Instruction: 总结这篇安全研究的主要观点

Input:
title:The Security of ChaCha20-Poly1305 in the Multi-User Setting
author:Jean Paul Degabriele and
J'erôme Govinden and
Felix G"unther and
Kenneth G. Paterson
The Security of ChaCha20-Poly1305 in the Multi-User Setting
Jean Paul Degabriele
jean_paul.degabriele@tu-darmstadt.de
CNS, Technische Universität Darmstadt
Jérôme Govinden
jerome.govinden@tu-darmstadt.de
CNS, Technische Universität Darmstadt
Felix Günther
felix.guenther@inf.ethz.ch
Applied Cryptography Group, ETH Zurich
ABSTRACT
The ChaCha20-Poly1305 AEAD scheme is being increasingly wid-
ely deployed in practice. Practitioners need proven security bounds
in order to set data limits and rekeying intervals for the scheme.
But the formal security analysis of ChaCha20-Poly1305 currently
lags behind that of AES-GCM. The only extant analysis (Procter,
2014) contains a flaw and is only for the single-user setting. We
rectify this situation. We prove a multi-user security bound on the
AEAD security of ChaCha20-Poly1305 and establish the tightness
of each term in our bound through matching attacks. We show
how our bound differs both qualitatively and quantitatively from
the known bounds for AES-GCM, highlighting how subtle design
choices lead to distinctive security properties. We translate our
bound to the nonce-randomized setting employed in TLS 1.3 and
elsewhere, and we additionally improve the corresponding security
bounds for GCM. Finally, we provide a simple yet stronger variant
of ChaCha20-Poly1305 that addresses the deficiencies highlighted
by our analysis.
CCS CONCEPTS
• Security and privacy → Mathematical foundations of cryp-
tography; Block and stream ciphers; Hash functions and message
authentication codes.
KEYWORDS
ChaCha20-Poly1305; Multi-User Security; GCM; Nonce Random-
ization, AEAD; TLS 1.3; Tight Security
ACM Reference Format:
Jean Paul Degabriele, Jérôme Govinden, Felix Günther, and Kenneth G.
Paterson. 2021. The Security of ChaCha20-Poly1305 in the Multi-User Set-
ting. In Proceedings of ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:An Intrusion Detection Tool for AODV-Based Ad hoc Wireless Networks
author:Giovanni Vigna and
Sumit Gwalani and
Kavitha Srinivasan and
Elizabeth M. Belding-Royer and
Richard A. Kemmerer
Available online at www.sciencedirect.com
Ad Hoc Networks 6 (2008) 578–599
www.elsevier.com/locate/adhoc
Threshold-based intrusion detection in ad hoc networks
and secure AODV q
A. Patwardhan a,*, J. Parker a, M. Iorga b, A. Joshi a, T. Karygiannis b, Y. Yesha a
a Computer Science and Electrical Engineering Department, UMBC, 1000 Hilltop Circle, Baltimore, MD 21250, United States
b Computer Security Division, National Institute of Standards and Technology, Gaithersburg, MD 20899, United States
Received 1 November 2006; received in revised form 28 February 2007; accepted 9 May 2007
Available online 18 May 2007
Abstract
Mobile ad hoc networks (MANETs) play an important role in connecting devices in pervasive environments. MANETs
provide inexpensive and versatile communication, yet several challenges remain in addressing their security. So far, numer-
ous schemes have been proposed for secure routing and intrusion detection, with only simulations to validate them; little
work exists, in implementing such schemes on small handheld devices. In this paper, we present our approach of securing a
MANET using a threshold-based intrusion detection system and a secure routing protocol. We present a proof-of-concept
implementation of our IDS deployed on handheld devices and in a MANET testbed connected by a secure version of
AODV over IPv6 – SecAODV. While the IDS helps detect attacks on data traﬃc, SecAODV incorporates security features
of non-repudiation and authentication, without relying on the availability of a Certiﬁcate Authority (CA) or a Key
Distribution Center (KDC). We present the design and implementation details of our system, the practical considerations
involved, and how these mechanisms can be used to detect and thwart malicious attacks.
Ó 2007 Elsevier B.V. All rights reser...


Instruction: 总结这篇安全研究的主要观点

Input:
title:An Intrusion Detection Tool for AODV-Based Ad hoc Wireless Networks
author:Giovanni Vigna and
Sumit Gwalani and
Kavitha Srinivasan and
Elizabeth M. Belding-Royer and
Richard A. Kemmerer
Available online at www.sciencedirect.com
Ad Hoc Networks 6 (2008) 578–599
www.elsevier.com/locate/adhoc
Threshold-based intrusion detection in ad hoc networks
and secure AODV q
A. Patwardhan a,*, J. Parker a, M. Iorga b, A. Joshi a, T. Karygiannis b, Y. Yesha a
a Computer Science and Electrical Engineering Department, UMBC, 1000 Hilltop Circle, Baltimore, MD 21250, United States
b Computer Security Division, National Institute of Standards and Technology, Gaithersburg, MD 20899, United States
Received 1 November 2006; received in revised form 28 February 2007; accepted 9 May 2007
Available online 18 May 2007
Abstract
Mobile ad hoc networks (MANETs) play an important role in connecting devices in pervasive environments. MANETs
provide inexpensive and versatile communication, yet several challenges remain in addressing their security. So far, numer-
ous schemes have been proposed for secure routing and intrusion detection, with only simulations to validate them; little
work exists, in implementing such schemes on small handheld devices. In this paper, we present our approach of securing a
MANET using a threshold-based intrusion detection system and a secure routing protocol. We present a proof-of-concept
implementation of our IDS deployed on handheld devices and in a MANET testbed connected by a secure version of
AODV over IPv6 – SecAODV. While the IDS helps detect attacks on data traﬃc, SecAODV incorporates security features
of non-repudiation and authentication, without relying on the availability of a Certiﬁcate Authority (CA) or a Key
Distribution Center (KDC). We present the design and implementation details of our system, the practical considerations
involved, and how these mechanisms can be used to detect and thwart malicious attacks.
Ó 2007 Elsevier B.V. All rights reser...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Result Pattern Hiding Searchable Encryption for Conjunctive Queries
author:Shangqi Lai and
Sikhar Patranabis and
Amin Sakzad and
Joseph K. Liu and
Debdeep Mukhopadhyay and
Ron Steinfeld and
Shifeng Sun and
Dongxi Liu and
Cong Zuo
Result Pattern Hiding Searchable Encryption for Conjunctive
Queries
(Full Version)
Shangqi Lai∗
Monash University
Melbourne, Australia
shangqi.lai@monash.edu
Joseph K. Liu†
Monash University
Melbourne, Australia
joseph.liu@monash.edu
Shi-Feng Sun∗†
Monash University
Melbourne, Australia
shifeng.sun@monash.edu
Sikhar Patranabis
Indian Institute of Technology
Kharagpur, India
sikhar.patranabis@iitkgp.ac.in
Debdeep Mukhopadhyay
Indian Institute of Technology
Kharagpur, India
debdeep@iitkgp.ac.in
Dongxi Liu
Data61, CSIRO
Syndey, Australia
dongxi.liu@data61.csiro.au
Amin Sakzad
Monash University
Melbourne, Australia
amin.sakzad@monash.edu
Ron Steinfeld
Monash University
Melbourne, Australia
ron.steinfeld@monash.edu
Cong Zuo∗
Monash University
Melbourne, Australia
cong.zuo1@monash.edu
ABSTRACT
The recently proposed Oblivious Cross-Tags (OXT) protocol (CRYP-
TO 2013) has broken new ground in designing efficient searchable
symmetric encryption (SSE) protocol with support for conjunctive
keyword search in a single-writer single-reader framework. While
the OXT protocol offers high performance by adopting a number
of specialised data-structures, it also trades-off security by leaking
‘partial’ database information to the server. Recent attacks have
exploited similar partial information leakage to breach database
confidentiality. Consequently, it is an open problem to design SSE
protocols that plug such leakages while retaining similar efficiency.
In this paper, we propose a new SSE protocol, called Hidden Cross-
Tags (HXT), that removes ‘Keyword Pair Result Pattern’ (KPRP)
leakage for conjunctive keyword search. We avoid this leakage by
adopting two additional cryptographic primitives - Hidden Vector
Encryption (HVE) and probabilistic (Bloom fil...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Result Pattern Hiding Searchable Encryption for Conjunctive Queries
author:Shangqi Lai and
Sikhar Patranabis and
Amin Sakzad and
Joseph K. Liu and
Debdeep Mukhopadhyay and
Ron Steinfeld and
Shifeng Sun and
Dongxi Liu and
Cong Zuo
Result Pattern Hiding Searchable Encryption for Conjunctive
Queries
(Full Version)
Shangqi Lai∗
Monash University
Melbourne, Australia
shangqi.lai@monash.edu
Joseph K. Liu†
Monash University
Melbourne, Australia
joseph.liu@monash.edu
Shi-Feng Sun∗†
Monash University
Melbourne, Australia
shifeng.sun@monash.edu
Sikhar Patranabis
Indian Institute of Technology
Kharagpur, India
sikhar.patranabis@iitkgp.ac.in
Debdeep Mukhopadhyay
Indian Institute of Technology
Kharagpur, India
debdeep@iitkgp.ac.in
Dongxi Liu
Data61, CSIRO
Syndey, Australia
dongxi.liu@data61.csiro.au
Amin Sakzad
Monash University
Melbourne, Australia
amin.sakzad@monash.edu
Ron Steinfeld
Monash University
Melbourne, Australia
ron.steinfeld@monash.edu
Cong Zuo∗
Monash University
Melbourne, Australia
cong.zuo1@monash.edu
ABSTRACT
The recently proposed Oblivious Cross-Tags (OXT) protocol (CRYP-
TO 2013) has broken new ground in designing efficient searchable
symmetric encryption (SSE) protocol with support for conjunctive
keyword search in a single-writer single-reader framework. While
the OXT protocol offers high performance by adopting a number
of specialised data-structures, it also trades-off security by leaking
‘partial’ database information to the server. Recent attacks have
exploited similar partial information leakage to breach database
confidentiality. Consequently, it is an open problem to design SSE
protocols that plug such leakages while retaining similar efficiency.
In this paper, we propose a new SSE protocol, called Hidden Cross-
Tags (HXT), that removes ‘Keyword Pair Result Pattern’ (KPRP)
leakage for conjunctive keyword search. We avoid this leakage by
adopting two additional cryptographic primitives - Hidden Vector
Encryption (HVE) and probabilistic (Bloom fil...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Scalable application layer multicast
author:Suman Banerjee and
Bobby Bhattacharjee and
Christopher Kommareddy
Scalable Application Layer Multicast
Suman Banerjee, Bobby Bhattacharjee, Christopher Kommareddy
Department of Computer Science,University of Maryland, College Park, MD 20742, USA
fsuman,bobby,kcrg@cs.umd.edu
ABSTRACT
We describe a new scalable application-layer multicast protocol, specif-
ically designed for low-bandwidth, data streaming applications with
large receiver sets. Our scheme is based upon a hierarchical cluster-
ing of the application-layer multicast peers and can support a num-
ber of different data delivery trees with desirable properties.
We present extensive simulations of both our protocol and the
Narada application-layer multicast protocol over Internet-like topolo-
gies. Our results show that for groups of size 32 or more, our proto-
col has lower link stress (by about 25%), improved or similar end-
to-end latencies and similar failure recovery properties. More im-
portantly, it is able to achieve these results by using orders of mag-
nitude lower control trafﬁc.
