Instruction: 总结这篇安全研究的主要观点

Input:
title:Enhancing DNS Resilience against Denial of Service Attacks
author:Vasileios Pappas and
Daniel Massey and
Lixia Zhang
Enhancing DNS Resilience against Denial of Service Attacks
Vasileios Pappas
T.J. Watson Center
IBM Research
vpappas@us.ibm.com
Dan Massey
Lixia Zhang
Computer Science Department
Computer Science Department
Colorado State University
massey@cs.colostate.edu
UCLA
lixia@cs.ucla.edu
Abstract
The Domain Name System (DNS) is a critical Internet
infrastructure that provides name to address mapping ser-
vices. In the past few years, distributed denial of service
(DDoS) attacks have targeted the DNS infrastructure and
threaten to disrupt this critical service. In this paper we
show that the existing DNS can gain signiﬁcant resilience
against DDoS attacks through a simple change to the cur-
rent DNS operations, by setting longer time-to-live values
for a special class of DNS resource records, the infras-
tructure records. These records are used to navigate the
DNS hierarchy and change infrequently. Furthermore, in
combination with a set of simple and incrementally deploy-
able record renewal policies, the DNS service availabil-
ity can be improved by one order of magnitude. Our ap-
proach requires neither additional physical resources nor
any change to the existing DNS design. We evaluate the
effectiveness of our proposed enhancement by using DNS
traces collected from multiple locations.
Keywords: DDoS, DNS, resilience, caching
1 Introduction
The Domain Name System (DNS) [16] provides name
services for the Internet. It maps hostnames to IP addresses
and also provides services for a growing number of other
applications, such as mapping IP addresses to geographic
locations or directory services for legacy telephony appli-
cations. Furthermore, protocols such as SMTP and SIP de-
pend on the DNS in order to route messages through appro-
priate application level gateways. As a result, the availabil-
ity of the DNS can affect the availability of a large number
o...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Attacking OpenSSL Implementation of ECDSA with a Few Signatures
author:Shuqin Fan and
Wenbo Wang and
Qingfeng Cheng
Attacking OpenSSL Implementation of ECDSA with a Few
Signatures
State Key Laboratory of
Luoyang University of Foreign
School of Computer Science
Wenbo Wang
Qingfeng Cheng
Shuqin Fan
Cryptology
P.O. Box 5159
Beijing, 100878, P.R.China
fansq@sklc.org
Languages
Luoyang, Henan, P.R.China
&
State Key Laboratory of
Cryptology
P.O. Box 5159
and Technology
Xidian University
Xi’an, Shanxi, P.R.China
&
Luoyang University of Foreign
Languages
Beijing, 100878,P.R.China
wangwenbo0305@-
Luoyang, Henan, P.R.China
qingfengc2008@sina.com
sina.com
ABSTRACT
In this work, we give a lattice attack on the ECDSA imple-
mentation in the latest version of OpenSSL, which imple-
ment the scalar multiplication by windowed Non-Adjacent
Form method. We propose a totally di(cid:11)erent but more ef-
(cid:12)cient method of extracting and utilizing information from
the side-channel results, remarkably improving the previous
attacks. First, we develop a new e(cid:14)cient method, which can
extract almost all information from the side-channel results,
obtaining 105.8 bits of information per signature on average
for 256-bit ECDSA. Then in order to make the utmost of our
extracted information, we translate the problem of recover-
ing secret key to the Extended Hidden Number Problem,
which can be solved by lattice reduction algorithms. Final-
ly, we introduce the methods of elimination, merging, most
signi(cid:12)cant digit recovering and enumeration to improve the
attack. Our attack is mounted to the secp256k1 curve, and
the result shows that only 4 signatures would be enough to
recover the secret key if the Flush+Reload attack is im-
plemented perfectly without any error,which is much better
than the best known result needing at least 13 signatures.
CCS Concepts
•Security and privacy → Digital signatures; Crypt-
analysis and other attacks; Side-channel analysis and
countermeasures...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Attacking OpenSSL Implementation of ECDSA with a Few Signatures
author:Shuqin Fan and
Wenbo Wang and
Qingfeng Cheng
Attacking OpenSSL Implementation of ECDSA with a Few
Signatures
State Key Laboratory of
Luoyang University of Foreign
School of Computer Science
Wenbo Wang
Qingfeng Cheng
Shuqin Fan
Cryptology
P.O. Box 5159
Beijing, 100878, P.R.China
fansq@sklc.org
Languages
Luoyang, Henan, P.R.China
&
State Key Laboratory of
Cryptology
P.O. Box 5159
and Technology
Xidian University
Xi’an, Shanxi, P.R.China
&
Luoyang University of Foreign
Languages
Beijing, 100878,P.R.China
wangwenbo0305@-
Luoyang, Henan, P.R.China
qingfengc2008@sina.com
sina.com
ABSTRACT
In this work, we give a lattice attack on the ECDSA imple-
mentation in the latest version of OpenSSL, which imple-
ment the scalar multiplication by windowed Non-Adjacent
Form method. We propose a totally di(cid:11)erent but more ef-
(cid:12)cient method of extracting and utilizing information from
the side-channel results, remarkably improving the previous
attacks. First, we develop a new e(cid:14)cient method, which can
extract almost all information from the side-channel results,
obtaining 105.8 bits of information per signature on average
for 256-bit ECDSA. Then in order to make the utmost of our
extracted information, we translate the problem of recover-
ing secret key to the Extended Hidden Number Problem,
which can be solved by lattice reduction algorithms. Final-
ly, we introduce the methods of elimination, merging, most
signi(cid:12)cant digit recovering and enumeration to improve the
attack. Our attack is mounted to the secp256k1 curve, and
the result shows that only 4 signatures would be enough to
recover the secret key if the Flush+Reload attack is im-
plemented perfectly without any error,which is much better
than the best known result needing at least 13 signatures.
