Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:DUET: integration of dynamic and static analyses for malware clustering
with cluster ensembles
author:Xin Hu and
Kang G. Shin
DUET: Integration of Dynamic and Static Analyses for Malware
Clustering with Cluster Ensembles
Xin Hu
IBM T.J. Watson Research Labs
huxin@us.ibm.com
Kang G. Shin
University of Michigan, Ann Arbor
kgshin@eecs.umich.edu
ABSTRACT
Automatic malware clustering plays a vital role in combating
the rapidly growing number of malware variants. Most ex-
isting malware clustering algorithms operate on either static
instruction features or dynamic behavior features to parti-
tion malware into families. However, these two distinct ap-
proaches have their own strengths and weaknesses in han-
dling diﬀerent types of malware. Moreover, diﬀerent cluster-
ing algorithms and even multiple runs of the same algorithms
may produce inconsistent or even contradictory results. To
remedy this heterogeneity and lack of robustness of a single
clustering algorithm, we propose a novel system called DUET
by exploiting the complementary nature of static and dy-
namic clustering algorithms and optimally integrating their
results. By using the concept of clustering ensemble, DUET
combines partitions from individual clustering algorithms
into a single consensus partition with better quality and ro-
bustness. DUET improves existing ensemble algorithms by
incorporating cluster-quality measures to eﬀectively recon-
cile diﬀerences and/or contradictions between base malware
clusterings. Using real-world malware samples, we compare
the performance of DUET (in terms of clustering precision,
recall and coverage) with individual state-of-the-art static
and dynamic clustering component. The comprehensive ex-
periments demonstrate DUET’s capability of improving the
coverage of malware samples by 20–40% while keeping the
precision near the optimum achievable by any individual
clustering algorithm.
1.
INTRODUCTION
The growing popularity of automatic malware-creation
toolkits, which a...


Instruction: 总结这篇安全研究的主要观点

Input:
title:DUET: integration of dynamic and static analyses for malware clustering
with cluster ensembles
author:Xin Hu and
Kang G. Shin
DUET: Integration of Dynamic and Static Analyses for Malware
Clustering with Cluster Ensembles
Xin Hu
IBM T.J. Watson Research Labs
huxin@us.ibm.com
Kang G. Shin
University of Michigan, Ann Arbor
kgshin@eecs.umich.edu
ABSTRACT
Automatic malware clustering plays a vital role in combating
the rapidly growing number of malware variants. Most ex-
isting malware clustering algorithms operate on either static
instruction features or dynamic behavior features to parti-
tion malware into families. However, these two distinct ap-
proaches have their own strengths and weaknesses in han-
dling diﬀerent types of malware. Moreover, diﬀerent cluster-
ing algorithms and even multiple runs of the same algorithms
may produce inconsistent or even contradictory results. To
remedy this heterogeneity and lack of robustness of a single
clustering algorithm, we propose a novel system called DUET
by exploiting the complementary nature of static and dy-
namic clustering algorithms and optimally integrating their
results. By using the concept of clustering ensemble, DUET
combines partitions from individual clustering algorithms
into a single consensus partition with better quality and ro-
bustness. DUET improves existing ensemble algorithms by
incorporating cluster-quality measures to eﬀectively recon-
cile diﬀerences and/or contradictions between base malware
clusterings. Using real-world malware samples, we compare
the performance of DUET (in terms of clustering precision,
recall and coverage) with individual state-of-the-art static
and dynamic clustering component. The comprehensive ex-
periments demonstrate DUET’s capability of improving the
coverage of malware samples by 20–40% while keeping the
precision near the optimum achievable by any individual
clustering algorithm.
1.
INTRODUCTION
The growing popularity of automatic malware-creation
toolkits, which a...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:An Empirical Study of Textual Key-Fingerprint Representations
author:Sergej Dechand and
Dominik Sch"urmann and
Karoline Busse and
Yasemin Acar and
Sascha Fahl and
Matthew Smith
An Empirical Study of Textual
Key-Fingerprint Representations
Sergej Dechand, University of Bonn; Dominik Schürmann, Technische Universität
Braunschweig; Karoline Busse, University of Bonn; Yasemin Acar and Sascha Fahl,
Saarland University; Matthew Smith, University of Bonn
 https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/dechand
This paper is included in the Proceedings of the 25th USENIX Security SymposiumAugust 10–12, 2016 • Austin, TXISBN 978-1-931971-32-4Open access to the Proceedings of the 25th USENIX Security Symposium is sponsored by USENIX An Empirical Study of Textual Key-Fingerprint Representations
Sergej Dechand
USECAP, University of Bonn
Yasemin Acar
CISPA, Saarland University
Dominik Sch¨urmann
IBR, TU Braunschweig
Sascha Fahl
CISPA, Saarland University
Karoline Busse
USECAP, University of Bonn
Matthew Smith
USECAP, University of Bonn
Abstract
Many security protocols still rely on manual ﬁngerprint
comparisons for authentication. The most well-known
and widely used key-ﬁngerprint representation are hexa-
decimal strings as used in various security tools. With
the introduction of end-to-end security in WhatsApp and
other messengers, the discussion on how to best repre-
sent key-ﬁngerprints for users is receiving a lot of inter-
est.
We conduct a 1047 participant study evaluating six
different textual key-ﬁngerprint representations with re-
gards to their performance and usability. We focus on
textual ﬁngerprints as the most robust and deployable
representation.
Our ﬁndings show that the currently used hexadeci-
mal representation is more prone to partial preimage at-
tacks in comparison to others. Based on our ﬁndings,
we make the recommendation that two alternative repre-
sentations should be adopted. The highest attack detec-...


Instruction: 总结这篇安全研究的主要观点

Input:
title:An Empirical Study of Textual Key-Fingerprint Representations
author:Sergej Dechand and
Dominik Sch"urmann and
Karoline Busse and
Yasemin Acar and
Sascha Fahl and
Matthew Smith
An Empirical Study of Textual
Key-Fingerprint Representations
Sergej Dechand, University of Bonn; Dominik Schürmann, Technische Universität
Braunschweig; Karoline Busse, University of Bonn; Yasemin Acar and Sascha Fahl,
Saarland University; Matthew Smith, University of Bonn
 https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/dechand
This paper is included in the Proceedings of the 25th USENIX Security SymposiumAugust 10–12, 2016 • Austin, TXISBN 978-1-931971-32-4Open access to the Proceedings of the 25th USENIX Security Symposium is sponsored by USENIX An Empirical Study of Textual Key-Fingerprint Representations
Sergej Dechand
USECAP, University of Bonn
Yasemin Acar
CISPA, Saarland University
Dominik Sch¨urmann
IBR, TU Braunschweig
Sascha Fahl
CISPA, Saarland University
Karoline Busse
USECAP, University of Bonn
Matthew Smith
USECAP, University of Bonn
Abstract
Many security protocols still rely on manual ﬁngerprint
comparisons for authentication. The most well-known
and widely used key-ﬁngerprint representation are hexa-
decimal strings as used in various security tools. With
the introduction of end-to-end security in WhatsApp and
other messengers, the discussion on how to best repre-
sent key-ﬁngerprints for users is receiving a lot of inter-
est.
We conduct a 1047 participant study evaluating six
different textual key-ﬁngerprint representations with re-
gards to their performance and usability. We focus on
textual ﬁngerprints as the most robust and deployable
representation.
Our ﬁndings show that the currently used hexadeci-
mal representation is more prone to partial preimage at-
tacks in comparison to others. Based on our ﬁndings,
we make the recommendation that two alternative repre-
sentations should be adopted. The highest attack detec-...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Quantifying the Impact of Blocklisting in the Age of Address Reuse
author:Sivaramakrishnan Ramanathan and
Anushah Hossain and
Jelena Mirkovic and
Minlan Yu and
Sadia Afroz
Quantifying the Impact of Blocklisting in the Age of Address
Reuse
Sivaramakrishnan
Ramanathan
University of Southern California
satyaman@usc.edu
Anushah Hossain
UC Berkeley, ICSI
anushah@icsi.berkeley.edu
Jelena Mirkovic
USC Information Sciences Institute
sunshine@isi.edu
Minlan Yu
Harvard University
minlanyu@g.harvard.edu
ABSTRACT
Blocklists, consisting of known malicious IP addresses, can be used
as a simple method to block malicious traffic. However, blocklists
can potentially lead to unjust blocking of legitimate users due to IP
address reuse, where more users could be blocked than intended. IP
addresses can be reused either at the same time (Network Address
Translation) or over time (dynamic addressing). We propose two
new techniques to identify reused addresses. We built a crawler
using the BitTorrent Distributed Hash Table to detect NATed ad-
dresses and use the RIPE Atlas measurement logs to detect dy-
namically allocated address spaces. We then analyze 151 publicly
available IPv4 blocklists to show the implications of reused ad-
dresses and find that 53–60% of blocklists contain reused addresses
having about 30.6K–45.1K listings of reused addresses. We also find
that reused addresses can potentially affect as many as 78 legitimate
users for as many as 44 days.
CCS CONCEPTS
• Networks → Network measurement; • Security and privacy
→ Network security;
KEYWORDS
IP address reuse, blocklists, unjust blocking
ACM Reference Format:
Sivaramakrishnan Ramanathan, Anushah Hossain, Jelena Mirkovic, Minlan
Yu, and Sadia Afroz. 2020. Quantifying the Impact of Blocklisting in the
Age of Address Reuse. In ACM Internet Measurement Conference (IMC ’20),
October 27–29, 2020, Virtual Event, USA. ACM, New York, NY, USA, 10 pages.
https://doi.org/10.1145/3419394.3423657
1 INTRODUCTION
Consider one user’s...