Finally, we present results from our wide-area testbed in which
we experimented with 32-100 member groups distributed over 8 dif-
ferent sites. In our experiments, averagegroup members established
and maintained low-latency paths and incurred a maximum packet
loss rate of less than 1% as members randomly joined and left the
multicast group. The average control overhead during our experi-
ments was less than 1 Kbps for groups of size 100.
Categories and Subject Descriptors
C.2.2 [Computer-Communication Networks]: Network Protocols;
C.2.4 [Computer-Communication Networks]: Distributed Sys-
tems; C.4 [Computer Systems Organization]: Performance of Sys-
tems
General Terms
Algorithms, Design, Performance, Experimentation
Keywords
Application layer multicast, Overlay networks, Peer-to-peer systems,
Hierarchy, Scalability
Permission to make digital or hard copies of all or part of...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Scalable application layer multicast
author:Suman Banerjee and
Bobby Bhattacharjee and
Christopher Kommareddy
Scalable Application Layer Multicast
Suman Banerjee, Bobby Bhattacharjee, Christopher Kommareddy
Department of Computer Science,University of Maryland, College Park, MD 20742, USA
fsuman,bobby,kcrg@cs.umd.edu
ABSTRACT
We describe a new scalable application-layer multicast protocol, specif-
ically designed for low-bandwidth, data streaming applications with
large receiver sets. Our scheme is based upon a hierarchical cluster-
ing of the application-layer multicast peers and can support a num-
ber of different data delivery trees with desirable properties.
We present extensive simulations of both our protocol and the
Narada application-layer multicast protocol over Internet-like topolo-
gies. Our results show that for groups of size 32 or more, our proto-
col has lower link stress (by about 25%), improved or similar end-
to-end latencies and similar failure recovery properties. More im-
portantly, it is able to achieve these results by using orders of mag-
nitude lower control trafﬁc.
Finally, we present results from our wide-area testbed in which
we experimented with 32-100 member groups distributed over 8 dif-
ferent sites. In our experiments, averagegroup members established
and maintained low-latency paths and incurred a maximum packet
loss rate of less than 1% as members randomly joined and left the
multicast group. The average control overhead during our experi-
ments was less than 1 Kbps for groups of size 100.
Categories and Subject Descriptors
C.2.2 [Computer-Communication Networks]: Network Protocols;
C.2.4 [Computer-Communication Networks]: Distributed Sys-
tems; C.4 [Computer Systems Organization]: Performance of Sys-
tems
General Terms
Algorithms, Design, Performance, Experimentation
Keywords
Application layer multicast, Overlay networks, Peer-to-peer systems,
Hierarchy, Scalability
Permission to make digital or hard copies of all or part of...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Passive IP traceback: capturing the origin of anonymous traffic
through network telescopes
author:Guang Yao and
Jun Bi and
Zijian Zhou
Passive IP Traceback: Capturing the Origin of Anonymous
Traffic through Network Telescopes
Guang Yao, Jun Bi, Zijian Zhou
Network Research Center, Tsinghua University, Beijing 100084, China
{yaog, junbi, zhouzj}@netarchlab.tsinghua.edu.cn
ABSTRACT
IP  traceback  can  be  used  to  find  the  origin  of  anonymous  traffic;
however,  Internet-scale  IP  traceback  systems  have  not  been
deployed  due  to  a  need  for  cooperation  between  Internet  Service
Providers (ISPs).  This article presents an Internet-scale Passive IP
Trackback (PIT) mechanism that does not require ISP deployment.
PIT analyzes the ICMP messages that may scattered to a network
telescope  as  spoofed  packets  travel  from  attacker  to  victim.    An
Internet route model is then used to help re-construct the attack path.
Applying  this  mechanism  to  data  collected  by  Cooperative
Association for Internet Data Analysis (CAIDA), we found  PIT can
construct a trace tree from at least one intermediate router in 55.4%
the fiercest packet spoofing attacks, and can construct a tree from at
least 10 routers in 23.4% of attacks. This initial result shows PIT is a
promising mechanism.
Categories and Subject Descriptors: C.2.0 [Computer-
Communication Networks]: General– Security and protection.
General Terms: Design
Keywords: IP traceback, network telescope
1.  INTRODUCTION
Distributed Denial of Service (DDoS) [1] attacks are one of the most
pressing  security  threats  on  the  Internet.  Attackers  can  launch
attacks from corners of the Internet, and the aggregated traffic can
exhaust  the  bandwidth  (or  other  resources)  at  the  victim.  DDoS
attack flows can be shut off by configuring IP source based filters if
one can identify the malicious clients.   However, attack flows can
use forged source addresses and thus source...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Passive IP traceback: capturing the origin of anonymous traffic
through network telescopes
author:Guang Yao and
Jun Bi and
Zijian Zhou
Passive IP Traceback: Capturing the Origin of Anonymous
Traffic through Network Telescopes
Guang Yao, Jun Bi, Zijian Zhou
Network Research Center, Tsinghua University, Beijing 100084, China
{yaog, junbi, zhouzj}@netarchlab.tsinghua.edu.cn
ABSTRACT
IP  traceback  can  be  used  to  find  the  origin  of  anonymous  traffic;
however,  Internet-scale  IP  traceback  systems  have  not  been
deployed  due  to  a  need  for  cooperation  between  Internet  Service
Providers (ISPs).  This article presents an Internet-scale Passive IP
Trackback (PIT) mechanism that does not require ISP deployment.
PIT analyzes the ICMP messages that may scattered to a network
telescope  as  spoofed  packets  travel  from  attacker  to  victim.    An
Internet route model is then used to help re-construct the attack path.
Applying  this  mechanism  to  data  collected  by  Cooperative
Association for Internet Data Analysis (CAIDA), we found  PIT can
construct a trace tree from at least one intermediate router in 55.4%
the fiercest packet spoofing attacks, and can construct a tree from at
least 10 routers in 23.4% of attacks. This initial result shows PIT is a
promising mechanism.
Categories and Subject Descriptors: C.2.0 [Computer-
Communication Networks]: General– Security and protection.
General Terms: Design
Keywords: IP traceback, network telescope
1.  INTRODUCTION
Distributed Denial of Service (DDoS) [1] attacks are one of the most
pressing  security  threats  on  the  Internet.  Attackers  can  launch
attacks from corners of the Internet, and the aggregated traffic can
exhaust  the  bandwidth  (or  other  resources)  at  the  victim.  DDoS
attack flows can be shut off by configuring IP source based filters if
one can identify the malicious clients.   However, attack flows can
use forged source addresses and thus source...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Errors, Misunderstandings, and Attacks: Analyzing the Crowdsourcing
Process of Ad-blocking Systems
author:Mshabab Alrizah and
Sencun Zhu and
Xinyu Xing and
Gang Wang
Errors, Misunderstandings, and Attacks: Analyzing the
Crowdsourcing Process of Ad-blocking Systems
Mshabab Alrizah
The Pennsylvania State University
maa25@psu.edu
Xinyu Xing
The Pennsylvania State University
xxing@ist.psu.edu
The Pennsylvania State University
Sencun Zhu
sxz16@psu.edu
Gang Wang
University of Illinois at Urbana-Champaign
gangw@illinois.edu
ABSTRACT
Ad-blocking systems such as Adblock Plus rely on crowdsourcing
to build and maintain filter lists, which are the basis for determin-
ing which ads to block on web pages. In this work, we seek to
advance our understanding of the ad-blocking community as well
as the errors and pitfalls of the crowdsourcing process. To do so,
we collected and analyzed a longitudinal dataset that covered the
dynamic changes of popular filter-list EasyList for nine years and
the error reports submitted by the crowd in the same period.
Our study yielded a number of significant findings regarding the
characteristics of FP and FN errors and their causes. For instances,
we found that false positive errors (i.e., incorrectly blocking legiti-
mate content) still took a long time before they could be discovered
(50% of them took more than a month) despite the community ef-
fort. Both EasyList editors and website owners were to blame for
the false positives. In addition, we found that a great number of
false negative errors (i.e., failing to block real advertisements) were
either incorrectly reported or simply ignored by the editors. Fur-
thermore, we analyzed evasion attacks from ad publishers against
ad-blockers. In total, our analysis covers 15 types of attack methods
including 8 methods that have not been studied by the research
community. We show how ad publishers have utilized them to
circumvent ad-blockers and empirically measure the reactions of
ad blockers. T...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Errors, Misunderstandings, and Attacks: Analyzing the Crowdsourcing
Process of Ad-blocking Systems
author:Mshabab Alrizah and
Sencun Zhu and
Xinyu Xing and
Gang Wang
Errors, Misunderstandings, and Attacks: Analyzing the
Crowdsourcing Process of Ad-blocking Systems
Mshabab Alrizah
The Pennsylvania State University
maa25@psu.edu
Xinyu Xing
The Pennsylvania State University
xxing@ist.psu.edu
The Pennsylvania State University
Sencun Zhu
sxz16@psu.edu
Gang Wang
University of Illinois at Urbana-Champaign
gangw@illinois.edu
ABSTRACT
Ad-blocking systems such as Adblock Plus rely on crowdsourcing
to build and maintain filter lists, which are the basis for determin-
ing which ads to block on web pages. In this work, we seek to
advance our understanding of the ad-blocking community as well
as the errors and pitfalls of the crowdsourcing process. To do so,
we collected and analyzed a longitudinal dataset that covered the
dynamic changes of popular filter-list EasyList for nine years and
the error reports submitted by the crowd in the same period.
Our study yielded a number of significant findings regarding the
characteristics of FP and FN errors and their causes. For instances,
we found that false positive errors (i.e., incorrectly blocking legiti-
mate content) still took a long time before they could be discovered
(50% of them took more than a month) despite the community ef-
fort. Both EasyList editors and website owners were to blame for
the false positives. In addition, we found that a great number of
false negative errors (i.e., failing to block real advertisements) were
either incorrectly reported or simply ignored by the editors. Fur-
thermore, we analyzed evasion attacks from ad publishers against
ad-blockers. In total, our analysis covers 15 types of attack methods
including 8 methods that have not been studied by the research
community. We show how ad publishers have utilized them to
circumvent ad-blockers and empirically measure the reactions of
ad blockers. T...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:The Art and Craft of Fraudulent App Promotion in Google Play
author:Mizanur Rahman and
Nestor Hernandez and
Ruben Recabarren and
Syed Ishtiaque Ahmed and
Bogdan Carbunar
The Art and Cra(cid:28) of Fraudulent App Promotion in Google Play
Mizanur Rahman∗
Amazon, USA
mrahm031@(cid:27)u.edu
Nestor Hernandez∗
FIU, Miami, USA
nestorghh@gmail.com
Ruben Recabarren
FIU, Miami, USA
recabarren@gmail.com
Syed Ishtiaque Ahmed
University of Toronto, Toronto, CA
ishtiaque@cs.toronto.edu
Bogdan Carbunar
FIU, Miami, USA
carbunar@gmail.com
ABSTRACT
Black Hat App Search Optimization (ASO) in the form of fake re-
views and sockpuppet accounts, is prevalent in peer-opinion sites,
e.g., app stores, with negative implications on the digital and real
lives of their users. To detect and (cid:27)lter fraud, a growing body of
research has provided insights into various aspects of fraud posting
activities, and made assumptions about the working procedures
of the fraudsters from online data. However, such assumptions of-
ten lack empirical evidence from the actual fraud perpetrators. To
address this problem, in this paper, we present results of both a
qualitative study with 18 ASO workers we recruited from 5 free-
lancing sites, concerning activities they performed on Google Play,
and a quantitative investigation with fraud-related data collected
from other 39 ASO workers.