CCS Concepts
•Security and privacy → Digital signatures; Crypt-
analysis and other attacks; Side-channel analysis and
countermeasures...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Network dialog minimization and network dialog diffing: two novel
primitives for network security applications
author:M. Zubair Rafique and
Juan Caballero and
Christophe Huygens and
Wouter Joosen
Network Dialog Minimization and Network Dialog Difﬁng:
Two Novel Primitives for Network Security Applications
M. Zubair Raﬁque
iMinds-DistriNet, KU Leuven
3001 Leuven, Belgium
zubair.raﬁque@cs.kuleuven.be
Christophe Huygens
iMinds-DistriNet, KU Leuven
3001 Leuven, Belgium
christophe.huygens@cs.kuleuven.be
Juan Caballero
IMDEA Software Institute
Madrid, Spain
juan.caballero@imdea.org
Wouter Joosen
iMinds-DistriNet, KU Leuven
3001 Leuven, Belgium
wouter.joosen@cs.kuleuven.be
ABSTRACT
1.
INTRODUCTION
In this work, we present two fundamental primitives for network
security: network dialog minimization and network dialog difﬁng.
Network dialog minimization (NDM) simpliﬁes an original dialog
with respect to a goal, so that the minimized dialog when replayed
still achieves the goal, but requires minimal network communica-
tion, achieving signiﬁcant time and bandwidth savings. We present
network delta debugging, the ﬁrst technique to solve NDM. Net-
work dialog difﬁng compares two dialogs, aligns them, and identi-
ﬁes their common and different parts. We propose a novel dialog
difﬁng technique that aligns two dialogs by ﬁnding a mapping that
maximizes similarity.
We have applied our techniques to 5 applications. We apply
our dialog minimization approach for: building drive-by download
milkers for 9 exploit kits, integrating them in a infrastructure that
has collected over 14,000 malware samples running from a single
machine; efﬁciently measuring the percentage of popular sites that
allow cookie replay, ﬁnding that 31% do not destroy the server-side
state when a user logs out and that 17% provide cookies that live
over a month; simplifying a cumbersome user interface, saving our
institution 3 hours of time per year and employee; and ﬁnding a
new vulnerability in a SIP server. ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Network dialog minimization and network dialog diffing: two novel
primitives for network security applications
author:M. Zubair Rafique and
Juan Caballero and
Christophe Huygens and
Wouter Joosen
Network Dialog Minimization and Network Dialog Difﬁng:
Two Novel Primitives for Network Security Applications
M. Zubair Raﬁque
iMinds-DistriNet, KU Leuven
3001 Leuven, Belgium
zubair.raﬁque@cs.kuleuven.be
Christophe Huygens
iMinds-DistriNet, KU Leuven
3001 Leuven, Belgium
christophe.huygens@cs.kuleuven.be
Juan Caballero
IMDEA Software Institute
Madrid, Spain
juan.caballero@imdea.org
Wouter Joosen
iMinds-DistriNet, KU Leuven
3001 Leuven, Belgium
wouter.joosen@cs.kuleuven.be
ABSTRACT
1.
INTRODUCTION
In this work, we present two fundamental primitives for network
security: network dialog minimization and network dialog difﬁng.
Network dialog minimization (NDM) simpliﬁes an original dialog
with respect to a goal, so that the minimized dialog when replayed
still achieves the goal, but requires minimal network communica-
tion, achieving signiﬁcant time and bandwidth savings. We present
network delta debugging, the ﬁrst technique to solve NDM. Net-
work dialog difﬁng compares two dialogs, aligns them, and identi-
ﬁes their common and different parts. We propose a novel dialog
difﬁng technique that aligns two dialogs by ﬁnding a mapping that
maximizes similarity.