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Why PCs Are Fragile and What We Can Do About It: A Study of Windows
Registry Problems
author:Archana Ganapathi and
Yi-Min Wang and
Ni Lao and
Ji-Rong Wen
Why PCs Are Fragile and What We Can Do About It:
A Study of Windows Registry Problems
Archana Ganapathi                 Yi-Min Wang                 Ni Lao and Ji-Rong Wen
    University of California
Berkeley, CA
    Microsoft Research
        Redmond, WA
     Microsoft Research
          Beijing, China
Abstract
framework
Software configuration problems are a major source
of failures in computer systems. In this paper, we present
a  new
for  categorizing  configuration
problems.  We  apply  this  categorization  to  Windows
Registry-related  problems  obtained
from  various
internal  as  well  as  external  sources.  Although
infrequent,  Registry-related  problems  are  difficult  to
diagnose  and  repair.  Consequently  they  frustrate  the
users. We classify problems based on their manifestation
and the scope of impact to gain useful insights into how
problems affect users and why PCs are fragile. We then
describe  techniques  to  identify  and  eliminate  such
Registry
failures.  We  propose  health  predicate
monitoring for detecting known problems, fault injection
for
improving  application  robustness,  and  access
protection mechanisms for preventing fragility problems.
1.  Introduction
and
complex
for
interesting
Windows-based  personal  computers  (PCs)  offer  a
platform
software
interactions. However, undisciplined uses and sharing of
persistent configuration data by Windows programs have
made PCs more vulnerable to fragility.  In particular, the
Windows  Registry  stores  large  quantities  of  complex,
undocumented  and  unprotected  configuration  data,
making  it  the  single  most  vulnerable  component  of  the
Windows  operating system. Understanding and undoing
Registry damage is a non-trivial task to the average user.
The problem is as ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Why PCs Are Fragile and What We Can Do About It: A Study of Windows
Registry Problems
author:Archana Ganapathi and
Yi-Min Wang and
Ni Lao and
Ji-Rong Wen
Why PCs Are Fragile and What We Can Do About It:
A Study of Windows Registry Problems
Archana Ganapathi                 Yi-Min Wang                 Ni Lao and Ji-Rong Wen
    University of California
Berkeley, CA
    Microsoft Research
        Redmond, WA
     Microsoft Research
          Beijing, China
Abstract
framework
Software configuration problems are a major source
of failures in computer systems. In this paper, we present
a  new
for  categorizing  configuration
problems.  We  apply  this  categorization  to  Windows
Registry-related  problems  obtained
from  various
internal  as  well  as  external  sources.  Although
infrequent,  Registry-related  problems  are  difficult  to
diagnose  and  repair.  Consequently  they  frustrate  the
users. We classify problems based on their manifestation
and the scope of impact to gain useful insights into how
problems affect users and why PCs are fragile. We then
describe  techniques  to  identify  and  eliminate  such
Registry
failures.  We  propose  health  predicate
monitoring for detecting known problems, fault injection
for
improving  application  robustness,  and  access
protection mechanisms for preventing fragility problems.
1.  Introduction
and
complex
for
interesting
Windows-based  personal  computers  (PCs)  offer  a
platform
software
interactions. However, undisciplined uses and sharing of
persistent configuration data by Windows programs have
made PCs more vulnerable to fragility.  In particular, the
Windows  Registry  stores  large  quantities  of  complex,
undocumented  and  unprotected  configuration  data,
making  it  the  single  most  vulnerable  component  of  the
Windows  operating system. Understanding and undoing
Registry damage is a non-trivial task to the average user.
The problem is as ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Ethane: taking control of the enterprise
author:Mart'ın Casado and
Michael J. Freedman and
Justin Pettit and
Jianying Luo and
Nick McKeown and
Scott Shenker
Ethane: Taking Control of the Enterprise
Martìn Casado, Michael J. Freedman,
Justin Pettit, Jianying Luo,
and Nick McKeown
Stanford University
Scott Shenker
U.C. Berkeley and ICSI
ABSTRACT
This paper presents Ethane, a new network architecture for the
enterprise. Ethane allows managers to deﬁne a single network-
wide ﬁne-grain policy, and then enforces it directly. Ethane cou-
ples extremely simple ﬂow-based Ethernet switches with a central-
ized controller that manages the admittance and routing of ﬂows.
While radical, this design is backwards-compatible with existing
hosts and switches.
We have implemented Ethane in both hardware and software,
supporting both wired and wireless hosts. Our operational Ethane
network has supported over 300 hosts for the past four months in
in Stanford University’s network, and this deployment experience
has signiﬁcantly affected Ethane’s design.
Categories and Subject Descriptors
C.2.6 [Computer Communication Networks]: Internetworking;
C.2.1 [Computer Communication Networks]: Network Archi-
tecture and Design
General Terms
Design, Experimentation, Performance
Keywords
Network, Architecture, Security, Management
1.
INTRODUCTION
Enterprise networks are often large, run a wide variety of appli-
cations and protocols, and typically operate under strict reliability
and security constraints; thus, they represent a challenging envi-
ronment for network management. The stakes are high, as busi-
ness productivity can be severely hampered by network misconﬁg-
urations or break-ins. Yet the current solutions are weak, making
enterprise network management both expensive and error-prone.
Indeed, most networks today require substantial manual conﬁgura-
tion by trained operators [11, 22, 23, 25] to achieve even moderate
security [24]. A Yankee Group report found that 62% of network...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Ethane: taking control of the enterprise
author:Mart'ın Casado and
Michael J. Freedman and
Justin Pettit and
Jianying Luo and
Nick McKeown and
Scott Shenker
Ethane: Taking Control of the Enterprise
Martìn Casado, Michael J. Freedman,
Justin Pettit, Jianying Luo,
and Nick McKeown
Stanford University
Scott Shenker
U.C. Berkeley and ICSI
ABSTRACT
This paper presents Ethane, a new network architecture for the
enterprise. Ethane allows managers to deﬁne a single network-
wide ﬁne-grain policy, and then enforces it directly. Ethane cou-
ples extremely simple ﬂow-based Ethernet switches with a central-
ized controller that manages the admittance and routing of ﬂows.
While radical, this design is backwards-compatible with existing
hosts and switches.
We have implemented Ethane in both hardware and software,
supporting both wired and wireless hosts. Our operational Ethane
network has supported over 300 hosts for the past four months in
in Stanford University’s network, and this deployment experience
has signiﬁcantly affected Ethane’s design.
Categories and Subject Descriptors
C.2.6 [Computer Communication Networks]: Internetworking;
C.2.1 [Computer Communication Networks]: Network Archi-
tecture and Design
General Terms
Design, Experimentation, Performance
Keywords
Network, Architecture, Security, Management
1.
INTRODUCTION
Enterprise networks are often large, run a wide variety of appli-
cations and protocols, and typically operate under strict reliability
and security constraints; thus, they represent a challenging envi-
ronment for network management. The stakes are high, as busi-
ness productivity can be severely hampered by network misconﬁg-
urations or break-ins. Yet the current solutions are weak, making
enterprise network management both expensive and error-prone.
Indeed, most networks today require substantial manual conﬁgura-
tion by trained operators [11, 22, 23, 25] to achieve even moderate
security [24]. A Yankee Group report found that 62% of network...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Introduction to the fifth workshop on dependable and secure nanocomputing
author:Jean Arlat and
Cristian Constantinescu and
Johan Karlsson and
Takashi Nanya and
Alan Wood
Introduction to the Fifth Workshop on Dependable and Secure Nanocomputing
Jean Arlat1, Cristian Constantinescu2, Johan Karlsson3, Takashi Nanya4, Alan Wood5
1 LAAS-CNRS and Université de Toulouse, 7, Av. du Colonel Roche 31077 Toulouse – France <jean.arlat@laas.fr>
2 AMD, 2950 E Harmony Rd., Fort Collins, CO 80528 – USA <cristian.constantinescu@amd.com>
3 Dept. of Computer Science & Eng., Chalmers University of Technology, 41296 Göteborg – Sweden <johan@chalmers.se>
4 Canon Inc., 3-30-2 Shimomaruko, Ohta-ku, Tokyo 146-8501 – Japan  <nanya.takashi@canon.co.jp>
5 Oracle, 501 Island Parkway, Belmont, CA 94002 – USA <alan.wood@oracle.com>
I. MOTIVATION AND OBJECTIVES
Nanocomputing  and  related-enabling  technologies  hold
the  promise  of  higher  performance  and
lower  power
consumption, as well as increased communication capabilities
and  functionality.  In  addition  to  the  impact  on  today
computerized systems, nanocomputing is an essential lever to
foster the emerging cyberphysical system paradigm. However,
the dependability and security of these unprecedentedly small
devices,  of  their  deployment,  and  of  their  interconnection
remain uncertain.  The main sources of concern are:
•  Nanometer devices are expected to be highly sensitive
to  process  variations.  The  guard-bands  used  today  for
avoiding
impact  of  such  variations  will  not
represent  a  feasible  solution  in  the  future.  As  a
consequence,  timing  errors  and  their  higher  frequency
of occurrence have to be addressed.
the
•  New  and  intricate  failure  modes,  specific  to  new
materials, are expected to raise serious challenges to the
design and test engineers.
•  Environment induced errors, such as single event upsets
(SEU), are likely to occur more frequently than in th...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Introduction to the fifth workshop on dependable and secure nanocomputing
author:Jean Arlat and
Cristian Constantinescu and
Johan Karlsson and
Takashi Nanya and
Alan Wood
Introduction to the Fifth Workshop on Dependable and Secure Nanocomputing
Jean Arlat1, Cristian Constantinescu2, Johan Karlsson3, Takashi Nanya4, Alan Wood5
1 LAAS-CNRS and Université de Toulouse, 7, Av. du Colonel Roche 31077 Toulouse – France <jean.arlat@laas.fr>
2 AMD, 2950 E Harmony Rd., Fort Collins, CO 80528 – USA <cristian.constantinescu@amd.com>
3 Dept. of Computer Science & Eng., Chalmers University of Technology, 41296 Göteborg – Sweden <johan@chalmers.se>
4 Canon Inc., 3-30-2 Shimomaruko, Ohta-ku, Tokyo 146-8501 – Japan  <nanya.takashi@canon.co.jp>
5 Oracle, 501 Island Parkway, Belmont, CA 94002 – USA <alan.wood@oracle.com>
I. MOTIVATION AND OBJECTIVES
Nanocomputing  and  related-enabling  technologies  hold
the  promise  of  higher  performance  and
lower  power
consumption, as well as increased communication capabilities
and  functionality.  In  addition  to  the  impact  on  today
computerized systems, nanocomputing is an essential lever to
foster the emerging cyberphysical system paradigm. However,
the dependability and security of these unprecedentedly small
devices,  of  their  deployment,  and  of  their  interconnection
remain uncertain.  The main sources of concern are:
•  Nanometer devices are expected to be highly sensitive
to  process  variations.  The  guard-bands  used  today  for
avoiding
impact  of  such  variations  will  not
represent  a  feasible  solution  in  the  future.  As  a
consequence,  timing  errors  and  their  higher  frequency
of occurrence have to be addressed.
the
•  New  and  intricate  failure  modes,  specific  to  new
materials, are expected to raise serious challenges to the
design and test engineers.
•  Environment induced errors, such as single event upsets
(SEU), are likely to occur more frequently than in th...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:On the Safety of IoT Device Physical Interaction Control
author:Wenbo Ding and
Hongxin Hu
On the Safety of IoT Device Physical Interaction Control
Wenbo Ding
Clemson University
wding@clemson.edu
Hongxin Hu
Clemson University
hongxih@clemson.edu
applications (a.k.a. appified IoT platforms) to manage devices in
an unattended manner, for example, turning on lights when users
return home, monitoring users’ kids from afar, or locking home
doors while users drive away [38].
ABSTRACT
Emerging Internet of Things (IoT) platforms provide increased func-
tionality to enable human interaction with the physical world in
an autonomous manner. The physical interaction features of IoT
platforms allow IoT devices to make an impact on the physical
environment. However, such features also bring new safety chal-
lenges, where attackers can leverage stealthy physical interactions
to launch attacks against IoT systems. In this paper, we propose
a framework called IoTMon that discovers any possible physical
interactions and generates all potential interaction chains across
applications in the IoT environment. IoTMon also includes an as-
sessment of the safety risk of each discovered inter-app interaction
chain based on its physical influence. To demonstrate the feasibility
of our approach, we provide a proof-of-concept implementation
of IoTMon and present a comprehensive system evaluation on
the Samsung SmartThings platform. We study 185 official Smart-
Things applications and find they can form 162 hidden inter-app
interaction chains through physical surroundings. In particular, our
experiment reveals that 37 interaction chains are highly risky and
could be potentially exploited to impact the safety of the IoT envi-
ronment.
KEYWORDS
Safety; Internet of Things; Physical Interaction Control
ACM Reference Format:
Wenbo Ding and Hongxin Hu. 2018. On the Safety of IoT Device Physical
Interaction Control. In 2018 ACM SIGSAC Conference on Computer and
Communications Security (CCS ’18), O...