We reveal (cid:27)ndings concerning various aspects of ASO worker ca-
pabilities and behaviors, including novel insights into their working
patterns, and supporting evidence for several existing assumptions.
Further, we found and report participant-revealed techniques to
bypass Google-imposed veri(cid:27)cations, concrete strategies to avoid
detection, and even strategies that leverage fraud detection to en-
hance fraud e(cid:28)cacy. We report a Google site vulnerability that
enabled us to infer the mobile device models used to post more
than 198 million reviews in Google Play, including 9,942 fake re-
views. We discus...


Instruction: 总结这篇安全研究的主要观点

Input:
title:The Art and Craft of Fraudulent App Promotion in Google Play
author:Mizanur Rahman and
Nestor Hernandez and
Ruben Recabarren and
Syed Ishtiaque Ahmed and
Bogdan Carbunar
The Art and Cra(cid:28) of Fraudulent App Promotion in Google Play
Mizanur Rahman∗
Amazon, USA
mrahm031@(cid:27)u.edu
Nestor Hernandez∗
FIU, Miami, USA
nestorghh@gmail.com
Ruben Recabarren
FIU, Miami, USA
recabarren@gmail.com
Syed Ishtiaque Ahmed
University of Toronto, Toronto, CA
ishtiaque@cs.toronto.edu
Bogdan Carbunar
FIU, Miami, USA
carbunar@gmail.com
ABSTRACT
Black Hat App Search Optimization (ASO) in the form of fake re-
views and sockpuppet accounts, is prevalent in peer-opinion sites,
e.g., app stores, with negative implications on the digital and real
lives of their users. To detect and (cid:27)lter fraud, a growing body of
research has provided insights into various aspects of fraud posting
activities, and made assumptions about the working procedures
of the fraudsters from online data. However, such assumptions of-
ten lack empirical evidence from the actual fraud perpetrators. To
address this problem, in this paper, we present results of both a
qualitative study with 18 ASO workers we recruited from 5 free-
lancing sites, concerning activities they performed on Google Play,
and a quantitative investigation with fraud-related data collected
from other 39 ASO workers.
We reveal (cid:27)ndings concerning various aspects of ASO worker ca-
pabilities and behaviors, including novel insights into their working
patterns, and supporting evidence for several existing assumptions.
Further, we found and report participant-revealed techniques to
bypass Google-imposed veri(cid:27)cations, concrete strategies to avoid
detection, and even strategies that leverage fraud detection to en-
hance fraud e(cid:28)cacy. We report a Google site vulnerability that
enabled us to infer the mobile device models used to post more
than 198 million reviews in Google Play, including 9,942 fake re-
views. We discus...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Ramblr: Making Reassembly Great Again
author:Ruoyu Wang and
Yan Shoshitaishvili and
Antonio Bianchi and
Aravind Machiry and
John Grosen and
Paul Grosen and
Christopher Kruegel and
Giovanni Vigna
Ramblr: Making Reassembly Great Again
Ruoyu Wang, Yan Shoshitaishvili, Antonio Bianchi, Aravind Machiry,
John Grosen, Paul Grosen, Christopher Kruegel, Giovanni Vigna
{ﬁsh, yans, antoniob, machiry, jmg, pcgrosen, chris, vigna}@cs.ucsb.edu
University of California, Santa Barbara
Abstract—Static binary rewriting has many important ap-
plications in reverse engineering, such as patching, code reuse,
and instrumentation. Binary reassembling is an efﬁcient solution
for static binary rewriting. While there has been a proposed
solution to the reassembly of binaries, an evaluation on a real-
world binary dataset shows that it suffers from some problems
that lead to breaking binaries. Those problems include incorrect
symbolization of immediates, failure in identifying symbolizable
constants, lack of pointer safety checks, and other issues. Failure
in addressing those problems makes the existing approach un-
suitable for real-world binaries, especially those compiled with
optimizations enabled.
In this paper, we present a new systematic approach for
binary reassembling. Our new approach is implemented in a tool
called Ramblr. We evaluate Ramblr on 106 real-world programs
on Linux x86 and x86-64, and 143 programs collected from the
Cyber Grand Challenge Qualiﬁcation Event. All programs are
compiled to binaries with a set of different compilation ﬂags
in order to cover as many real-world scenarios as possible.
Ramblr successfully reassembles most of the binaries, which
is an improvement over the state-of-the-art approach. It should
be noted that our reassembling procedure yields no execution
overhead and no size expansion.
I.
INTRODUCTION
Our world is extremely software-dependent. Because of
this, disruption caused by ﬂaws in this software has signif-
icant impact in the “real wor...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Ramblr: Making Reassembly Great Again
author:Ruoyu Wang and
Yan Shoshitaishvili and
Antonio Bianchi and
Aravind Machiry and
John Grosen and
Paul Grosen and
Christopher Kruegel and
Giovanni Vigna
Ramblr: Making Reassembly Great Again
Ruoyu Wang, Yan Shoshitaishvili, Antonio Bianchi, Aravind Machiry,
John Grosen, Paul Grosen, Christopher Kruegel, Giovanni Vigna
{ﬁsh, yans, antoniob, machiry, jmg, pcgrosen, chris, vigna}@cs.ucsb.edu
University of California, Santa Barbara
Abstract—Static binary rewriting has many important ap-
plications in reverse engineering, such as patching, code reuse,
and instrumentation. Binary reassembling is an efﬁcient solution
for static binary rewriting. While there has been a proposed
solution to the reassembly of binaries, an evaluation on a real-
world binary dataset shows that it suffers from some problems
that lead to breaking binaries. Those problems include incorrect
symbolization of immediates, failure in identifying symbolizable
constants, lack of pointer safety checks, and other issues. Failure
in addressing those problems makes the existing approach un-
suitable for real-world binaries, especially those compiled with
optimizations enabled.
In this paper, we present a new systematic approach for
binary reassembling. Our new approach is implemented in a tool
called Ramblr. We evaluate Ramblr on 106 real-world programs
on Linux x86 and x86-64, and 143 programs collected from the
Cyber Grand Challenge Qualiﬁcation Event. All programs are
compiled to binaries with a set of different compilation ﬂags
in order to cover as many real-world scenarios as possible.
Ramblr successfully reassembles most of the binaries, which
is an improvement over the state-of-the-art approach. It should
be noted that our reassembling procedure yields no execution
overhead and no size expansion.
I.
INTRODUCTION
Our world is extremely software-dependent. Because of
this, disruption caused by ﬂaws in this software has signif-
icant impact in the “real wor...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Error Propagation Profiling of Operating Systems
author:Andr'eas Johansson and
Neeraj Suri
Error Propagation Proﬁling of Operating Systems
Department of Computer Science, Technische Universit¨at Darmstadt
Andr´eas Johansson and Neeraj Suri
{aja,suri}@informatik.tu-darmstadt.de
Abstract
An Operating System (OS) constitutes a fundamental
software (SW) component of a computing system. The ro-
bustness of its operations, or lack thereof, strongly inﬂu-
ences the robustness of the entire system. Targeting en-
hancement of robustness at the OS level via use of add-on
SW wrappers, this paper presents an error propagation pro-
ﬁling framework that assists in a) systematic identiﬁcation
and location of design and operational vulnerabilities, and
b) quantiﬁcation of their potential impact. Focusing on data
(value) errors occurring in OS drivers, a set of measures is
presented that aids a designer to locate such vulnerabilities,
either on an OS service (system call) basis or a per driver
basis. A case study and associated experimental process,
using Windows CE .Net, is presented outlining the utility of
our proposed approach.
1. Introduction
The robustness of the OS, i.e., the ability to withstand
perturbations with continued service provision, directly af-
fects the robustness of the whole system. As applications
depend on the OS delivering correct and timely services, a
failure to do so will likely impact the system’s ability to de-
liver its services. In spite of the signiﬁcant ongoing efforts
to enhance OS robustness, and advances in the underlying
SW development processes, OS’s still occasionally fail to
deliver stipulated services. One reason is the complexity
of OS level interactions with varied SW components in the
system that are often unknown at OS design time, e.g., ap-
plications, drivers, libraries. This “dynamic” nature of OS’s
makes it hard to design an OS to be comprehensively robust
against errors that can occur in its operational environment.
This ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Error Propagation Profiling of Operating Systems
author:Andr'eas Johansson and
Neeraj Suri
Error Propagation Proﬁling of Operating Systems
Department of Computer Science, Technische Universit¨at Darmstadt
Andr´eas Johansson and Neeraj Suri
{aja,suri}@informatik.tu-darmstadt.de
Abstract
An Operating System (OS) constitutes a fundamental
software (SW) component of a computing system. The ro-
bustness of its operations, or lack thereof, strongly inﬂu-
ences the robustness of the entire system. Targeting en-
hancement of robustness at the OS level via use of add-on
SW wrappers, this paper presents an error propagation pro-
ﬁling framework that assists in a) systematic identiﬁcation
and location of design and operational vulnerabilities, and
b) quantiﬁcation of their potential impact. Focusing on data
(value) errors occurring in OS drivers, a set of measures is
presented that aids a designer to locate such vulnerabilities,
either on an OS service (system call) basis or a per driver
basis. A case study and associated experimental process,
using Windows CE .Net, is presented outlining the utility of
our proposed approach.
1. Introduction
The robustness of the OS, i.e., the ability to withstand
perturbations with continued service provision, directly af-
fects the robustness of the whole system. As applications
depend on the OS delivering correct and timely services, a
failure to do so will likely impact the system’s ability to de-
liver its services. In spite of the signiﬁcant ongoing efforts
to enhance OS robustness, and advances in the underlying
SW development processes, OS’s still occasionally fail to
deliver stipulated services. One reason is the complexity
of OS level interactions with varied SW components in the
system that are often unknown at OS design time, e.g., ap-
plications, drivers, libraries. This “dynamic” nature of OS’s
makes it hard to design an OS to be comprehensively robust
against errors that can occur in its operational environment.
This ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Robust full duplex radio link
author:Dinesh Bharadia and
Kiran Raj Joshi and
Sachin Katti
Robust Full Duplex Radio Link
Dinesh Bharadia
Stanford University
dineshb@stanford.edu
Kiran Raj Joshi
Stanford University
krjoshi@stanford.edu
Sachin Katti
Stanford University
skatti@stanford.edu
ABSTRACT
This paper presents demonstration of a real-time full duplex point-
to-point link, where transmission and reception occurs in the same
spectrum band simultaneously between a pair of full-duplex radios.
This demo ﬁrst builds a full duplex radio by implementing self-
interference cancellation technique on top of a traditional half duplex
radio architecture. We then establish a point-to-point link using a
pair of these radios that can transmit and receive OFDM packets. By
changing the environmental conditions around the full-duplex radios
we then demonstrate the robustness of the self-interference cancella-
tion to adapt to the changing environment.
Categories and Subject Descriptors
C.2.1 [Computer Communication Networks]: Network Architec-
ture and Design—Wireless communication
Keywords: Full Duplex; Interference Cancellation; Non-linear Can-
cellation
1.