We have applied our techniques to 5 applications. We apply
our dialog minimization approach for: building drive-by download
milkers for 9 exploit kits, integrating them in a infrastructure that
has collected over 14,000 malware samples running from a single
machine; efﬁciently measuring the percentage of popular sites that
allow cookie replay, ﬁnding that 31% do not destroy the server-side
state when a user logs out and that 17% provide cookies that live
over a month; simplifying a cumbersome user interface, saving our
institution 3 hours of time per year and employee; and ﬁnding a
new vulnerability in a SIP server. ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Breaking and Fixing VoLTE: Exploiting Hidden Data Channels and Mis-implementations
author:Hongil Kim and
Dongkwan Kim and
Minhee Kwon and
HyungSeok Han and
Yeongjin Jang and
Dongsu Han and
Taesoo Kim and
Yongdae Kim
Exploiting Hidden Data Channels and Mis-implementations
Breaking and Fixing VoLTE:
∗Hongil Kim† ∗Dongkwan Kim† Minhee Kwon† Hyungseok Han†
Yeongjin Jang§ Dongsu Han† Taesoo Kim§ Yongdae Kim†
†
§
KAIST, Republic of Korea
Georgia Institute of Technology, USA
{hongilk, dkay, minhee.k, han456, dongsu_han, yongdaek}@kaist.ac.kr,
{yeongjin.jang, taesoo}@gatech.edu
ABSTRACT
Long Term Evolution (LTE) is becoming the dominant cellular
networking technology, shifting the cellular network away from
its circuit-switched legacy towards a packet-switched network that
resembles the Internet. To support voice calls over the LTE net-
work, operators have introduced Voice-over-LTE (VoLTE), which
dramatically changes how voice calls are handled, both from user
equipment and infrastructure perspectives. We ﬁnd that this dra-
matic shift opens up a number of new attack surfaces that have not
been previously explored. To call attention to this matter, this paper
presents a systematic security analysis.
Unlike the traditional call setup, the VoLTE call setup is controlled
and performed at the Application Processor (AP), using the SIP over
IP. A legitimate user who has control over the AP can potentially
control and exploit the call setup process to establish a VoLTE
channel. This combined with the legacy accounting policy (e.g.,
unlimited voice and the separation of data and voice) leads to a
number of free data channels. In the process of unveiling the free
data channels, we identify a number of additional vulnerabilities
of early VoLTE implementations, which lead to serious exploits,
such as caller spooﬁng, over-billing, and denial-of-service attacks.
We identify the nature of these vulnerabilities and concrete exploits
that directly result from the adoption of VoLTE. ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Breaking and Fixing VoLTE: Exploiting Hidden Data Channels and Mis-implementations
author:Hongil Kim and
Dongkwan Kim and
Minhee Kwon and
HyungSeok Han and
Yeongjin Jang and
Dongsu Han and
Taesoo Kim and
Yongdae Kim
Exploiting Hidden Data Channels and Mis-implementations
Breaking and Fixing VoLTE:
∗Hongil Kim† ∗Dongkwan Kim† Minhee Kwon† Hyungseok Han†
Yeongjin Jang§ Dongsu Han† Taesoo Kim§ Yongdae Kim†
†
§
KAIST, Republic of Korea
Georgia Institute of Technology, USA
{hongilk, dkay, minhee.k, han456, dongsu_han, yongdaek}@kaist.ac.kr,
{yeongjin.jang, taesoo}@gatech.edu
ABSTRACT
Long Term Evolution (LTE) is becoming the dominant cellular
networking technology, shifting the cellular network away from
its circuit-switched legacy towards a packet-switched network that
resembles the Internet. To support voice calls over the LTE net-
work, operators have introduced Voice-over-LTE (VoLTE), which
dramatically changes how voice calls are handled, both from user
equipment and infrastructure perspectives. We ﬁnd that this dra-
matic shift opens up a number of new attack surfaces that have not
been previously explored. To call attention to this matter, this paper
presents a systematic security analysis.
Unlike the traditional call setup, the VoLTE call setup is controlled
and performed at the Application Processor (AP), using the SIP over
IP. A legitimate user who has control over the AP can potentially
control and exploit the call setup process to establish a VoLTE
channel. This combined with the legacy accounting policy (e.g.,
unlimited voice and the separation of data and voice) leads to a
number of free data channels. In the process of unveiling the free
data channels, we identify a number of additional vulnerabilities
of early VoLTE implementations, which lead to serious exploits,
such as caller spooﬁng, over-billing, and denial-of-service attacks.
We identify the nature of these vulnerabilities and concrete exploits
that directly result from the adoption of VoLTE. ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:e-NeXSh: Achieving an Effectively Non-Executable Stack and Heap via
System-Call Policing
author:Gaurav S. Kc and
Angelos D. Keromytis
e-NeXSh: Achieving an Effectively Non-Executable Stack and Heap via
System-Call Policing
Google Inc., Mountain View, CA 94043, USA
Gaurav S. Kc
gskc@google.com
Angelos D. Keromytis
Columbia University, New York, NY 10027, USA
angelos@cs.columbia.edu
Abstract
We present e-NeXSh, a novel security approach that
utilises kernel and LIBC support for efﬁciently defending
systems against process-subversion attacks. Such attacks
exploit vulnerabilities in software to override its program
control-ﬂow and consequently invoke system calls, caus-
ing out-of-process damage. Our technique defeats such at-
tacks by monitoring all LIBC function and system-call in-
vocations, and validating them against process-speciﬁc in-
formation that strictly prescribes the permissible behaviour
for the program (unlike general sandboxing techniques that
require manually maintained, explicit policies, we use the
program code itself as a guideline for an implicit policy).
Any deviation from this behaviour is considered malicious,
and we halt the attack, limiting its damage to within the
subverted process.
