized all speciﬁcations of a host-based IDS in SHIM which together
with a trusted ﬁle policy enabled us to reason about the soundness and
completeness of the speciﬁcations by proving that the speciﬁcations sat-
isfy the policy under various assumptions. These assumptions are prop-
erties of the system that are not checked by the IDS. Analysis of these
assumptions shows the beneﬁcial role of SHIM in improving the security
of the system. The formal framework and analysis methodology will pro-
vide a scientiﬁc basis for one to argue that an IDS can detect known and
unknown attacks by arguing that the IDS detects all attacks that would
violate a policy.
Keywords: Intrusion detection, veriﬁcation, formal method, security
policy
1 Introduction
Intrusion detection is an eﬀective technology to supplement traditional security
mechanisms, such as access control, to improve the security of computer system...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A Security Architecture for Object-Based Distributed Systems
author:Bogdan C. Popescu and
Maarten van Steen and
Andrew S. Tanenbaum
A Security Architecture for Object-Based Distributed Systems
Bogdan C. Popescu
Vrije Universiteit
Maarten van Steen
Vrije Universiteit
Andrew S. Tanenbaum
Vrije Universiteit
Amsterdam, The Netherlands
Amsterdam, The Netherlands
Amsterdam, The Netherlands
bpopescu@cs.vu.nl
steen@cs.vu.nl
ast@cs.vu.nl
Abstract
Large-scale distributed systems present numerous secu-
rity problems not present in local systems.
In this paper
we present a general security architecture for a large-scale
object-based distributed system. Its main features include
ways for servers to authenticate clients, clients to authenti-
cate servers, new secure servers to be instantiated without
manual intervention, and ways to restrict which client can
perform which operation on which object. All of these fea-
tures are done in a platform- and application-independent
way, so the results are quite general. The basic idea behind
the scheme is to have each object owner issue cryptograph-
ically sealed certiﬁcates to users to prove which operations
they may request and to servers to prove which operations
they are authorized to execute. These certiﬁcates are used
to ensure secure binding and secure method invocation. The
paper discusses the required certiﬁcates and security proto-
cols for using them.
1 Introduction
Security in large-scale distributed systems differs from
operating system security by the fact that there is no central,
trusted authority that mediates interaction between users
and processes. Instead, a distributed system usually runs on
top of a large number of loosely coupled autonomous hosts.
Those hosts may run different operating systems, and may
have different security policies, which can be enforced in
different ways by careless, or even malicious administra-
tors.
A popular trend in distributed systems is to encapsulate
functionality as objects and p...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A Security Architecture for Object-Based Distributed Systems
author:Bogdan C. Popescu and
Maarten van Steen and
Andrew S. Tanenbaum
A Security Architecture for Object-Based Distributed Systems
Bogdan C. Popescu
Vrije Universiteit
Maarten van Steen
Vrije Universiteit
Andrew S. Tanenbaum
Vrije Universiteit
Amsterdam, The Netherlands
Amsterdam, The Netherlands
Amsterdam, The Netherlands
bpopescu@cs.vu.nl
steen@cs.vu.nl
ast@cs.vu.nl
Abstract
Large-scale distributed systems present numerous secu-
rity problems not present in local systems.
In this paper
we present a general security architecture for a large-scale
object-based distributed system. Its main features include
ways for servers to authenticate clients, clients to authenti-
cate servers, new secure servers to be instantiated without
manual intervention, and ways to restrict which client can
perform which operation on which object. All of these fea-
tures are done in a platform- and application-independent
way, so the results are quite general. The basic idea behind
the scheme is to have each object owner issue cryptograph-
ically sealed certiﬁcates to users to prove which operations
they may request and to servers to prove which operations
they are authorized to execute. These certiﬁcates are used
to ensure secure binding and secure method invocation. The
paper discusses the required certiﬁcates and security proto-
cols for using them.
1 Introduction
Security in large-scale distributed systems differs from
operating system security by the fact that there is no central,
trusted authority that mediates interaction between users
and processes. Instead, a distributed system usually runs on
top of a large number of loosely coupled autonomous hosts.
Those hosts may run different operating systems, and may
have different security policies, which can be enforced in
different ways by careless, or even malicious administra-
tors.
