Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Xede: Practical Exploit Early Detection
author:Meining Nie and
Purui Su and
Qi Li and
Zhi Wang and
Lingyun Ying and
Jinlong Hu and
Dengguo Feng
Xede: Practical Exploit Early Detection
Meining Nie1, Purui Su1,2(B), Qi Li3, Zhi Wang4, Lingyun Ying1,
Jinlong Hu5, and Dengguo Feng1
1 Trusted Computing and Information Assurance Laboratory,
Institute of Software, CAS, Beijing, People’s Republic of China
purui@iscas.ac.cn
2 State Key Laboratory of Computer Science,
Institute of Software, CAS, Beijing, China
3 Tsinghua University, Beijing, China
4 Florida State University, Tallahassee, USA
5 South China University of Technology, Guangzhou, China
Abstract. Code reuse and code injection attacks have become the
popular techniques for advanced persistent threat (APT) to bypass
exploit-mitigation mechanisms deployed in modern operating systems.
Meanwhile, complex, benign programs such as Microsoft Oﬃce employ
many advanced techniques to improve the performance. Code execu-
tion patterns generated by these techniques are surprisingly similar to
exploits. This makes the practical exploit detection very challenging,
especially on the Windows platform. In this paper, we propose a practi-
cal exploit early detection system called Xede to comprehensively detect
code reuse and code injection attacks. Xede can eﬀectively reduce false
positives and false negatives in the exploit detection. We demonstrate
the eﬀectiveness of Xede by experimenting with exploit samples and
deploying Xede on the Internet. Xede can accurately detect all types of
exploits. In particular, it can capture many exploits that cannot be cap-
tured by mainstream anti-virus software and detect exploits that fail to
compromise the systems due to variations in the system conﬁgurations.
Keywords: Exploits · Code injection · Code reuse · ROP · Detection
1 Introduction
Advanced persistent threat (APT) is a stealthy, continuous, and targeted attack
against high-value targets, such as enterprises and government agencie...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Xede: Practical Exploit Early Detection
author:Meining Nie and
Purui Su and
Qi Li and
Zhi Wang and
Lingyun Ying and
Jinlong Hu and
Dengguo Feng
Xede: Practical Exploit Early Detection
Meining Nie1, Purui Su1,2(B), Qi Li3, Zhi Wang4, Lingyun Ying1,
Jinlong Hu5, and Dengguo Feng1
1 Trusted Computing and Information Assurance Laboratory,
Institute of Software, CAS, Beijing, People’s Republic of China
purui@iscas.ac.cn
2 State Key Laboratory of Computer Science,
Institute of Software, CAS, Beijing, China
3 Tsinghua University, Beijing, China
4 Florida State University, Tallahassee, USA
5 South China University of Technology, Guangzhou, China
Abstract. Code reuse and code injection attacks have become the
popular techniques for advanced persistent threat (APT) to bypass
exploit-mitigation mechanisms deployed in modern operating systems.
Meanwhile, complex, benign programs such as Microsoft Oﬃce employ
many advanced techniques to improve the performance. Code execu-
tion patterns generated by these techniques are surprisingly similar to
exploits. This makes the practical exploit detection very challenging,
especially on the Windows platform. In this paper, we propose a practi-
cal exploit early detection system called Xede to comprehensively detect
code reuse and code injection attacks. Xede can eﬀectively reduce false
positives and false negatives in the exploit detection. We demonstrate
the eﬀectiveness of Xede by experimenting with exploit samples and
deploying Xede on the Internet. Xede can accurately detect all types of
exploits. In particular, it can capture many exploits that cannot be cap-
tured by mainstream anti-virus software and detect exploits that fail to
compromise the systems due to variations in the system conﬁgurations.
Keywords: Exploits · Code injection · Code reuse · ROP · Detection
1 Introduction
Advanced persistent threat (APT) is a stealthy, continuous, and targeted attack
against high-value targets, such as enterprises and government agencie...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A Treasury System for Cryptocurrencies: Enabling Better Collaborative
Intelligence
author:Bingsheng Zhang and
Roman Oliynykov and
Hamed Balogun
A Treasury System for Cryptocurrencies:
Enabling Better Collaborative Intelligence
Bingsheng Zhang
Lancaster University, UK
b.zhang2@lancaster.ac.uk
Roman Oliynykov
Input Output Hong Kong
roman.oliynykov@iohk.io
Hamed Balogun
Lancaster University, UK
h.balogun@lancaster.ac.uk
Abstract—A treasury system is a community-controlled and
decentralized collaborative decision-making mechanism for sus-
tainable funding of blockchain development and maintenance.
During each treasury period, project proposals are submitted,
discussed, and voted for; top-ranked projects are funded from the
treasury. The Dash governance system is a real-world example
of such kind of systems. In this work, we, for the ﬁrst time,
provide a rigorous study of the treasury system. We modelled,
designed, and implemented a provably secure treasury system
that is compatible with most existing blockchain infrastructures,
such as Bitcoin, Ethereum, etc. More speciﬁcally, the proposed
treasury system supports liquid democracy/delegative voting for
better collaborative intelligence. Namely, the stake holders can
either vote directly on the proposed projects or delegate their
votes to experts. Its core component is a distributed universally
composable secure end-to-end veriﬁable voting protocol. The
integrity of the treasury voting decisions is guaranteed even when
all the voting committee members are corrupted. To further
improve efﬁciency, we proposed the world’s ﬁrst honest veriﬁer
zero-knowledge proof for unit vector encryption with logarithmic
size communication. This partial result may be of independent
interest
to other cryptographic protocols. A pilot system is
implemented in Scala over the Scorex 2.0 framework, and its
benchmark results indicate that the proposed system can support
tens of thousands of treasury participants with high efﬁciency.
I.
INTR...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A Treasury System for Cryptocurrencies: Enabling Better Collaborative
Intelligence
author:Bingsheng Zhang and
Roman Oliynykov and
Hamed Balogun
A Treasury System for Cryptocurrencies:
Enabling Better Collaborative Intelligence
Bingsheng Zhang
Lancaster University, UK
b.zhang2@lancaster.ac.uk
Roman Oliynykov
Input Output Hong Kong
roman.oliynykov@iohk.io
Hamed Balogun
Lancaster University, UK
h.balogun@lancaster.ac.uk
Abstract—A treasury system is a community-controlled and
decentralized collaborative decision-making mechanism for sus-
tainable funding of blockchain development and maintenance.
During each treasury period, project proposals are submitted,
discussed, and voted for; top-ranked projects are funded from the
treasury. The Dash governance system is a real-world example
of such kind of systems. In this work, we, for the ﬁrst time,
provide a rigorous study of the treasury system. We modelled,
designed, and implemented a provably secure treasury system
that is compatible with most existing blockchain infrastructures,
such as Bitcoin, Ethereum, etc. More speciﬁcally, the proposed
treasury system supports liquid democracy/delegative voting for
better collaborative intelligence. Namely, the stake holders can
either vote directly on the proposed projects or delegate their
votes to experts. Its core component is a distributed universally
composable secure end-to-end veriﬁable voting protocol. The
integrity of the treasury voting decisions is guaranteed even when
all the voting committee members are corrupted. To further
improve efﬁciency, we proposed the world’s ﬁrst honest veriﬁer
zero-knowledge proof for unit vector encryption with logarithmic
size communication. This partial result may be of independent
interest
to other cryptographic protocols. A pilot system is
implemented in Scala over the Scorex 2.0 framework, and its
benchmark results indicate that the proposed system can support
tens of thousands of treasury participants with high efﬁciency.
I.
INTR...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Chaos Monkey: Increasing SDN Reliability through Systematic Network
Destruction
author:Michael Alan Chang and
Brendan Tschaen and
Theophilus Benson and
Laurent Vanbever
Chaos Monkey: Increasing SDN Reliability through
Systematic Network Destruction
Michael Alan Chang
Princeton University
machang@princeton.edu
Brendan Tschaen
Duke University
btschaen@cs.duke.edu
Theophilus Benson
Duke University
tbenson@cs.duke.edu
Laurent Vanbever
lvanbever@ethz.ch
ETH Zürich
1.
INTRODUCTION
As modern networking applications become increasingly
dynamic and high-bandwidth, software deﬁned networking
(SDN) has emerged as an agile, cost eﬀective architecture
with widespread adoption across industry.
In SDN, the
control-plane program runs on a logically-centralized con-
troller which directly conﬁgures the packet-handling mech-
anisms in the underlying switches using an open API (e.g.,
OpenFlow). While the controller makes it exceptionally con-
venient for a network operator to control and manage a net-
work, the controller requires complex logic and becomes a
single point of failure within the network. As a result, con-
ﬁguration errors by the controller could be extremely costly
for the network provider.
Several SDN controllers have been developed since the
conception of SDN, and network operators have utilized very
traditional means of identifying bugs in the controller, such
as unit testing and model checking [1]. However, it has be-
come apparent that these methods cannot practically handle
the inherent complexity of the controller platform that man-
ages large networks. Ultimately, one major source of this
complexity are network failures, as they trigger execution of
unexplored portions of code; these network failures are in-
evitable, costly, and considering all possible interleaving of
bugs is simply unfeasible.
To address this problem, we propose “Chaos Monkey” a
real-time post-deployment failure injection tool. Inspired by
industry practices in the cloud [2], Chaos Monke...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Chaos Monkey: Increasing SDN Reliability through Systematic Network
Destruction
author:Michael Alan Chang and
Brendan Tschaen and
Theophilus Benson and
Laurent Vanbever
Chaos Monkey: Increasing SDN Reliability through
Systematic Network Destruction
Michael Alan Chang
Princeton University
machang@princeton.edu
Brendan Tschaen
Duke University
btschaen@cs.duke.edu
Theophilus Benson
Duke University
tbenson@cs.duke.edu
Laurent Vanbever
lvanbever@ethz.ch
ETH Zürich
1.
INTRODUCTION
As modern networking applications become increasingly
dynamic and high-bandwidth, software deﬁned networking
(SDN) has emerged as an agile, cost eﬀective architecture
with widespread adoption across industry.
In SDN, the
control-plane program runs on a logically-centralized con-
troller which directly conﬁgures the packet-handling mech-
anisms in the underlying switches using an open API (e.g.,
OpenFlow). While the controller makes it exceptionally con-
venient for a network operator to control and manage a net-
work, the controller requires complex logic and becomes a
single point of failure within the network. As a result, con-
ﬁguration errors by the controller could be extremely costly
for the network provider.
Several SDN controllers have been developed since the
conception of SDN, and network operators have utilized very
traditional means of identifying bugs in the controller, such
as unit testing and model checking [1]. However, it has be-
come apparent that these methods cannot practically handle
the inherent complexity of the controller platform that man-
ages large networks. Ultimately, one major source of this
complexity are network failures, as they trigger execution of
unexplored portions of code; these network failures are in-
evitable, costly, and considering all possible interleaving of
bugs is simply unfeasible.
To address this problem, we propose “Chaos Monkey” a
real-time post-deployment failure injection tool. Inspired by
industry practices in the cloud [2], Chaos Monke...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Federated infrastructure: usage, patterns, and insights from "the
people's network"
author:Dhananjay Jagtap and
Alex Yen and
Huanlei Wu and
Aaron Schulman and
Pat Pannuto
Federated Infrastructure: Usage, Patterns, and Insights from
“The People’s Network”
Dhananjay Jagtap∗
dtjagtap@eng.ucsd.edu
UC San Diego
Alex Yen∗
alyen@ucsd.edu
UC San Diego
Huanlei Wu
huw012@ucsd.edu
UC San Diego
Aaron Schulman
schulman@cs.ucsd.edu
UC San Diego
ABSTRACT
In this paper, we provide the first broad measurement study of
the operation, adoption, performance, and efficacy of Helium. The
Helium network aims to provide low-power, wide-area network
wireless coverage for Internet of Things-class devices. In contrast to
traditional infrastructure, “hotspots” (base stations) are owned and
operated by individuals who are paid by the network for providing
coverage and are paid directly by users for ferrying data.