Instruction: 总结这篇安全研究的主要观点

Input:
title:On the Safety of IoT Device Physical Interaction Control
author:Wenbo Ding and
Hongxin Hu
On the Safety of IoT Device Physical Interaction Control
Wenbo Ding
Clemson University
wding@clemson.edu
Hongxin Hu
Clemson University
hongxih@clemson.edu
applications (a.k.a. appified IoT platforms) to manage devices in
an unattended manner, for example, turning on lights when users
return home, monitoring users’ kids from afar, or locking home
doors while users drive away [38].
ABSTRACT
Emerging Internet of Things (IoT) platforms provide increased func-
tionality to enable human interaction with the physical world in
an autonomous manner. The physical interaction features of IoT
platforms allow IoT devices to make an impact on the physical
environment. However, such features also bring new safety chal-
lenges, where attackers can leverage stealthy physical interactions
to launch attacks against IoT systems. In this paper, we propose
a framework called IoTMon that discovers any possible physical
interactions and generates all potential interaction chains across
applications in the IoT environment. IoTMon also includes an as-
sessment of the safety risk of each discovered inter-app interaction
chain based on its physical influence. To demonstrate the feasibility
of our approach, we provide a proof-of-concept implementation
of IoTMon and present a comprehensive system evaluation on
the Samsung SmartThings platform. We study 185 official Smart-
Things applications and find they can form 162 hidden inter-app
interaction chains through physical surroundings. In particular, our
experiment reveals that 37 interaction chains are highly risky and
could be potentially exploited to impact the safety of the IoT envi-
ronment.
KEYWORDS
Safety; Internet of Things; Physical Interaction Control
ACM Reference Format:
Wenbo Ding and Hongxin Hu. 2018. On the Safety of IoT Device Physical
Interaction Control. In 2018 ACM SIGSAC Conference on Computer and
Communications Security (CCS ’18), O...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Keystroke-Based User Identification on Smart Phones
author:Saira Zahid and
Muhammad Shahzad and
Syed Ali Khayam and
Muddassar Farooq
Keystroke-Based User Identiﬁcation
on Smart Phones
Saira Zahid1, Muhammad Shahzad1, Syed Ali Khayam1,2,
and Muddassar Farooq1
1 Next Generation Intelligent Networks Research Center (nexGIN RC)
National University of Computer & Emerging Sciences (FAST-NUCES)
{saira.zahid,muhammad.shahzad,muddassar.farooq}@nexginrc.org
Islamabad, Pakistan
2 School of Electrical Engineering & Computer Science (SEECS)
National University of Sciences & Technology (NUST)
Islamabad, Pakistan
ali.khayam@seecs.edu.pk
Abstract. Smart phones are now being used to store users’ identities and
sensitive information/data. Therefore, it is important to authenticate le-
gitimate users of a smart phone and to block imposters. In this paper, we
demonstrate that keystroke dynamics of a smart phone user can be trans-
lated into a viable features’ set for accurate user identiﬁcation. To this
end, we collect and analyze keystroke data of 25 diverse smart phone users.
Based on this analysis, we select six distinguishing keystroke features that
can be used for user identiﬁcation. We show that these keystroke features
for diﬀerent users are diﬀused and therefore a fuzzy classiﬁer is well-suited
to cluster and classify them. We then optimize the front-end fuzzy clas-
siﬁer using Particle Swarm Optimization (PSO) and Genetic Algorithm
(GA) as back-end dynamic optimizers to adapt to variations in usage pat-
terns. Finally, we provide a novel keystroke dynamics based PIN (Personal
Identiﬁcation Number) veriﬁcation mode to ensure information security
on smart phones. The results of our experiments show that the proposed
user identiﬁcation system has an average error rate of 2% after the detec-
tion mode and the error rate of rejecting legitimate users drops to zero
in the PIN veriﬁcation mode. We also compare error rates (in terms of
detecting both legitimate users and imposte...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Keystroke-Based User Identification on Smart Phones
author:Saira Zahid and
Muhammad Shahzad and
Syed Ali Khayam and
Muddassar Farooq
Keystroke-Based User Identiﬁcation
on Smart Phones
Saira Zahid1, Muhammad Shahzad1, Syed Ali Khayam1,2,
and Muddassar Farooq1
1 Next Generation Intelligent Networks Research Center (nexGIN RC)
National University of Computer & Emerging Sciences (FAST-NUCES)
{saira.zahid,muhammad.shahzad,muddassar.farooq}@nexginrc.org
Islamabad, Pakistan
2 School of Electrical Engineering & Computer Science (SEECS)
National University of Sciences & Technology (NUST)
Islamabad, Pakistan
ali.khayam@seecs.edu.pk
Abstract. Smart phones are now being used to store users’ identities and
sensitive information/data. Therefore, it is important to authenticate le-
gitimate users of a smart phone and to block imposters. In this paper, we
demonstrate that keystroke dynamics of a smart phone user can be trans-
lated into a viable features’ set for accurate user identiﬁcation. To this
end, we collect and analyze keystroke data of 25 diverse smart phone users.
Based on this analysis, we select six distinguishing keystroke features that
can be used for user identiﬁcation. We show that these keystroke features
for diﬀerent users are diﬀused and therefore a fuzzy classiﬁer is well-suited
to cluster and classify them. We then optimize the front-end fuzzy clas-
siﬁer using Particle Swarm Optimization (PSO) and Genetic Algorithm
(GA) as back-end dynamic optimizers to adapt to variations in usage pat-
terns. Finally, we provide a novel keystroke dynamics based PIN (Personal
Identiﬁcation Number) veriﬁcation mode to ensure information security
on smart phones. The results of our experiments show that the proposed
user identiﬁcation system has an average error rate of 2% after the detec-
tion mode and the error rate of rejecting legitimate users drops to zero
in the PIN veriﬁcation mode. We also compare error rates (in terms of
detecting both legitimate users and imposte...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Crash graphs: An aggregated view of multiple crashes to improve crash
triage
author:Sunghun Kim and
Thomas Zimmermann and
Nachiappan Nagappan
Crash Graphs: An Aggregated View of Multiple Crashes to Improve Crash Triage
Sunghun Kim*
Hong Kong University of Science and Technology
Hong Kong
hunkim@cse.ust.hk
Abstract—Crash  reporting  systems  play  an  important  role  in
the overall reliability and dependability of the system helping
in  identifying  and  debugging  crashes  in  software  systems
deployed in the field. In Microsoft for example, the Windows
Error Reporting (WER) system receives crash data from users,
classifies them, and presents crash information for developers
to  fix  crashes.  However,  most  crash  reporting  systems  deal
with crashes individually; they compare crashes individually to
classify  them,  which  may  cause  misclassification.  Developers
need  to  download  multiple  crash  data  files  for  debugging,
which requires non-trivial effort. In this paper, we propose an
approach  based  on  crash  graphs,  which  are  an  aggregated
view  of  multiple  crashes.  Our  experience  with  crash  graphs
indicates  that  it  reduces  misclassification  and  helps  identify
fixable crashes in advance.
INTRODUCTION
Keywords-component; crash; graph; triaging; network
I.
Crash  reporting  systems 1  such  as  Windows  Error
Reporting (WER) [13], Mozilla Crash Stats [15], and Apple
CrashReporter  [3]  have  been  widely  deployed  in  practice.
The crash reporting systems help organizations determine the
overall reliability of their software systems in the field.
The  crash  reporting  systems  collect  crash  related  data,
classify  them,  and  present  the  information  to  developers  to
fix crashes [9, 11]. For example, WER receives crash stack
traces  from  users  in  the  field.  Then,  WER  identifies  crash
root  cause(s)  using  heuristics  (analyzing  the  traces  using
machine learning/pattern ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Crash graphs: An aggregated view of multiple crashes to improve crash
triage
author:Sunghun Kim and
Thomas Zimmermann and
Nachiappan Nagappan
Crash Graphs: An Aggregated View of Multiple Crashes to Improve Crash Triage
Sunghun Kim*
Hong Kong University of Science and Technology
Hong Kong
hunkim@cse.ust.hk
Abstract—Crash  reporting  systems  play  an  important  role  in
the overall reliability and dependability of the system helping
in  identifying  and  debugging  crashes  in  software  systems
deployed in the field. In Microsoft for example, the Windows
Error Reporting (WER) system receives crash data from users,
classifies them, and presents crash information for developers
to  fix  crashes.  However,  most  crash  reporting  systems  deal
with crashes individually; they compare crashes individually to
classify  them,  which  may  cause  misclassification.  Developers
need  to  download  multiple  crash  data  files  for  debugging,
which requires non-trivial effort. In this paper, we propose an
approach  based  on  crash  graphs,  which  are  an  aggregated
view  of  multiple  crashes.  Our  experience  with  crash  graphs
indicates  that  it  reduces  misclassification  and  helps  identify
fixable crashes in advance.
INTRODUCTION
Keywords-component; crash; graph; triaging; network
I.
Crash  reporting  systems 1  such  as  Windows  Error
Reporting (WER) [13], Mozilla Crash Stats [15], and Apple
CrashReporter  [3]  have  been  widely  deployed  in  practice.
The crash reporting systems help organizations determine the
overall reliability of their software systems in the field.
The  crash  reporting  systems  collect  crash  related  data,
classify  them,  and  present  the  information  to  developers  to
fix crashes [9, 11]. For example, WER receives crash stack
traces  from  users  in  the  field.  Then,  WER  identifies  crash
root  cause(s)  using  heuristics  (analyzing  the  traces  using
machine learning/pattern ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:HyperSentry: enabling stealthy in-context measurement of hypervisor
integrity
author:Ahmed M. Azab and
Peng Ning and
Zhi Wang and
Xuxian Jiang and
Xiaolan Zhang and
Nathan C. Skalsky
HyperSentry: Enabling Stealthy In-context Measurement of
Hypervisor Integrity ࢩ
Ahmed M. Azab
Peng Ning
Zhi Wang
Xuxian Jiang
Department of Computer Science, North Carolina State University
{amazab, pning, zhi_wang, xuxian_jiang}@ncsu.edu
Xiaolan Zhang
Nathan C. Skalsky
IBM T.J. Watson Research Center
cxzhang@us.ibm.com
IBM Systems & Technology Group
nskalsky@us.ibm.com
ABSTRACT
6DEI F=FAH FHAIAJI 0OFAH5AJHO = LA BH=AMH J A
=>A EJACHEJO A=IKHAAJ B = HKEC DOFAHLEIH H =O
JDAH DECDAIJ FHELEACA@ IBJM=HA =OAH  = IOIJA 7EA
ANEIJEC IKJEI BH FHJA?JEC FHELEACA@ IBJM=HA 0OFAH
5AJHO @AI J EJH@K?A = DECDAH FHELEACA@ IBJM=HA =OAH
>AM JDA EJACHEJO A=IKHAAJ J=HCAJ MDE?D ?K@ IJ=HJ
=JDAH H=?A MEJD =E?EKI =JJ=?AHI E >J=EEC JDA DECD
AIJ FHELEACA E JDA IOIJA 1IJA=@ 0OFAH5AJHO EJH@K?AI
= IBJM=HA ?FAJ JD=J EI FHFAHO EI=JA@ BH JDA DO
FAHLEIH J A=>A IJA=JDO =@ E?JANJ A=IKHAAJ B
JDA HKJEA EJACHEJO B JDA DOFAHLEIH 9DEA IJA=JDEAII
EI A?AII=HO J AIKHA JD=J = ?FHEIA@ DOFAHLEIH @AI
J D=LA = ?D=?A J DE@A JDA =JJ=? JH=?AI KF @AJA?J
EC = KF?EC A=IKHAAJ E?JANJ A=IKHAAJ EI
A?AII=HO J HAJHEALA = JDA AA@A@ EFKJI BH = IK??AIIBK
EJACHEJO A=IKHAAJ
0OFAH5AJHO KIAI = KJB>=@ ?D=A AC 1JAE
CAJ 2=JBH ==CAAJ 1JAHB=?A 121 MDE?D EI ?
O =L=E=>A  IAHLAH F=JBHI J JHECCAH JDA IJA=JDO
A=IKHAAJ =@ =@FJI JDA 5OIJA ==CAAJ @A
5 J FHJA?J EJI >=IA ?@A =@ ?HEJE?= @=J= ) AO ?
JHE>KJE B 0OFAH5AJHO EI JDA IAJ B LA JA?DEGKAI JD=J
LAH?A 5ߣI EEJ=JE FHLE@EC = EJACHEJO A=IKHA
AJ =CAJ MEJD  JDA I=A ?JANJK= EBH=JE =L=E
=>A J JDA DOFAHLEIH   ?FAJAO FHJA?JA@ A...