A popular trend in distributed systems is to encapsulate
functionality as objects and p...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Cutting the electric bill for internet-scale systems
author:Asfandyar Qureshi and
Rick Weber and
Hari Balakrishnan and
John V. Guttag and
Bruce M. Maggs
Cutting the Electric Bill for Internet-Scale Systems
Asfandyar Qureshi
MIT CSAIL
asfandyar@mit.edu
Rick Weber
Akamai Technologies
riweber@akamai.com
Hari Balakrishnan
MIT CSAIL
hari@mit.edu
John Guttag
MIT CSAIL
guttag@mit.edu
Bruce Maggs
Carnegie Mellon University
bmm@cs.cmu.edu
ABSTRACT
Energy expenses are becoming an increasingly important
fraction of data center operating costs. At the same time,
the energy expense per unit of computation can vary sig-
niﬁcantly between two diﬀerent locations.
In this paper,
we characterize the variation due to ﬂuctuating electricity
prices and argue that existing distributed systems should be
able to exploit this variation for signiﬁcant economic gains.
Electricity prices exhibit both temporal and geographic vari-
ation, due to regional demand diﬀerences, transmission inef-
ﬁciencies, and generation diversity. Starting with historical
electricity prices, for twenty nine locations in the US, and
network traﬃc data collected on Akamai’s CDN, we use sim-
ulation to quantify the possible economic gains for a realistic
workload. Our results imply that existing systems may be
able to save millions of dollars a year in electricity costs, by
being cognizant of locational computation cost diﬀerences.
Categories and Subject Descriptors
C.2.4 [Computer-Communication Networks]: Distributed
Systems
General Terms
Economics, Management, Performance
1.
INTRODUCTION
With the rise of “Internet-scale” systems and “cloud com-
puting” services, there is an increasing trend toward massive,
geographically distributed systems. The largest of these are
made up of hundreds of thousands of servers and several data
centers. A large data center may require many megawatts
of electricity [1], enough to power thousands of homes.
Millions of dollars must be spent annually on the electric-
ity needed to p...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Cutting the electric bill for internet-scale systems
author:Asfandyar Qureshi and
Rick Weber and
Hari Balakrishnan and
John V. Guttag and
Bruce M. Maggs
Cutting the Electric Bill for Internet-Scale Systems
Asfandyar Qureshi
MIT CSAIL
asfandyar@mit.edu
Rick Weber
Akamai Technologies
riweber@akamai.com
Hari Balakrishnan
MIT CSAIL
hari@mit.edu
John Guttag
MIT CSAIL
guttag@mit.edu
Bruce Maggs
Carnegie Mellon University
bmm@cs.cmu.edu
ABSTRACT
Energy expenses are becoming an increasingly important
fraction of data center operating costs. At the same time,
the energy expense per unit of computation can vary sig-
niﬁcantly between two diﬀerent locations.
In this paper,
we characterize the variation due to ﬂuctuating electricity
prices and argue that existing distributed systems should be
able to exploit this variation for signiﬁcant economic gains.
Electricity prices exhibit both temporal and geographic vari-
ation, due to regional demand diﬀerences, transmission inef-
ﬁciencies, and generation diversity. Starting with historical
electricity prices, for twenty nine locations in the US, and
network traﬃc data collected on Akamai’s CDN, we use sim-
ulation to quantify the possible economic gains for a realistic
workload. Our results imply that existing systems may be
able to save millions of dollars a year in electricity costs, by
being cognizant of locational computation cost diﬀerences.
Categories and Subject Descriptors
C.2.4 [Computer-Communication Networks]: Distributed
Systems
General Terms
Economics, Management, Performance
1.
INTRODUCTION
With the rise of “Internet-scale” systems and “cloud com-
puting” services, there is an increasing trend toward massive,
geographically distributed systems. The largest of these are
made up of hundreds of thousands of servers and several data
centers. A large data center may require many megawatts
of electricity [1], enough to power thousands of homes.
Millions of dollars must be spent annually on the electric-
ity needed to p...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Identifying and Analyzing Pointer Misuses for Sophisticated Memory-corruption
Exploit Diagnosis
author:Mingwei Zhang and
Aravind Prakash and
Xiaolei Li and
Zhenkai Liang and
Heng Yin
Identifying and Analyzing Pointer Misuses
for Sophisticated
Memory-corruption Exploit Diagnosis
Mingwei Zhang (†)
Aravind Prakash (§)
Xiaolei Li (†)
Zhenkai Liang (†)
Heng Yin (§)
(†) School of Computing, National University of Singapore
(§) Department of Electrical Engineering and Computer
Science, Syracuse University
Simple Stack Buffer Overflow
  An attacker overwrites vulnerable function return
address, which points to shellcode on stack.
shellcode
return address
buffer
Only one step
  These single step attacks don’t work anymore thanks to:
  ASLR, DEP, NX, etc.