As of May, 2021, Helium has over 40,000 active hotspots with
1,000 new hotspots coming online every day. This deployment is
decentralized – 84% of users own at most three hotspots. Some
support infrastructure remains highly centralized, however, with
over 99% of data traffic routed through one cloud endpoint and
multiple cities in which all hotspots rely on one ISP for backhaul.
Helium is largely speculative today with more hotspot activity
than user activity. Crowdsourced, incentive-guided infrastructure
deployment largely works but shows evidence of gamification and
apathy. As Helium lacks clear, radio-oriented coverage maps, we
develop and test coverage models based on network incentives.
Finally, empirical testing with IoT devices finds basic success, but
uncovers numerous reliability issues.
CCS CONCEPTS
• Networks→ Network measurement; Network performance
analysis.
KEYWORDS
Decentralized wireless, LoRa, Internet of Things, Helium, LPWAN
ACM Reference Format:
Dhananjay Jagtap, Alex Yen, Huanlei Wu, Aaron Schulman, and Pat Pannuto.
2021. Federated Infrastructure: Usage, Patte...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Federated infrastructure: usage, patterns, and insights from "the
people's network"
author:Dhananjay Jagtap and
Alex Yen and
Huanlei Wu and
Aaron Schulman and
Pat Pannuto
Federated Infrastructure: Usage, Patterns, and Insights from
“The People’s Network”
Dhananjay Jagtap∗
dtjagtap@eng.ucsd.edu
UC San Diego
Alex Yen∗
alyen@ucsd.edu
UC San Diego
Huanlei Wu
huw012@ucsd.edu
UC San Diego
Aaron Schulman
schulman@cs.ucsd.edu
UC San Diego
ABSTRACT
In this paper, we provide the first broad measurement study of
the operation, adoption, performance, and efficacy of Helium. The
Helium network aims to provide low-power, wide-area network
wireless coverage for Internet of Things-class devices. In contrast to
traditional infrastructure, “hotspots” (base stations) are owned and
operated by individuals who are paid by the network for providing
coverage and are paid directly by users for ferrying data.
As of May, 2021, Helium has over 40,000 active hotspots with
1,000 new hotspots coming online every day. This deployment is
decentralized – 84% of users own at most three hotspots. Some
support infrastructure remains highly centralized, however, with
over 99% of data traffic routed through one cloud endpoint and
multiple cities in which all hotspots rely on one ISP for backhaul.
Helium is largely speculative today with more hotspot activity
than user activity. Crowdsourced, incentive-guided infrastructure
deployment largely works but shows evidence of gamification and
apathy. As Helium lacks clear, radio-oriented coverage maps, we
develop and test coverage models based on network incentives.
Finally, empirical testing with IoT devices finds basic success, but
uncovers numerous reliability issues.
CCS CONCEPTS
• Networks→ Network measurement; Network performance
analysis.
KEYWORDS
Decentralized wireless, LoRa, Internet of Things, Helium, LPWAN
ACM Reference Format:
Dhananjay Jagtap, Alex Yen, Huanlei Wu, Aaron Schulman, and Pat Pannuto.
2021. Federated Infrastructure: Usage, Patte...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Neuroscience Meets Cryptography: Designing Crypto Primitives Secure
Against Rubber Hose Attacks
author:Hristo Bojinov and
Daniel S'anchez and
Paul J. Reber and
Dan Boneh and
Patrick Lincoln
Neuroscience Meets Cryptography:
Designing Crypto Primitives Secure Against Rubber Hose Attacks
Hristo Bojinov
Stanford University
Daniel Sanchez, Paul Reber
Northwestern University
Dan Boneh
Stanford University
Patrick Lincoln
SRI
Abstract
Cryptographic systems often rely on the secrecy of cryp-
tographic keys given to users. Many schemes, however,
cannot resist coercion attacks where the user is forcibly
asked by an attacker to reveal the key. These attacks,
known as rubber hose cryptanalysis, are often the easiest
way to defeat cryptography. We present a defense against
coercion attacks using the concept of implicit learning
from cognitive psychology.
Implicit learning refers to
learning of patterns without any conscious knowledge of
the learned pattern. We use a carefully crafted computer
game to plant a secret password in the participant’s brain
without the participant having any conscious knowledge
of the trained password. While the planted secret can
be used for authentication, the participant cannot be co-
erced into revealing it since he or she has no conscious
knowledge of it. We performed a number of user studies
using Amazon’s Mechanical Turk to verify that partici-
pants can successfully re-authenticate over time and that
they are unable to reconstruct or even recognize short
fragments of the planted secret.
1
Introduction
Consider the following scenario: a high security facility
employs a sophisticated authentication system to check
that only persons who know a secret key, possess a hard-
ware token, and have an authorized biometric can enter.
Guards ensure that only people who successfully authen-
ticate can enter the facility. Now, suppose a clever at-
tacker captures an authenticated user. The attacker can
steal the user’s hardware token, fake the user...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Neuroscience Meets Cryptography: Designing Crypto Primitives Secure
Against Rubber Hose Attacks
author:Hristo Bojinov and
Daniel S'anchez and
Paul J. Reber and
Dan Boneh and
Patrick Lincoln
Neuroscience Meets Cryptography:
Designing Crypto Primitives Secure Against Rubber Hose Attacks
Hristo Bojinov
Stanford University
Daniel Sanchez, Paul Reber
Northwestern University
Dan Boneh
Stanford University
Patrick Lincoln
SRI
Abstract
Cryptographic systems often rely on the secrecy of cryp-
tographic keys given to users. Many schemes, however,
cannot resist coercion attacks where the user is forcibly
asked by an attacker to reveal the key. These attacks,
known as rubber hose cryptanalysis, are often the easiest
way to defeat cryptography. We present a defense against
coercion attacks using the concept of implicit learning
from cognitive psychology.
Implicit learning refers to
learning of patterns without any conscious knowledge of
the learned pattern. We use a carefully crafted computer
game to plant a secret password in the participant’s brain
without the participant having any conscious knowledge
of the trained password. While the planted secret can
be used for authentication, the participant cannot be co-
erced into revealing it since he or she has no conscious
knowledge of it. We performed a number of user studies
using Amazon’s Mechanical Turk to verify that partici-
pants can successfully re-authenticate over time and that
they are unable to reconstruct or even recognize short
fragments of the planted secret.
1
Introduction
Consider the following scenario: a high security facility
employs a sophisticated authentication system to check
that only persons who know a secret key, possess a hard-
ware token, and have an authorized biometric can enter.
Guards ensure that only people who successfully authen-
ticate can enter the facility. Now, suppose a clever at-
tacker captures an authenticated user. The attacker can
steal the user’s hardware token, fake the user...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Towards Database Firewall: Mining the Damage Spreading Patterns
author:Kun Bai and
Peng Liu
Towards Database Firewall: Mining the Damage Spreading Patterns
Kun Bai Peng Liu
College of Information Sciences and Technology
The Pennsylvania State University
University Park, PA 16802, USA
{kbai, pliu}@ist.psu.edu
Abstract
Access control and integrity constraints are well known ap-
proaches to ensure data integrity in commercial database systems.
However, due to operational mistakes, malicious intent of insiders
or vulnerabilities exploited by outsiders, data stored in a database
can still be compromised. When the database is under an attack,
rolling back and re-executing the damaged transactions are the
most used mechanisms during system recovery. This kind of mech-
anism either stops (or greatly restricts) the database service dur-
ing repair, which causes unacceptable availability loss or denial-
of-service for mission critical applications, or may cause serious
damage spreading during on-the-ﬂy recovery where many clean
data items are accidentally corrupted by legitimate new trans-
actions. To resolve this dilemma, we devise a novel mechanism,
called database ﬁrewall in this paper. This ﬁrewall is designed to
protect good data from being corrupted due to damage spreading.
Pattern mining and Bayesian network techniques are adopted in
the framework to mine frequent damage spreading patterns and to
predict the data integrity in the face of attack. Our approach pro-
vides a probability based strategy to estimate the data integrity on
the ﬂy. With this feature, the database ﬁrewall is able to enforce a
policy of transaction ﬁltering to dynamically ﬁlter out the potential
spreading transactions.
1 Introduction
Transactional processing systems (e.g., database sys-
tems) have become increasingly sophisticated and been
critical to most cyber infrastructures, such as banking, e-
Commerce, military combat-ﬁeld command centers, etc.
Data availability and integrity are cruci...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Towards Database Firewall: Mining the Damage Spreading Patterns
author:Kun Bai and
Peng Liu
Towards Database Firewall: Mining the Damage Spreading Patterns
Kun Bai Peng Liu
College of Information Sciences and Technology
The Pennsylvania State University
University Park, PA 16802, USA
{kbai, pliu}@ist.psu.edu
Abstract
Access control and integrity constraints are well known ap-
proaches to ensure data integrity in commercial database systems.
However, due to operational mistakes, malicious intent of insiders
or vulnerabilities exploited by outsiders, data stored in a database
can still be compromised. When the database is under an attack,
rolling back and re-executing the damaged transactions are the
most used mechanisms during system recovery. This kind of mech-
anism either stops (or greatly restricts) the database service dur-
ing repair, which causes unacceptable availability loss or denial-
of-service for mission critical applications, or may cause serious
damage spreading during on-the-ﬂy recovery where many clean
data items are accidentally corrupted by legitimate new trans-
actions. To resolve this dilemma, we devise a novel mechanism,
called database ﬁrewall in this paper. This ﬁrewall is designed to
protect good data from being corrupted due to damage spreading.
Pattern mining and Bayesian network techniques are adopted in
the framework to mine frequent damage spreading patterns and to
predict the data integrity in the face of attack. Our approach pro-
vides a probability based strategy to estimate the data integrity on
the ﬂy. With this feature, the database ﬁrewall is able to enforce a
policy of transaction ﬁltering to dynamically ﬁlter out the potential
spreading transactions.
1 Introduction
Transactional processing systems (e.g., database sys-
tems) have become increasingly sophisticated and been
critical to most cyber infrastructures, such as banking, e-
Commerce, military combat-ﬁeld command centers, etc.
Data availability and integrity are cruci...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Certified Verification of Algebraic Properties on Low-Level Mathematical
Constructs in Cryptographic Programs
author:Ming-Hsien Tsai and
Bow-Yaw Wang and
Bo-Yin Yang
Certified Verification of Algebraic Properties on Low-
Level Mathematical Constructs in Cryptographic Programs
Ming-Hsien Tsai
Academia Sinica
Taipei, Taiwan
mhtsai208@gmail.com
Bow-Yaw Wang
Academia Sinica
Taipei, Taiwan
bywang@iis.sinica.edu.tw
Bo-Yin Yang
Academia Sinica
Taipei, Taiwan
byyang@iis.sinica.edu.tw
ABSTRACT
Mathematical constructs are necessary for computation on the
underlying algebraic structures of cryptosystems. They are often
written in assembly language and optimized manually for efficiency.