We implemented e-NeXSh as a set of modiﬁcations to the
linux-2.4.18-3 kernel and a new user-space shared
library (e-NeXSh.so). The technique is transparent, re-
quiring no modiﬁcations to existing libraries or applica-
tions. e-NeXSh was able to successfully defeat both code-
injection and libc-based attacks in our effectiveness tests.
The technique is simple and lightweight, demonstrating no
measurable overhead for select UNIX utilities, and a negli-
gible 1.55% performance impact on the Apache web server.
1 Introduction
In recent years, the issue of process-subversion attacks
has become very important, as is evidenced by the number
of CERT advisories [2]. These are attacks that exploit pro-
gramming errors in software to compromise running sys-
tems. Such ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:e-NeXSh: Achieving an Effectively Non-Executable Stack and Heap via
System-Call Policing
author:Gaurav S. Kc and
Angelos D. Keromytis
e-NeXSh: Achieving an Effectively Non-Executable Stack and Heap via
System-Call Policing
Google Inc., Mountain View, CA 94043, USA
Gaurav S. Kc
gskc@google.com
Angelos D. Keromytis
Columbia University, New York, NY 10027, USA
angelos@cs.columbia.edu
Abstract
We present e-NeXSh, a novel security approach that
utilises kernel and LIBC support for efﬁciently defending
systems against process-subversion attacks. Such attacks
exploit vulnerabilities in software to override its program
control-ﬂow and consequently invoke system calls, caus-
ing out-of-process damage. Our technique defeats such at-
tacks by monitoring all LIBC function and system-call in-
vocations, and validating them against process-speciﬁc in-
formation that strictly prescribes the permissible behaviour
for the program (unlike general sandboxing techniques that
require manually maintained, explicit policies, we use the
program code itself as a guideline for an implicit policy).
Any deviation from this behaviour is considered malicious,
and we halt the attack, limiting its damage to within the
subverted process.
We implemented e-NeXSh as a set of modiﬁcations to the
linux-2.4.18-3 kernel and a new user-space shared
library (e-NeXSh.so). The technique is transparent, re-
quiring no modiﬁcations to existing libraries or applica-
tions. e-NeXSh was able to successfully defeat both code-
injection and libc-based attacks in our effectiveness tests.
The technique is simple and lightweight, demonstrating no
measurable overhead for select UNIX utilities, and a negli-
gible 1.55% performance impact on the Apache web server.
1 Introduction
In recent years, the issue of process-subversion attacks
has become very important, as is evidenced by the number
of CERT advisories [2]. These are attacks that exploit pro-
gramming errors in software to compromise running sys-
tems. Such ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A Security Model and Fully Verified Implementation for the IETF
QUIC Record Layer
author:Antoine Delignat-Lavaud and
C'edric Fournet and
Bryan Parno and
Jonathan Protzenko and
Tahina Ramananandro and
Jay Bosamiya and
Joseph Lallemand and
Itsaka Rakotonirina and
Yi Zhou
9
3
0
0
0
.
1
2
0
2
.
1
0
0
0
4
P
S
/
9
0
1
1
.
0
1
:
I
O
D
|
E
E
E
I
1
2
0
2
©
0
0
.
1
3
$
/
1
2
/
5
-
4
3
9
8
-
1
8
2
7
-
1
-
8
7
9
|
)
P
S
(
y
c
a
v
i
r
P
d
n
a
y
t
i
r
u
c
e
S
n
o
m
u
i
s
o
p
m
y
S
E
E
E
I
1
2
0
2
2021 IEEE Symposium on Security and Privacy (SP)
A Security Model and Fully Veriﬁed Implementation
for the IETF QUIC Record Layer
Antoine Delignat-Lavaud∗, Cédric Fournet∗, Bryan Parno†, Jonathan Protzenko∗, Tahina Ramananandro∗,
Jay Bosamiya†, Joseph Lallemand‡, Itsaka Rakotonirina‡, Yi Zhou†
∗Microsoft Research †Carnegie Mellon University ‡INRIA Nancy Grand-Est, LORIA
Abstract—Drawing on earlier protocol-veriﬁcation work, we
investigate the security of the QUIC record layer, as standardized
by the IETF in draft version 30. This version features major
differences compared to Google’s original protocol and early
IETF drafts. It serves as a useful test case for our veriﬁcation
methodology and toolchain, while also, hopefully, drawing atten-
tion to a little studied yet crucially important emerging standard.
We model QUIC packet and header encryption, which uses
a custom construction for privacy. To capture its goals, we
propose a security deﬁnition for authenticated encryption with
semi-implicit nonces. We show that QUIC uses an instance of a
generic construction parameterized by a standard AEAD-secure
scheme and a PRF-secure cipher. We formalize and verify the
security of this construction in F(cid:2). The proof uncovers interesting
limitations of nonce conﬁdentiality, due to the malleability of short
headers and the ability to choose the number of least signiﬁcant
bits included in the packet counter. We propose improvements
that simplify the proof and increase robustness agai...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A Security Model and Fully Verified Implementation for the IETF
QUIC Record Layer
author:Antoine Delignat-Lavaud and
C'edric Fournet and
Bryan Parno and
Jonathan Protzenko and
Tahina Ramananandro and
Jay Bosamiya and
Joseph Lallemand and
Itsaka Rakotonirina and
Yi Zhou
9
3
0
0
0
.