2
Exploiting SEH Mechanism
TIB
step 2
SEH Record
exception handler
prev
t
S
a
c
k
g
r
o
w
h
t
arguments prepared by OS
for exception handler
return address of exception
handler function
return address
security cookie
buffer
DispatcherContext
ContextRecord
EstablisherFrame
ExceptionRecord
return address
pop
pop
ret
step 1
step 3
3
Insights
  Recent attacks employ multiple steps.
  Pointer misuse is very prominent in
sophisticated attacks.
  Key steps constitute pointer misuses.
Our Goal:
Diagnosing pointer misuses in a multi-step attack.
4
Pointerscope – Attack
Diagnosis Engine
  Type System tailored to diagnose pointer
misuse.
  Eager type inference system to detect
pointer misuses.
  Provide big picture of the misuse through
key steps graph.
5
Overview
Guest
  OS
Vulnerable
Program
(Browser)
Exploit
(Malicious
Server)
Type
  Inference
Engine
Execu6on
  Monitor
(TEMU)
Execu6on
Trace
Diagnosis
  Engine
Diagnosis
Report
6
Variable And Variable Type
  A variable is a memory location or a register.
  Simple primitive variable types:
  Integer
  Control Pointer (or code pointer)
  Data Pointer
  Other. (The rest o...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Identifying and Analyzing Pointer Misuses for Sophisticated Memory-corruption
Exploit Diagnosis
author:Mingwei Zhang and
Aravind Prakash and
Xiaolei Li and
Zhenkai Liang and
Heng Yin
Identifying and Analyzing Pointer Misuses
for Sophisticated
Memory-corruption Exploit Diagnosis
Mingwei Zhang (†)
Aravind Prakash (§)
Xiaolei Li (†)
Zhenkai Liang (†)
Heng Yin (§)
(†) School of Computing, National University of Singapore
(§) Department of Electrical Engineering and Computer
Science, Syracuse University
Simple Stack Buffer Overflow
  An attacker overwrites vulnerable function return
address, which points to shellcode on stack.
shellcode
return address
buffer
Only one step
  These single step attacks don’t work anymore thanks to:
  ASLR, DEP, NX, etc.
2
Exploiting SEH Mechanism
TIB
step 2
SEH Record
exception handler
prev
t
S
a
c
k
g
r
o
w
h
t
arguments prepared by OS
for exception handler
return address of exception
handler function
return address
security cookie
buffer
DispatcherContext
ContextRecord
EstablisherFrame
ExceptionRecord
return address
pop
pop
ret
step 1
step 3
3
Insights
  Recent attacks employ multiple steps.
  Pointer misuse is very prominent in
sophisticated attacks.
  Key steps constitute pointer misuses.
Our Goal:
Diagnosing pointer misuses in a multi-step attack.
4
Pointerscope – Attack
Diagnosis Engine
  Type System tailored to diagnose pointer
misuse.
  Eager type inference system to detect
pointer misuses.
  Provide big picture of the misuse through
key steps graph.
5
Overview
Guest
  OS
Vulnerable
Program
(Browser)
Exploit
(Malicious
Server)
Type
  Inference
Engine
Execu6on
  Monitor
(TEMU)
Execu6on
Trace
Diagnosis
  Engine
Diagnosis
Report
6
Variable And Variable Type
  A variable is a memory location or a register.