We develop a certified technique to verify low-level mathematical
constructs in X25519, the default elliptic curve Diffie-Hellman key
exchange protocol used in OpenSSH. Our technique translates an
algebraic specification of mathematical constructs into an algebraic
problem. The algebraic problem in turn is solved by the computer
algebra system Singular. The proof assistant Coq certifies the
translation and solution to algebraic problems. Specifications about
output ranges and potential program overflows are translated to
SMT problems and verified by SMT solvers. We report our case
studies on verifying arithmetic computation over a large finite field
and the Montgomery Ladderstep, a crucial loop in X25519.
CCS CONCEPTS
• Security and privacy → Logic and verification;
KEYWORDS
cryptography; verification; low-level implementation
1 INTRODUCTION
In order to take advantage of computer security offered by modern
cryptography, cryptosystems must be realized by cryptographic
programs where mathematical constructs are required to compute
on the underlying algebraic structures of cryptosystems. Such math-
ematical constructs are frequently invoked in cryptographic pro-
grams; they are often written in assembly language and manually
optimized for efficiency. Security of cryptosystems could be com-
pr...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Certified Verification of Algebraic Properties on Low-Level Mathematical
Constructs in Cryptographic Programs
author:Ming-Hsien Tsai and
Bow-Yaw Wang and
Bo-Yin Yang
Certified Verification of Algebraic Properties on Low-
Level Mathematical Constructs in Cryptographic Programs
Ming-Hsien Tsai
Academia Sinica
Taipei, Taiwan
mhtsai208@gmail.com
Bow-Yaw Wang
Academia Sinica
Taipei, Taiwan
bywang@iis.sinica.edu.tw
Bo-Yin Yang
Academia Sinica
Taipei, Taiwan
byyang@iis.sinica.edu.tw
ABSTRACT
Mathematical constructs are necessary for computation on the
underlying algebraic structures of cryptosystems. They are often
written in assembly language and optimized manually for efficiency.
We develop a certified technique to verify low-level mathematical
constructs in X25519, the default elliptic curve Diffie-Hellman key
exchange protocol used in OpenSSH. Our technique translates an
algebraic specification of mathematical constructs into an algebraic
problem. The algebraic problem in turn is solved by the computer
algebra system Singular. The proof assistant Coq certifies the
translation and solution to algebraic problems. Specifications about
output ranges and potential program overflows are translated to
SMT problems and verified by SMT solvers. We report our case
studies on verifying arithmetic computation over a large finite field
and the Montgomery Ladderstep, a crucial loop in X25519.
CCS CONCEPTS
• Security and privacy → Logic and verification;
KEYWORDS
cryptography; verification; low-level implementation
1 INTRODUCTION
In order to take advantage of computer security offered by modern
cryptography, cryptosystems must be realized by cryptographic
programs where mathematical constructs are required to compute
on the underlying algebraic structures of cryptosystems. Such math-
ematical constructs are frequently invoked in cryptographic pro-
grams; they are often written in assembly language and manually
optimized for efficiency. Security of cryptosystems could be com-
pr...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Dynamix: anonymity on dynamic social structures
author:Abedelaziz Mohaisen and
Yongdae Kim
Dynamix: Anonymity on Dynamic Social Structures
Abedelaziz Mohaisen
Verisign Labs, VA, USA
Yongdae Kim
KAIST, Daejeon, South Korea
ABSTRACT
In this paper we advance communication using social networks in
two directions by considering dynamics of social graphs. First,
we formally deﬁne the problem of routing on dynamic graphs and
show an interesting and intuitive connection between graph dy-
namics and random walks on weighted graphs; graphs in which
weights summarize history of edge dynamics and allow for future
dynamics to be used as weight adjustment. Second, we present sev-
eral measurements of our proposed model on dynamic graphs ex-
tracted from real-world social networks and compare them to static
structures driven from the same graphs. We show several interest-
ing trade-offs and highlight the potential of our model to capture
dynamics, enrich graph structure, and improves the quantitative
sender anonymity when compared to the case of static graphs.
Categories and Subject Descriptors
C.2.0 [Computer Communication Networks]: General – Security
and Protection; C.4 [Performance of Systems]: Design studies
Keywords
Social networks, Anonymity, Dynamics, P2P communication.
1.
INTRODUCTION
Social networks provide rich algorithmic and structural prop-
erties that can be used for building certain classes of application
beneﬁting from these properties. When considered along with the
main characteristic of social networks, trust, the potential of these
networks becomes very promising in solving real-world problems.
For example, social networks have been proposed as a building
block to defend against the Sybil attack [19], to enable routing
in delay tolerant networks[3, 6], and to provide peer-to-peer and
private communication [14, 9, 4]. However, social network-based
systems make certain assumptions towards achieving their goals;
trust among nodes is assumed binary [10], ass...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Dynamix: anonymity on dynamic social structures
author:Abedelaziz Mohaisen and
Yongdae Kim
Dynamix: Anonymity on Dynamic Social Structures
Abedelaziz Mohaisen
Verisign Labs, VA, USA
Yongdae Kim
KAIST, Daejeon, South Korea
ABSTRACT
In this paper we advance communication using social networks in
two directions by considering dynamics of social graphs. First,
we formally deﬁne the problem of routing on dynamic graphs and
show an interesting and intuitive connection between graph dy-
namics and random walks on weighted graphs; graphs in which
weights summarize history of edge dynamics and allow for future
dynamics to be used as weight adjustment. Second, we present sev-
eral measurements of our proposed model on dynamic graphs ex-
tracted from real-world social networks and compare them to static
structures driven from the same graphs. We show several interest-
ing trade-offs and highlight the potential of our model to capture
dynamics, enrich graph structure, and improves the quantitative
sender anonymity when compared to the case of static graphs.
Categories and Subject Descriptors
C.2.0 [Computer Communication Networks]: General – Security
and Protection; C.4 [Performance of Systems]: Design studies
Keywords
Social networks, Anonymity, Dynamics, P2P communication.
1.
INTRODUCTION
Social networks provide rich algorithmic and structural prop-
erties that can be used for building certain classes of application
beneﬁting from these properties. When considered along with the
main characteristic of social networks, trust, the potential of these
networks becomes very promising in solving real-world problems.
For example, social networks have been proposed as a building
block to defend against the Sybil attack [19], to enable routing
in delay tolerant networks[3, 6], and to provide peer-to-peer and
private communication [14, 9, 4]. However, social network-based
systems make certain assumptions towards achieving their goals;
trust among nodes is assumed binary [10], ass...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Minimizing Noise in HyperLogLog-Based Spread Estimation of Multiple
Flows
author:Dinhnguyen Dao and
Rhongho Jang and
Changhun Jung and
David Mohaisen and
DaeHun Nyang
2022 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
2
4
0
0
0
.
2
2
0
2
.
5
0
4
3
5
N
S
D
/
9
0
1
1
.
0
1
:
I
O
D
|
E
E
E
I
2
2
0
2
©
0
0
.
1
3
$
/
2
2
/
1
-
3
9
6
1
-
4
5
6
6
-
1
-
8
7
9
|
)
N
S
D
(
s
k
r
o
w
t
e
N
d
n
a
s
m
e
t
s
y
S
e
l
b
a
d
n
e
p
e
D
n
o
e
c
n
e
r
e
f
n
o
C
l
a
n
o
i
t
a
n
r
e
t
n
I
P
I
F
I
/
E
E
E
I
l
a
u
n
n
A
d
n
2
5
2
2
0
2
Minimizing Noise in HyperLogLog-Based Spread
Estimation of Multiple Flows
Rhongho Jang†
Wayne State Univ.
r.jang@wayne.edu
Ewha Womans Univ.
mizno@ewha.ac.kr
Univ. of Central Florida
David Mohaisen
Changhun Jung
Dinh Nguyen Dao†
Inha Univ.
nguyen@inha.edu
mohaisen@ucf.edu
DaeHun Nyang
Ewha Womans Univ.
nyang@ewha.ac.kr
Abstract—Cardinality estimation has become an essential
building block of modern network monitoring systems due to
the increasing concerns of cyberattacks (e.g., Denial-of-Service,
worm, spammer, scanner, etc.). However, the ever-increasing at-
tack scale and the diversity of patterns (i.e., ﬂow size distribution)
will produce a biased estimation of existing solutions if apply a
monotonic hypothesis for network trafﬁc. The most representa-
tive solution is virtual HyperLogLog (vHLL), which extended the
proven HLL, a single element cardinality estimation solution, to
a multi-tenant version using a memory random sharing and noise
elimination approach. In this paper, we show that the assumption
made by vHLL’s does not work for large-scale network trafﬁc
with diverse ﬂow distributions. To resolve the issue, we propose
a novel noise elimination method, called Rank Recovery-based
Spread Estimator (RRSE), which is tolerant to both attack and
normal trafﬁc scenarios while using limited computation and
storage. We show that our recovery function is more reliable than
state-of-the-art approaches. Moreover,...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Minimizing Noise in HyperLogLog-Based Spread Estimation of Multiple
Flows
author:Dinhnguyen Dao and
Rhongho Jang and
Changhun Jung and
David Mohaisen and
DaeHun Nyang
2022 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
2
4
0
0
0
.
2
2
0
2
.
5
0
4
3
5
N
S
D
/
9
0
1
1
.
0
1
:
I
O
D
|
E
E
E
I
2
2
0
2
©
0
0
.
1
3
$
/
2
2
/
1
-
3
9
6
1
-
4
5
6
6
-
1
-
8
7
9
|
)
N
S
D
(
s
k
r
o
w
t
e
N
d
n
a
s
m
e
t
s
y
S
e
l
b
a
d
n
e
p
e
D
n
o
e
c
n
e
r
e
f
n
o
C
l
a
n
o
i
t
a
n
r
e
t
n
I
P
I
F
I
/
E
E
E
I
l
a
u
n
n
A
d
n
2
5
2
2
0
2
Minimizing Noise in HyperLogLog-Based Spread
Estimation of Multiple Flows
Rhongho Jang†
Wayne State Univ.
r.jang@wayne.edu
Ewha Womans Univ.
mizno@ewha.ac.kr
Univ. of Central Florida
David Mohaisen
Changhun Jung
Dinh Nguyen Dao†
Inha Univ.
nguyen@inha.edu
mohaisen@ucf.edu
DaeHun Nyang
Ewha Womans Univ.
nyang@ewha.ac.kr
Abstract—Cardinality estimation has become an essential
building block of modern network monitoring systems due to
the increasing concerns of cyberattacks (e.g., Denial-of-Service,
worm, spammer, scanner, etc.). However, the ever-increasing at-
tack scale and the diversity of patterns (i.e., ﬂow size distribution)
will produce a biased estimation of existing solutions if apply a
monotonic hypothesis for network trafﬁc. The most representa-
tive solution is virtual HyperLogLog (vHLL), which extended the
proven HLL, a single element cardinality estimation solution, to
a multi-tenant version using a memory random sharing and noise
elimination approach. In this paper, we show that the assumption
made by vHLL’s does not work for large-scale network trafﬁc
with diverse ﬂow distributions. To resolve the issue, we propose
a novel noise elimination method, called Rank Recovery-based
Spread Estimator (RRSE), which is tolerant to both attack and
normal trafﬁc scenarios while using limited computation and
storage. We show that our recovery function is more reliable than
state-of-the-art approaches. Moreover,...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A Financial Institution's Legacy Mainframe Access Control System in
Light of the Proposed NIST RBAC Standard
author:Andrew D. Marshall
A Financial Institution’s Legacy Mainframe Access Control System in Light of
the Proposed NIST RBAC Standard
Andrew D. Marshall
TD Bank Financial Group
275 Dundas Street
London, Ontario, Canada
andrew.marshall@td.com
Abstract
In this paper we describe a mainframe access control
system (DENT) and its associated delegated administration
tool (DSAS) that were used in a ﬁnancial institution for over
20 years to control access to banking transaction products.