1
2
0
2
.
1
0
0
0
4
P
S
/
9
0
1
1
.
0
1
:
I
O
D
|
E
E
E
I
1
2
0
2
©
0
0
.
1
3
$
/
1
2
/
5
-
4
3
9
8
-
1
8
2
7
-
1
-
8
7
9
|
)
P
S
(
y
c
a
v
i
r
P
d
n
a
y
t
i
r
u
c
e
S
n
o
m
u
i
s
o
p
m
y
S
E
E
E
I
1
2
0
2
2021 IEEE Symposium on Security and Privacy (SP)
A Security Model and Fully Veriﬁed Implementation
for the IETF QUIC Record Layer
Antoine Delignat-Lavaud∗, Cédric Fournet∗, Bryan Parno†, Jonathan Protzenko∗, Tahina Ramananandro∗,
Jay Bosamiya†, Joseph Lallemand‡, Itsaka Rakotonirina‡, Yi Zhou†
∗Microsoft Research †Carnegie Mellon University ‡INRIA Nancy Grand-Est, LORIA
Abstract—Drawing on earlier protocol-veriﬁcation work, we
investigate the security of the QUIC record layer, as standardized
by the IETF in draft version 30. This version features major
differences compared to Google’s original protocol and early
IETF drafts. It serves as a useful test case for our veriﬁcation
methodology and toolchain, while also, hopefully, drawing atten-
tion to a little studied yet crucially important emerging standard.
We model QUIC packet and header encryption, which uses
a custom construction for privacy. To capture its goals, we
propose a security deﬁnition for authenticated encryption with
semi-implicit nonces. We show that QUIC uses an instance of a
generic construction parameterized by a standard AEAD-secure
scheme and a PRF-secure cipher. We formalize and verify the
security of this construction in F(cid:2). The proof uncovers interesting
limitations of nonce conﬁdentiality, due to the malleability of short
headers and the ability to choose the number of least signiﬁcant
bits included in the packet counter. We propose improvements
that simplify the proof and increase robustness agai...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Detecting covert timing channels: an entropy-based approach
author:Steven Gianvecchio and
Haining Wang
Detecting Covert Timing Channels: An Entropy-Based
Approach
Steven Gianvecchio and Haining Wang
Department of Computer Science
The College of William and Mary
Williamsburg, VA 23187, USA
{srgian, hnw}@cs.wm.edu
ABSTRACT
The detection of covert timing channels is of increasing in-
terest in light of recent practice on the exploitation of covert
timing channels over the Internet. However, due to the high
variation in legitimate network traﬃc, detecting covert tim-
ing channels is a challenging task. The existing detection
schemes are ineﬀective to detect most of the covert timing
channels known to the security community. In this paper, we
introduce a new entropy-based approach to detecting vari-
ous covert timing channels. Our new approach is based on
the observation that the creation of a covert timing chan-
nel has certain eﬀects on the entropy of the original process,
and hence, a change in the entropy of a process provides a
critical clue for covert timing channel detection. Exploiting
this observation, we investigate the use of entropy and con-
ditional entropy in detecting covert timing channels. Our
experimental results show that our entropy-based approach
is sensitive to the current covert timing channels, and is ca-
pable of detecting them in an accurate manner.
Categories and Subject Descriptors
C.2.0 [Computer-Communication Networks]: General—
Security and Protection
General Terms
Security
Keywords
Covert Timing Channels, Detection
1.
INTRODUCTION
As an eﬀective way to exﬁltrate data from a well-protected
network, a covert timing channel manipulates the timing or
ordering of network events (e.g., packet arrivals) for secret
information transfer over the Internet, even without com-
promising an end-host inside the network. On the one hand,
Permission to make digital or hard copies of all or part of this work for
personal or classroom use is granted wi...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Detecting covert timing channels: an entropy-based approach
author:Steven Gianvecchio and
Haining Wang
Detecting Covert Timing Channels: An Entropy-Based
Approach
Steven Gianvecchio and Haining Wang
Department of Computer Science
The College of William and Mary
Williamsburg, VA 23187, USA
{srgian, hnw}@cs.wm.edu
ABSTRACT
The detection of covert timing channels is of increasing in-
terest in light of recent practice on the exploitation of covert
timing channels over the Internet. However, due to the high
variation in legitimate network traﬃc, detecting covert tim-
ing channels is a challenging task. The existing detection
schemes are ineﬀective to detect most of the covert timing
channels known to the security community. In this paper, we
introduce a new entropy-based approach to detecting vari-
ous covert timing channels. Our new approach is based on
the observation that the creation of a covert timing chan-
nel has certain eﬀects on the entropy of the original process,
and hence, a change in the entropy of a process provides a
critical clue for covert timing channel detection. Exploiting
this observation, we investigate the use of entropy and con-
ditional entropy in detecting covert timing channels. Our
experimental results show that our entropy-based approach
is sensitive to the current covert timing channels, and is ca-
pable of detecting them in an accurate manner.
Categories and Subject Descriptors
C.2.0 [Computer-Communication Networks]: General—
Security and Protection
General Terms
Security
Keywords
Covert Timing Channels, Detection
1.