Instruction: 总结这篇安全研究的主要观点

Input:
title:HyperSentry: enabling stealthy in-context measurement of hypervisor
integrity
author:Ahmed M. Azab and
Peng Ning and
Zhi Wang and
Xuxian Jiang and
Xiaolan Zhang and
Nathan C. Skalsky
HyperSentry: Enabling Stealthy In-context Measurement of
Hypervisor Integrity ࢩ
Ahmed M. Azab
Peng Ning
Zhi Wang
Xuxian Jiang
Department of Computer Science, North Carolina State University
{amazab, pning, zhi_wang, xuxian_jiang}@ncsu.edu
Xiaolan Zhang
Nathan C. Skalsky
IBM T.J. Watson Research Center
cxzhang@us.ibm.com
IBM Systems & Technology Group
nskalsky@us.ibm.com
ABSTRACT
6DEI F=FAH FHAIAJI 0OFAH5AJHO = LA BH=AMH J A
=>A EJACHEJO A=IKHAAJ B = HKEC DOFAHLEIH H =O
JDAH DECDAIJ FHELEACA@ IBJM=HA =OAH  = IOIJA 7EA
ANEIJEC IKJEI BH FHJA?JEC FHELEACA@ IBJM=HA 0OFAH
5AJHO @AI J EJH@K?A = DECDAH FHELEACA@ IBJM=HA =OAH
>AM JDA EJACHEJO A=IKHAAJ J=HCAJ MDE?D ?K@ IJ=HJ
=JDAH H=?A MEJD =E?EKI =JJ=?AHI E >J=EEC JDA DECD
AIJ FHELEACA E JDA IOIJA 1IJA=@ 0OFAH5AJHO EJH@K?AI
= IBJM=HA ?FAJ JD=J EI FHFAHO EI=JA@ BH JDA DO
FAHLEIH J A=>A IJA=JDO =@ E?JANJ A=IKHAAJ B
JDA HKJEA EJACHEJO B JDA DOFAHLEIH 9DEA IJA=JDEAII
EI A?AII=HO J AIKHA JD=J = ?FHEIA@ DOFAHLEIH @AI
J D=LA = ?D=?A J DE@A JDA =JJ=? JH=?AI KF @AJA?J
EC = KF?EC A=IKHAAJ E?JANJ A=IKHAAJ EI
A?AII=HO J HAJHEALA = JDA AA@A@ EFKJI BH = IK??AIIBK
EJACHEJO A=IKHAAJ
0OFAH5AJHO KIAI = KJB>=@ ?D=A AC 1JAE
CAJ 2=JBH ==CAAJ 1JAHB=?A 121 MDE?D EI ?
O =L=E=>A  IAHLAH F=JBHI J JHECCAH JDA IJA=JDO
A=IKHAAJ =@ =@FJI JDA 5OIJA ==CAAJ @A
5 J FHJA?J EJI >=IA ?@A =@ ?HEJE?= @=J= ) AO ?
JHE>KJE B 0OFAH5AJHO EI JDA IAJ B LA JA?DEGKAI JD=J
LAH?A 5ߣI EEJ=JE FHLE@EC = EJACHEJO A=IKHA
AJ =CAJ MEJD  JDA I=A ?JANJK= EBH=JE =L=E
=>A J JDA DOFAHLEIH   ?FAJAO FHJA?JA@ A...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:OcuLock: Exploring Human Visual System for Authentication in Virtual
Reality Head-mounted Display
author:Shiqing Luo and
Anh Nguyen and
Chen Song and
Feng Lin and
Wenyao Xu and
Zhisheng Yan
OcuLock: Exploring Human Visual System for
Authentication in Virtual Reality Head-mounted
Display
Shiqing Luo∗, Anh Nguyen∗, Chen Song†, Feng Lin‡, Wenyao Xu§ and Zhisheng Yan∗
∗Georgia State University, Email: {sluo10, anguyen139}@student.gsu.edu, zyan@gsu.edu
†San Diego State University, Email: csong@sdsu.edu
‡Zhejiang University, Email: ﬂin@zju.edu.cn
§SUNY Buffalo, Email: wenyaoxu@buffalo.edu
Abstract—The increasing popularity of virtual reality (VR) in
a wide spectrum of applications has generated sensitive personal
data such as medical records and credit card information. While
protecting such data from unauthorized access is critical, directly
applying traditional authentication methods (e.g., PIN) through
new VR input modalities such as remote controllers and head nav-
igation would cause security issues. The authentication action can
be purposefully observed by attackers to infer the authentication
input. Unlike any other mobile devices, VR presents immersive
experience via a head-mounted display (HMD) that fully covers
users’ eye area without public exposure. Leveraging this feature,
we explore human visual system (HVS) as a novel biometric
authentication tailored for VR platforms. While previous works
used eye globe movement (gaze) to authenticate smartphones or
PCs, they suffer from a high error rate and low stability since
eye gaze is highly dependent on cognitive states. In this paper,
we explore the HVS as a whole to consider not just the eye
globe movement but also the eyelid, extraocular muscles, cells,
and surrounding nerves in the HVS. Exploring HVS biostructure
and unique HVS features triggered by immersive VR content can
enhance authentication stability. To this end, we present OcuLock,
an HVS-based system for reliable and unobservable VR HMD
authentica...


Instruction: 总结这篇安全研究的主要观点

Input:
title:OcuLock: Exploring Human Visual System for Authentication in Virtual
Reality Head-mounted Display
author:Shiqing Luo and
Anh Nguyen and
Chen Song and
Feng Lin and
Wenyao Xu and
Zhisheng Yan
OcuLock: Exploring Human Visual System for
Authentication in Virtual Reality Head-mounted
Display
Shiqing Luo∗, Anh Nguyen∗, Chen Song†, Feng Lin‡, Wenyao Xu§ and Zhisheng Yan∗
∗Georgia State University, Email: {sluo10, anguyen139}@student.gsu.edu, zyan@gsu.edu
†San Diego State University, Email: csong@sdsu.edu
‡Zhejiang University, Email: ﬂin@zju.edu.cn
§SUNY Buffalo, Email: wenyaoxu@buffalo.edu
Abstract—The increasing popularity of virtual reality (VR) in
a wide spectrum of applications has generated sensitive personal
data such as medical records and credit card information. While
protecting such data from unauthorized access is critical, directly
applying traditional authentication methods (e.g., PIN) through
new VR input modalities such as remote controllers and head nav-
igation would cause security issues. The authentication action can
be purposefully observed by attackers to infer the authentication
input. Unlike any other mobile devices, VR presents immersive
experience via a head-mounted display (HMD) that fully covers
users’ eye area without public exposure. Leveraging this feature,
we explore human visual system (HVS) as a novel biometric
authentication tailored for VR platforms. While previous works
used eye globe movement (gaze) to authenticate smartphones or
PCs, they suffer from a high error rate and low stability since
eye gaze is highly dependent on cognitive states. In this paper,
we explore the HVS as a whole to consider not just the eye
globe movement but also the eyelid, extraocular muscles, cells,
and surrounding nerves in the HVS. Exploring HVS biostructure
and unique HVS features triggered by immersive VR content can
enhance authentication stability. To this end, we present OcuLock,
an HVS-based system for reliable and unobservable VR HMD
authentica...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:TimeVM: a framework for online intrusion mitigation and fast recovery
using multi-time-lag traffic replay
author:Khalid Elbadawi and
Ehab Al-Shaer
TimeVM: A Framework for Online Intrusion Mitigation and
Fast Recovery Using Multi-Time-Lag Trafﬁc Replay
Khalid Elbadawi
School of Computing
DePaul University
Chicago, IL 60604
badawi@cs.depaul.edu
Ehab Al-Shaer
School of Computing
DePaul University
Chicago, IL 60604
ehab@cs.depaul.edu
ABSTRACT
Network intrusions become a signiﬁcation threat to network
servers and its availability. A simple intrusion can suspend
the organization’s network services and can lead to a ﬁnan-
cial disaster. In this paper, we propose a framework called
TimeVM to mitigate, or even eliminate, the infection of a
network intrusion on-line as fast as possible. The frame-
work is based on the virtual machine technology and traﬃc-
replay-based recovery. TimeVM gives the illusion of “time
machine”. TimeVM logs only the network traﬃc to a server
and replays the logged traﬃc to multiple “shadow” virtual
machines (Shadow VM) after diﬀerent time delays (time
lags). Consequently, each Shadow VM will represent the
server at diﬀerent time in history. When attack/infection
is detected, TimeVM enables navigating through the traf-
ﬁc history (logs), picking uninfected Shadow VM, removing
the attack traﬃc, and then fast-replaying the entire traﬃc
history to this Shadow VM. As a result, a typical up-to-date
uninfected version of the original system can be constructed.
The paper shows the implementation details for TimeVM.
It also addresses many practical challenges related to how
to conﬁgure and deploy TimeVM in a system in order to
minimize the recovery time. We present analytical frame-
work and extensive evaluation to validate our approach in
diﬀerent environments.
Categories and Subject Descriptors
K.6.5 [Management of Computing and Information
Systems]: Security and Protection—Invasive software; D.4.8
[Operating System]: Performance—modeling and predic-...


Instruction: 总结这篇安全研究的主要观点

Input:
title:TimeVM: a framework for online intrusion mitigation and fast recovery
using multi-time-lag traffic replay
author:Khalid Elbadawi and
Ehab Al-Shaer
TimeVM: A Framework for Online Intrusion Mitigation and
Fast Recovery Using Multi-Time-Lag Trafﬁc Replay
Khalid Elbadawi
School of Computing
DePaul University
Chicago, IL 60604
badawi@cs.depaul.edu
Ehab Al-Shaer
School of Computing
DePaul University
Chicago, IL 60604
ehab@cs.depaul.edu
ABSTRACT
Network intrusions become a signiﬁcation threat to network
servers and its availability. A simple intrusion can suspend
the organization’s network services and can lead to a ﬁnan-
cial disaster. In this paper, we propose a framework called
TimeVM to mitigate, or even eliminate, the infection of a
network intrusion on-line as fast as possible. The frame-
work is based on the virtual machine technology and traﬃc-
replay-based recovery. TimeVM gives the illusion of “time
machine”. TimeVM logs only the network traﬃc to a server
and replays the logged traﬃc to multiple “shadow” virtual
machines (Shadow VM) after diﬀerent time delays (time
lags). Consequently, each Shadow VM will represent the
server at diﬀerent time in history. When attack/infection
is detected, TimeVM enables navigating through the traf-
ﬁc history (logs), picking uninfected Shadow VM, removing
the attack traﬃc, and then fast-replaying the entire traﬃc
history to this Shadow VM. As a result, a typical up-to-date
uninfected version of the original system can be constructed.
The paper shows the implementation details for TimeVM.
It also addresses many practical challenges related to how
to conﬁgure and deploy TimeVM in a system in order to
minimize the recovery time. We present analytical frame-
work and extensive evaluation to validate our approach in
diﬀerent environments.
Categories and Subject Descriptors
K.6.5 [Management of Computing and Information
Systems]: Security and Protection—Invasive software; D.4.8
[Operating System]: Performance—modeling and predic-...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:The One-Page Setting: A Higher Standard for Evaluating Website Fingerprinting
Defenses
author:Tao Wang
The One-Page Setting: A Higher Standard for Evaluating Website
Fingerprinting Defenses
Tao Wang
taowang@sfu.ca
Simon Fraser University
Burnaby, Canada
ABSTRACT
To defeat Website Fingerprinting (WF) attacks that threaten pri-
vacy on anonymity technologies such as Tor, defenses have been
proposed and evaluated under the multi-page setting. The multi-
page setting was designed as a difficult setting for the attacker and
therefore gives too much of an advantage to the defense, allowing
weak defenses to show success. We argue that all WF defenses
should instead be evaluated under the one-page setting so that the
defender needs to meet a higher standard of success.
Evaluating known WF defenses under the one-page setting, we
found that Decoy, Front and Tamaraw all failed to defend against
WF attacks. None of these defenses were shown to be vulnerable in
previous work. In Tamaraw’s case, the attacker’s TPR increases 13
times from 2.9% to 37% with 4.4% FPR; he can also achieve 91% TPR
and 21% FPR. We also found that these attacks were able to succeed
in a wide array of newly defined WF scenarios that could not be
captured by the standard laboratory scenario. In response, we create
the first defense that is strong enough for the one-page setting by
augmenting Tamaraw with greater randomization overhead so that
its anonymity sets are more evenly dispersed.
CCS CONCEPTS
• Security and privacy → Pseudonymity, anonymity and un-
traceability; • Networks → Network privacy and anonymity.
KEYWORDS
Anonymity networks; traffic analysis; website fingerprinting
ACM Reference Format:
Tao Wang. 2021. The One-Page Setting: A Higher Standard for Evaluating
Website Fingerprinting Defenses. In Proceedings of the 2021 ACM SIGSAC
Conference on Computer and Communications Security (CCS ’21), November
15–19, 2021, Virtual Event, Republic of Korea. ACM, New York, NY, USA,
13 pages. https://...