The ﬁr st part of this paper describes the design and oper-
ation of DENT/DSAS as an example of a long-lived access
control system in a ﬁnancial institution.
A standard for Role-Based Access Control (RBAC) has
recently been proposed by the United States National Insti-
tute of Standards and Technology (NIST). The second part
of this paper discusses how the functionality of DENT/DSAS
could be achieved by applying its principles of operation
within the NIST model. In so doing we also evaluate the
proposed standard by validating it against the requirements
embodied in a successful access control system.
We conclude with some observations about the design
of DENT/DSAS and suggestions for changes in the pro-
posed RBAC standard to accommodate some features of
DENT/DSAS that it does not appear to support.
1. Introduction
The The Toronto-Dominion Bank (TD)
is one of
Canada’s largest ﬁnancial
institutions. On February 1,
2000, it acquired the assets of CT Financial Services (CT),
which operated a trust company and related ﬁnancial ser-
vices businesses under the name Canada Trust. With the
purchase TD acquired a portfolio of software that consti-
tuted the banking systems of the former Canada Trust. As a
consequence of system integration decisions driven by busi-
ness requirements, much of the CT software portfolio has
been or shortly will be retired, including the access control
syste...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A Financial Institution's Legacy Mainframe Access Control System in
Light of the Proposed NIST RBAC Standard
author:Andrew D. Marshall
A Financial Institution’s Legacy Mainframe Access Control System in Light of
the Proposed NIST RBAC Standard
Andrew D. Marshall
TD Bank Financial Group
275 Dundas Street
London, Ontario, Canada
andrew.marshall@td.com
Abstract
In this paper we describe a mainframe access control
system (DENT) and its associated delegated administration
tool (DSAS) that were used in a ﬁnancial institution for over
20 years to control access to banking transaction products.
The ﬁr st part of this paper describes the design and oper-
ation of DENT/DSAS as an example of a long-lived access
control system in a ﬁnancial institution.
A standard for Role-Based Access Control (RBAC) has
recently been proposed by the United States National Insti-
tute of Standards and Technology (NIST). The second part
of this paper discusses how the functionality of DENT/DSAS
could be achieved by applying its principles of operation
within the NIST model. In so doing we also evaluate the
proposed standard by validating it against the requirements
embodied in a successful access control system.
We conclude with some observations about the design
of DENT/DSAS and suggestions for changes in the pro-
posed RBAC standard to accommodate some features of
DENT/DSAS that it does not appear to support.
1. Introduction
The The Toronto-Dominion Bank (TD)
is one of
Canada’s largest ﬁnancial
institutions. On February 1,
2000, it acquired the assets of CT Financial Services (CT),
which operated a trust company and related ﬁnancial ser-
vices businesses under the name Canada Trust. With the
purchase TD acquired a portfolio of software that consti-
tuted the banking systems of the former Canada Trust. As a
consequence of system integration decisions driven by busi-
ness requirements, much of the CT software portfolio has
been or shortly will be retired, including the access control
syste...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Identifying elephant flows through periodically sampled packets
author:Tatsuya Mori and
Masato Uchida and
Ryoichi Kawahara and
Jianping Pan and
Shigeki Goto
Identifying Elephant Flows Through
Periodically Sampled Packets
Tatsuya Mori
NTT Service Integration Labs
Waseda University
mori.tatsuya@lab.ntt.co.jp
Masato Uchida
NTT Service Integration Labs
uchida.masato@lab.ntt.co.jp
Ryoichi Kawahara
NTT Service Integration Labs
kawahara.ryoichi@lab.ntt.co.jp
Jianping Pan
NTT MCL
panjianping@acm.org
ABSTRACT
Identifying elephant ﬂows is very important in developing
eﬀective and eﬃcient traﬃc engineering schemes. In addi-
tion, obtaining the statistics of these ﬂows is also very useful
for network operation and management. On the other hand,
with the rapid growth of link speed in recent years, packet
sampling has become a very attractive and scalable means
to measure ﬂow statistics; however, it also makes identi-
fying elephant ﬂows become much more diﬃcult. Based on
Bayes’ theorem, this paper develops techniques and schemes
to identify elephant ﬂows in periodically sampled packets.
We show that our basic framework is very ﬂexible in mak-
ing appropriate trade-oﬀs between false positives (misiden-
tiﬁed ﬂows) and false negatives (missed elephant ﬂows) with
regard to a given sampling frequency. We further validate
and evaluate our approach by using some publicly available
traces. Our schemes are generic and require no per-packet
processing; hence, they allow a very cost-eﬀective imple-
mentation for being deployed in large-scale high-speed net-
works.
Categories and Subject Descriptors: C.2.3 [Computer-
Communication Networks]: Network Operations—Network
monitoring
General Terms: Measurement, Theory, Veriﬁcation
Keywords: measurement, ﬂow statistics, packet sampling,
Bayes’ theorem, the elephant and mice phenomenon
1.
INTRODUCTION
As many measurement-based studies have revealed, ﬂow
statistics exhibit strong heavy-tail behaviors in various net-
works (including the Inte...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Identifying elephant flows through periodically sampled packets
author:Tatsuya Mori and
Masato Uchida and
Ryoichi Kawahara and
Jianping Pan and
Shigeki Goto
Identifying Elephant Flows Through
Periodically Sampled Packets
Tatsuya Mori
NTT Service Integration Labs
Waseda University
mori.tatsuya@lab.ntt.co.jp
Masato Uchida
NTT Service Integration Labs
uchida.masato@lab.ntt.co.jp
Ryoichi Kawahara
NTT Service Integration Labs
kawahara.ryoichi@lab.ntt.co.jp
Jianping Pan
NTT MCL
panjianping@acm.org
ABSTRACT
Identifying elephant ﬂows is very important in developing
eﬀective and eﬃcient traﬃc engineering schemes. In addi-
tion, obtaining the statistics of these ﬂows is also very useful
for network operation and management. On the other hand,
with the rapid growth of link speed in recent years, packet
sampling has become a very attractive and scalable means
to measure ﬂow statistics; however, it also makes identi-
fying elephant ﬂows become much more diﬃcult. Based on
Bayes’ theorem, this paper develops techniques and schemes
to identify elephant ﬂows in periodically sampled packets.
We show that our basic framework is very ﬂexible in mak-
ing appropriate trade-oﬀs between false positives (misiden-
tiﬁed ﬂows) and false negatives (missed elephant ﬂows) with
regard to a given sampling frequency. We further validate
and evaluate our approach by using some publicly available
traces. Our schemes are generic and require no per-packet
processing; hence, they allow a very cost-eﬀective imple-
mentation for being deployed in large-scale high-speed net-
works.
Categories and Subject Descriptors: C.2.3 [Computer-
Communication Networks]: Network Operations—Network
monitoring
General Terms: Measurement, Theory, Veriﬁcation
Keywords: measurement, ﬂow statistics, packet sampling,
Bayes’ theorem, the elephant and mice phenomenon
1.
INTRODUCTION
As many measurement-based studies have revealed, ﬂow
statistics exhibit strong heavy-tail behaviors in various net-
works (including the Inte...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Exploiting Temporal Persistence to Detect Covert Botnet Channels
author:Fr'ed'eric Giroire and
Jaideep Chandrashekar and
Nina Taft and
Eve M. Schooler and
Dina Papagiannaki
Exploiting Temporal Persistence to Detect
Covert Botnet Channels
Frederic Giroire1, Jaideep Chandrashekar2, Nina Taft2, Eve Schooler2,
and Dina Papagiannaki2
1 Project Mascotte, I3S(CNRS/UNS)/INRIA
2 Intel Research
Abstract. We describe a method to detect botnet command and con-
trol traﬃc and individual end-hosts. We introduce the notion of “desti-
nation traﬃc atoms” which aggregate the destinations and services that
are communicated with. We then compute the ”persistence”, which is
a measure of temporal regularity and that we propose in this paper,
for individual destination atoms. Very persistent destination atoms are
added to a host’s whitelist during a training period. Subsequently, we
track the persistence of new destination atoms not already whitelisted
in order to identify suspicious C&C destinations. A particularly novel
aspect is that we track persistence at multiple timescales concurrently.
Importantly, our method does not require any a-priori information about
destinations, ports, or protocols used by the C&C communication, nor
do we require payload inspection. We evaluate our system using exten-
sive user traﬃc traces collected from an enterprise network, along with
collected botnet traces.
We demonstrate that our method correctly identiﬁes a botnet’s C&C
traﬃc, even when it is very stealthy. We also show that ﬁltering outgoing
traﬃc with the constructed whitelists dramatically improves the perfor-
mance of traditional anomaly detectors. Finally, we show that the C&C
detection can be achieved with a very low false positive rate.
1 Introduction
A botnet is a collection of compromised end-hosts all under the control of a
particular bot-master (or bot-herder). The recruited end-hosts, also called drones
or zombies, are marshalled and controlled by the bot-herders via a ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Exploiting Temporal Persistence to Detect Covert Botnet Channels
author:Fr'ed'eric Giroire and
Jaideep Chandrashekar and
Nina Taft and
Eve M. Schooler and
Dina Papagiannaki
Exploiting Temporal Persistence to Detect
Covert Botnet Channels
Frederic Giroire1, Jaideep Chandrashekar2, Nina Taft2, Eve Schooler2,
and Dina Papagiannaki2
1 Project Mascotte, I3S(CNRS/UNS)/INRIA
2 Intel Research
Abstract. We describe a method to detect botnet command and con-
trol traﬃc and individual end-hosts. We introduce the notion of “desti-
nation traﬃc atoms” which aggregate the destinations and services that
are communicated with. We then compute the ”persistence”, which is
a measure of temporal regularity and that we propose in this paper,
for individual destination atoms. Very persistent destination atoms are
added to a host’s whitelist during a training period. Subsequently, we
track the persistence of new destination atoms not already whitelisted
in order to identify suspicious C&C destinations. A particularly novel
aspect is that we track persistence at multiple timescales concurrently.
Importantly, our method does not require any a-priori information about
destinations, ports, or protocols used by the C&C communication, nor
do we require payload inspection. We evaluate our system using exten-
sive user traﬃc traces collected from an enterprise network, along with
collected botnet traces.
We demonstrate that our method correctly identiﬁes a botnet’s C&C
traﬃc, even when it is very stealthy. We also show that ﬁltering outgoing
traﬃc with the constructed whitelists dramatically improves the perfor-
mance of traditional anomaly detectors. Finally, we show that the C&C
detection can be achieved with a very low false positive rate.
1 Introduction
A botnet is a collection of compromised end-hosts all under the control of a
particular bot-master (or bot-herder). The recruited end-hosts, also called drones
or zombies, are marshalled and controlled by the bot-herders via a ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Toward the Analysis of Embedded Firmware through Automated Re-hosting
author:Eric Gustafson and
Marius Muench and
Chad Spensky and
Nilo Redini and
Aravind Machiry and
Yanick Fratantonio and
Davide Balzarotti and
Aur'elien Francillon and
Yung Ryn Choe and
Christopher Kruegel and
Giovanni Vigna
Toward the Analysis of Embedded Firmware through Automated Re-hosting
Eric Gustafson1,2, Marius Muench3, Chad Spensky1, Nilo Redini1, Aravind Machiry1, Yanick Fratantonio3
Aurélien Francillon3, Davide Balzarotti3, Yung Ryn Choe2, Christopher Kruegel1, and Giovanni Vigna1
1University of California, Santa Barbara
{edg, cspensky, nredini, machiry, chris, vigna}@cs.ucsb.edu
2Sandia National Laboratories
{edgusta, yrchoe}@sandia.gov
3EURECOM
{marius.muench, francill, yanick.fratantonio, balzarot}@eurecom.fr
Abstract
The recent paradigm shift introduced by the Internet of
Things (IoT) has brought embedded systems into focus as
a target for both security analysts and malicious adversaries.