INTRODUCTION
Full duplex radios have huge advantage over their half duplex
counterparts. Several work on full duplex radios [5, 3, 7, 6, 4, 8] have
proposed various hardware and algorithmic techniques to achieve
different level of self-interference cancellation required for realiza-
tion of full duplex radios. Yet, these works have failed to reduce the
ingrained skepticism of both academia and industry alike regarding
the feasibility of implementing these techniques and their adaptabil-
ity to dynamic environmental conditions. This demo has two fold
objectives; ﬁrst, we implement a working full duplex radio using the
architecture proposed in [5]. We then build full duplex radio link by
using a pair of these full duplex radios and demonstrate that they can
adapt to the changing environmental conditions around them [5].
I...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Robust full duplex radio link
author:Dinesh Bharadia and
Kiran Raj Joshi and
Sachin Katti
Robust Full Duplex Radio Link
Dinesh Bharadia
Stanford University
dineshb@stanford.edu
Kiran Raj Joshi
Stanford University
krjoshi@stanford.edu
Sachin Katti
Stanford University
skatti@stanford.edu
ABSTRACT
This paper presents demonstration of a real-time full duplex point-
to-point link, where transmission and reception occurs in the same
spectrum band simultaneously between a pair of full-duplex radios.
This demo ﬁrst builds a full duplex radio by implementing self-
interference cancellation technique on top of a traditional half duplex
radio architecture. We then establish a point-to-point link using a
pair of these radios that can transmit and receive OFDM packets. By
changing the environmental conditions around the full-duplex radios
we then demonstrate the robustness of the self-interference cancella-
tion to adapt to the changing environment.
Categories and Subject Descriptors
C.2.1 [Computer Communication Networks]: Network Architec-
ture and Design—Wireless communication
Keywords: Full Duplex; Interference Cancellation; Non-linear Can-
cellation
1.
INTRODUCTION
Full duplex radios have huge advantage over their half duplex
counterparts. Several work on full duplex radios [5, 3, 7, 6, 4, 8] have
proposed various hardware and algorithmic techniques to achieve
different level of self-interference cancellation required for realiza-
tion of full duplex radios. Yet, these works have failed to reduce the
ingrained skepticism of both academia and industry alike regarding
the feasibility of implementing these techniques and their adaptabil-
ity to dynamic environmental conditions. This demo has two fold
objectives; ﬁrst, we implement a working full duplex radio using the
architecture proposed in [5]. We then build full duplex radio link by
using a pair of these full duplex radios and demonstrate that they can
adapt to the changing environmental conditions around them [5].
I...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Optimal Average-Complexity Ideal-Security Order-Preserving Encryption
author:Florian Kerschbaum and
Axel Schr"opfer
Optimal Average-Complexity Ideal-Security
Order-Preserving Encryption
Florian Kerschbaum
SAP
Karlsruhe, Germany
ﬂorian.kerschbaum@sap.com
Axel Schröpfer
SAP
Karlsruhe, Germany
axel.schroepfer@sap.com
ABSTRACT
Order-preserving encryption enables performing many classes
of queries – including range queries – on encrypted databases.
Popa et al. recently presented an ideal-secure order-preserving
encryption (or encoding) scheme, but their cost of inser-
tions (encryption) is very high.
In this paper we present
an also ideal-secure, but signiﬁcantly more eﬃcient order-
preserving encryption scheme. Our scheme is inspired by
Reed’s referenced work on the average height of random bi-
nary search trees. We show that our scheme improves the
average communication complexity from O(n log n) to O(n)
under uniform distribution. Our scheme also integrates ef-
ﬁciently with adjustable encryption as used in CryptDB. In
our experiments for database inserts we achieve a perfor-
mance increase of up to 81% in LANs and 95% in WANs.
Categories and Subject Descriptors
D.4.6 [Operating Systems]: Security and Protection—
Cryptographic controls; C.2.4 [Computer-Communication
Networks]: Distributed Systems—Distributed databases
Keywords
Order-Preserving Encryption; Indistinguishability; Ideal Se-
curity; Eﬃciency; Adjustable Encryption; In-Memory Col-
umn Database
1.
INTRODUCTION
Order-preserving encryption [6, 8, 9, 32] enables perform-
ing many classes of queries – including range queries – on
encrypted data without modiﬁcation of the database en-
gine. Recent results in database implementation suggest
that these queries are quite practical in terms of perfor-
mance [17, 33]. Hence, researchers have suggested a number
of order-preserving encryption schemes. Nevertheless, the
security of these schemes is still under discussion.
Boldyreva et al. provide the ﬁrst form...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Optimal Average-Complexity Ideal-Security Order-Preserving Encryption
author:Florian Kerschbaum and
Axel Schr"opfer
Optimal Average-Complexity Ideal-Security
Order-Preserving Encryption
Florian Kerschbaum
SAP
Karlsruhe, Germany
ﬂorian.kerschbaum@sap.com
Axel Schröpfer
SAP
Karlsruhe, Germany
axel.schroepfer@sap.com
ABSTRACT
Order-preserving encryption enables performing many classes
of queries – including range queries – on encrypted databases.
Popa et al. recently presented an ideal-secure order-preserving
encryption (or encoding) scheme, but their cost of inser-
tions (encryption) is very high.
In this paper we present
an also ideal-secure, but signiﬁcantly more eﬃcient order-
preserving encryption scheme. Our scheme is inspired by
Reed’s referenced work on the average height of random bi-
nary search trees. We show that our scheme improves the
average communication complexity from O(n log n) to O(n)
under uniform distribution. Our scheme also integrates ef-
ﬁciently with adjustable encryption as used in CryptDB. In
our experiments for database inserts we achieve a perfor-
mance increase of up to 81% in LANs and 95% in WANs.
Categories and Subject Descriptors
D.4.6 [Operating Systems]: Security and Protection—
Cryptographic controls; C.2.4 [Computer-Communication
Networks]: Distributed Systems—Distributed databases
Keywords
Order-Preserving Encryption; Indistinguishability; Ideal Se-
curity; Eﬃciency; Adjustable Encryption; In-Memory Col-
umn Database
1.
INTRODUCTION
Order-preserving encryption [6, 8, 9, 32] enables perform-
ing many classes of queries – including range queries – on
encrypted data without modiﬁcation of the database en-
gine. Recent results in database implementation suggest
that these queries are quite practical in terms of perfor-
mance [17, 33]. Hence, researchers have suggested a number
of order-preserving encryption schemes. Nevertheless, the
security of these schemes is still under discussion.
Boldyreva et al. provide the ﬁrst form...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:PASTA: PASsword-based Threshold Authentication
author:Shashank Agrawal and
Peihan Miao and
Payman Mohassel and
Pratyay Mukherjee
Advanced Materials Research Vols. 143-144 (2011) pp 915-919
Online available since 2010/Oct/28 at www.scientific.net
© (2011) Trans Tech Publications, Switzerland
doi:10.4028/www.scientific.net/AMR.143-144.915
All rights reserved. No part of contents of this paper may be reproduced or transmitted in any form or by any means without the written permission of TTP,
www.ttp.net. (ID: 129.93.24.73, University of Nebraska-Lincoln, Lincoln, USA-18/03/15,03:15:53)
   A New Threshold Password Authentication Scheme  Yung-Cheng Lee  Department of Security Technology and Management, WuFeng University, Chiayi, Taiwan. yclee@wfu.edu.tw Keywords: Password authentication; Threshold scheme; Secret sharing. Abstract. The well-known password authentication mechanisms are widely used in networks to protect resources from unauthorized access. The ad hoc networks, due to their dynamic and lack of network infrastructure features, require authentication schemes to ensure security. In this paper, we propose a new threshold password authentication scheme for ad hoc networks. Our scheme can be efficiently implemented in mobile devices, and can achieve mutual authentication with registered users. Introduction The ad hoc network [15], constructed by a group of mobile devices without using any network infrastructure, is suitable for military or emergency uses. Ad hoc network causes a lot of security challenges such as unauthorized access due to its flexibility and lack of secure network infrastructure. Password authentication schemes are the simplest and most convenient authentication mechanisms in network environment to protect unauthorized access. Until now, there are many schemes proposed [2–6, 8-12, 14, 17, 18]. However, due to their security shortcomings, most schemes could not be applied in ad hoc networks. In 1981, Lamport proposed the first well-known pas...


Instruction: 总结这篇安全研究的主要观点

Input:
title:PASTA: PASsword-based Threshold Authentication
author:Shashank Agrawal and
Peihan Miao and
Payman Mohassel and
Pratyay Mukherjee
Advanced Materials Research Vols. 143-144 (2011) pp 915-919
Online available since 2010/Oct/28 at www.scientific.net
© (2011) Trans Tech Publications, Switzerland
doi:10.4028/www.scientific.net/AMR.143-144.915
All rights reserved. No part of contents of this paper may be reproduced or transmitted in any form or by any means without the written permission of TTP,
www.ttp.net. (ID: 129.93.24.73, University of Nebraska-Lincoln, Lincoln, USA-18/03/15,03:15:53)
   A New Threshold Password Authentication Scheme  Yung-Cheng Lee  Department of Security Technology and Management, WuFeng University, Chiayi, Taiwan. yclee@wfu.edu.tw Keywords: Password authentication; Threshold scheme; Secret sharing. Abstract. The well-known password authentication mechanisms are widely used in networks to protect resources from unauthorized access. The ad hoc networks, due to their dynamic and lack of network infrastructure features, require authentication schemes to ensure security. In this paper, we propose a new threshold password authentication scheme for ad hoc networks. Our scheme can be efficiently implemented in mobile devices, and can achieve mutual authentication with registered users. Introduction The ad hoc network [15], constructed by a group of mobile devices without using any network infrastructure, is suitable for military or emergency uses. Ad hoc network causes a lot of security challenges such as unauthorized access due to its flexibility and lack of secure network infrastructure. Password authentication schemes are the simplest and most convenient authentication mechanisms in network environment to protect unauthorized access. Until now, there are many schemes proposed [2–6, 8-12, 14, 17, 18]. However, due to their security shortcomings, most schemes could not be applied in ad hoc networks. In 1981, Lamport proposed the first well-known pas...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Defending Against Injection Attacks Through Context-Sensitive String
Evaluation
author:Tadeusz Pietraszek and
Chris Vanden Berghe
Defending Against Injection Attacks Through
Context-Sensitive String Evaluation
Tadeusz Pietraszek1 and Chris Vanden Berghe1,2
S¨aumerstrasse 4, CH-8803 R¨uschlikon, Switzerland
2 Katholieke Universiteit Leuven,
1 IBM Zurich Research Laboratory,
Celestijnenlaan 200A, B-3001 Leuven, Belgium
{pie, vbc}@zurich.ibm.com
Abstract. Injection vulnerabilities pose a major threat to application-
level security. Some of the more common types are SQL injection, cross-
site scripting and shell injection vulnerabilities. Existing methods for
defending against injection attacks, that is, attacks exploiting these vul-
nerabilities, rely heavily on the application developers and are therefore
error-prone.
In this paper we introduce CSSE, a method to detect and prevent
injection attacks. CSSE works by addressing the root cause why such at-
tacks can succeed, namely the ad-hoc serialization of user-provided input.
It provides a platform-enforced separation of channels, using a com-
bination of assignment of metadata to user-provided input, metadata-
preserving string operations and context-sensitive string evaluation.