INTRODUCTION
As an eﬀective way to exﬁltrate data from a well-protected
network, a covert timing channel manipulates the timing or
ordering of network events (e.g., packet arrivals) for secret
information transfer over the Internet, even without com-
promising an end-host inside the network. On the one hand,
Permission to make digital or hard copies of all or part of this work for
personal or classroom use is granted wi...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:WebShield: Enabling Various Web Defense Techniques without Client
Side Modifications
author:Zhichun Li and
Yi Tang and
Yinzhi Cao and
Vaibhav Rastogi and
Yan Chen and
Bin Liu and
Clint Sbisa
WebShield: Enabling Various Web Defense Techniques without Client Side
Modiﬁcations
Zhichun Li§ Tang Yi† Yinzhi Cao‡ Vaibhav Rastogi‡ Yan Chen‡ Bin Liu† Clint Sbisa‡
§NEC Laboratories America
†Tsinghua University, China
§zhichun@nec-labs.com †tangy05@mails.tsinghua.edu.cn
†bliu@tsinghua.edu.cn
‡ychen@northwestern.edu
‡{yinzhicao2013,vrastogi,c-sbisa}@u.northwestern.edu
‡Northwestern University
Abstract
Today, web attacks are increasing in frequency, sever-
ity and sophistication. Existing solutions are either host-
based which suffer deployment problems or middlebox ap-
proaches that can only accommodate certain security pro-
tection mechanisms with limited protection. In this paper,
we propose four design principles for general middlebox
frameworks of web protection, and apply these principles to
design WebShield, which can enable various host-based se-
curity mechanisms. In particular, we run all the JavaScript
from remote web servers only at shadow browser instances
inside the middlebox, and only run our trusted JavaScript
rendering agent at client browsers. The trusted rendering
agent turns browsers into a thin web terminal by recon-
structing the encoded DOM of a webpage.
We implement a prototype of WebShield. Evaluation
demonstrates that a general JavaScript rendering agent
can render webpages precisely and be just slightly slower
than direct access. We further demonstrate that our design
can work well with interactive web applications such as
JavaScript games. WebShield can detect attacks deeply em-
bedded in dynamic HTML pages including the ones in com-
plex Web 2.0 applications, and can also detect both known
and unknown vulnerabilities. We further show that Web-
Shield is scalable for deployment.
anisms have been proposed [12, 14, 16, 17, 19, 26, 30, 34,
36]. For...


Instruction: 总结这篇安全研究的主要观点

Input:
title:WebShield: Enabling Various Web Defense Techniques without Client
Side Modifications
author:Zhichun Li and
Yi Tang and
Yinzhi Cao and
Vaibhav Rastogi and
Yan Chen and
Bin Liu and
Clint Sbisa
WebShield: Enabling Various Web Defense Techniques without Client Side
Modiﬁcations
Zhichun Li§ Tang Yi† Yinzhi Cao‡ Vaibhav Rastogi‡ Yan Chen‡ Bin Liu† Clint Sbisa‡
§NEC Laboratories America
†Tsinghua University, China
§zhichun@nec-labs.com †tangy05@mails.tsinghua.edu.cn
†bliu@tsinghua.edu.cn
‡ychen@northwestern.edu
‡{yinzhicao2013,vrastogi,c-sbisa}@u.northwestern.edu
‡Northwestern University
Abstract
Today, web attacks are increasing in frequency, sever-
ity and sophistication. Existing solutions are either host-
based which suffer deployment problems or middlebox ap-
proaches that can only accommodate certain security pro-
tection mechanisms with limited protection. In this paper,
we propose four design principles for general middlebox
frameworks of web protection, and apply these principles to
design WebShield, which can enable various host-based se-
curity mechanisms. In particular, we run all the JavaScript
from remote web servers only at shadow browser instances
inside the middlebox, and only run our trusted JavaScript
rendering agent at client browsers. The trusted rendering
agent turns browsers into a thin web terminal by recon-
structing the encoded DOM of a webpage.
We implement a prototype of WebShield. Evaluation
demonstrates that a general JavaScript rendering agent
can render webpages precisely and be just slightly slower
than direct access. We further demonstrate that our design
can work well with interactive web applications such as
JavaScript games. WebShield can detect attacks deeply em-
bedded in dynamic HTML pages including the ones in com-
plex Web 2.0 applications, and can also detect both known
and unknown vulnerabilities. We further show that Web-
Shield is scalable for deployment.
anisms have been proposed [12, 14, 16, 17, 19, 26, 30, 34,
36]. For...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Networked Cryptographic Devices Resilient to Capture
author:Philip D. MacKenzie and
Michael K. Reiter
Networked Cryptographic Devices Resilient to Capture
(Extended Abstract)
Philip MacKenzie
Michael K. Reiter
Bell Labs, Lucent Technologies, Murray Hill, New Jersey, USA
{philmac,reiter}@research.bell-labs.com
Abstract
We present  a  simple  technique  by  which a  device  that
performs private key operations (signatures or decryptions)
in networked applications,  and whose local private  key  is
activated with a password or PIN, can be immunized to off-
line dictionary attacks in case the device is captured.  Our
techniques do not assume tamper resistance of  the device,
but rather exploit the networked nature of  the device, in that
the device’s private  key  operations are pe formed  using  a
simple  interaction with a  remote sewer:  This sewer; how-
ever; is untrusted-its
compromise does not reduce the se-
curiv of  the device’s private  key  unless the device  is also
captured-and  need not have a prior relationship with the
device.  We further  extend  this approach with  support for
key disabling, by which the rightj‘ul owner of  a  stolen de-
vice can disable the device’s private key even if the attacker
already knows the user’s password.