Typiﬁed by their lack of standardized hardware, diverse soft-
ware, and opaque functionality, IoT devices present unique
challenges to security analysts due to the tight coupling
between their ﬁrmware and the hardware for which it was de-
signed. In order to take advantage of modern program analysis
techniques, such as fuzzing or symbolic execution, with any
kind of scale or depth, analysts must have the ability to exe-
cute ﬁrmware code in emulated (or virtualized) environments.
However, these emulation environments are rarely available
and are cumbersome to create through manual reverse
engineering, greatly limiting the analysis of binary ﬁrmware.
In this work, we explore the problem of ﬁrmware
re-hosting, the process by which ﬁrmware is migrated
from its original hardware environment into a virtualized
one. We show that an approach capable of creating virtual,
interactive environments in an automated manner is a
necessity to enable ﬁrmware analysis at scale. We present
the ﬁrst proof-o...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Toward the Analysis of Embedded Firmware through Automated Re-hosting
author:Eric Gustafson and
Marius Muench and
Chad Spensky and
Nilo Redini and
Aravind Machiry and
Yanick Fratantonio and
Davide Balzarotti and
Aur'elien Francillon and
Yung Ryn Choe and
Christopher Kruegel and
Giovanni Vigna
Toward the Analysis of Embedded Firmware through Automated Re-hosting
Eric Gustafson1,2, Marius Muench3, Chad Spensky1, Nilo Redini1, Aravind Machiry1, Yanick Fratantonio3
Aurélien Francillon3, Davide Balzarotti3, Yung Ryn Choe2, Christopher Kruegel1, and Giovanni Vigna1
1University of California, Santa Barbara
{edg, cspensky, nredini, machiry, chris, vigna}@cs.ucsb.edu
2Sandia National Laboratories
{edgusta, yrchoe}@sandia.gov
3EURECOM
{marius.muench, francill, yanick.fratantonio, balzarot}@eurecom.fr
Abstract
The recent paradigm shift introduced by the Internet of
Things (IoT) has brought embedded systems into focus as
a target for both security analysts and malicious adversaries.
Typiﬁed by their lack of standardized hardware, diverse soft-
ware, and opaque functionality, IoT devices present unique
challenges to security analysts due to the tight coupling
between their ﬁrmware and the hardware for which it was de-
signed. In order to take advantage of modern program analysis
techniques, such as fuzzing or symbolic execution, with any
kind of scale or depth, analysts must have the ability to exe-
cute ﬁrmware code in emulated (or virtualized) environments.
However, these emulation environments are rarely available
and are cumbersome to create through manual reverse
engineering, greatly limiting the analysis of binary ﬁrmware.
In this work, we explore the problem of ﬁrmware
re-hosting, the process by which ﬁrmware is migrated
from its original hardware environment into a virtualized
one. We show that an approach capable of creating virtual,
interactive environments in an automated manner is a
necessity to enable ﬁrmware analysis at scale. We present
the ﬁrst proof-o...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:InjectaBLE: Injecting malicious traffic into established Bluetooth
Low Energy connections
author:Romain Cayre and
Florent Galtier and
Guillaume Auriol and
Vincent Nicomette and
Mohamed Kaâniche and
G'eraldine Marconato
0
5
0
0
0
.
1
2
0
2
.
7
8
9
8
4
N
S
D
/
9
0
1
1
.
0
1
:
I
O
D
|
E
E
E
I
1
2
0
2
©
0
0
.
1
3
$
/
1
2
/
7
-
2
7
5
3
-
4
5
6
6
-
1
-
8
7
9
|
)
N
S
D
(
s
k
r
o
w
t
e
N
d
n
a
s
m
e
t
s
y
S
e
l
b
a
d
n
e
p
e
D
n
o
e
c
n
e
r
e
f
n
o
C
l
a
n
o
i
t
a
n
r
e
t
n
I
P
I
F
I
/
E
E
E
I
l
a
u
n
n
A
t
s
1
5
1
2
0
2
2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
InjectaBLE: Injecting malicious trafﬁc into
established Bluetooth Low Energy connections
Romain Cayre∗‡, Florent Galtier∗, Guillaume Auriol∗†, Vincent Nicomette∗†, Mohamed Kaˆaniche∗, G´eraldine Marconato‡
∗CNRS, LAAS, 7 avenue du colonel Roche, F-31400
†Univ de Toulouse, INSA, LAAS, F-31400
‡APSYS.Lab, APSYS
Email: ∗ﬁrstname.lastname@laas.fr ‡ﬁrstname.lastname@airbus.com
Abstract—Bluetooth Low Energy (BLE) is nowadays one of
the most popular wireless communication protocols for Internet
of Things (IoT) devices. As a result, several attacks have targeted
this protocol or its implementations in recent years, illustrating
the growing interest for this technology. However, some major
challenges remain from an offensive perspective, such as injecting
arbitrary frames, hijacking the Slave role or performing a Man-
in-The-Middle in an already established connection. In this paper,
we describe a novel attack called InjectaBLE, allowing to inject
malicious trafﬁc into an existing connection. This attack is highly
critical as the vulnerability exploited is inherent to the BLE
speciﬁcation itself, which means that any BLE connection can
be possibly vulnerable, regardless of the BLE devices involved
in the connection. We describe the theoretical foundations of the
attack, how to implement it in practice, and we explore four
critical attack scenarios allowing to mali...


Instruction: 总结这篇安全研究的主要观点

Input:
title:InjectaBLE: Injecting malicious traffic into established Bluetooth
Low Energy connections
author:Romain Cayre and
Florent Galtier and
Guillaume Auriol and
Vincent Nicomette and
Mohamed Kaâniche and
G'eraldine Marconato
0
5
0
0
0
.
1
2
0
2
.
7
8
9
8
4
N
S
D
/
9
0
1
1
.
0
1
:
I
O
D
|
E
E
E
I
1
2
0
2
©
0
0
.
1
3
$
/
1
2
/
7
-
2
7
5
3
-
4
5
6
6
-
1
-
8
7
9
|
)
N
S
D
(
s
k
r
o
w
t
e
N
d
n
a
s
m
e
t
s
y
S
e
l
b
a
d
n
e
p
e
D
n
o
e
c
n
e
r
e
f
n
o
C
l
a
n
o
i
t
a
n
r
e
t
n
I
P
I
F
I
/
E
E
E
I
l
a
u
n
n
A
t
s
1
5
1
2
0
2
2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
InjectaBLE: Injecting malicious trafﬁc into
established Bluetooth Low Energy connections
Romain Cayre∗‡, Florent Galtier∗, Guillaume Auriol∗†, Vincent Nicomette∗†, Mohamed Kaˆaniche∗, G´eraldine Marconato‡
∗CNRS, LAAS, 7 avenue du colonel Roche, F-31400
†Univ de Toulouse, INSA, LAAS, F-31400
‡APSYS.Lab, APSYS
Email: ∗ﬁrstname.lastname@laas.fr ‡ﬁrstname.lastname@airbus.com
Abstract—Bluetooth Low Energy (BLE) is nowadays one of
the most popular wireless communication protocols for Internet
of Things (IoT) devices. As a result, several attacks have targeted
this protocol or its implementations in recent years, illustrating
the growing interest for this technology. However, some major
challenges remain from an offensive perspective, such as injecting
arbitrary frames, hijacking the Slave role or performing a Man-
in-The-Middle in an already established connection. In this paper,
we describe a novel attack called InjectaBLE, allowing to inject
malicious trafﬁc into an existing connection. This attack is highly
critical as the vulnerability exploited is inherent to the BLE
speciﬁcation itself, which means that any BLE connection can
be possibly vulnerable, regardless of the BLE devices involved
in the connection. We describe the theoretical foundations of the
attack, how to implement it in practice, and we explore four
critical attack scenarios allowing to mali...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
author:Minghong Fang and
Xiaoyu Cao and
Jinyuan Jia and
Neil Zhenqiang Gong
Local Model Poisoning Attacks to Byzantine-Robust
Federated Learning
Minghong Fang, Iowa State University; Xiaoyu Cao, Jinyuan Jia, and
Neil Gong, Duke University
https://www.usenix.org/conference/usenixsecurity20/presentation/fang
This paper is included in the Proceedings of the 29th USENIX Security Symposium.August 12–14, 2020978-1-939133-17-5Open access to the Proceedings of the 29th USENIX Security Symposium is sponsored by USENIX.Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
Minghong Fang∗1, Xiaoyu Cao∗2, Jinyuan Jia2, Neil Zhenqiang Gong2
1CS Department, Iowa State University, 2ECE Department, Duke University
1myfang@iastate.edu, 2{xiaoyu.cao, jinyuan.jia, neil.gong}@duke.edu
Abstract
In federated learning, multiple client devices jointly learn a
machine learning model: each client device maintains a local
model for its local training dataset, while a master device
maintains a global model via aggregating the local models
from the client devices. The machine learning community
recently proposed several federated learning methods that
were claimed to be robust against Byzantine failures (e.g.,
system failures, adversarial manipulations) of certain client
devices. In this work, we perform the ﬁrst systematic study
on local model poisoning attacks to federated learning. We
assume an attacker has compromised some client devices,
and the attacker manipulates the local model parameters on
the compromised client devices during the learning process
such that the global model has a large testing error rate. We
formulate our attacks as optimization problems and apply
our attacks to four recent Byzantine-robust federated learning
methods. Our empirical results on four real-world datasets
show that our attacks can substantially increase the error rates
of the models learnt by the federated learning...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
author:Minghong Fang and
Xiaoyu Cao and
Jinyuan Jia and
Neil Zhenqiang Gong
Local Model Poisoning Attacks to Byzantine-Robust
Federated Learning
Minghong Fang, Iowa State University; Xiaoyu Cao, Jinyuan Jia, and
Neil Gong, Duke University
https://www.usenix.org/conference/usenixsecurity20/presentation/fang
This paper is included in the Proceedings of the 29th USENIX Security Symposium.August 12–14, 2020978-1-939133-17-5Open access to the Proceedings of the 29th USENIX Security Symposium is sponsored by USENIX.Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
Minghong Fang∗1, Xiaoyu Cao∗2, Jinyuan Jia2, Neil Zhenqiang Gong2
1CS Department, Iowa State University, 2ECE Department, Duke University
1myfang@iastate.edu, 2{xiaoyu.cao, jinyuan.jia, neil.gong}@duke.edu
Abstract
In federated learning, multiple client devices jointly learn a
machine learning model: each client device maintains a local
model for its local training dataset, while a master device
maintains a global model via aggregating the local models
from the client devices. The machine learning community
recently proposed several federated learning methods that
were claimed to be robust against Byzantine failures (e.g.,
system failures, adversarial manipulations) of certain client
devices. In this work, we perform the ﬁrst systematic study
on local model poisoning attacks to federated learning. We
assume an attacker has compromised some client devices,
and the attacker manipulates the local model parameters on
the compromised client devices during the learning process
such that the global model has a large testing error rate. We
formulate our attacks as optimization problems and apply
our attacks to four recent Byzantine-robust federated learning
methods. Our empirical results on four real-world datasets
show that our attacks can substantially increase the error rates
of the models learnt by the federated learning...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Nabs: A System for Detecting Resource Abuses via Characterization
of Flow Content Type
author:Kulesh Shanmugasundaram and
Mehdi Kharrazi and
Nasir D. Memon
Nabs: A System for Detecting Resource Abuses via Characterization
of Flow Content Type
Kulesh Shanmugasundaram
Mehdi Kharrazi
Nasir Memon
kulesh@isis.poly.edu
mehdi@isis.poly.edu
memon@poly.edu
Polytechnic University
Brooklyn, NY11201
Abstract
One of the growing problems faced by network ad-
ministrators is the abuse of computing resources by
authorized and unauthorized personnel. The nature
of abuse may vary from using unauthorized applica-
tions to serving unauthorized content. Proliferation of
peer-to-peer networks and wide use of tunnels makes
it diﬃcult to detect such abuses and easy to circum-
vent security policies. This paper presents the design
and implementation of a system, called Nabs, that
characterizes content types of network ﬂows based
solely on the payload which can then be used to iden-
tify abuses of computing resources. The proposed
method does not depend on packet headers or other
simple packet characteristics hence is more robust to
circumvention.