  Simple primitive variable types:
  Integer
  Control Pointer (or code pointer)
  Data Pointer
  Other. (The rest o...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Breaking LTE on Layer Two
author:David Rupprecht and
Katharina Kohls and
Thorsten Holz and
Christina P"opper
(cid:19)(cid:17)(cid:18)(cid:26)(cid:1)(cid:42)(cid:38)(cid:38)(cid:38)(cid:1)(cid:52)(cid:90)(cid:78)(cid:81)(cid:80)(cid:84)(cid:74)(cid:86)(cid:78)(cid:1)(cid:80)(cid:79)(cid:1)(cid:52)(cid:70)(cid:68)(cid:86)(cid:83)(cid:74)(cid:85)(cid:90)(cid:1)(cid:66)(cid:79)(cid:69)(cid:1)(cid:49)(cid:83)(cid:74)(cid:87)(cid:66)(cid:68)(cid:90)
Breaking LTE on Layer Two
David Rupprecht
Katharina Kohls
Thorsten Holz
Christina P¨opper
Ruhr-University Bochum
david.rupprecht@rub.de
Ruhr-University Bochum
katharina.kohls@rub.de
Ruhr-University Bochum
New York University Abu Dhabi
thorsten.holz@rub.de
christina.poepper@nyu.edu
Abstract—Long Term Evolution (LTE) is the latest mobile
communication standard and has a pivotal role in our infor-
mation society: LTE combines performance goals with modern
security mechanisms and serves casual use cases as well as critical
infrastructure and public safety communications. Both scenarios
are demanding towards a resilient and secure speciﬁcation and
implementation of LTE, as outages and open attack vectors
potentially lead to severe risks. Previous work on LTE protocol
security identiﬁed crucial attack vectors for both the physical
(layer one) and network (layer three) layers. Data link layer
(layer two) protocols, however, remain a blind spot in existing
LTE security research.
In this paper, we present a comprehensive layer two security
analysis and identify three attack vectors. These attacks impair
the conﬁdentiality and/or privacy of LTE communication. More
speciﬁcally, we ﬁrst present a passive identity mapping attack
that matches volatile radio identities to longer lasting network
identities, enabling us to identify users within a cell and serving
as a stepping stone for follow-up attacks. Second, we demonstrate
how a passive attacker can abuse the resource allocation as
a side channel to perform website ﬁngerprintin...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Breaking LTE on Layer Two
author:David Rupprecht and
Katharina Kohls and
Thorsten Holz and
Christina P"opper
(cid:19)(cid:17)(cid:18)(cid:26)(cid:1)(cid:42)(cid:38)(cid:38)(cid:38)(cid:1)(cid:52)(cid:90)(cid:78)(cid:81)(cid:80)(cid:84)(cid:74)(cid:86)(cid:78)(cid:1)(cid:80)(cid:79)(cid:1)(cid:52)(cid:70)(cid:68)(cid:86)(cid:83)(cid:74)(cid:85)(cid:90)(cid:1)(cid:66)(cid:79)(cid:69)(cid:1)(cid:49)(cid:83)(cid:74)(cid:87)(cid:66)(cid:68)(cid:90)
Breaking LTE on Layer Two
David Rupprecht
Katharina Kohls
Thorsten Holz
Christina P¨opper
Ruhr-University Bochum
david.rupprecht@rub.de
Ruhr-University Bochum
katharina.kohls@rub.de
Ruhr-University Bochum
New York University Abu Dhabi
thorsten.holz@rub.de
christina.poepper@nyu.edu
Abstract—Long Term Evolution (LTE) is the latest mobile
communication standard and has a pivotal role in our infor-
mation society: LTE combines performance goals with modern
security mechanisms and serves casual use cases as well as critical
infrastructure and public safety communications. Both scenarios
are demanding towards a resilient and secure speciﬁcation and
implementation of LTE, as outages and open attack vectors
potentially lead to severe risks. Previous work on LTE protocol
security identiﬁed crucial attack vectors for both the physical
(layer one) and network (layer three) layers. Data link layer
(layer two) protocols, however, remain a blind spot in existing
LTE security research.
In this paper, we present a comprehensive layer two security
analysis and identify three attack vectors. These attacks impair
the conﬁdentiality and/or privacy of LTE communication. More
speciﬁcally, we ﬁrst present a passive identity mapping attack
that matches volatile radio identities to longer lasting network
identities, enabling us to identify users within a cell and serving
as a stepping stone for follow-up attacks. Second, we demonstrate
how a passive attacker can abuse the resource allocation as
a side channel to perform website ﬁngerprintin...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Processing Dangerous Paths - On Security and Privacy of the Portable
Document Format
author:Jens M"uller and
Dominik Noss and
Christian Mainka and
Vladislav Mladenov and
J"org Schwenk
Processing Dangerous Paths
– On Security and Privacy of the Portable Document Format
Jens Müller
Dominik Noss
Ruhr University Bochum
jens.a.mueller@rub.de
Ruhr University Bochum
dominik.noss@rub.de
Christian Mainka
Ruhr University Bochum
christian.mainka@rub.de
Vladislav Mladenov
Ruhr University Bochum
vladislav.mladenov@rub.de
Jörg Schwenk
Ruhr University Bochum
joerg.schwenk@rub.de
Abstract—PDF is the de-facto standard for document ex-
change. It is common to open PDF ﬁles from potentially untrusted
sources such as email attachments or downloaded from the
Internet. In this work, we perform an in-depth analysis of the
capabilities of malicious PDF documents. Instead of focusing on
implementation bugs, we abuse legitimate features of the PDF
standard itself by systematically identifying dangerous paths in
the PDF ﬁle structure. These dangerous paths lead to attacks
that we categorize into four generic classes:
(1) Denial-of-
Service attacks affecting the host that processes the document.