CSSE requires neither application developer interaction nor appli-
cation source code modiﬁcations. Since only changes to the underlying
platform are needed, it eﬀectively shifts the burden of implementing
countermeasures against injection attacks from the many application
developers to the small team of security-savvy platform developers. Our
method is eﬀective against most types of injection attacks, and we show
that it is also less error-prone than other solutions proposed so far.
We have developed a prototype CSSE implementation for PHP, a
platform that is particularly prone to these vulnerabilities. We used
our prototype with phpBB, a well-known bulletin-board application,
to validate our method. CSSE detected and prevented all the ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Defending Against Injection Attacks Through Context-Sensitive String
Evaluation
author:Tadeusz Pietraszek and
Chris Vanden Berghe
Defending Against Injection Attacks Through
Context-Sensitive String Evaluation
Tadeusz Pietraszek1 and Chris Vanden Berghe1,2
S¨aumerstrasse 4, CH-8803 R¨uschlikon, Switzerland
2 Katholieke Universiteit Leuven,
1 IBM Zurich Research Laboratory,
Celestijnenlaan 200A, B-3001 Leuven, Belgium
{pie, vbc}@zurich.ibm.com
Abstract. Injection vulnerabilities pose a major threat to application-
level security. Some of the more common types are SQL injection, cross-
site scripting and shell injection vulnerabilities. Existing methods for
defending against injection attacks, that is, attacks exploiting these vul-
nerabilities, rely heavily on the application developers and are therefore
error-prone.
In this paper we introduce CSSE, a method to detect and prevent
injection attacks. CSSE works by addressing the root cause why such at-
tacks can succeed, namely the ad-hoc serialization of user-provided input.
It provides a platform-enforced separation of channels, using a com-
bination of assignment of metadata to user-provided input, metadata-
preserving string operations and context-sensitive string evaluation.
CSSE requires neither application developer interaction nor appli-
cation source code modiﬁcations. Since only changes to the underlying
platform are needed, it eﬀectively shifts the burden of implementing
countermeasures against injection attacks from the many application
developers to the small team of security-savvy platform developers. Our
method is eﬀective against most types of injection attacks, and we show
that it is also less error-prone than other solutions proposed so far.
We have developed a prototype CSSE implementation for PHP, a
platform that is particularly prone to these vulnerabilities. We used
our prototype with phpBB, a well-known bulletin-board application,
to validate our method. CSSE detected and prevented all the ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Touching the Untouchables: Dynamic Security Analysis of the LTE
Control Plane
author:Hongil Kim and
Jiho Lee and
Eunkyu Lee and
Yongdae Kim
(cid:19)(cid:17)(cid:18)(cid:26)(cid:1)(cid:42)(cid:38)(cid:38)(cid:38)(cid:1)(cid:52)(cid:90)(cid:78)(cid:81)(cid:80)(cid:84)(cid:74)(cid:86)(cid:78)(cid:1)(cid:80)(cid:79)(cid:1)(cid:52)(cid:70)(cid:68)(cid:86)(cid:83)(cid:74)(cid:85)(cid:90)(cid:1)(cid:66)(cid:79)(cid:69)(cid:1)(cid:49)(cid:83)(cid:74)(cid:87)(cid:66)(cid:68)(cid:90)
Touching the Untouchables: Dynamic Security
Analysis of the LTE Control Plane
Hongil Kim
KAIST
Jiho Lee
KAIST
Eunkyu Lee
KAIST
Yongdae Kim
KAIST
hongilk@kaist.ac.kr
jiholee@kaist.ac.kr
ekleez@kaist.ac.kr
yongdaek@kaist.ac.kr
Abstract—This paper presents our extensive investigation
of the security aspects of control plane procedures based on
dynamic testing of the control components in operational Long
Term Evolution (LTE) networks. For dynamic testing in LTE
networks, we implemented a semi-automated testing tool, named
LTEFuzz, by using open-source LTE software over which the
user has full control. We systematically generated test cases by
deﬁning three basic security properties by closely analyzing the
standards. Based on the security property, LTEFuzz generates
and sends the test cases to a target network, and classiﬁes the
problematic behavior by only monitoring the device-side logs.
Accordingly, we uncovered 36 vulnerabilities, which have not
been disclosed previously. These ﬁndings are categorized into ﬁve
types: Improper handling of (1) unprotected initial procedure,
(2) crafted plain requests, (3) messages with invalid integrity
protection, (4) replayed messages, and (5) security procedure
bypass. We conﬁrmed those vulnerabilities by demonstrating
proof-of-concept attacks against operational LTE networks. The
impact of the attacks is to either deny LTE services to legitimate
users, spoof SMS messages, or eavesdrop/manipulate user data
trafﬁc. Precise root cause analysis and potential...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Touching the Untouchables: Dynamic Security Analysis of the LTE
Control Plane
author:Hongil Kim and
Jiho Lee and
Eunkyu Lee and
Yongdae Kim
(cid:19)(cid:17)(cid:18)(cid:26)(cid:1)(cid:42)(cid:38)(cid:38)(cid:38)(cid:1)(cid:52)(cid:90)(cid:78)(cid:81)(cid:80)(cid:84)(cid:74)(cid:86)(cid:78)(cid:1)(cid:80)(cid:79)(cid:1)(cid:52)(cid:70)(cid:68)(cid:86)(cid:83)(cid:74)(cid:85)(cid:90)(cid:1)(cid:66)(cid:79)(cid:69)(cid:1)(cid:49)(cid:83)(cid:74)(cid:87)(cid:66)(cid:68)(cid:90)
Touching the Untouchables: Dynamic Security
Analysis of the LTE Control Plane
Hongil Kim
KAIST
Jiho Lee
KAIST
Eunkyu Lee
KAIST
Yongdae Kim
KAIST
hongilk@kaist.ac.kr
jiholee@kaist.ac.kr
ekleez@kaist.ac.kr
yongdaek@kaist.ac.kr
Abstract—This paper presents our extensive investigation
of the security aspects of control plane procedures based on
dynamic testing of the control components in operational Long
Term Evolution (LTE) networks. For dynamic testing in LTE
networks, we implemented a semi-automated testing tool, named
LTEFuzz, by using open-source LTE software over which the
user has full control. We systematically generated test cases by
deﬁning three basic security properties by closely analyzing the
standards. Based on the security property, LTEFuzz generates
and sends the test cases to a target network, and classiﬁes the
problematic behavior by only monitoring the device-side logs.
Accordingly, we uncovered 36 vulnerabilities, which have not
been disclosed previously. These ﬁndings are categorized into ﬁve
types: Improper handling of (1) unprotected initial procedure,
(2) crafted plain requests, (3) messages with invalid integrity
protection, (4) replayed messages, and (5) security procedure
bypass. We conﬁrmed those vulnerabilities by demonstrating
proof-of-concept attacks against operational LTE networks. The
impact of the attacks is to either deny LTE services to legitimate
users, spoof SMS messages, or eavesdrop/manipulate user data
trafﬁc. Precise root cause analysis and potential...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:State of the Art: Automated Black-Box Web Application Vulnerability
Testing
author:Jason Bau and
Elie Bursztein and
Divij Gupta and
John C. Mitchell
2010 IEEE Symposium on Security and Privacy
State of the Art: Automated Black-Box Web Application Vulnerability Testing
Jason Bau, Elie Bursztein, Divij Gupta, John Mitchell
Stanford University
{jbau, divijg}@stanford.edu, {elie, mitchell}@cs.stanford.edu
Stanford, CA
Abstract—Black-box web application vulnerability scanners
are automated tools that probe web applications for security
vulnerabilities. In order to assess the current state of the art, we
obtained access to eight leading tools and carried out a study
of: (i) the class of vulnerabilities tested by these scanners, (ii)
their effectiveness against target vulnerabilities, and (iii) the
relevance of the target vulnerabilities to vulnerabilities found
in the wild. To conduct our study we used a custom web
application vulnerable to known and projected vulnerabilities,
and previous versions of widely used web applications con-
taining known vulnerabilities. Our results show the promise
and effectiveness of automated tools, as a group, and also
some limitations. In particular, “stored” forms of Cross Site
Scripting (XSS) and SQL Injection (SQLI) vulnerabilities are
not currently found by many tools. Because our goal is to
assess the potential of future research, not to evaluate speciﬁc
vendors, we do not report comparative data or make any
recommendations about purchase of speciﬁc tools.
Keywords-Web Application Security; Black Box Testing;
Vulnerability Detection; Security Standards Compliance;
I. INTRODUCTION
Black-box web application vulnerability scanners are au-
tomated tools that probe web applications for security vul-
nerabilities, without access to source code used to build the
applications. While there are intrinsic limitations of black-
box tools, in comparison with code walkthrough, automated
source code analysis tools, and procedures carried out ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:State of the Art: Automated Black-Box Web Application Vulnerability
Testing
author:Jason Bau and
Elie Bursztein and
Divij Gupta and
John C. Mitchell
2010 IEEE Symposium on Security and Privacy
State of the Art: Automated Black-Box Web Application Vulnerability Testing
Jason Bau, Elie Bursztein, Divij Gupta, John Mitchell
Stanford University
{jbau, divijg}@stanford.edu, {elie, mitchell}@cs.stanford.edu
Stanford, CA
Abstract—Black-box web application vulnerability scanners
are automated tools that probe web applications for security
vulnerabilities. In order to assess the current state of the art, we
obtained access to eight leading tools and carried out a study
of: (i) the class of vulnerabilities tested by these scanners, (ii)
their effectiveness against target vulnerabilities, and (iii) the
relevance of the target vulnerabilities to vulnerabilities found
in the wild. To conduct our study we used a custom web
application vulnerable to known and projected vulnerabilities,
and previous versions of widely used web applications con-
taining known vulnerabilities. Our results show the promise
and effectiveness of automated tools, as a group, and also
some limitations. In particular, “stored” forms of Cross Site
Scripting (XSS) and SQL Injection (SQLI) vulnerabilities are
not currently found by many tools. Because our goal is to
assess the potential of future research, not to evaluate speciﬁc
vendors, we do not report comparative data or make any
recommendations about purchase of speciﬁc tools.
Keywords-Web Application Security; Black Box Testing;
Vulnerability Detection; Security Standards Compliance;
I. INTRODUCTION
Black-box web application vulnerability scanners are au-
tomated tools that probe web applications for security vul-
nerabilities, without access to source code used to build the
applications. While there are intrinsic limitations of black-
box tools, in comparison with code walkthrough, automated
source code analysis tools, and procedures carried out ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Difficulties in Modeling SCADA Traffic: A Comparative Analysis
author:Rafael Ramos Regis Barbosa and
Ramin Sadre and
Aiko Pras
Diﬃculties in Modeling SCADA Traﬃc:
A Comparative Analysis
Rafael R.R. Barbosa, Ramin Sadre, and Aiko Pras
University of Twente Design and Analysis of Communication Systems (DACS)
Enschede, The Netherlands
{r.barbosa,r.sadre,a.pras}@utwente.nl
Abstract. Modern critical infrastructures, such as water distribution
and power generation, are large facilities that are distributed over large
geographical areas. Supervisory Control and Data Acquisition (SCADA)
networks are deployed to guarantee the correct operation and safety of
these infrastructures. In this paper, we describe key characteristics of
SCADA traﬃc, verifying if models developed for traﬃc in traditional
IT networks are applicable. Our results show that SCADA traﬃc largely
diﬀers from traditional IT traﬃc, more noticeably not presenting diurnal
patters or self-similar correlations in the time series.