1 Introduction
Abuse of computing resources is one of the growing
problems. Network administrators deal with a vari-
ety of abuses such as, network bandwidth by unau-
thorized application services, and the distribution of
unauthorized content to name a few. Abusers can be
malicious attackers looking for free resources to host
their illegal activities, a malicious insider running a
peer-to-peer hub, or simply an ill informed user unin-
tentionally running an application proxy.
The two most common defenses that are used to
prevent network abuses are ﬁrewalls and Intrusion De-
tection Systems (IDS). An IDS is not useful in de-
tecting many types of abuses where the essence of the
abuse is not captured by a simple set of signatures.
Firewalls, on the other hand, are more eﬀective in pre-
venting abuse. Firewalls use port blocking to thwart
unauth...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Nabs: A System for Detecting Resource Abuses via Characterization
of Flow Content Type
author:Kulesh Shanmugasundaram and
Mehdi Kharrazi and
Nasir D. Memon
Nabs: A System for Detecting Resource Abuses via Characterization
of Flow Content Type
Kulesh Shanmugasundaram
Mehdi Kharrazi
Nasir Memon
kulesh@isis.poly.edu
mehdi@isis.poly.edu
memon@poly.edu
Polytechnic University
Brooklyn, NY11201
Abstract
One of the growing problems faced by network ad-
ministrators is the abuse of computing resources by
authorized and unauthorized personnel. The nature
of abuse may vary from using unauthorized applica-
tions to serving unauthorized content. Proliferation of
peer-to-peer networks and wide use of tunnels makes
it diﬃcult to detect such abuses and easy to circum-
vent security policies. This paper presents the design
and implementation of a system, called Nabs, that
characterizes content types of network ﬂows based
solely on the payload which can then be used to iden-
tify abuses of computing resources. The proposed
method does not depend on packet headers or other
simple packet characteristics hence is more robust to
circumvention.
1 Introduction
Abuse of computing resources is one of the growing
problems. Network administrators deal with a vari-
ety of abuses such as, network bandwidth by unau-
thorized application services, and the distribution of
unauthorized content to name a few. Abusers can be
malicious attackers looking for free resources to host
their illegal activities, a malicious insider running a
peer-to-peer hub, or simply an ill informed user unin-
tentionally running an application proxy.
The two most common defenses that are used to
prevent network abuses are ﬁrewalls and Intrusion De-
tection Systems (IDS). An IDS is not useful in de-
tecting many types of abuses where the essence of the
abuse is not captured by a simple set of signatures.
Firewalls, on the other hand, are more eﬀective in pre-
venting abuse. Firewalls use port blocking to thwart
unauth...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:How to kill symbolic deobfuscation for free (or: unleashing the potential
of path-oriented protections)
author:Mathilde Ollivier and
S'ebastien Bardin and
Richard Bonichon and
Jean-Yves Marion
How to Kill Symbolic Deobfuscation for Free
(or: Unleashing the Potential of Path-Oriented Protections)
Mathilde Ollivier
CEA, LIST,
Paris-Saclay, France
mathilde.ollivier2@cea.fr
Richard Bonichon
CEA, LIST,
Paris-Saclay, France
richard.bonichon@cea.fr
Sébastien Bardin
CEA, LIST,
Paris-Saclay, France
sebastien.bardin@cea.fr
Jean-Yves Marion
Université de Lorraine, CNRS, LORIA
Nancy, France
Jean-Yves.Marion@loria.fr
ABSTRACT
Code obfuscation is a major tool for protecting software intellec-
tual property from attacks such as reverse engineering or code
tampering. Yet, recently proposed (automated) attacks based on
Dynamic Symbolic Execution (DSE) shows very promising results,
hence threatening software integrity. Current defenses are not
fully satisfactory, being either not efficient against symbolic rea-
soning, or affecting runtime performance too much, or being too
easy to spot. We present and study a new class of anti-DSE pro-
tections coined as path-oriented protections targeting the weakest
spot of DSE, namely path exploration. We propose a lightweight,
efficient, resistant and analytically proved class of obfuscation algo-
rithms designed to hinder DSE-based attacks. Extensive evaluation
demonstrates that these approaches critically counter symbolic
deobfuscation while yielding only a very slight overhead.
CCS CONCEPTS
• Security and privacy → Software reverse engineering; Logic
and verification; Malware and its mitigation; • Software and its
engineering → Formal methods.
KEYWORDS
Reverse Engineering; Code Protection; Obfuscation
ACM Reference Format:
Mathilde Ollivier, Sébastien Bardin, Richard Bonichon, and Jean-Yves Mar-
ion. 2019. How to Kill Symbolic Deobfuscation for Free (or: Unleashing the
Potential of Path-Oriented Protections) . In 2019 Annual Comput...


Instruction: 总结这篇安全研究的主要观点

Input:
title:How to kill symbolic deobfuscation for free (or: unleashing the potential
of path-oriented protections)
author:Mathilde Ollivier and
S'ebastien Bardin and
Richard Bonichon and
Jean-Yves Marion
How to Kill Symbolic Deobfuscation for Free
(or: Unleashing the Potential of Path-Oriented Protections)
Mathilde Ollivier
CEA, LIST,
Paris-Saclay, France
mathilde.ollivier2@cea.fr
Richard Bonichon
CEA, LIST,
Paris-Saclay, France
richard.bonichon@cea.fr
Sébastien Bardin
CEA, LIST,
Paris-Saclay, France
sebastien.bardin@cea.fr
Jean-Yves Marion
Université de Lorraine, CNRS, LORIA
Nancy, France
Jean-Yves.Marion@loria.fr
ABSTRACT
Code obfuscation is a major tool for protecting software intellec-
tual property from attacks such as reverse engineering or code
tampering. Yet, recently proposed (automated) attacks based on
Dynamic Symbolic Execution (DSE) shows very promising results,
hence threatening software integrity. Current defenses are not
fully satisfactory, being either not efficient against symbolic rea-
soning, or affecting runtime performance too much, or being too
easy to spot. We present and study a new class of anti-DSE pro-
tections coined as path-oriented protections targeting the weakest
spot of DSE, namely path exploration. We propose a lightweight,
efficient, resistant and analytically proved class of obfuscation algo-
rithms designed to hinder DSE-based attacks. Extensive evaluation
demonstrates that these approaches critically counter symbolic
deobfuscation while yielding only a very slight overhead.
CCS CONCEPTS
• Security and privacy → Software reverse engineering; Logic
and verification; Malware and its mitigation; • Software and its
engineering → Formal methods.
KEYWORDS
Reverse Engineering; Code Protection; Obfuscation
ACM Reference Format:
Mathilde Ollivier, Sébastien Bardin, Richard Bonichon, and Jean-Yves Mar-
ion. 2019. How to Kill Symbolic Deobfuscation for Free (or: Unleashing the
Potential of Path-Oriented Protections) . In 2019 Annual Comput...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:When hardware meets software: a bulletproof solution to forensic memory
acquisition
author:Alessandro Reina and
Aristide Fattori and
Fabio Pagani and
Lorenzo Cavallaro and
Danilo Bruschi
When Hardware Meets Software:
A Bulletproof Solution to Forensic Memory Acquisition
Alessandro Reina
Dipartimento di Informatica
Università degli Studi di Milano
Aristide Fattori
Dipartimento di Informatica
Università degli Studi di Milano
Fabio Pagani
Dipartimento di Informatica
Università degli Studi di Milano
Lorenzo Cavallaro
Information Security Group
Royal Holloway, University of London
Danilo Bruschi
Dipartimento di Informatica
Università degli Studi di Milano
ABSTRACT
The acquisition of volatile memory of running systems has
become a prominent and essential procedure in digital foren-
sic analysis and incident responses.
In fact, unencrypted
passwords, cryptographic material, text fragments and latest-
generation malware may easily be protected as encrypted
blobs on persistent storage, while living seamlessly in the
volatile memory of a running system. Likewise, systems’
run-time information, such as open network connections,
open ﬁles and running processes, are by deﬁnition live en-
tities that can only be observed by examining the volatile
memory of a running system. In this context, tampering of
volatile data while an acquisition is in progress or during
transfer to an external trusted entity is an ongoing issue as
it may irremediably invalidate the collected evidence.
To overcome such issues, we present SMMDumper, a novel
technique to perform atomic acquisitions of volatile memory
of running systems. SMMDumper is implemented as an x86
ﬁrmware, which leverages the System Management Mode of
Intel CPUs to create a complete and reliable snapshot of the
state of the system that, with a minimal hardware support,
is resilient to malware attacks. To the best of our knowledge,
SMMDumper is the ﬁrst technique that is able to atomically
acquire the whole volatile memory, over...


Instruction: 总结这篇安全研究的主要观点

Input:
title:When hardware meets software: a bulletproof solution to forensic memory
acquisition
author:Alessandro Reina and
Aristide Fattori and
Fabio Pagani and
Lorenzo Cavallaro and
Danilo Bruschi
When Hardware Meets Software:
A Bulletproof Solution to Forensic Memory Acquisition
Alessandro Reina
Dipartimento di Informatica
Università degli Studi di Milano
Aristide Fattori
Dipartimento di Informatica
Università degli Studi di Milano
Fabio Pagani
Dipartimento di Informatica
Università degli Studi di Milano
Lorenzo Cavallaro
Information Security Group
Royal Holloway, University of London
Danilo Bruschi
Dipartimento di Informatica
Università degli Studi di Milano
ABSTRACT
The acquisition of volatile memory of running systems has
become a prominent and essential procedure in digital foren-
sic analysis and incident responses.
In fact, unencrypted
passwords, cryptographic material, text fragments and latest-
generation malware may easily be protected as encrypted
blobs on persistent storage, while living seamlessly in the
volatile memory of a running system. Likewise, systems’
run-time information, such as open network connections,
open ﬁles and running processes, are by deﬁnition live en-
tities that can only be observed by examining the volatile
memory of a running system. In this context, tampering of
volatile data while an acquisition is in progress or during
transfer to an external trusted entity is an ongoing issue as
it may irremediably invalidate the collected evidence.