(2) Information disclosure attacks leaking personal data out of the
victim’s computer. (3) Data manipulation on the victim’s system.
(4) Code execution on the victim’s machine. An evaluation of 28
popular PDF processing applications shows that 26 of them are
vulnerable at least one attack. Finally, we propose a methodology
to protect against attacks based on PDF features systematically.
I.
INTRODUCTION
The Portable Document Format (PDF) is arguably the most
widely used data format for ofﬁce document exchange. While
the total number of PDF ﬁles is impossible to guess, Adobe
announced that 250 billion documents have been opened
by Adobe products in 2018 [59]. Being true or not, PDF
documents are heavily used in business to business as well
as consumer use cases. Exchanging, creating, and ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Processing Dangerous Paths - On Security and Privacy of the Portable
Document Format
author:Jens M"uller and
Dominik Noss and
Christian Mainka and
Vladislav Mladenov and
J"org Schwenk
Processing Dangerous Paths
– On Security and Privacy of the Portable Document Format
Jens Müller
Dominik Noss
Ruhr University Bochum
jens.a.mueller@rub.de
Ruhr University Bochum
dominik.noss@rub.de
Christian Mainka
Ruhr University Bochum
christian.mainka@rub.de
Vladislav Mladenov
Ruhr University Bochum
vladislav.mladenov@rub.de
Jörg Schwenk
Ruhr University Bochum
joerg.schwenk@rub.de
Abstract—PDF is the de-facto standard for document ex-
change. It is common to open PDF ﬁles from potentially untrusted
sources such as email attachments or downloaded from the
Internet. In this work, we perform an in-depth analysis of the
capabilities of malicious PDF documents. Instead of focusing on
implementation bugs, we abuse legitimate features of the PDF
standard itself by systematically identifying dangerous paths in
the PDF ﬁle structure. These dangerous paths lead to attacks
that we categorize into four generic classes:
(1) Denial-of-
Service attacks affecting the host that processes the document.
(2) Information disclosure attacks leaking personal data out of the
victim’s computer. (3) Data manipulation on the victim’s system.
(4) Code execution on the victim’s machine. An evaluation of 28
popular PDF processing applications shows that 26 of them are
vulnerable at least one attack. Finally, we propose a methodology
to protect against attacks based on PDF features systematically.
I.
INTRODUCTION
The Portable Document Format (PDF) is arguably the most
widely used data format for ofﬁce document exchange. While
the total number of PDF ﬁles is impossible to guess, Adobe
announced that 250 billion documents have been opened
by Adobe products in 2018 [59]. Being true or not, PDF
documents are heavily used in business to business as well
as consumer use cases. Exchanging, creating, and ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Tracking Probabilistic Correlation of Monitoring Data for Fault Detection
in Complex Systems
author:Zhen Guo and
Guofei Jiang and
Haifeng Chen and
Kenji Yoshihira
Tracking Probabilistic Correlation of
Monitoring Data for Fault Detection in Complex Systems
Zhen Guo*
Guofei Jiang, Haifeng Chen, Kenji Yoshihira
Robust and Secure System Group
NEC Laboratories America
 Princeton, NJ 08540
Email: {gfj,haifeng,kenji}@nec-labs.com
systems,  databases,  servers  and networking  devices,  a
single fault could cause the whole service down. While
building  a  fault-free  system  of  such  complexity  is
unrealistic,  it  is  very  desirable  to  have  effective  fault
detection and  isolation methods  in  operational  system
management.  Studies  [1]  have  shown  that  the  time
taken to detect and isolate faults is a major contributor
to  mean  time  to  repair  (MTTR),  defined  to  be  the
average amount of time required to resolve problems.