1 Introduction
Modern critical infrastructures, such as water distribution and power generation,
are large facilities that are distributed over large geographical areas. Supervisory
Control And Data Acquisition (SCADA) networks are deployed to continuously
monitor these infrastructures in order to guarantee correct operation and safety.
Originally, SCADA networks were isolated networks running proprietary proto-
cols, but there is an increasing trend toward the usage of IP protocols and the
interconnection with other networks and even the Internet.
Intuitively, we expect SCADA to present traﬃc patterns much diﬀerent to
those of “traditional” Information Technology (IT) networks. This is due to a
number of reasons. First, SCADA networks are expected to be more stable over
time, in the sense that new nodes are not expected to join or leave frequently.
Second, traditional networks usually support a multitude of protocols, such as
HTTP, instant messaging and Voice over IP, while the num...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Difficulties in Modeling SCADA Traffic: A Comparative Analysis
author:Rafael Ramos Regis Barbosa and
Ramin Sadre and
Aiko Pras
Diﬃculties in Modeling SCADA Traﬃc:
A Comparative Analysis
Rafael R.R. Barbosa, Ramin Sadre, and Aiko Pras
University of Twente Design and Analysis of Communication Systems (DACS)
Enschede, The Netherlands
{r.barbosa,r.sadre,a.pras}@utwente.nl
Abstract. Modern critical infrastructures, such as water distribution
and power generation, are large facilities that are distributed over large
geographical areas. Supervisory Control and Data Acquisition (SCADA)
networks are deployed to guarantee the correct operation and safety of
these infrastructures. In this paper, we describe key characteristics of
SCADA traﬃc, verifying if models developed for traﬃc in traditional
IT networks are applicable. Our results show that SCADA traﬃc largely
diﬀers from traditional IT traﬃc, more noticeably not presenting diurnal
patters or self-similar correlations in the time series.
1 Introduction
Modern critical infrastructures, such as water distribution and power generation,
are large facilities that are distributed over large geographical areas. Supervisory
Control And Data Acquisition (SCADA) networks are deployed to continuously
monitor these infrastructures in order to guarantee correct operation and safety.
Originally, SCADA networks were isolated networks running proprietary proto-
cols, but there is an increasing trend toward the usage of IP protocols and the
interconnection with other networks and even the Internet.
Intuitively, we expect SCADA to present traﬃc patterns much diﬀerent to
those of “traditional” Information Technology (IT) networks. This is due to a
number of reasons. First, SCADA networks are expected to be more stable over
time, in the sense that new nodes are not expected to join or leave frequently.
Second, traditional networks usually support a multitude of protocols, such as
HTTP, instant messaging and Voice over IP, while the num...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Toward the Accurate Identification of Network Applications
author:Andrew W. Moore and
Konstantina Papagiannaki
Toward the Accurate Identiﬁcation of
Network Applications
Andrew W. Moore1,(cid:1) and Konstantina Papagiannaki2
1 University of Cambridge
andrew.moore@cl.cam.ac.uk
2 Intel Research, Cambridge
dina.papagiannaki@intel.com
Abstract. Well-known port numbers can no longer be used to reliably
identify network applications. There is a variety of new Internet appli-
cations that either do not use well-known port numbers or use other
protocols, such as HTTP, as wrappers in order to go through ﬁrewalls
without being blocked. One consequence of this is that a simple inspec-
tion of the port numbers used by ﬂows may lead to the inaccurate clas-
siﬁcation of network traﬃc. In this work, we look at these inaccuracies
in detail. Using a full payload packet trace collected from an Internet
site we attempt to identify the types of errors that may result from port-
based classiﬁcation and quantify them for the speciﬁc trace under study.
To address this question we devise a classiﬁcation methodology that re-
lies on the full packet payload. We describe the building blocks of this
methodology and elaborate on the complications that arise in that con-
text. A classiﬁcation technique approaching 100% accuracy proves to be
a labor-intensive process that needs to test ﬂow-characteristics against
multiple classiﬁcation criteria in order to gain suﬃcient conﬁdence in
the nature of the causal application. Nevertheless, the beneﬁts gained
from a content-based classiﬁcation approach are evident. We are capable
of accurately classifying what would be otherwise classiﬁed as unknown
as well as identifying traﬃc ﬂows that could otherwise be classiﬁed in-
correctly. Our work opens up multiple research issues that we intend to
address in future work.
1
Introduction
Network traﬃc monitoring has attracted a lot of interest in the recent past.
One of the main operations performed within ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Toward the Accurate Identification of Network Applications
author:Andrew W. Moore and
Konstantina Papagiannaki
Toward the Accurate Identiﬁcation of
Network Applications
Andrew W. Moore1,(cid:1) and Konstantina Papagiannaki2
1 University of Cambridge
andrew.moore@cl.cam.ac.uk
2 Intel Research, Cambridge
dina.papagiannaki@intel.com
Abstract. Well-known port numbers can no longer be used to reliably
identify network applications. There is a variety of new Internet appli-
cations that either do not use well-known port numbers or use other
protocols, such as HTTP, as wrappers in order to go through ﬁrewalls
without being blocked. One consequence of this is that a simple inspec-
tion of the port numbers used by ﬂows may lead to the inaccurate clas-
siﬁcation of network traﬃc. In this work, we look at these inaccuracies
in detail. Using a full payload packet trace collected from an Internet
site we attempt to identify the types of errors that may result from port-
based classiﬁcation and quantify them for the speciﬁc trace under study.
To address this question we devise a classiﬁcation methodology that re-
lies on the full packet payload. We describe the building blocks of this
methodology and elaborate on the complications that arise in that con-
text. A classiﬁcation technique approaching 100% accuracy proves to be
a labor-intensive process that needs to test ﬂow-characteristics against
multiple classiﬁcation criteria in order to gain suﬃcient conﬁdence in
the nature of the causal application. Nevertheless, the beneﬁts gained
from a content-based classiﬁcation approach are evident. We are capable
of accurately classifying what would be otherwise classiﬁed as unknown
as well as identifying traﬃc ﬂows that could otherwise be classiﬁed in-
correctly. Our work opens up multiple research issues that we intend to
address in future work.
1
Introduction
Network traﬃc monitoring has attracted a lot of interest in the recent past.
One of the main operations performed within ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Swiped: Analyzing Ground-truth Data of a Marketplace for Stolen Debit
and Credit Cards
author:Maxwell Aliapoulios and
Cameron Ballard and
Rasika Bhalerao and
Tobias Lauinger and
Damon McCoy
Swiped: Analyzing Ground-truth Data of a
Marketplace for Stolen Debit and Credit Cards
Maxwell Aliapoulios, Cameron Ballard, Rasika Bhalerao, Tobias Lauinger, and
Damon McCoy, New York University
https://www.usenix.org/conference/usenixsecurity21/presentation/aliapoulios
This paper is included in the Proceedings of the 30th USENIX Security Symposium.August 11–13, 2021978-1-939133-24-3Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX.Swiped: Analyzing Ground-truth Data of a Marketplace
for Stolen Debit and Credit Cards
Maxwell Aliapoulios, Cameron Ballard, Rasika Bhalerao, Tobias Lauinger, Damon McCoy
New York University
Abstract
This paper presents the ﬁrst empirical study of ground-truth
data from a major underground shop selling stolen credit
and debit cards. To date, there is little quantitative knowledge
about how this segment of the underground economy operates,
despite it causing fraud losses estimated at billions of dollars
a year. Our analysis of four years of leaked transactional
data allows us to characterize this shop’s business model,
sellers, customers, and ﬁnances. The shop earned close to
$104 M in gross revenue, and listed over 19 M unique card
numbers for sale. Around 97% of the inventory was stolen
magnetic stripe data, commonly used to produce counterfeit
cards for in-person payments. Perhaps surprisingly, customers
purchased only 40% of this inventory. In contrast, the shop
sold 83% of its card-not-present inventory, used for online
fraud, which appeared to be in short supply. Demand and
pricing were not uniform, as buyers appeared to perceive
some banks as having weaker countermeasures against fraud.
Even multiple years into the U.S. EMV chip deployment, the
supply of stolen magnetic stripe data continued to ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Swiped: Analyzing Ground-truth Data of a Marketplace for Stolen Debit
and Credit Cards
author:Maxwell Aliapoulios and
Cameron Ballard and
Rasika Bhalerao and
Tobias Lauinger and
Damon McCoy
Swiped: Analyzing Ground-truth Data of a
Marketplace for Stolen Debit and Credit Cards
Maxwell Aliapoulios, Cameron Ballard, Rasika Bhalerao, Tobias Lauinger, and
Damon McCoy, New York University
https://www.usenix.org/conference/usenixsecurity21/presentation/aliapoulios
This paper is included in the Proceedings of the 30th USENIX Security Symposium.August 11–13, 2021978-1-939133-24-3Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX.Swiped: Analyzing Ground-truth Data of a Marketplace
for Stolen Debit and Credit Cards
Maxwell Aliapoulios, Cameron Ballard, Rasika Bhalerao, Tobias Lauinger, Damon McCoy
New York University
Abstract
This paper presents the ﬁrst empirical study of ground-truth
data from a major underground shop selling stolen credit
and debit cards. To date, there is little quantitative knowledge
about how this segment of the underground economy operates,
despite it causing fraud losses estimated at billions of dollars
a year. Our analysis of four years of leaked transactional
data allows us to characterize this shop’s business model,
sellers, customers, and ﬁnances. The shop earned close to
$104 M in gross revenue, and listed over 19 M unique card
numbers for sale. Around 97% of the inventory was stolen
magnetic stripe data, commonly used to produce counterfeit
cards for in-person payments. Perhaps surprisingly, customers
purchased only 40% of this inventory. In contrast, the shop
sold 83% of its card-not-present inventory, used for online
fraud, which appeared to be in short supply. Demand and
pricing were not uniform, as buyers appeared to perceive
some banks as having weaker countermeasures against fraud.
Even multiple years into the U.S. EMV chip deployment, the
supply of stolen magnetic stripe data continued to ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Poster: Finding JavaScript Name Conflicts on the Web
author:Mingxue Zhang and
Wei Meng and
Yi Wang
POSTER: Finding JavaScript Name Conflicts on the Web
Mingxue Zhang
Chinese University of Hong Kong
mxzhang@cse.cuhk.edu.hk
Wei Meng
wei@cse.cuhk.edu.hk
Chinese University of Hong Kong
Southern University of Science and
Yi Wang
Technology
wy@ieee.org
ABSTRACT
Including JavaScript code from many different hosts is a popular
practice in developing web applications. For example, to include a
social plugin like the Facebook Like button, a web developer needs
to only include a script from facebook.net in her/his web page.
However, in a web browser, all the identifiers (i.e., variable names
and function names) in scripts loaded in the same frame share
a single global namespace. Therefore, a script can overwrite any
of the global variables and/or global functions defined in another
script, causing unexpected behavior.
In this work, we develop a browser-based dynamic analysis
framework, that monitors and records any writes to JavaScript
global variables and global functions. Our tool is able to cover
all the code executed in the run time. We detected 778 conflicts
across the Alexa top 1K websites. Our results show that global name
conflicts can indeed expose web applications to security risks.
CCS CONCEPTS
• Security and privacy → Browser security; Web application
security.