Instruction: 总结这篇安全研究的主要观点

Input:
title:The One-Page Setting: A Higher Standard for Evaluating Website Fingerprinting
Defenses
author:Tao Wang
The One-Page Setting: A Higher Standard for Evaluating Website
Fingerprinting Defenses
Tao Wang
taowang@sfu.ca
Simon Fraser University
Burnaby, Canada
ABSTRACT
To defeat Website Fingerprinting (WF) attacks that threaten pri-
vacy on anonymity technologies such as Tor, defenses have been
proposed and evaluated under the multi-page setting. The multi-
page setting was designed as a difficult setting for the attacker and
therefore gives too much of an advantage to the defense, allowing
weak defenses to show success. We argue that all WF defenses
should instead be evaluated under the one-page setting so that the
defender needs to meet a higher standard of success.
Evaluating known WF defenses under the one-page setting, we
found that Decoy, Front and Tamaraw all failed to defend against
WF attacks. None of these defenses were shown to be vulnerable in
previous work. In Tamaraw’s case, the attacker’s TPR increases 13
times from 2.9% to 37% with 4.4% FPR; he can also achieve 91% TPR
and 21% FPR. We also found that these attacks were able to succeed
in a wide array of newly defined WF scenarios that could not be
captured by the standard laboratory scenario. In response, we create
the first defense that is strong enough for the one-page setting by
augmenting Tamaraw with greater randomization overhead so that
its anonymity sets are more evenly dispersed.
CCS CONCEPTS
• Security and privacy → Pseudonymity, anonymity and un-
traceability; • Networks → Network privacy and anonymity.
KEYWORDS
Anonymity networks; traffic analysis; website fingerprinting
ACM Reference Format:
Tao Wang. 2021. The One-Page Setting: A Higher Standard for Evaluating
Website Fingerprinting Defenses. In Proceedings of the 2021 ACM SIGSAC
Conference on Computer and Communications Security (CCS ’21), November
15–19, 2021, Virtual Event, Republic of Korea. ACM, New York, NY, USA,
13 pages. https://...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:On the Secrecy of Timing-Based Active Watermarking Trace-Back Techniques
author:Pai Peng and
Peng Ning and
Douglas S. Reeves
On the Secrecy of Timing-Based Active Watermarking Trace-Back Techniques∗
Pai Peng
Peng Ning
Douglas S. Reeves
Cyber Defense Laboratory
Department of Computer Science
North Carolina State University
Raleigh, NC 27695, USA
Abstract
Timing-based active watermarking schemes are devel-
oped to trace back attackers through stepping stone con-
nections or anonymizing networks. By slightly changing
packet timing, these schemes achieve robust correlation
for encrypted network connections under timing perturba-
tion. However, the manipulation on packet timing makes
the schemes themselves a potential target of intelligent at-
tackers. In this paper, we analyze the secrecy of the timing-
based active watermarking techniques for tracing through
stepping stones, and propose an attack scheme based on an-
alyzing the packet delays between adjacent stepping stones.
We develop attack techniques to infer important watermark
parameters, and to recover and duplicate embedded water-
marks. The resulting techniques enable an attacker to de-
feat the tracing systems in certain cases by removing water-
marks from the stepping stone connections, or replicating
watermarks in non-stepping stone connections. We also de-
velop techniques to determine in real-time whether a step-
ping stone connection is being watermarked for trace-back
purposes. We have performed substantial experiments using
real-world data to evaluate these techniques. The experi-
mental results demonstrate that for the watermark scheme
being attacked (1) embedded watermarks can be success-
fully recovered and duplicated when the watermark param-
eters are not chosen carefully, and (2) the existence of wa-
termarks in a network ﬂow can always be quickly detected.
1. Introduction
The rapid growth of the Internet not only brings the
global connectivity to the general public, but also offers
maliciou...


Instruction: 总结这篇安全研究的主要观点

Input:
title:On the Secrecy of Timing-Based Active Watermarking Trace-Back Techniques
author:Pai Peng and
Peng Ning and
Douglas S. Reeves
On the Secrecy of Timing-Based Active Watermarking Trace-Back Techniques∗
Pai Peng
Peng Ning
Douglas S. Reeves
Cyber Defense Laboratory
Department of Computer Science
North Carolina State University
Raleigh, NC 27695, USA
Abstract
Timing-based active watermarking schemes are devel-
oped to trace back attackers through stepping stone con-
nections or anonymizing networks. By slightly changing
packet timing, these schemes achieve robust correlation
for encrypted network connections under timing perturba-
tion. However, the manipulation on packet timing makes
the schemes themselves a potential target of intelligent at-
tackers. In this paper, we analyze the secrecy of the timing-
based active watermarking techniques for tracing through
stepping stones, and propose an attack scheme based on an-
alyzing the packet delays between adjacent stepping stones.
We develop attack techniques to infer important watermark
parameters, and to recover and duplicate embedded water-
marks. The resulting techniques enable an attacker to de-
feat the tracing systems in certain cases by removing water-
marks from the stepping stone connections, or replicating
watermarks in non-stepping stone connections. We also de-
velop techniques to determine in real-time whether a step-
ping stone connection is being watermarked for trace-back
purposes. We have performed substantial experiments using
real-world data to evaluate these techniques. The experi-
mental results demonstrate that for the watermark scheme
being attacked (1) embedded watermarks can be success-
fully recovered and duplicated when the watermark param-
eters are not chosen carefully, and (2) the existence of wa-
termarks in a network ﬂow can always be quickly detected.
1. Introduction
The rapid growth of the Internet not only brings the
global connectivity to the general public, but also offers
maliciou...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:On the structure and characteristics of user agent string
author:Jeffery Kline and
Paul Barford and
Aaron Cahn and
Joel Sommers
On the Structure and Characteristics of User Agent String
Jeff Kline
comScore, Inc.
jkline@comscore.com
University of Wisconsin-Madison
Paul Barford
comScore, Inc.
pb@cs.wisc.edu
Aaron Cahn
comScore, Inc.
acahn@comscore.com
Joel Sommers
Colgate University
jsommers@colgate.edu
ABSTRACT
User agent (UA) strings transmitted during HTTP transactions
convey client system configuration details to ensure that content
returned by a server is appropriate for the requesting host. As
such, analysis of UA strings and their structure offers a unique per-
spective on active client systems in the Internet and when tracked
longitudinally, offers a perspective on the nature of system and
configuration dynamics. In this paper, we describe our study of
UA string characteristics. Our work is based on analyzing a unique
corpus of over 1B UA strings collected over a period of 2 years by
comScore. We begin by analyzing the general characteristics of
UA strings, focusing on the most prevalent strings and dynamic
behaviors. We identify the top 10 most popular User Agents, which
account for 26% of total daily volume. These strings describe the
expected instances of popular platforms such as Microsoft, Apple
and Google. We then report on the characteristics of low-volume
UA strings, which has important implications for unique device
identification. We show that this class of user agent generates the
overwhelming majority of traffic, with between 2M and 10M in-
stances observed each day. We show that the distribution of UA
strings has temporal dependence and we show the distribution
measured depends on the type of content served. Finally, we report
on two large-scale UA anomalies characterized by web browsers
sending false and misleading UAs in their web requests.
CCS CONCEPTS
• Information systems → Web log analysis; Traffic analysis;
Data mining; • Software and...


Instruction: 总结这篇安全研究的主要观点

Input:
title:On the structure and characteristics of user agent string
author:Jeffery Kline and
Paul Barford and
Aaron Cahn and
Joel Sommers
On the Structure and Characteristics of User Agent String
Jeff Kline
comScore, Inc.
jkline@comscore.com
University of Wisconsin-Madison
Paul Barford
comScore, Inc.
pb@cs.wisc.edu
Aaron Cahn
comScore, Inc.
acahn@comscore.com
Joel Sommers
Colgate University
jsommers@colgate.edu
ABSTRACT
User agent (UA) strings transmitted during HTTP transactions
convey client system configuration details to ensure that content
returned by a server is appropriate for the requesting host. As
such, analysis of UA strings and their structure offers a unique per-
spective on active client systems in the Internet and when tracked
longitudinally, offers a perspective on the nature of system and
configuration dynamics. In this paper, we describe our study of
UA string characteristics. Our work is based on analyzing a unique
corpus of over 1B UA strings collected over a period of 2 years by
comScore. We begin by analyzing the general characteristics of
UA strings, focusing on the most prevalent strings and dynamic
behaviors. We identify the top 10 most popular User Agents, which
account for 26% of total daily volume. These strings describe the
expected instances of popular platforms such as Microsoft, Apple
and Google. We then report on the characteristics of low-volume
UA strings, which has important implications for unique device
identification. We show that this class of user agent generates the
overwhelming majority of traffic, with between 2M and 10M in-
stances observed each day. We show that the distribution of UA
strings has temporal dependence and we show the distribution
measured depends on the type of content served. Finally, we report
on two large-scale UA anomalies characterized by web browsers
sending false and misleading UAs in their web requests.
CCS CONCEPTS
• Information systems → Web log analysis; Traffic analysis;
Data mining; • Software and...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:ShadowMove: A Stealthy Lateral Movement Strategy
author:Amirreza Niakanlahiji and
Jinpeng Wei and
Md Rabbi Alam and
Qingyang Wang and
Bei-Tseng Chu
ShadowMove: A Stealthy Lateral Movement Strategy
Amirreza Niakanlahiji, University of Illinois Springfield; Jinpeng Wei and
Md Rabbi Alam, UNC Charlotte; Qingyang Wang, Louisiana State University;
Bei-Tseng Chu, UNC Charlotte
https://www.usenix.org/conference/usenixsecurity20/presentation/niakanlahiji
This paper is included in the Proceedings of the 29th USENIX Security Symposium.August 12–14, 2020978-1-939133-17-5Open access to the Proceedings of the 29th USENIX Security Symposium is sponsored by USENIX.ShadowMove: A Stealthy Lateral Movement Strategy
Amirreza Niakanlahiji∗
University of Illinois Springﬁeld
aniak2@uis.edu
Jinpeng Wei
UNC Charlotte
jwei8@uncc.edu
Md Rabbi Alam
UNC Charlotte
malam5@uncc.edu
Qingyang Wang
Louisiana State University
qwang26@lsu.edu
Bei-Tseng Chu
UNC Charlotte
billchu@uncc.edu
Abstract
Advanced Persistence Threat (APT) attacks use various
strategies and techniques to move laterally within an enter-
prise environment; however, the existing strategies and tech-
niques have limitations such as requiring elevated permissions,
creating new connections, performing new authentications, or
requiring process injections. Based on these characteristics,
many host and network-based solutions have been proposed
to prevent or detect such lateral movement attempts. In this
paper, we present a novel stealthy lateral movement strategy,
ShadowMove, in which only established connections between
systems in an enterprise network are misused for lateral move-
ments. It has a set of unique features such as requiring no
elevated privilege, no new connection, no extra authentication,
and no process injection, which makes it stealthy against state-
of-the-art detection mechanisms. ShadowMove is enabled by
a novel socket duplication approach that allows a malicious
process to silently abuse TCP connections es...