For  example,  on  November  1,  2005,  trading  on  the
Tokyo stock market was suspended for four hours after
its  IT  systems  failed.  Therefore,  effective  fault
detection  and  isolation  is  critical  for  improving  the
reliability and availability of mission critical systems.
is  often  scattered
Meanwhile, large amount of monitoring data can be
collected  from  distributed  systems  for  fault  analysis
such  as  software  log  files,  system  audit  events  and
network  traffic  statistics.  In  fact  this  monitoring  data
can be regarded as the observables of the internal states
of  dynamic  systems.  However,  given  the  distributed
nature  of  complex  information  systems,  evidence  of
fault  occurrence
in  various
monitoring  data  collected  across  distributed  systems
and observation time. Therefore, one challenge is how
to  correlate  the  monitoring  data  effectively  for  fault
analysis.  Internet  services  have  large  number  of  user
requests  everyday  and  much ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Tracking Probabilistic Correlation of Monitoring Data for Fault Detection
in Complex Systems
author:Zhen Guo and
Guofei Jiang and
Haifeng Chen and
Kenji Yoshihira
Tracking Probabilistic Correlation of
Monitoring Data for Fault Detection in Complex Systems
Zhen Guo*
Guofei Jiang, Haifeng Chen, Kenji Yoshihira
Robust and Secure System Group
NEC Laboratories America
 Princeton, NJ 08540
Email: {gfj,haifeng,kenji}@nec-labs.com
systems,  databases,  servers  and networking  devices,  a
single fault could cause the whole service down. While
building  a  fault-free  system  of  such  complexity  is
unrealistic,  it  is  very  desirable  to  have  effective  fault
detection and  isolation methods  in  operational  system
management.  Studies  [1]  have  shown  that  the  time
taken to detect and isolate faults is a major contributor
to  mean  time  to  repair  (MTTR),  defined  to  be  the
average amount of time required to resolve problems.
For  example,  on  November  1,  2005,  trading  on  the
Tokyo stock market was suspended for four hours after
its  IT  systems  failed.  Therefore,  effective  fault
detection  and  isolation  is  critical  for  improving  the
reliability and availability of mission critical systems.
is  often  scattered
Meanwhile, large amount of monitoring data can be
collected  from  distributed  systems  for  fault  analysis
such  as  software  log  files,  system  audit  events  and
network  traffic  statistics.  In  fact  this  monitoring  data
can be regarded as the observables of the internal states
of  dynamic  systems.  However,  given  the  distributed
nature  of  complex  information  systems,  evidence  of
fault  occurrence
in  various
monitoring  data  collected  across  distributed  systems
and observation time. Therefore, one challenge is how
to  correlate  the  monitoring  data  effectively  for  fault
analysis.  Internet  services  have  large  number  of  user
requests  everyday  and  much ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:High-Fidelity Modeling of Computer Network Worms
author:Kalyan S. Perumalla and
Srikanth Sundaragopalan
High-Fidelity Modeling of Computer Network Worms
Kalyan S. Perumalla
kalyan@cc.gatech.edu
            Srikanth Sundaragopalan
                 srikanth@cc.gatech.edu
College of Computing, Georgia Institute of Technology, Atlanta, Georgia
Abstract
to  capture
the  general  method  of  choice
Abstract  modeling,  such as using  epidemic models,
has  been
for
understanding  and  analyzing  the  high-level  effects  of
worms.  However, high-fidelity models, such as packet-
level  models,  are  indispensable  for  moving  beyond
aggregate  effects,
finer  nuances  and
complexities  associated  with  known  and  future  worms
in  realistic  network  environments.    Here,  we  first
identify  the  spectrum  of  available  alternatives  for
worm  modeling,  and  classify  them  according  to  their
scalability  and  fidelity.    Among  them,  we  focus  on
three  high-fidelity  methods  for  modeling  worms,  and
study  their  effectiveness  with  respect  to  scalability.
Employing  these  methods,  we  are  then  able  to,
respectively,  achieve  some  of  the  largest  packet-level
simulations  of  worm  models  to  date;  implant  and
attack  actual  worm  monitoring/defense  installations
inside
identify  a
that
workaround
fundamentally  constrains  worm  modeling  at
the
highest fidelity levels.
large  simulated  networks;  and
requirement
real-time
for
1
Introduction
Abstract  models  such  as  epidemic  models  have  so
far  been  the  general  means  of  choice  for  modeling
worm  propagation.    However,  such  models  possess
limitations due to their many simplifying assumptions.