1. Introduction
A  device that  performs  signatures or decryptions using
the private key of a public key  pair, and that stores the pri-
vate key locally on stable storage, is typically vulnerable to
exposure of that private key if the device is captured. While
encryption of the private key under a password is common,
the  ease with  which  passwords succumb to  offline dictio-
nary  attacks (e.g.,  see [35, 27,  18, 411) implies that better
protections are needed.  Many such protections have been
proposed, but most require tamper-resistance of the device.
Others used in practice replace the password with a stronger
key stored on another device that the user holds, thus mov-
ing th...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Networked Cryptographic Devices Resilient to Capture
author:Philip D. MacKenzie and
Michael K. Reiter
Networked Cryptographic Devices Resilient to Capture
(Extended Abstract)
Philip MacKenzie
Michael K. Reiter
Bell Labs, Lucent Technologies, Murray Hill, New Jersey, USA
{philmac,reiter}@research.bell-labs.com
Abstract
We present  a  simple  technique  by  which a  device  that
performs private key operations (signatures or decryptions)
in networked applications,  and whose local private  key  is
activated with a password or PIN, can be immunized to off-
line dictionary attacks in case the device is captured.  Our
techniques do not assume tamper resistance of  the device,
but rather exploit the networked nature of  the device, in that
the device’s private  key  operations are pe formed  using  a
simple  interaction with a  remote sewer:  This sewer; how-
ever; is untrusted-its
compromise does not reduce the se-
curiv of  the device’s private  key  unless the device  is also
captured-and  need not have a prior relationship with the
device.  We further  extend  this approach with  support for
key disabling, by which the rightj‘ul owner of  a  stolen de-
vice can disable the device’s private key even if the attacker
already knows the user’s password.
1. Introduction
A  device that  performs  signatures or decryptions using
the private key of a public key  pair, and that stores the pri-
vate key locally on stable storage, is typically vulnerable to
exposure of that private key if the device is captured. While
encryption of the private key under a password is common,
the  ease with  which  passwords succumb to  offline dictio-
nary  attacks (e.g.,  see [35, 27,  18, 411) implies that better
protections are needed.  Many such protections have been
proposed, but most require tamper-resistance of the device.
Others used in practice replace the password with a stronger
key stored on another device that the user holds, thus mov-
ing th...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A Taxonomy of Botnet Structures
author:David Dagon and
Guofei Gu and
Christopher P. Lee and
Wenke Lee
23rd Annual Computer Security Applications Conference
23rd Annual Computer Security Applications Conference
A Taxonomy of Botnet Structures
David Dagon, Guofei Gu, Christopher P. Lee, Wenke Lee
Georgia Institute of Technology
{dagon@cc., guofei@cc., chrislee@, wenke@cc.}gatech.edu
Abstract
We propose a taxonomy of botnet structures, based on
their utility to the botmaster. We propose key metrics
to measure their utility for various activities (e.g., spam,
ddos). Using these performance metrics, we consider the
ability of different response techniques to degrade or dis-
rupt botnets.
In particular, our models show that targeted responses
are particularly effective against scale free botnets and ef-
forts to increase the robustness of scale free networks comes
at a cost of diminished transitivity. Botmasters do not ap-
pear to have any structural solutions to this problem in
scale free networks. We also show that random graph bot-
nets (e.g., those using P2P formations) are highly resistant
to both random and targeted responses.
We evaluate the impact of responses on different topolo-
gies using simulation and demonstrate the utility of our pro-
posed metrics by performing novel measurements of a P2P
network. Our analysis shows how botnets may be classiﬁed
according to structure and given rank or priority using our
proposed metrics. This may help direct responses and sug-
gests which general remediation strategies are more likely
to succeed.
1 Introduction
Malware authors routinely harness the resources of their
victims, creating networks of compromised machines called
botnets. The attackers’ ability to coordinate the victim com-
puters presents novel challenges for researchers. To fully
understand the threat posed by such networks, we must
identify classes of botnet topologies, their potential uses,
and the challenges each class presents for detection and re-
m...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A Taxonomy of Botnet Structures
author:David Dagon and
Guofei Gu and
Christopher P. Lee and
Wenke Lee
23rd Annual Computer Security Applications Conference
23rd Annual Computer Security Applications Conference
A Taxonomy of Botnet Structures
David Dagon, Guofei Gu, Christopher P. Lee, Wenke Lee
Georgia Institute of Technology
{dagon@cc., guofei@cc., chrislee@, wenke@cc.}gatech.edu
Abstract
We propose a taxonomy of botnet structures, based on
their utility to the botmaster. We propose key metrics
to measure their utility for various activities (e.g., spam,
ddos). Using these performance metrics, we consider the
ability of different response techniques to degrade or dis-
rupt botnets.