Instruction: 总结这篇安全研究的主要观点

Input:
title:ShadowMove: A Stealthy Lateral Movement Strategy
author:Amirreza Niakanlahiji and
Jinpeng Wei and
Md Rabbi Alam and
Qingyang Wang and
Bei-Tseng Chu
ShadowMove: A Stealthy Lateral Movement Strategy
Amirreza Niakanlahiji, University of Illinois Springfield; Jinpeng Wei and
Md Rabbi Alam, UNC Charlotte; Qingyang Wang, Louisiana State University;
Bei-Tseng Chu, UNC Charlotte
https://www.usenix.org/conference/usenixsecurity20/presentation/niakanlahiji
This paper is included in the Proceedings of the 29th USENIX Security Symposium.August 12–14, 2020978-1-939133-17-5Open access to the Proceedings of the 29th USENIX Security Symposium is sponsored by USENIX.ShadowMove: A Stealthy Lateral Movement Strategy
Amirreza Niakanlahiji∗
University of Illinois Springﬁeld
aniak2@uis.edu
Jinpeng Wei
UNC Charlotte
jwei8@uncc.edu
Md Rabbi Alam
UNC Charlotte
malam5@uncc.edu
Qingyang Wang
Louisiana State University
qwang26@lsu.edu
Bei-Tseng Chu
UNC Charlotte
billchu@uncc.edu
Abstract
Advanced Persistence Threat (APT) attacks use various
strategies and techniques to move laterally within an enter-
prise environment; however, the existing strategies and tech-
niques have limitations such as requiring elevated permissions,
creating new connections, performing new authentications, or
requiring process injections. Based on these characteristics,
many host and network-based solutions have been proposed
to prevent or detect such lateral movement attempts. In this
paper, we present a novel stealthy lateral movement strategy,
ShadowMove, in which only established connections between
systems in an enterprise network are misused for lateral move-
ments. It has a set of unique features such as requiring no
elevated privilege, no new connection, no extra authentication,
and no process injection, which makes it stealthy against state-
of-the-art detection mechanisms. ShadowMove is enabled by
a novel socket duplication approach that allows a malicious
process to silently abuse TCP connections es...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Measuring the Practical Impact of DNSSEC Deployment
author:Wilson Lian and
Eric Rescorla and
Hovav Shacham and
Stefan Savage
Measuring the Practical Impact
of DNSSEC Deployment
Wilson Lian, University of California, San Diego; Eric Rescorla, RTFM, Inc.;
Hovav Shacham and Stefan Savage, University of California, San Diego
Open access to the Proceedings of the 22nd USENIX Security Symposium is sponsored by USENIXThis paper is included in the Proceedings of the 22nd USENIX Security Symposium.August 14–16, 2013 • Washington, D.C., USAISBN 978-1-931971-03-4Measuring the practical impact of DNSSEC Deployment
Wilson Lian
UC San Diego
Eric Rescorla
RTFM, Inc.
Hovav Shacham
UC San Diego
Stefan Savage
UC San Diego
Abstract
DNSSEC extends DNS with a public-key infras-
tructure, providing compatible clients with crypto-
graphic assurance for DNS records they obtain, even
in the presence of an active network attacker. As
with many Internet protocol deployments, admin-
istrators deciding whether to deploy DNSSEC for
their DNS zones must perform cost/beneﬁt analy-
sis. For some fraction of clients — those that perform
DNSSEC validation — the zone will be protected
from malicious hijacking. But another fraction of
clients — those whose DNS resolvers are buggy and
incompatible with DNSSEC — will no longer be able
to connect to the zone. Deploying DNSSEC requires
making a cost-beneﬁt decision, balancing security for
some users with denial of service for others.
We have performed a large-scale measurement of
the eﬀects of DNSSEC on client name resolution us-
ing an ad network to collect results from over 500,000
geographically-distributed clients. Our ﬁndings cor-
roborate those of previous researchers in showing
that a relatively small fraction of users are protected
by DNSSEC-validating resolvers. And we show, for
the ﬁrst time, that enabling DNSSEC measurably in-
creases end-to-end resolution failures. For every 10
clients that are protected from DNS tampering when
a dom...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Measuring the Practical Impact of DNSSEC Deployment
author:Wilson Lian and
Eric Rescorla and
Hovav Shacham and
Stefan Savage
Measuring the Practical Impact
of DNSSEC Deployment
Wilson Lian, University of California, San Diego; Eric Rescorla, RTFM, Inc.;
Hovav Shacham and Stefan Savage, University of California, San Diego
Open access to the Proceedings of the 22nd USENIX Security Symposium is sponsored by USENIXThis paper is included in the Proceedings of the 22nd USENIX Security Symposium.August 14–16, 2013 • Washington, D.C., USAISBN 978-1-931971-03-4Measuring the practical impact of DNSSEC Deployment
Wilson Lian
UC San Diego
Eric Rescorla
RTFM, Inc.
Hovav Shacham
UC San Diego
Stefan Savage
UC San Diego
Abstract
DNSSEC extends DNS with a public-key infras-
tructure, providing compatible clients with crypto-
graphic assurance for DNS records they obtain, even
in the presence of an active network attacker. As
with many Internet protocol deployments, admin-
istrators deciding whether to deploy DNSSEC for
their DNS zones must perform cost/beneﬁt analy-
sis. For some fraction of clients — those that perform
DNSSEC validation — the zone will be protected
from malicious hijacking. But another fraction of
clients — those whose DNS resolvers are buggy and
incompatible with DNSSEC — will no longer be able
to connect to the zone. Deploying DNSSEC requires
making a cost-beneﬁt decision, balancing security for
some users with denial of service for others.
We have performed a large-scale measurement of
the eﬀects of DNSSEC on client name resolution us-
ing an ad network to collect results from over 500,000
geographically-distributed clients. Our ﬁndings cor-
roborate those of previous researchers in showing
that a relatively small fraction of users are protected
by DNSSEC-validating resolvers. And we show, for
the ﬁrst time, that enabling DNSSEC measurably in-
creases end-to-end resolution failures. For every 10
clients that are protected from DNS tampering when
a dom...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Empowering Low-Power Wide Area Networks in Urban Settings
author:Rashad Eletreby and
Diana Zhang and
Swarun Kumar and
Osman Yagan
Empowering Low-Power Wide Area Networks in Urban Settings
Rashad Eletreby
Carnegie Mellon University
Pittsburgh, PA
reletreby@cmu.edu
Swarun Kumar
Carnegie Mellon University
Pittsburgh, PA
swarun@cmu.edu
Diana Zhang
Carnegie Mellon University
Pittsburgh, PA
dianaz1@andrew.cmu.edu
Osman Yağan
Carnegie Mellon University
Pittsburgh, PA
oyagan@andrew.cmu.edu
ABSTRACT
Low-Power Wide Area Networks (LP-WANs) are an attractive
emerging platform to connect the Internet-of-things. LP-WANs
enable low-cost devices with a 10-year battery to communicate
at few kbps to a base station, kilometers away. But deploying LP-
WANs in large urban environments is challenging, given the sheer
density of nodes that causes interference, coupled with attenuation
from buildings that limits signal range. Yet, state-of-the-art tech-
niques to address these limitations demand inordinate hardware
complexity at the base stations or clients, increasing their size and
cost.
This paper presents Choir, a system that overcomes challenges
pertaining to density and range of urban LP-WANs despite the lim-
ited capabilities of base station and client hardware. First, Choir pro-
poses a novel technique that aims to disentangle and decode large
numbers of interfering transmissions at a simple, single-antenna
LP-WAN base station. It does so, perhaps counter-intuitively, by
taking the hardware imperfections of low-cost LP-WAN clients
to its advantage. Second, Choir exploits the correlation of sensed
data collected by LP-WAN nodes to collaboratively reach a far-
away base station, even if individual clients are beyond its range.
We implement and evaluate Choir on USRP N210 base stations
serving a 10 square kilometer area surrounding Carnegie Mellon
University campus. Our results reveal that Choir improves network
throughput of commodity LP-WAN clients by 6.84 × and expands
commun...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Empowering Low-Power Wide Area Networks in Urban Settings
author:Rashad Eletreby and
Diana Zhang and
Swarun Kumar and
Osman Yagan
Empowering Low-Power Wide Area Networks in Urban Settings
Rashad Eletreby
Carnegie Mellon University
Pittsburgh, PA
reletreby@cmu.edu
Swarun Kumar
Carnegie Mellon University
Pittsburgh, PA
swarun@cmu.edu
Diana Zhang
Carnegie Mellon University
Pittsburgh, PA
dianaz1@andrew.cmu.edu
Osman Yağan
Carnegie Mellon University
Pittsburgh, PA
oyagan@andrew.cmu.edu
ABSTRACT
Low-Power Wide Area Networks (LP-WANs) are an attractive
emerging platform to connect the Internet-of-things. LP-WANs
enable low-cost devices with a 10-year battery to communicate
at few kbps to a base station, kilometers away. But deploying LP-
WANs in large urban environments is challenging, given the sheer
density of nodes that causes interference, coupled with attenuation
from buildings that limits signal range. Yet, state-of-the-art tech-
niques to address these limitations demand inordinate hardware
complexity at the base stations or clients, increasing their size and
cost.
This paper presents Choir, a system that overcomes challenges
pertaining to density and range of urban LP-WANs despite the lim-
ited capabilities of base station and client hardware. First, Choir pro-
poses a novel technique that aims to disentangle and decode large
numbers of interfering transmissions at a simple, single-antenna
LP-WAN base station. It does so, perhaps counter-intuitively, by
taking the hardware imperfections of low-cost LP-WAN clients
to its advantage. Second, Choir exploits the correlation of sensed
data collected by LP-WAN nodes to collaboratively reach a far-
away base station, even if individual clients are beyond its range.
We implement and evaluate Choir on USRP N210 base stations
serving a 10 square kilometer area surrounding Carnegie Mellon
University campus. Our results reveal that Choir improves network
throughput of commodity LP-WAN clients by 6.84 × and expands
commun...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Locally Differentially Private Analysis of Graph Statistics
author:Jacob Imola and
Takao Murakami and
Kamalika Chaudhuri
Locally Differentially Private Analysis of
Graph Statistics
Jacob Imola, UC San Diego; Takao Murakami, AIST;
Kamalika Chaudhuri, UC San Diego
https://www.usenix.org/conference/usenixsecurity21/presentation/imola
This paper is included in the Proceedings of the 30th USENIX Security Symposium.August 11–13, 2021978-1-939133-24-3Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX.Locally Differentially Private Analysis of Graph Statistics
Jacob Imola∗
UC San Diego
Takao Murakami∗
AIST
Kamalika Chaudhuri
UC San Diego
Abstract
Differentially private analysis of graphs is widely used for
releasing statistics from sensitive graphs while still preserv-
ing user privacy. Most existing algorithms however are in a
centralized privacy model, where a trusted data curator holds
the entire graph. As this model raises a number of privacy and
security issues – such as, the trustworthiness of the curator
and the possibility of data breaches, it is desirable to consider
algorithms in a more decentralized local model where no
server holds the entire graph.
In this work, we consider a local model, and present al-
gorithms for counting subgraphs – a fundamental task for
analyzing the connection patterns in a graph – with LDP
(Local Differential Privacy). For triangle counts, we present
algorithms that use one and two rounds of interaction, and
show that an additional round can signiﬁcantly improve the
utility. For k-star counts, we present an algorithm that achieves
an order optimal estimation error in the non-interactive lo-
cal model. We provide new lower-bounds on the estimation
error for general graph statistics including triangle counts
and k-star counts. Finally, we perform extensive experiments
on two real datasets, and show that it is indeed possible to
accurately estimate subgraph counts in the local differential...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Locally Differentially Private Analysis of Graph Statistics
author:Jacob Imola and
Takao Murakami and
Kamalika Chaudhuri
Locally Differentially Private Analysis of
Graph Statistics
Jacob Imola, UC San Diego; Takao Murakami, AIST;
Kamalika Chaudhuri, UC San Diego
https://www.usenix.org/conference/usenixsecurity21/presentation/imola
This paper is included in the Proceedings of the 30th USENIX Security Symposium.August 11–13, 2021978-1-939133-24-3Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX.Locally Differentially Private Analysis of Graph Statistics
Jacob Imola∗
UC San Diego
Takao Murakami∗
AIST
Kamalika Chaudhuri
UC San Diego
Abstract
Differentially private analysis of graphs is widely used for
releasing statistics from sensitive graphs while still preserv-
ing user privacy. Most existing algorithms however are in a
centralized privacy model, where a trusted data curator holds
the entire graph. As this model raises a number of privacy and
security issues – such as, the trustworthiness of the curator
and the possibility of data breaches, it is desirable to consider
algorithms in a more decentralized local model where no
server holds the entire graph.
In this work, we consider a local model, and present al-
gorithms for counting subgraphs – a fundamental task for
analyzing the connection patterns in a graph – with LDP
(Local Differential Privacy). For triangle counts, we present
algorithms that use one and two rounds of interaction, and
show that an additional round can signiﬁcantly improve the
utility. For k-star counts, we present an algorithm that achieves
an order optimal estimation error in the non-interactive lo-
cal model. We provide new lower-bounds on the estimation
error for general graph statistics including triangle counts
and k-star counts. Finally, we perform extensive experiments
on two real datasets, and show that it is indeed possible to
accurately estimate subgraph counts in the local differential...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Compiler-Directed Program-Fault Coverage for Highly Available Java