They  are  useful  for  certain  studies,  such  as  post
mortem  analysis,  but  otherwise  poor  in  versatility.
This
to
accommodate complex scenarios, such as sophisticated
worms,  elaborate  defense  mechanisms,  rich  netwo...


Instruction: 总结这篇安全研究的主要观点

Input:
title:High-Fidelity Modeling of Computer Network Worms
author:Kalyan S. Perumalla and
Srikanth Sundaragopalan
High-Fidelity Modeling of Computer Network Worms
Kalyan S. Perumalla
kalyan@cc.gatech.edu
            Srikanth Sundaragopalan
                 srikanth@cc.gatech.edu
College of Computing, Georgia Institute of Technology, Atlanta, Georgia
Abstract
to  capture
the  general  method  of  choice
Abstract  modeling,  such as using  epidemic models,
has  been
for
understanding  and  analyzing  the  high-level  effects  of
worms.  However, high-fidelity models, such as packet-
level  models,  are  indispensable  for  moving  beyond
aggregate  effects,
finer  nuances  and
complexities  associated  with  known  and  future  worms
in  realistic  network  environments.    Here,  we  first
identify  the  spectrum  of  available  alternatives  for
worm  modeling,  and  classify  them  according  to  their
scalability  and  fidelity.    Among  them,  we  focus  on
three  high-fidelity  methods  for  modeling  worms,  and
study  their  effectiveness  with  respect  to  scalability.
Employing  these  methods,  we  are  then  able  to,
respectively,  achieve  some  of  the  largest  packet-level
simulations  of  worm  models  to  date;  implant  and
attack  actual  worm  monitoring/defense  installations
inside
identify  a
that
workaround
fundamentally  constrains  worm  modeling  at
the
highest fidelity levels.
large  simulated  networks;  and
requirement
real-time
for
1
Introduction
Abstract  models  such  as  epidemic  models  have  so
far  been  the  general  means  of  choice  for  modeling
worm  propagation.    However,  such  models  possess
limitations due to their many simplifying assumptions.
They  are  useful  for  certain  studies,  such  as  post
mortem  analysis,  but  otherwise  poor  in  versatility.
This
to
accommodate complex scenarios, such as sophisticated
worms,  elaborate  defense  mechanisms,  rich  netwo...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Inherent PUFs and secure PRNGs on commercial off-the-shelf microcontrollers
author:Anthony Van Herrewege and
Andr'e Schaller and
Stefan Katzenbeisser and
Ingrid Verbauwhede
Demo: Inherent PUFs and Secure PRNGs on
Commercial Off-the-Shelf Microcontrollers
Anthony Van Herrewege
KU Leuven
Heverlee, Belgium
anthony.vanherrewege@
esat.kuleuven.be
Stefan Katzenbeisser
TU Darmstadt
Darmstadt, Germany
katzenbeisser@seceng.
informatik.tu-
darmstadt.de
André Schaller
TU Darmstadt
Darmstadt, Germany
schaller@seceng.
informatik.tu-
darmstadt.de
Ingrid Verbauwhede
KU Leuven
Heverlee, Belgium
ingrid.verbauwhede@
esat.kuleuven.be
ABSTRACT
Research on Physically Unclonable Functions (PUFs) has
become very popular in recent years. However, all PUFs
researched so far require either ASICs, FPGAs or a micro-
controller with external components. Our research focuses
on identifying PUFs in commercial oﬀ-the-shelf devices, e.g.
microcontrollers. We show that PUFs exist in several oﬀ-the-
shelf products, which can be used for security applications.
We present measurement results on the PUF behavior
of ﬁve of the most popular microcontrollers today: ARM
Cortex-A, ARM Cortex-M, Atmel AVR, Microchip PIC16 and
Texas Instruments MSP430. Based on these measurements,
we can calculate whether these chips can be considered for
applications requiring strong cryptography.