KEYWORDS
JavaScript; Name conflicts; Web applications
ACM Reference Format:
Mingxue Zhang, Wei Meng, and Yi Wang. 2019. POSTER: Finding JavaScript
Name Conflicts on the Web. In 2019 ACM SIGSAC Conference on Computer
and Communications Security (CCS ’19), November 11–15, 2019, London,
United Kingdom. ACM, New York, NY, USA, 3 pages. https://doi.org/10.1145/
3319535.3363268
1 INTRODUCTION
It is very common to separate code of different functionalities into
multiple JavaScript files in today’s web applications. Including
JavaScript code from other hosts is also a very popular practice in
developing web ap...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Poster: Finding JavaScript Name Conflicts on the Web
author:Mingxue Zhang and
Wei Meng and
Yi Wang
POSTER: Finding JavaScript Name Conflicts on the Web
Mingxue Zhang
Chinese University of Hong Kong
mxzhang@cse.cuhk.edu.hk
Wei Meng
wei@cse.cuhk.edu.hk
Chinese University of Hong Kong
Southern University of Science and
Yi Wang
Technology
wy@ieee.org
ABSTRACT
Including JavaScript code from many different hosts is a popular
practice in developing web applications. For example, to include a
social plugin like the Facebook Like button, a web developer needs
to only include a script from facebook.net in her/his web page.
However, in a web browser, all the identifiers (i.e., variable names
and function names) in scripts loaded in the same frame share
a single global namespace. Therefore, a script can overwrite any
of the global variables and/or global functions defined in another
script, causing unexpected behavior.
In this work, we develop a browser-based dynamic analysis
framework, that monitors and records any writes to JavaScript
global variables and global functions. Our tool is able to cover
all the code executed in the run time. We detected 778 conflicts
across the Alexa top 1K websites. Our results show that global name
conflicts can indeed expose web applications to security risks.
CCS CONCEPTS
• Security and privacy → Browser security; Web application
security.
KEYWORDS
JavaScript; Name conflicts; Web applications
ACM Reference Format:
Mingxue Zhang, Wei Meng, and Yi Wang. 2019. POSTER: Finding JavaScript
Name Conflicts on the Web. In 2019 ACM SIGSAC Conference on Computer
and Communications Security (CCS ’19), November 11–15, 2019, London,
United Kingdom. ACM, New York, NY, USA, 3 pages. https://doi.org/10.1145/
3319535.3363268
1 INTRODUCTION
It is very common to separate code of different functionalities into
multiple JavaScript files in today’s web applications. Including
JavaScript code from other hosts is also a very popular practice in
developing web ap...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A smart pre-classifier to reduce power consumption of TCAMs for multi-dimensional
packet classification
author:Yadi Ma and
Suman Banerjee
A Smart Pre-Classiﬁer to Reduce Power Consumption of
TCAMs for Multi-dimensional Packet Classiﬁcation
Yadi Ma
University of Wisconsin
Madison, WI, USA
yadi@cs.wisc.edu
Suman Banerjee
University of Wisconsin
Madison, WI, USA
suman@cs.wisc.edu
ABSTRACT
Ternary Content-Addressable Memories (TCAMs) has become the
industrial standard for high-throughput packet classiﬁcation. How-
ever, one major drawback of TCAMs is their high power consump-
tion, which is becoming critical with the boom of data centers, the
growing classiﬁers and the deployment of IPv6. In this paper, we
propose a practical and efﬁcient solution which introduces a smart
pre-classiﬁer to reduce power consumption of TCAMs for multi-
dimensional packet classiﬁcation. We reduce the dimension of the
problem through the pre-classiﬁer which pre-classiﬁes a packet on
two header ﬁelds, source and destination IP addresses. We then re-
turn to the high dimension problem where only a small portion of a
TCAM is activated and searched for a given packet. The smart pre-
classiﬁer is built in a way such that a given packet matches at most
one entry in the pre-classiﬁer, which make commodity TCAMs
sufﬁcient to implement the pre-classiﬁer. Furthermore, each rule
is stored only once in one of the TCAM blocks, which avoids
rule replication. The presented solution uses commodity TCAMs,
and the proposed algorithms are easy to implement. Our scheme
achieves a median power reduction of 91% and an average power
reduction of 88% on real and synthetic classiﬁers respectively.
Categories and Subject Descriptors
C.2.6 [Computer-Communication Networks]: Internetworking—
Routers
Keywords
Packet classiﬁcation, SmartPC, power consumption
1.
INTRODUCTION
Given a set of strictly ordered rules in a classiﬁer, the packet
classiﬁcation problem is to ﬁnd out the ﬁrst (highest priority) rule
that matc...


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Characterizing residential broadband networks
author:Marcel Dischinger and
Andreas Haeberlen and
P. Krishna Gummadi and
Stefan Saroiu
Characterizing Residential Broadband Networks
Marcel Dischinger
MPI for Software Systems
mdischin@mpi-sws.mpg.de
Krishna P. Gummadi
MPI for Software Systems
gummadi@mpi-sws.mpg.de
A large and rapidly growing proportion of users connect to
the Internet via residential broadband networks such as Dig-
ital Subscriber Lines (DSL) and cable. Residential networks
are often the bottleneck in the last mile of today’s Internet.
Their characteristics critically aﬀect Internet applications,
including voice-over-IP, online games, and peer-to-peer con-
tent sharing/delivery systems. However, to date, few studies
have investigated commercial broadband deployments, and
rigorous measurement data that characterize these networks
at scale are lacking.
In this paper, we present the ﬁrst large-scale measurement
study of major cable and DSL providers in North America
and Europe. We describe and evaluate the measurement
tools we developed for this purpose. Our study character-
izes several properties of broadband networks, including link
capacities, packet round-trip times and jitter, packet loss
rates, queue lengths, and queue drop policies. Our analysis
reveals important ways in which residential networks diﬀer
from how the Internet is conventionally thought to operate.
We also discuss the implications of our ﬁndings for many
emerging protocols and systems, including delay-based con-
gestion control (e.g., PCP) and network coordinate systems
(e.g., Vivaldi).
Systems Organization]:
Categories and Subject Descriptors
C.2.2 [Computer Systems Organization]: Computer-
Communication Networks—Network Operations; C.2.5
[Computer
Computer-
Communication Networks—Local and Wide-Area Networks;
C.4 [Computer Systems Organization]: Performance of
Systems
General Terms
Measurement, Performance, Experimentation
Keywords
Broadband access networks, DSL, cable, netw...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Characterizing residential broadband networks
author:Marcel Dischinger and
Andreas Haeberlen and
P. Krishna Gummadi and
Stefan Saroiu
Characterizing Residential Broadband Networks
Marcel Dischinger
MPI for Software Systems
mdischin@mpi-sws.mpg.de
Krishna P. Gummadi
MPI for Software Systems
gummadi@mpi-sws.mpg.de
A large and rapidly growing proportion of users connect to
the Internet via residential broadband networks such as Dig-
ital Subscriber Lines (DSL) and cable. Residential networks
are often the bottleneck in the last mile of today’s Internet.
Their characteristics critically aﬀect Internet applications,
including voice-over-IP, online games, and peer-to-peer con-
tent sharing/delivery systems. However, to date, few studies
have investigated commercial broadband deployments, and
rigorous measurement data that characterize these networks
at scale are lacking.
In this paper, we present the ﬁrst large-scale measurement
study of major cable and DSL providers in North America
and Europe. We describe and evaluate the measurement
tools we developed for this purpose. Our study character-
izes several properties of broadband networks, including link
capacities, packet round-trip times and jitter, packet loss
rates, queue lengths, and queue drop policies. Our analysis
reveals important ways in which residential networks diﬀer
from how the Internet is conventionally thought to operate.
We also discuss the implications of our ﬁndings for many
emerging protocols and systems, including delay-based con-
gestion control (e.g., PCP) and network coordinate systems
(e.g., Vivaldi).
Systems Organization]:
Categories and Subject Descriptors
C.2.2 [Computer Systems Organization]: Computer-
Communication Networks—Network Operations; C.2.5
[Computer
Computer-
Communication Networks—Local and Wide-Area Networks;
C.4 [Computer Systems Organization]: Performance of
Systems
General Terms
Measurement, Performance, Experimentation
Keywords
Broadband access networks, DSL, cable, netw...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Server Siblings: Identifying Shared IPv4/IPv6 Infrastructure Via Active
Fingerprinting
author:Robert Beverly and
Arthur W. Berger
Server Siblings: Identifying Shared IPv4/IPv6
Infrastructure Via Active Fingerprinting
Robert Beverly1(B) and Arthur Berger2
1 Naval Postgraduate School, Monterey, CA, USA
2 MIT CSAIL/Akamai, Cambridge, MA, USA
rbeverly@nps.edu
awberger@csail.mit.edu
Abstract. We present, validate, and apply an active measurement tech-
nique that ascertains whether candidate IPv4 and IPv6 server addresses
are “siblings,” i.e., assigned to the same physical machine. In contrast
to prior eﬀorts limited to passive monitoring, opportunistic measure-
ments, or end-client populations, we propose an active methodology that
generalizes to all TCP-reachable devices, including servers. Our method
extends prior device ﬁngerprinting techniques to improve their feasibil-
ity in modern environments, and uses them to support measurement-
based detection of sibling interfaces. We validate our technique against
a diverse set of 61 web servers with known sibling addresses and ﬁnd it
to be over 97 % accurate with 99 % precision. Finally, we apply the tech-
nique to characterize the top ∼6,400 Alexa IPv6-capable web domains,
and discover that a DNS name in common does not imply that the cor-
responding IPv4 and IPv6 addresses are on the same machine, network,
or even autonomous system. Understanding sibling and non-sibling rela-
tionships gives insight not only into IPv6 deployment and evolution, but
also helps characterize the potential for correlated failures and suscepti-
bility to certain attacks.
1 Introduction
While signiﬁcant prior research has characterized the evolution, routing, and
performance of IPv6 [5,6,15], less attention has been given to understanding
whether IPv6 infrastructure is being deployed using separate hardware or by
adding IPv6 to existing machines. I.e., are providers using separate IPv4 and
IPv6 servers to host the same web content, or usin...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Server Siblings: Identifying Shared IPv4/IPv6 Infrastructure Via Active
Fingerprinting
author:Robert Beverly and
Arthur W. Berger
Server Siblings: Identifying Shared IPv4/IPv6
Infrastructure Via Active Fingerprinting
Robert Beverly1(B) and Arthur Berger2
1 Naval Postgraduate School, Monterey, CA, USA
2 MIT CSAIL/Akamai, Cambridge, MA, USA
rbeverly@nps.edu
awberger@csail.mit.edu
Abstract. We present, validate, and apply an active measurement tech-
nique that ascertains whether candidate IPv4 and IPv6 server addresses
are “siblings,” i.e., assigned to the same physical machine. In contrast
to prior eﬀorts limited to passive monitoring, opportunistic measure-
ments, or end-client populations, we propose an active methodology that
generalizes to all TCP-reachable devices, including servers. Our method
extends prior device ﬁngerprinting techniques to improve their feasibil-
ity in modern environments, and uses them to support measurement-
based detection of sibling interfaces. We validate our technique against
a diverse set of 61 web servers with known sibling addresses and ﬁnd it
to be over 97 % accurate with 99 % precision. Finally, we apply the tech-
nique to characterize the top ∼6,400 Alexa IPv6-capable web domains,
and discover that a DNS name in common does not imply that the cor-
responding IPv4 and IPv6 addresses are on the same machine, network,
or even autonomous system. Understanding sibling and non-sibling rela-
tionships gives insight not only into IPv6 deployment and evolution, but
also helps characterize the potential for correlated failures and suscepti-
bility to certain attacks.