Internet Services
author:Chen Fu and
Richard P. Martin and
Kiran Nagaraja and
Thu D. Nguyen and
Barbara G. Ryder and
David Wonnacott
Compiler-directed Program-fault Coverage
for Highly Available Java Internet Services∗
Chen Fu, Richard P. Martin, Kiran Nagaraja,
Thu D. Nguyen, Barbara G. Ryder
Department of Computer Science
Rutgers University, Piscataway, NJ 08854
‡
†
David Wonnacott
Department of Computer Science
Haverford College
Haverford, PA 19041
Abstract: We present a new approach that uses compiler-
directed fault-injection for coverage testing of recovery
code in Internet services to evaluate their robustness to op-
erating system and I/O hardware faults. We deﬁne a set
of program-fault coverage metrics that enable quantiﬁca-
tion of Java catch blocks exercised during fault-injection
experiments. We use compiler analyses to instrument appli-
cation code in two ways: to direct fault injection to occur
at appropriate points during execution, and to measure the
resulting coverage. As a proof of concept for these ideas,
we have applied our techniques manually to Mufﬁn, a proxy
server; we obtained a high degree of coverage of catch
blocks, with, on average, 85% of the expected faults per
catch being experienced as caught exceptions.
1
Introduction
Many different approaches to fault injection have been
developed and studied [10, 11, 17, 20, 28], but in a software
engineering context all these efforts suffer from a funda-
mental limitation. Speciﬁcally, they have led to a proba-
bilistic analysis that describes the likelihood that a program
or software component can deliver correct service under
speciﬁc fault and work loads [3], treating the application as
a black box which only can be tested in terms of its observ-
able behavior in response to inputs. While this probabilistic
reasoning is necessary to produce dependable software, it
is not sufﬁcient for software designers and testers to under...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Compiler-Directed Program-Fault Coverage for Highly Available Java
Internet Services
author:Chen Fu and
Richard P. Martin and
Kiran Nagaraja and
Thu D. Nguyen and
Barbara G. Ryder and
David Wonnacott
Compiler-directed Program-fault Coverage
for Highly Available Java Internet Services∗
Chen Fu, Richard P. Martin, Kiran Nagaraja,
Thu D. Nguyen, Barbara G. Ryder
Department of Computer Science
Rutgers University, Piscataway, NJ 08854
‡
†
David Wonnacott
Department of Computer Science
Haverford College
Haverford, PA 19041
Abstract: We present a new approach that uses compiler-
directed fault-injection for coverage testing of recovery
code in Internet services to evaluate their robustness to op-
erating system and I/O hardware faults. We deﬁne a set
of program-fault coverage metrics that enable quantiﬁca-
tion of Java catch blocks exercised during fault-injection
experiments. We use compiler analyses to instrument appli-
cation code in two ways: to direct fault injection to occur
at appropriate points during execution, and to measure the
resulting coverage. As a proof of concept for these ideas,
we have applied our techniques manually to Mufﬁn, a proxy
server; we obtained a high degree of coverage of catch
blocks, with, on average, 85% of the expected faults per
catch being experienced as caught exceptions.
1
Introduction
Many different approaches to fault injection have been
developed and studied [10, 11, 17, 20, 28], but in a software
engineering context all these efforts suffer from a funda-
mental limitation. Speciﬁcally, they have led to a proba-
bilistic analysis that describes the likelihood that a program
or software component can deliver correct service under
speciﬁc fault and work loads [3], treating the application as
a black box which only can be tested in terms of its observ-
able behavior in response to inputs. While this probabilistic
reasoning is necessary to produce dependable software, it
is not sufﬁcient for software designers and testers to under...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Social Networks Meet Distributed Systems: Towards a Robust Sybil Defense
under Churn
author:Nitin Chiluka and
Nazareno Andrade and
Johan A. Pouwelse and
Henk J. Sips
Social Networks Meet Distributed Systems
Towards a Robust Sybil Defense under Churn
Nitin Chiluka
INRIA Rennes
ﬁrst.last@gmail.com
Nazareno Andrade
UFCG
nazareno@lsd.ufcg.edu.br
Johan Pouwelse
Delft University of Technology
j.a.pouwelse@tudelft.nl
Henk Sips
Delft University of Technology
h.j.sips@tudelft.nl
ABSTRACT
This paper examines the impact of heavy churn on the ro-
bustness of decentralized social network-based Sybil defense
(SNSD) schemes. Our analysis reveals that (i) heavy churn
disintegrates the social overlay network that is fundamental
to these schemes into multiple disconnected components, re-
sulting in poor network connectivity, and (ii) a naive solution
that adds links from each node to all its 2-hop neighbors im-
proves network connectivity but comes at a signiﬁcant cost
of poor attack resilience of these schemes.
We propose a new design point in the trade-oﬀ between
network connectivity and attack resilience of SNSD schemes,
where each node adds links to only a selective few of all its 2-
hop neighbors based on a minimum expansion contribution
(MinEC) heuristic. Extensive evaluation through simula-
tions shows that our approach fares as good as the naive
2-hop solution in terms of network connectivity, while mak-
ing little compromise on the attack resilience. Moreover, our
approach preserves the fast-mixing property that is funda-
mental to many SNSD schemes even at high levels of churn.
This result suggests that existing and potential future SNSD
schemes relying on this property can incorporate our ap-
proach into their designs with minimal changes.
Categories and Subject Descriptors
C.2.0 [Computer-Communication Networks]: General—
Security and protection
Keywords
Social overlay network, Churn, Sybil attack
1.
INTRODUCTION
Security and churn are two key challenges in designin...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Social Networks Meet Distributed Systems: Towards a Robust Sybil Defense
under Churn
author:Nitin Chiluka and
Nazareno Andrade and
Johan A. Pouwelse and
Henk J. Sips
Social Networks Meet Distributed Systems
Towards a Robust Sybil Defense under Churn
Nitin Chiluka
INRIA Rennes
ﬁrst.last@gmail.com
Nazareno Andrade
UFCG
nazareno@lsd.ufcg.edu.br
Johan Pouwelse
Delft University of Technology
j.a.pouwelse@tudelft.nl
Henk Sips
Delft University of Technology
h.j.sips@tudelft.nl
ABSTRACT
This paper examines the impact of heavy churn on the ro-
bustness of decentralized social network-based Sybil defense
(SNSD) schemes. Our analysis reveals that (i) heavy churn
disintegrates the social overlay network that is fundamental
to these schemes into multiple disconnected components, re-
sulting in poor network connectivity, and (ii) a naive solution
that adds links from each node to all its 2-hop neighbors im-
proves network connectivity but comes at a signiﬁcant cost
of poor attack resilience of these schemes.
We propose a new design point in the trade-oﬀ between
network connectivity and attack resilience of SNSD schemes,
where each node adds links to only a selective few of all its 2-
hop neighbors based on a minimum expansion contribution
(MinEC) heuristic. Extensive evaluation through simula-
tions shows that our approach fares as good as the naive
2-hop solution in terms of network connectivity, while mak-
ing little compromise on the attack resilience. Moreover, our
approach preserves the fast-mixing property that is funda-
mental to many SNSD schemes even at high levels of churn.
This result suggests that existing and potential future SNSD
schemes relying on this property can incorporate our ap-
proach into their designs with minimal changes.
Categories and Subject Descriptors
C.2.0 [Computer-Communication Networks]: General—
Security and protection
Keywords
Social overlay network, Churn, Sybil attack
1.
INTRODUCTION
Security and churn are two key challenges in designin...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Leaky DNN: Stealing Deep-Learning Model Secret with GPU Context-Switching
Side-Channel
author:Junyi Wei and
Yicheng Zhang and
Zhe Zhou and
Zhou Li and
Mohammad Abdullah Al Faruque
Leaky DNN: Stealing Deep-learning Model Secret
with GPU Context-switching Side-channel
Junyi Wei∗, Yicheng Zhang†, Zhe Zhou∗, Zhou Li† and Mohammad Abdullah Al Faruque†
∗Fudan University, Email: wjygerald@gmail.com, zhouzhe@fudan.edu.cn
†University of California, Irvine, Email: {yichez16, zhou.li, alfaruqu}@uci.edu
Abstract—Machine learning has been attracting strong inter-
ests in recent years. Numerous companies have invested great
efforts and resources to develop customized deep-learning models,
which are their key intellectual properties. In this work, we
investigate to what extent the secret of deep-learning models can
be inferred by attackers.
In particular, we focus on the scenario that a model developer
and an adversary share the same GPU when training a Deep
Neural Network (DNN) model. We exploit the GPU side-channel
based on context-switching penalties. This side-channel allows us
to extract the ﬁne-grained structural secret of a DNN model,
including its layer composition and hyper-parameters.
Leveraging this side-channel, we developed an attack prototype
named MoSConS, which applies LSTM-based inference models to
identify the structural secret. Our evaluation of MoSConS shows
the structural information can be accurately recovered. There-
fore, we believe new defense mechanisms should be developed to
protect training against the GPU side-channel.
Index Terms—Deep-learning; GPU; Side-channel;
I. INTRODUCTION
In recent years, technologies driven by machine-learning,
especially deep learning, have been gaining strong momentum
from the research community and industry. Those technologies
have shown promises and early success in transforming the
application domains, like computer vision [54] and speech
recognition [64]. Driven by this wave, numerous companies
have been devoting h...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Leaky DNN: Stealing Deep-Learning Model Secret with GPU Context-Switching
Side-Channel
author:Junyi Wei and
Yicheng Zhang and
Zhe Zhou and
Zhou Li and
Mohammad Abdullah Al Faruque
Leaky DNN: Stealing Deep-learning Model Secret
with GPU Context-switching Side-channel
Junyi Wei∗, Yicheng Zhang†, Zhe Zhou∗, Zhou Li† and Mohammad Abdullah Al Faruque†
∗Fudan University, Email: wjygerald@gmail.com, zhouzhe@fudan.edu.cn
†University of California, Irvine, Email: {yichez16, zhou.li, alfaruqu}@uci.edu
Abstract—Machine learning has been attracting strong inter-
ests in recent years. Numerous companies have invested great
efforts and resources to develop customized deep-learning models,
which are their key intellectual properties. In this work, we
investigate to what extent the secret of deep-learning models can
be inferred by attackers.
In particular, we focus on the scenario that a model developer
and an adversary share the same GPU when training a Deep
Neural Network (DNN) model. We exploit the GPU side-channel
based on context-switching penalties. This side-channel allows us
to extract the ﬁne-grained structural secret of a DNN model,
including its layer composition and hyper-parameters.
Leveraging this side-channel, we developed an attack prototype
named MoSConS, which applies LSTM-based inference models to
identify the structural secret. Our evaluation of MoSConS shows
the structural information can be accurately recovered. There-
fore, we believe new defense mechanisms should be developed to
protect training against the GPU side-channel.
Index Terms—Deep-learning; GPU; Side-channel;
I. INTRODUCTION
In recent years, technologies driven by machine-learning,
especially deep learning, have been gaining strong momentum
from the research community and industry. Those technologies
have shown promises and early success in transforming the
application domains, like computer vision [54] and speech
recognition [64]. Driven by this wave, numerous companies
have been devoting h...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:SoK: The Evolution of Sybil Defense via Social Networks
author:Lorenzo Alvisi and
Allen Clement and
Alessandro Epasto and
Silvio Lattanzi and
Alessandro Panconesi
2013 IEEE Symposium on Security and Privacy
SoK: The Evolution of Sybil Defense via Social Networks
Lorenzo Alvisi
Allen Clement
UT Austin
MPI−SWS
Alessandro Epasto
Sapienza, U of Rome
Silvio Lattanzi
Google Inc.
Alessandro Panconesi
Sapienza, U of Rome
Abstract—Sybil attacks in which an adversary forges a
potentially unbounded number of identities are a danger to
distributed systems and online social networks. The goal of
sybil defense is to accurately identify sybil identities.
This paper surveys the evolution of sybil defense protocols
that leverage the structural properties of the social graph
underlying a distributed system to identify sybil identities. We
make two main contributions. First, we clarify the deep con-
nection between sybil defense and the theory of random walks.
This leads us to identify a community detection algorithm that,
for the ﬁrst time, offers provable guarantees in the context of
sybil defense. Second, we advocate a new goal for sybil defense
that addresses the more limited, but practically useful, goal of
securely white-listing a local region of the graph.
I. INTRODUCTION
The possibility that malicious users may forge an un−
bounded number of sybil identities, indistinguishable from
honest ones, is a fundamental threat to distributed systems
that rely on voting [11]. This threat is particularly acute
in decentralized systems, where it may be impractical or
impossible to rely on a single authority to certify which users
are legitimate [20]. The goal of sybil defense is to accurately
identify sybil identities1—“ideally, the system should accept
all legitimate identities but no counterfeit entities” [11]—
but simple techniques can be either too brittle (beating a
CAPTCHA [40] costs a fraction of a cent) or too blunt (IP
ﬁltering penalizes all users behind a NAT).
Against thi...