To overcome such issues, we present SMMDumper, a novel
technique to perform atomic acquisitions of volatile memory
of running systems. SMMDumper is implemented as an x86
ﬁrmware, which leverages the System Management Mode of
Intel CPUs to create a complete and reliable snapshot of the
state of the system that, with a minimal hardware support,
is resilient to malware attacks. To the best of our knowledge,
SMMDumper is the ﬁrst technique that is able to atomically
acquire the whole volatile memory, over...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch
Shadowing
author:Sangho Lee and
Ming-Wei Shih and
Prasun Gera and
Taesoo Kim and
Hyesoon Kim and
Marcus Peinado
Inferring Fine-grained Control Flow Inside
SGX Enclaves with Branch Shadowing
Sangho Lee, Ming-Wei Shih, Prasun Gera, Taesoo Kim, and Hyesoon Kim,
Georgia Institute of Technology; Marcus Peinado, Microsoft Research
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/lee-sangho
This paper is included in the Proceedings of the 26th USENIX Security SymposiumAugust 16–18, 2017 • Vancouver, BC, CanadaISBN 978-1-931971-40-9Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIXInferring Fine-grained Control Flow Inside
SGX Enclaves with Branch Shadowing
Sangho Lee† Ming-Wei Shih† Prasun Gera† Taesoo Kim† Hyesoon Kim† Marcus Peinado∗
† Georgia Institute of Technology
∗ Microsoft Research
Abstract
Intel has introduced a hardware-based trusted execution
environment, Intel Software Guard Extensions (SGX),
that provides a secure, isolated execution environment,
or enclave, for a user program without trusting any un-
derlying software (e.g., an operating system) or firmware.
Researchers have demonstrated that SGX is vulnerable
to a page-fault-based attack. However, the attack only
reveals page-level memory accesses within an enclave.
In this paper, we explore a new, yet critical, side-
channel attack, branch shadowing, that reveals fine-
grained control flows (branch granularity) in an enclave.
The root cause of this attack is that SGX does not clear
branch history when switching from enclave to non-
enclave mode, leaving fine-grained traces for the outside
world to observe, which gives rise to a branch-prediction
side channel. However, exploiting this channel in practice
is challenging because 1) measuring branch execution
time is too noisy for distinguishing fine-grained control-
flow changes and 2) pausing an enclave righ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch
Shadowing
author:Sangho Lee and
Ming-Wei Shih and
Prasun Gera and
Taesoo Kim and
Hyesoon Kim and
Marcus Peinado
Inferring Fine-grained Control Flow Inside
SGX Enclaves with Branch Shadowing
Sangho Lee, Ming-Wei Shih, Prasun Gera, Taesoo Kim, and Hyesoon Kim,
Georgia Institute of Technology; Marcus Peinado, Microsoft Research
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/lee-sangho
This paper is included in the Proceedings of the 26th USENIX Security SymposiumAugust 16–18, 2017 • Vancouver, BC, CanadaISBN 978-1-931971-40-9Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIXInferring Fine-grained Control Flow Inside
SGX Enclaves with Branch Shadowing
Sangho Lee† Ming-Wei Shih† Prasun Gera† Taesoo Kim† Hyesoon Kim† Marcus Peinado∗
† Georgia Institute of Technology
∗ Microsoft Research
Abstract
Intel has introduced a hardware-based trusted execution
environment, Intel Software Guard Extensions (SGX),
that provides a secure, isolated execution environment,
or enclave, for a user program without trusting any un-
derlying software (e.g., an operating system) or firmware.
Researchers have demonstrated that SGX is vulnerable
to a page-fault-based attack. However, the attack only
reveals page-level memory accesses within an enclave.
In this paper, we explore a new, yet critical, side-
channel attack, branch shadowing, that reveals fine-
grained control flows (branch granularity) in an enclave.
The root cause of this attack is that SGX does not clear
branch history when switching from enclave to non-
enclave mode, leaving fine-grained traces for the outside
world to observe, which gives rise to a branch-prediction
side channel. However, exploiting this channel in practice
is challenging because 1) measuring branch execution
time is too noisy for distinguishing fine-grained control-
flow changes and 2) pausing an enclave righ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:IMP4GT: IMPersonation Attacks in 4G NeTworks
author:David Rupprecht and
Katharina Kohls and
Thorsten Holz and
Christina P"opper
IMP4GT: IMPersonation Attacks in 4G NeTworks
David Rupprecht
Ruhr University Bochum
david.rupprecht@rub.de
Katharina Kohls
Ruhr University Bochum
katharina.kohls@rub.de
Thorsten Holz
Ruhr University Bochum
thorsten.holz@rub.de
Christina P¨opper
NYU Abu Dhabi
christina.poepper@nyu.edu
Abstract—Long Term Evolution (LTE/4G) establishes mutual
authentication with a provably secure Authentication and Key
Agreement (AKA) protocol on layer three of the network stack.
Permanent integrity protection of the control plane safeguards
the trafﬁc against manipulations. However, missing integrity pro-
tection of the user plane still allows an adversary to manipulate
and redirect IP packets, as recently demonstrated.
In this work, we introduce a novel cross-layer attack that
exploits the existing vulnerability on layer two and extends it
with an attack mechanism on layer three. More precisely, we take
advantage of the default IP stack behavior of operating systems
and show that combining it with the layer-two vulnerability allows
an active attacker to impersonate a user towards the network
and vice versa; we name these attacks IMP4GT (IMPersonation
attacks in 4G neTworks). In contrast to a simple redirection
attack as demonstrated in prior work, our attack dramatically
extends the possible attack scenarios and thus emphasizes the
need for user-plane integrity protection in mobile communication
standards. The results of our work imply that providers can no
longer rely on mutual authentication for billing, access control,
and legal prosecution. On the other hand, users are exposed
to any incoming IP connection as an adversary can bypass
the provider’s ﬁrewall. To demonstrate the practical impact of
our attack, we conduct two IMP4GT attack variants in a live,
commercial network, which—for the ﬁrst time—completely break
the mutual authentication aim...


Instruction: 总结这篇安全研究的主要观点

Input:
title:IMP4GT: IMPersonation Attacks in 4G NeTworks
author:David Rupprecht and
Katharina Kohls and
Thorsten Holz and
Christina P"opper
IMP4GT: IMPersonation Attacks in 4G NeTworks
David Rupprecht
Ruhr University Bochum
david.rupprecht@rub.de
Katharina Kohls
Ruhr University Bochum
katharina.kohls@rub.de
Thorsten Holz
Ruhr University Bochum
thorsten.holz@rub.de
Christina P¨opper
NYU Abu Dhabi
christina.poepper@nyu.edu
Abstract—Long Term Evolution (LTE/4G) establishes mutual
authentication with a provably secure Authentication and Key
Agreement (AKA) protocol on layer three of the network stack.
Permanent integrity protection of the control plane safeguards
the trafﬁc against manipulations. However, missing integrity pro-
tection of the user plane still allows an adversary to manipulate
and redirect IP packets, as recently demonstrated.
In this work, we introduce a novel cross-layer attack that
exploits the existing vulnerability on layer two and extends it
with an attack mechanism on layer three. More precisely, we take
advantage of the default IP stack behavior of operating systems
and show that combining it with the layer-two vulnerability allows
an active attacker to impersonate a user towards the network
and vice versa; we name these attacks IMP4GT (IMPersonation
attacks in 4G neTworks). In contrast to a simple redirection
attack as demonstrated in prior work, our attack dramatically
extends the possible attack scenarios and thus emphasizes the
need for user-plane integrity protection in mobile communication
standards. The results of our work imply that providers can no
longer rely on mutual authentication for billing, access control,
and legal prosecution. On the other hand, users are exposed
to any incoming IP connection as an adversary can bypass
the provider’s ﬁrewall. To demonstrate the practical impact of
our attack, we conduct two IMP4GT attack variants in a live,
commercial network, which—for the ﬁrst time—completely break
the mutual authentication aim...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:On the Forensic Validity of Approximated Audit Logs
author:Noor Michael and
Jaron Mink and
Jason Liu and
Sneha Gaur and
Wajih Ul Hassan and
Adam Bates
On the Forensic Validity of Approximated Audit Logs
Noor Michael
Jaron Mink
Jason Liu
University of Illinois at
Urbana-Champaign
nsm2@illinois.edu
Sneha Gaur
University of Illinois at
Urbana-Champaign
sg2@illinois.edu
University of Illinois at
Urbana-Champaign
jaronmm2@illinois.edu
Wajih Ul Hassan
University of Illinois at
Urbana-Champaign
whassan3@illinois.edu
University of Illinois at
Urbana-Champaign
jdliu2@illinois.edu
Adam Bates
University of Illinois at
Urbana-Champaign
batesa@illinois.edu
ABSTRACT
Auditing is an increasingly essential tool for the defense of comput-
ing systems, but the unwieldy nature of log data imposes significant
burdens on administrators and analysts. To address this issue, a
variety of techniques have been proposed for approximating the
contents of raw audit logs, facilitating efficient storage and analysis.
However, the security value of these approximated logs is diffi-
cult to measure—relative to the original log, it is unclear if these
techniques retain the forensic evidence needed to effectively inves-
tigate threats. Unfortunately, prior work has only investigated this
issue anecdotally, demonstrating sufficient evidence is retained for
specific attack scenarios.
In this work, we address this gap in the literature through for-
malizing metrics for quantifying the forensic validity of an approxi-
mated audit log under differing threat models. In addition to provid-
ing quantifiable security arguments for prior work, we also identify
a novel point in the approximation design space—that log events
describing typical (benign) system activity can be aggressively ap-
proximated, while events that encode anomalous behavior should
be preserved with lossless fidelity. We instantiate this notion of
Attack-Preserving forensic validity in LogApprox, a new approxi-
mation technique that el...


Instruction: 总结这篇安全研究的主要观点

Input:
title:On the Forensic Validity of Approximated Audit Logs
author:Noor Michael and
Jaron Mink and
Jason Liu and
Sneha Gaur and
Wajih Ul Hassan and
Adam Bates
On the Forensic Validity of Approximated Audit Logs
Noor Michael
Jaron Mink
Jason Liu
University of Illinois at
Urbana-Champaign
nsm2@illinois.edu
Sneha Gaur
University of Illinois at
Urbana-Champaign
sg2@illinois.edu
University of Illinois at
Urbana-Champaign
jaronmm2@illinois.edu
Wajih Ul Hassan
University of Illinois at
Urbana-Champaign
whassan3@illinois.edu
University of Illinois at
Urbana-Champaign
jdliu2@illinois.edu
Adam Bates
University of Illinois at
Urbana-Champaign
batesa@illinois.edu
ABSTRACT
Auditing is an increasingly essential tool for the defense of comput-
ing systems, but the unwieldy nature of log data imposes significant
burdens on administrators and analysts. To address this issue, a
variety of techniques have been proposed for approximating the
contents of raw audit logs, facilitating efficient storage and analysis.
However, the security value of these approximated logs is diffi-
cult to measure—relative to the original log, it is unclear if these
techniques retain the forensic evidence needed to effectively inves-
tigate threats. Unfortunately, prior work has only investigated this
issue anecdotally, demonstrating sufficient evidence is retained for
specific attack scenarios.
In this work, we address this gap in the literature through for-
malizing metrics for quantifying the forensic validity of an approxi-
mated audit log under differing threat models. In addition to provid-
ing quantifiable security arguments for prior work, we also identify
a novel point in the approximation design space—that log events
describing typical (benign) system activity can be aggressively ap-
proximated, while events that encode anomalous behavior should
be preserved with lossless fidelity. We instantiate this notion of
Attack-Preserving forensic validity in LogApprox, a new approxi-
mation technique that el...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Ripcord: a modular platform for data center networking
author:Brandon Heller and
David Erickson and
Nick McKeown and
Rean Griffith and
Igor Ganichev and
Scott Whyte and
Kyriakos Zarifis and
Daekyeong Moon and
Scott Shenker and
Stephen Stuart
Ripcord: A Modular Platform for Data Center Networking
Brandon Heller,
David Erickson,
Nick McKeown
Stanford University
Stanford, CA, USA
{brandonh, derickso, nickm}
@stanford.edu
Rean Grifﬁth,
Igor Ganichev,
Scott Shenker
University of California
Berkeley, CA, USA
{rean, igor}
@eecs.berkeley.edu
shenker@icsi.berkeley.edu
Kyriakos Zariﬁs
International Computer
Science Institute
Berkeley, CA, USA
zariﬁs@icsi.berkeley.edu
Daekyeong Moon
Nicira Networks
Palo Alto, CA, USA
dkmoon@nicira.com
Scott Whyte,
Stephen Stuart
Google, Inc.