1 Introduction
While signiﬁcant prior research has characterized the evolution, routing, and
performance of IPv6 [5,6,15], less attention has been given to understanding
whether IPv6 infrastructure is being deployed using separate hardware or by
adding IPv6 to existing machines. I.e., are providers using separate IPv4 and
IPv6 servers to host the same web content, or usin...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:StrongChain: Transparent and Collaborative Proof-of-Work Consensus
author:Pawel Szalachowski and
Dani"el Reijsbergen and
Ivan Homoliak and
Siwei Sun
StrongChain: Transparent and Collaborative
Proof-of-Work Consensus
Pawel Szalachowski, Daniël Reijsbergen, and Ivan Homoliak, Singapore University of
Technology and Design (SUTD); Siwei Sun, Institute of Information Engineering and DCS
Center, Chinese Academy of Sciences
https://www.usenix.org/conference/usenixsecurity19/presentation/szalachowski
This paper is included in the Proceedings of the 28th USENIX Security Symposium.August 14–16, 2019 • Santa Clara, CA, USA978-1-939133-06-9Open access to the Proceedings of the 28th USENIX Security Symposium is sponsored by USENIX.StrongChain: Transparent and Collaborative Proof-of-Work Consensus
Pawel Szalachowski1
Dani¨el Reijsbergen1
Ivan Homoliak1
Siwei Sun2,∗
1Singapore University of Technology and Design (SUTD)
2Institute of Information Engineering and DCS Center, Chinese Academy of Sciences
Abstract
Bitcoin is the most successful cryptocurrency so far. This
is mainly due to its novel consensus algorithm, which is
based on proof-of-work combined with a cryptographically-
protected data structure and a rewarding scheme that incen-
tivizes nodes to participate. However, despite its unprece-
dented success Bitcoin suffers from many inefﬁciencies. For
instance, Bitcoin’s consensus mechanism has been proved to
be incentive-incompatible, its high reward variance causes
centralization, and its hardcoded deﬂation raises questions
about its long-term sustainability.
In this work, we revise the Bitcoin consensus mechanism
by proposing StrongChain, a scheme that introduces trans-
parency and incentivizes participants to collaborate rather
than to compete. The core design of our protocol is to
reﬂect and utilize the computing power aggregated on the
blockchain which is invisible and “wasted” in Bitcoin today.
Introducing relatively easy, although important changes to
Bi...


Instruction: 总结这篇安全研究的主要观点

Input:
title:StrongChain: Transparent and Collaborative Proof-of-Work Consensus
author:Pawel Szalachowski and
Dani"el Reijsbergen and
Ivan Homoliak and
Siwei Sun
StrongChain: Transparent and Collaborative
Proof-of-Work Consensus
Pawel Szalachowski, Daniël Reijsbergen, and Ivan Homoliak, Singapore University of
Technology and Design (SUTD); Siwei Sun, Institute of Information Engineering and DCS
Center, Chinese Academy of Sciences
https://www.usenix.org/conference/usenixsecurity19/presentation/szalachowski
This paper is included in the Proceedings of the 28th USENIX Security Symposium.August 14–16, 2019 • Santa Clara, CA, USA978-1-939133-06-9Open access to the Proceedings of the 28th USENIX Security Symposium is sponsored by USENIX.StrongChain: Transparent and Collaborative Proof-of-Work Consensus
Pawel Szalachowski1
Dani¨el Reijsbergen1
Ivan Homoliak1
Siwei Sun2,∗
1Singapore University of Technology and Design (SUTD)
2Institute of Information Engineering and DCS Center, Chinese Academy of Sciences
Abstract
Bitcoin is the most successful cryptocurrency so far. This
is mainly due to its novel consensus algorithm, which is
based on proof-of-work combined with a cryptographically-
protected data structure and a rewarding scheme that incen-
tivizes nodes to participate. However, despite its unprece-
dented success Bitcoin suffers from many inefﬁciencies. For
instance, Bitcoin’s consensus mechanism has been proved to
be incentive-incompatible, its high reward variance causes
centralization, and its hardcoded deﬂation raises questions
about its long-term sustainability.
In this work, we revise the Bitcoin consensus mechanism
by proposing StrongChain, a scheme that introduces trans-
parency and incentivizes participants to collaborate rather
than to compete. The core design of our protocol is to
reﬂect and utilize the computing power aggregated on the
blockchain which is invisible and “wasted” in Bitcoin today.
Introducing relatively easy, although important changes to
Bi...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Traffic Behaviour Characterization Using NetMate
author:Annie De Montigny-Leboeuf and
Mathieu Couture and
Fr'ed'eric Massicotte
Traffic Behaviour Characterization Using NetMate
Annie De Montigny-Leboeuf, Mathieu Couture, and Frederic Massicotte
Communications Research Centre Canada (CRC) , Ottawa, ON, Canada
{annie.demontigny-leboeuf, mathieu.couture,
frederic.massicotte}@crc.gc.ca
Abstract. Previous studies have shown the feasibility of deriving simple indica-
tors of file transfers, human-interactivity, and other important behavioural char-
acteristics. We are proposing a practical implementation and use of such indica-
tors with NetMate. In its current state as a work in progress, our extended ver-
sion  of  NetMate  will  already  be  of  interest  to  network  security  practitioners
conducting incident analysis.  The tool can be used to post-process traffic traces
containing suspicious flows in order to obtain a behavioural description of the
incident  and  surrounding  traffic  activities.  With  further  development,  the  ap-
proach has great potential for other use cases such as intrusion detection, insider
threat detection, and traffic classification.
The majority of current network  monitoring tools rely on  well-known port numbers
and/or payload analysis to identify the network applications. While payload analysis
is more reliable than port numbers, decoding is not always possible due to encryption
or obfuscation, for instance.
Previous research studies have shown that classifying network traffic according to
flow  behaviour  is  feasible  and  promising  [1][2][3][4].    Despite  relevant  studies,  we
are not aware of traffic characterization solutions of this type being used in practice
by network security professionals.
Our  proposed  implementation  is  designed  with  practitioners  in  mind.  Installation
and  use  are  simple  and  similar  to  other  common  packet  processing  tools  such  as
tcpdump and ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Traffic Behaviour Characterization Using NetMate
author:Annie De Montigny-Leboeuf and
Mathieu Couture and
Fr'ed'eric Massicotte
Traffic Behaviour Characterization Using NetMate
Annie De Montigny-Leboeuf, Mathieu Couture, and Frederic Massicotte
Communications Research Centre Canada (CRC) , Ottawa, ON, Canada
{annie.demontigny-leboeuf, mathieu.couture,
frederic.massicotte}@crc.gc.ca
Abstract. Previous studies have shown the feasibility of deriving simple indica-
tors of file transfers, human-interactivity, and other important behavioural char-
acteristics. We are proposing a practical implementation and use of such indica-
tors with NetMate. In its current state as a work in progress, our extended ver-
sion  of  NetMate  will  already  be  of  interest  to  network  security  practitioners
conducting incident analysis.  The tool can be used to post-process traffic traces
containing suspicious flows in order to obtain a behavioural description of the
incident  and  surrounding  traffic  activities.  With  further  development,  the  ap-
proach has great potential for other use cases such as intrusion detection, insider
threat detection, and traffic classification.
The majority of current network  monitoring tools rely on  well-known port numbers
and/or payload analysis to identify the network applications. While payload analysis
is more reliable than port numbers, decoding is not always possible due to encryption
or obfuscation, for instance.
Previous research studies have shown that classifying network traffic according to
flow  behaviour  is  feasible  and  promising  [1][2][3][4].    Despite  relevant  studies,  we
are not aware of traffic characterization solutions of this type being used in practice
by network security professionals.
Our  proposed  implementation  is  designed  with  practitioners  in  mind.  Installation
and  use  are  simple  and  similar  to  other  common  packet  processing  tools  such  as
tcpdump and ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Towards Implicit Visual Memory-Based Authentication
author:Claude Castelluccia and
Markus D"urmuth and
Maximilian Golla and
Fatma Deniz
Towards Implicit Visual Memory-Based
Authentication
Claude Castelluccia
Inria Grenoble
claude.castelluccia@inria.fr
Markus D¨urmuth and Maximilian Golla
{markus.duermuth,maximilian.golla}@rub.de
Ruhr-University Bochum
Fatma Deniz
University of California, Berkeley
fatma@berkeley.edu
Abstract—Selecting and remembering secure passwords puts
a high cognitive burden on the user, which has adverse effects
on usability and security. Authentication schemes based on
implicit memory can relieve the user of the burden of actively
remembering a secure password. In this paper, we propose a
new authentication scheme (MooneyAuth) that relies on implicitly
remembering the content of previously seen Mooney images.
These images are thresholded two-tone images derived from
images containing single objects. Our scheme has two phases:
In the enrollment phase, a user is presented with Mooney images,
their corresponding original images, and labels. This creates an
implicit link between the Mooney image and the object in the
user’s memory that serves as the authentication secret. In the
authentication phase, the user has to label a set of Mooney images,
a task that gets performed with substantially fewer mistakes if
the images have been seen in the enrollment phase. We applied
an information-theoretical approach to compute the eligibility of
the user, based on which images were labeled correctly. This new
dynamic scoring is substantially better than previously proposed
static scoring by considering the surprisal of the observed events.
We built a prototype and performed three experiments with
230 and 70 participants over the course of 264 and 21 days,
respectively. We show that MooneyAuth outperforms current
implicit memory-based schemes, and demonstrates a promising
new approach for fallback authentication procedures on the Web.
I.
INTRODUCTIO...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Towards Implicit Visual Memory-Based Authentication
author:Claude Castelluccia and
Markus D"urmuth and
Maximilian Golla and
Fatma Deniz
Towards Implicit Visual Memory-Based
Authentication
Claude Castelluccia
Inria Grenoble
claude.castelluccia@inria.fr
Markus D¨urmuth and Maximilian Golla
{markus.duermuth,maximilian.golla}@rub.de
Ruhr-University Bochum
Fatma Deniz
University of California, Berkeley
fatma@berkeley.edu
Abstract—Selecting and remembering secure passwords puts
a high cognitive burden on the user, which has adverse effects
on usability and security. Authentication schemes based on
implicit memory can relieve the user of the burden of actively
remembering a secure password. In this paper, we propose a
new authentication scheme (MooneyAuth) that relies on implicitly
remembering the content of previously seen Mooney images.
These images are thresholded two-tone images derived from
images containing single objects. Our scheme has two phases:
In the enrollment phase, a user is presented with Mooney images,
their corresponding original images, and labels. This creates an
implicit link between the Mooney image and the object in the
user’s memory that serves as the authentication secret. In the
authentication phase, the user has to label a set of Mooney images,
a task that gets performed with substantially fewer mistakes if
the images have been seen in the enrollment phase. We applied
an information-theoretical approach to compute the eligibility of
the user, based on which images were labeled correctly. This new
dynamic scoring is substantially better than previously proposed
static scoring by considering the surprisal of the observed events.
We built a prototype and performed three experiments with
230 and 70 participants over the course of 264 and 21 days,
respectively. We show that MooneyAuth outperforms current
implicit memory-based schemes, and demonstrates a promising
new approach for fallback authentication procedures on the Web.
I.
INTRODUCTIO...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。