Instruction: 总结这篇安全研究的主要观点

Input:
title:SoK: The Evolution of Sybil Defense via Social Networks
author:Lorenzo Alvisi and
Allen Clement and
Alessandro Epasto and
Silvio Lattanzi and
Alessandro Panconesi
2013 IEEE Symposium on Security and Privacy
SoK: The Evolution of Sybil Defense via Social Networks
Lorenzo Alvisi
Allen Clement
UT Austin
MPI−SWS
Alessandro Epasto
Sapienza, U of Rome
Silvio Lattanzi
Google Inc.
Alessandro Panconesi
Sapienza, U of Rome
Abstract—Sybil attacks in which an adversary forges a
potentially unbounded number of identities are a danger to
distributed systems and online social networks. The goal of
sybil defense is to accurately identify sybil identities.
This paper surveys the evolution of sybil defense protocols
that leverage the structural properties of the social graph
underlying a distributed system to identify sybil identities. We
make two main contributions. First, we clarify the deep con-
nection between sybil defense and the theory of random walks.
This leads us to identify a community detection algorithm that,
for the ﬁrst time, offers provable guarantees in the context of
sybil defense. Second, we advocate a new goal for sybil defense
that addresses the more limited, but practically useful, goal of
securely white-listing a local region of the graph.
I. INTRODUCTION
The possibility that malicious users may forge an un−
bounded number of sybil identities, indistinguishable from
honest ones, is a fundamental threat to distributed systems
that rely on voting [11]. This threat is particularly acute
in decentralized systems, where it may be impractical or
impossible to rely on a single authority to certify which users
are legitimate [20]. The goal of sybil defense is to accurately
identify sybil identities1—“ideally, the system should accept
all legitimate identities but no counterfeit entities” [11]—
but simple techniques can be either too brittle (beating a
CAPTCHA [40] costs a fraction of a cent) or too blunt (IP
ﬁltering penalizes all users behind a NAT).
Against thi...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Demystifying Soft Error Assessment Strategies on ARM CPUs: Microarchitectural
Fault Injection vs. Neutron Beam Experiments
author:Athanasios Chatzidimitriou and
Pablo Bodmann and
George Papadimitriou and
Dimitris Gizopoulos and
Paolo Rech
2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
Demystifying Soft Error Assessment Strategies on
ARM CPUs: Microarchitectural Fault Injection vs.
Neutron Beam Experiments
Athanasios Chatzidimitriou†
Pablo Bodmann*
George Papadimitriou† Dimitris Gizopoulos†
Paolo Rech*
†Dept. of Informatics and Telecommunications, University of Athens, Athens, Greece
{achatz | georgepap | dgizop}@di.uoa.gr
*PPGC, Institute of Informatics, Federal University of Rio Grande do Sul, Porto Alegre, Brasil
{prjbodmann | prech}@inf.ufrgs.br
Abstract—Fault injection in early microarchitecture-level sim-
ulation CPU models and beam experiments on the ﬁnal physical
CPU chip are two established methodologies to access the soft
error reliability of a microprocessor at different stages of its
design ﬂow. Beam experiments, on one hand, estimate the
devices expected soft error rate in realistic physical conditions
by exposing it to accelerated particles ﬂuxes. Fault injection in
microarchitectural models of the processor, on the other hand,
provides deep insights on faults propagation through the entire
system stack, including the operating system. Combining beam
experiments and fault injection data can deliver deep insights
about the devices expected reliability when deployed in the ﬁeld.
However, it is yet largely unclear if the fault injection error rates
can be compared to those reported by beam experiments and
how this comparison can lead to informed soft error protection
decisions in early stages of the system design.
In this paper, we present and analyze data gathered with
extensive beam experiments (on physical CPU hardware) and
microarchitectural fault injections (on an equivalent CPU model
on Gem5) perfor...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Demystifying Soft Error Assessment Strategies on ARM CPUs: Microarchitectural
Fault Injection vs. Neutron Beam Experiments
author:Athanasios Chatzidimitriou and
Pablo Bodmann and
George Papadimitriou and
Dimitris Gizopoulos and
Paolo Rech
2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
Demystifying Soft Error Assessment Strategies on
ARM CPUs: Microarchitectural Fault Injection vs.
Neutron Beam Experiments
Athanasios Chatzidimitriou†
Pablo Bodmann*
George Papadimitriou† Dimitris Gizopoulos†
Paolo Rech*
†Dept. of Informatics and Telecommunications, University of Athens, Athens, Greece
{achatz | georgepap | dgizop}@di.uoa.gr
*PPGC, Institute of Informatics, Federal University of Rio Grande do Sul, Porto Alegre, Brasil
{prjbodmann | prech}@inf.ufrgs.br
Abstract—Fault injection in early microarchitecture-level sim-
ulation CPU models and beam experiments on the ﬁnal physical
CPU chip are two established methodologies to access the soft
error reliability of a microprocessor at different stages of its
design ﬂow. Beam experiments, on one hand, estimate the
devices expected soft error rate in realistic physical conditions
by exposing it to accelerated particles ﬂuxes. Fault injection in
microarchitectural models of the processor, on the other hand,
provides deep insights on faults propagation through the entire
system stack, including the operating system. Combining beam
experiments and fault injection data can deliver deep insights
about the devices expected reliability when deployed in the ﬁeld.
However, it is yet largely unclear if the fault injection error rates
can be compared to those reported by beam experiments and
how this comparison can lead to informed soft error protection
decisions in early stages of the system design.
In this paper, we present and analyze data gathered with
extensive beam experiments (on physical CPU hardware) and
microarchitectural fault injections (on an equivalent CPU model
on Gem5) perfor...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:An inquiry into the nature and causes of the wealth of internet miscreants
author:Jason Franklin and
Adrian Perrig and
Vern Paxson and
Stefan Savage
An Inquiry into the Nature and Causes of
the Wealth of Internet Miscreants∗
Jason Franklin
Carnegie Mellon University
jfrankli@cs.cmu.edu
Adrian Perrig
Cylab/CMU
perrig@cmu.edu
Vern Paxson
ICSI
vern@icsi.berkeley.edu
Stefan Savage
UC San Diego
savage@cs.ucsd.edu
ABSTRACT
This paper studies an active underground economy which special-
izes in the commoditization of activities such as credit card fraud,
identity theft, spamming, phishing, online credential theft, and the
sale of compromised hosts. Using a seven month trace of logs col-
lected from an active underground market operating on public In-
ternet chat networks, we measure how the shift from “hacking for
fun” to “hacking for proﬁt” has given birth to a societal substrate
mature enough to steal wealth into the millions of dollars in less
than one year.
Categories and Subject Descriptors
K.4.1 [Public Policy Issues]: ABUSE AND CRIME INVOLVING
COMPUTERS
General Terms
Measurement,Security
Keywords
eCrime, Underground Markets
∗
This research was supported in part by CyLab at Carnegie Mel-
lon under grant DAAD19-02-1-0389 from the Army Research
Ofﬁce, and grants CNS-0537246, CCF-0424422, CNS-0433668,
and NSF-0433702 from the National Science Foundation. Jason
Franklin performed this research while on appointment as a U.S.
Department of Homeland Security (DHS) Fellow under the DHS
Scholarship and Fellowship Program, a program administered by
the Oak Ridge Institute for Science and Education (ORISE) for
DHS through an interagency agreement with the U.S Department
of Energy (DOE). The views and conclusions contained here are
those of the authors and should not be interpreted as necessarily
representing the ofﬁcial policies or endorsements, either express or
implied, of ARO, CMU, NSF, DHS, DOE, ORISE or the U.S. Gov-
ernment or any of its agencies.
Permission to make...