Mountain View, CA, USA
{swhyte, sstuart}@google.com
ABSTRACT
In this demo, we present Ripcord, a modular platform for
rapidly prototyping scale-out data center networks. Rip-
cord enables researchers to build and evaluate new network
features and topologies, using only commercially available
hardware and open-source software. The Ripcord demo will
show three examples of custom network functions, operating
together, on top of a 160-node cluster. The ﬁrst is a routing
engine that isolates classes of traﬃc. The second is a dy-
namic network manager than adjusts links and switch power
states to reduce energy. The third is a statistics aggrega-
tor that supports network health monitoring and automatic
alerts. The demo will be interactive, with a visualization of
live parameters for each link and switch, such as bandwidth,
drops, and power status, as well a control panel to modify
the traﬃc load. We feel that an interactive demo is the best
way to introduce the research community to Ripcord and
get their feedback.
Categories and Subject Descriptors: C.2.1 [Network
Architecture and Design]: Network communications; C.2.2
[Network Protocols] Routing protocols
General Terms: Design, Experimentation, Management...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Ripcord: a modular platform for data center networking
author:Brandon Heller and
David Erickson and
Nick McKeown and
Rean Griffith and
Igor Ganichev and
Scott Whyte and
Kyriakos Zarifis and
Daekyeong Moon and
Scott Shenker and
Stephen Stuart
Ripcord: A Modular Platform for Data Center Networking
Brandon Heller,
David Erickson,
Nick McKeown
Stanford University
Stanford, CA, USA
{brandonh, derickso, nickm}
@stanford.edu
Rean Grifﬁth,
Igor Ganichev,
Scott Shenker
University of California
Berkeley, CA, USA
{rean, igor}
@eecs.berkeley.edu
shenker@icsi.berkeley.edu
Kyriakos Zariﬁs
International Computer
Science Institute
Berkeley, CA, USA
zariﬁs@icsi.berkeley.edu
Daekyeong Moon
Nicira Networks
Palo Alto, CA, USA
dkmoon@nicira.com
Scott Whyte,
Stephen Stuart
Google, Inc.
Mountain View, CA, USA
{swhyte, sstuart}@google.com
ABSTRACT
In this demo, we present Ripcord, a modular platform for
rapidly prototyping scale-out data center networks. Rip-
cord enables researchers to build and evaluate new network
features and topologies, using only commercially available
hardware and open-source software. The Ripcord demo will
show three examples of custom network functions, operating
together, on top of a 160-node cluster. The ﬁrst is a routing
engine that isolates classes of traﬃc. The second is a dy-
namic network manager than adjusts links and switch power
states to reduce energy. The third is a statistics aggrega-
tor that supports network health monitoring and automatic
alerts. The demo will be interactive, with a visualization of
live parameters for each link and switch, such as bandwidth,
drops, and power status, as well a control panel to modify
the traﬃc load. We feel that an interactive demo is the best
way to introduce the research community to Ripcord and
get their feedback.
Categories and Subject Descriptors: C.2.1 [Network
Architecture and Design]: Network communications; C.2.2
[Network Protocols] Routing protocols
General Terms: Design, Experimentation, Management...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Chip and Skim: Cloning EMV Cards with the Pre-play Attack
author:Mike Bond and
Omar Choudary and
Steven J. Murdoch and
Sergei P. Skorobogatov and
Ross J. Anderson
2014 IEEE Symposium on Security and Privacy
Chip and Skim: cloning EMV cards with the pre-play attack
Mike Bond, Omar Choudary, Steven J. Murdoch, Sergei Skorobogatov, Ross Anderson
Computer Laboratory, University of Cambridge, UK
forename.lastname@cl.cam.ac.uk
Abstract—EMV, also known as “Chip and PIN”,
is the
leading system for card payments worldwide. It
is used
throughout Europe and much of Asia, and is starting to be
introduced in North America too. Payment cards contain a
chip so they can execute an authentication protocol. This
protocol requires point-of-sale (POS) terminals or ATMs to
generate a nonce, called the unpredictable number, for each
transaction to ensure it is fresh. We have discovered two serious
problems: a widespread implementation ﬂaw and a deeper,
more difﬁcult to ﬁx ﬂaw with the EMV protocol itself. The
ﬁrst ﬂaw is that some EMV implementers have merely used
counters, timestamps or home-grown algorithms to supply this
nonce. This exposes them to a “pre-play” attack which is
indistinguishable from card cloning from the standpoint of the
logs available to the card-issuing bank, and can be carried out
even if it is impossible to clone a card physically. Card cloning
is the very type of fraud that EMV was supposed to prevent.
We describe how we detected the vulnerability, a survey
methodology we developed to chart the scope of the weakness,
evidence from ATM and terminal experiments in the ﬁeld, and
our implementation of proof-of-concept attacks. We found ﬂaws
in widely-used ATMs from the largest manufacturers. We can
now explain at least some of the increasing number of frauds in
which victims are refused refunds by banks which claim that
EMV cards cannot be cloned and that a customer involved
in a dispute must therefore be mistaken or complicit. The
second problem was exposed b...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Chip and Skim: Cloning EMV Cards with the Pre-play Attack
author:Mike Bond and
Omar Choudary and
Steven J. Murdoch and
Sergei P. Skorobogatov and
Ross J. Anderson
2014 IEEE Symposium on Security and Privacy
Chip and Skim: cloning EMV cards with the pre-play attack
Mike Bond, Omar Choudary, Steven J. Murdoch, Sergei Skorobogatov, Ross Anderson
Computer Laboratory, University of Cambridge, UK
forename.lastname@cl.cam.ac.uk
Abstract—EMV, also known as “Chip and PIN”,
is the
leading system for card payments worldwide. It
is used
throughout Europe and much of Asia, and is starting to be
introduced in North America too. Payment cards contain a
chip so they can execute an authentication protocol. This
protocol requires point-of-sale (POS) terminals or ATMs to
generate a nonce, called the unpredictable number, for each
transaction to ensure it is fresh. We have discovered two serious
problems: a widespread implementation ﬂaw and a deeper,
more difﬁcult to ﬁx ﬂaw with the EMV protocol itself. The
ﬁrst ﬂaw is that some EMV implementers have merely used
counters, timestamps or home-grown algorithms to supply this
nonce. This exposes them to a “pre-play” attack which is
indistinguishable from card cloning from the standpoint of the
logs available to the card-issuing bank, and can be carried out
even if it is impossible to clone a card physically. Card cloning
is the very type of fraud that EMV was supposed to prevent.
We describe how we detected the vulnerability, a survey
methodology we developed to chart the scope of the weakness,
evidence from ATM and terminal experiments in the ﬁeld, and
our implementation of proof-of-concept attacks. We found ﬂaws
in widely-used ATMs from the largest manufacturers. We can
now explain at least some of the increasing number of frauds in
which victims are refused refunds by banks which claim that
EMV cards cannot be cloned and that a customer involved
in a dispute must therefore be mistaken or complicit. The
second problem was exposed b...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Reuse-oriented camouflaging trojan: Vulnerability detection and attack
construction
author:Zhiqiang Lin and
Xiangyu Zhang and
Dongyan Xu
2010 IEEE/IFIP International
Conference
on Dependable
Systems
& Networks
(DSN)
Reuse-Oriented
Camouflaging
Trojan: Vulnerability
and
Detection
Attack Construction
Zhiqiang Lin Xiangyu Zhang Dongyan Xu
Department of Computer Science and CERIAS, Purdue University
{zlin,xyzhang,dxu}@cs.purdue.edu
Abstract
We introduce
the reuse-oriented
camouflaging
ma
trojan - a
in
action,
of implementing
Trojan
63%
invocation
At the network
of a targeted
to legitimate
software binaries.
such a trojan identifies
a legal invocation.
To perform a
and reuses an existing
this trojan is stealthy
function usually
where it is legal to do so, closely
new threat
licious
function in a legal binary program instead
the function itself. Furthermore,
that the malicious
takes place in a location
mimicking
tim binary can still
out exhibiting
close-source
shareware
can be maliciously
gets of this type of attack.
work to determine
to this attack and to construct
experiments
demonstrate
are a real threat
naries can be effectively
the vic
level,
protocol
follow its communication
with
Meanwhile,
many
are rich in functions
that
tar
a frame
with a number of real-world
that the reuse-oriented
trojan if so. Our
software binaries
trojans
camouflaging
of this type in legal bi
any anomalous behavior.
and vulnerabilities
making them attractive
In this paper, we present
and confirmed.
"reused",
a concrete
binaries
revealed
if a given binary program is vulnerable
TmJ::��:Ec:����
2%
Troj:m-13ankc;
4%
Trojan-
Gamc"lllicf
17%
I'll
Trojan·Dropper
5%
Trojan-Spy  Troj:m-PSW
10%
7%
(a)
(b)
Figure 1. Distribution
(b) trojan payloads
in VxHeaven.
of (a) malware types and
1 Introduction
Trojan is the type of mal ware that appears
to perform a
logics.
It
and reliability.
securit...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Reuse-oriented camouflaging trojan: Vulnerability detection and attack
construction
author:Zhiqiang Lin and
Xiangyu Zhang and
Dongyan Xu
2010 IEEE/IFIP International
Conference
on Dependable
Systems
& Networks
(DSN)
Reuse-Oriented
Camouflaging
Trojan: Vulnerability
and
Detection
Attack Construction
Zhiqiang Lin Xiangyu Zhang Dongyan Xu
Department of Computer Science and CERIAS, Purdue University
{zlin,xyzhang,dxu}@cs.purdue.edu
Abstract
We introduce
the reuse-oriented
camouflaging
ma
trojan - a
in
action,
of implementing
Trojan
63%
invocation
At the network
of a targeted
to legitimate
software binaries.
such a trojan identifies
a legal invocation.
To perform a
and reuses an existing
this trojan is stealthy
function usually
where it is legal to do so, closely
new threat
licious
function in a legal binary program instead
the function itself. Furthermore,
that the malicious
takes place in a location
mimicking
tim binary can still
out exhibiting
close-source
shareware
can be maliciously
gets of this type of attack.
work to determine
to this attack and to construct
experiments
demonstrate
are a real threat
naries can be effectively
the vic
level,
protocol
follow its communication
with
Meanwhile,
many
are rich in functions
that
tar
a frame
with a number of real-world
that the reuse-oriented
trojan if so. Our
software binaries
trojans
camouflaging
of this type in legal bi
any anomalous behavior.
and vulnerabilities
making them attractive
In this paper, we present
and confirmed.
"reused",
a concrete
binaries
revealed
if a given binary program is vulnerable
TmJ::��:Ec:����
2%
Troj:m-13ankc;
4%
Trojan-
Gamc"lllicf
17%
I'll
Trojan·Dropper
5%
Trojan-Spy  Troj:m-PSW
10%
7%
(a)
(b)
Figure 1. Distribution
(b) trojan payloads
in VxHeaven.
of (a) malware types and
1 Introduction
Trojan is the type of mal ware that appears
to perform a
logics.
It
and reliability.
securit...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。