As a result of these ﬁndings, we present a secure bootloader
for the ARM Cortex-A9 platform based on a PUF inherent to
the device, requiring no external components. Furthermore,
instead of discarding the randomness in PUF responses, we
utilize this to create strong seeds for pseudo-random number
generators (PRNGs). The existence of a secure RNG is at
the heart of virtually every cryptographic protocol, yet very
often overlooked. We present the implementation of a strongly
seeded PRNG for the ARM Cortex-M family, again requiring
no external components.
Categories and Subject Descriptors
D.4.6 [Operating Systems]: Security ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Inherent PUFs and secure PRNGs on commercial off-the-shelf microcontrollers
author:Anthony Van Herrewege and
Andr'e Schaller and
Stefan Katzenbeisser and
Ingrid Verbauwhede
Demo: Inherent PUFs and Secure PRNGs on
Commercial Off-the-Shelf Microcontrollers
Anthony Van Herrewege
KU Leuven
Heverlee, Belgium
anthony.vanherrewege@
esat.kuleuven.be
Stefan Katzenbeisser
TU Darmstadt
Darmstadt, Germany
katzenbeisser@seceng.
informatik.tu-
darmstadt.de
André Schaller
TU Darmstadt
Darmstadt, Germany
schaller@seceng.
informatik.tu-
darmstadt.de
Ingrid Verbauwhede
KU Leuven
Heverlee, Belgium
ingrid.verbauwhede@
esat.kuleuven.be
ABSTRACT
Research on Physically Unclonable Functions (PUFs) has
become very popular in recent years. However, all PUFs
researched so far require either ASICs, FPGAs or a micro-
controller with external components. Our research focuses
on identifying PUFs in commercial oﬀ-the-shelf devices, e.g.
microcontrollers. We show that PUFs exist in several oﬀ-the-
shelf products, which can be used for security applications.
We present measurement results on the PUF behavior
of ﬁve of the most popular microcontrollers today: ARM
Cortex-A, ARM Cortex-M, Atmel AVR, Microchip PIC16 and
Texas Instruments MSP430. Based on these measurements,
we can calculate whether these chips can be considered for
applications requiring strong cryptography.
As a result of these ﬁndings, we present a secure bootloader
for the ARM Cortex-A9 platform based on a PUF inherent to
the device, requiring no external components. Furthermore,
instead of discarding the randomness in PUF responses, we
utilize this to create strong seeds for pseudo-random number
generators (PRNGs). The existence of a secure RNG is at
the heart of virtually every cryptographic protocol, yet very
often overlooked. We present the implementation of a strongly
seeded PRNG for the ARM Cortex-M family, again requiring
no external components.
Categories and Subject Descriptors
D.4.6 [Operating Systems]: Security ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:ROPMEMU: A Framework for the Analysis of Complex Code-Reuse Attacks
author:Mariano Graziano and
Davide Balzarotti and
Alain Zidouemba
ROPMEMU: A Framework for the
Analysis of Complex Code-Reuse Attacks
Mariano Graziano
Cisco Systems, Inc.
Davide Balzarotti
Eurecom
Alain Zidouemba
Cisco Systems, Inc.
ABSTRACT
Code reuse attacks based on return oriented programming
(ROP) are becoming more and more prevalent every year.
They started as a way to circumvent operating systems
protections against injected code, but they are now also
used as a technique to keep the malicious code hidden from
detection and analysis systems. This means that while in
the past ROP chains were short and simple (and therefore
did not require any dedicated tool for their analysis), we
recently started to observe very complex algorithms – such
as a complete rootkit – implemented entirely as a sequence
of ROP gadgets.
In this paper, we present a set of techniques to analyze
complex code reuse attacks. First, we identify and dis-
cuss the main challenges that complicate the reverse engi-
neer of code implemented using ROP. Second, we propose
an emulation-based framework to dissect, reconstruct, and
simplify ROP chains. Finally, we test our tool on the most
complex example available to date: a ROP rootkit contain-
ing four separate chains, two of them dynamically gener-
ated at runtime.
1.
INTRODUCTION
Memory analysis and memory forensics are active re-
search ﬁelds that have rapidly evolved over the past decade
and they are now a popular, complementary approach to
support modern malware analysis and inspect potentially
compromised machines. The main focus on memory foren-
sics (from a malicious code perspective) is to ﬁnd intrusion
evidences in the physical memory. Commonly, these evi-
dences involve artifacts that has been created or injected in
memory by malicious components. Volatility plugins like
psxview and malfind are good example of tools that per-
form this task. Unfortunately, the cur...