In particular, our models show that targeted responses
are particularly effective against scale free botnets and ef-
forts to increase the robustness of scale free networks comes
at a cost of diminished transitivity. Botmasters do not ap-
pear to have any structural solutions to this problem in
scale free networks. We also show that random graph bot-
nets (e.g., those using P2P formations) are highly resistant
to both random and targeted responses.
We evaluate the impact of responses on different topolo-
gies using simulation and demonstrate the utility of our pro-
posed metrics by performing novel measurements of a P2P
network. Our analysis shows how botnets may be classiﬁed
according to structure and given rank or priority using our
proposed metrics. This may help direct responses and sug-
gests which general remediation strategies are more likely
to succeed.
1 Introduction
Malware authors routinely harness the resources of their
victims, creating networks of compromised machines called
botnets. The attackers’ ability to coordinate the victim com-
puters presents novel challenges for researchers. To fully
understand the threat posed by such networks, we must
identify classes of botnet topologies, their potential uses,
and the challenges each class presents for detection and re-
m...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Confidentiality of event data in policy-based monitoring
author:Mirko Montanari and
Roy H. Campbell
Conﬁdentiality of Event Data in Policy-based
Monitoring
Mirko Montanari, Roy H. Campbell
University of Illinois at Urbana-Champaign
{mmontan2, rhc}@illinois.edu
Abstract—Monitoring systems observe important information
that could be a valuable resource to malicious users: attackers
can use the knowledge of topology information, application logs,
or conﬁguration data to target attacks and make them hard to
detect. The increasing need for correlating information across
distributed systems to better detect potential attacks and to meet
regulatory requirements can potentially exacerbate the problem
if the monitoring is centralized. A single zero-day vulnerability
would permit an attacker to access all information.
This paper introduces a novel algorithm for performing
policy-based security monitoring. We use policies to distribute
information across several hosts, so that any host compromise
has limited impact on the conﬁdentiality of the data about
the overall system. Experiments show that our solution spreads
information uniformly across distributed monitoring hosts and
forces attackers to perform multiple actions to acquire important
data.
Index Terms—security; monitoring; policy compliance; conﬁ-
dentiality; distributed systems;
I. INTRODUCTION
Directed attacks toward organizations are becoming com-
monplace. While these attacks often use targeted ﬁshing
emails for getting a foothold into the organization, once inside
they require information about network topology, ﬁrewalls,
and placement of critical systems to further perpetrate the
attack [1]. Attackers need to identify critical resources, and
malware needs to target systems with speciﬁc characteristics in
order to exploit vulnerabilities. Searching for such information
through the network using port scanning or using random
infections of non-critical systems increases the chance of
detecting the malware proc...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Confidentiality of event data in policy-based monitoring
author:Mirko Montanari and
Roy H. Campbell
Conﬁdentiality of Event Data in Policy-based
Monitoring
Mirko Montanari, Roy H. Campbell
University of Illinois at Urbana-Champaign
{mmontan2, rhc}@illinois.edu
Abstract—Monitoring systems observe important information
that could be a valuable resource to malicious users: attackers
can use the knowledge of topology information, application logs,
or conﬁguration data to target attacks and make them hard to
detect. The increasing need for correlating information across
distributed systems to better detect potential attacks and to meet
regulatory requirements can potentially exacerbate the problem
if the monitoring is centralized. A single zero-day vulnerability
would permit an attacker to access all information.
This paper introduces a novel algorithm for performing
policy-based security monitoring. We use policies to distribute
information across several hosts, so that any host compromise
has limited impact on the conﬁdentiality of the data about
the overall system. Experiments show that our solution spreads
information uniformly across distributed monitoring hosts and
forces attackers to perform multiple actions to acquire important
data.
Index Terms—security; monitoring; policy compliance; conﬁ-
dentiality; distributed systems;
I. INTRODUCTION
Directed attacks toward organizations are becoming com-
monplace. While these attacks often use targeted ﬁshing
emails for getting a foothold into the organization, once inside
they require information about network topology, ﬁrewalls,
and placement of critical systems to further perpetrate the
attack [1]. Attackers need to identify critical resources, and
malware needs to target systems with speciﬁc characteristics in
order to exploit vulnerabilities. Searching for such information
through the network using port scanning or using random
infections of non-critical systems increases the chance of
detecting the malware proc...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Group Signatures with Time-bound Keys Revisited: A New Model and
an Efficient Construction
author:Keita Emura and
Takuya Hayashi and
Ai Ishida
Group Signatures with Time-bound Keys Revisited:
A New Model and an Efﬁcient Construction
Keita Emura
National Institute of
Information and
Takuya Hayashi
National Institute of
Information and
Communications Technology
Communications Technology
(NICT)
(NICT)
k-emura@nict.go.jp
takuya.hayashi@nict.go.jp
Ai Ishida
Tokyo Institute of
Technology/National Institute
of Advanced Industrial
Science and Technology
(AIST)
ishida0@is.titech.ac.jp
ABSTRACT
Chu et al. (ASIACCS 2012) proposed group signature with
time-bound keys (GS-TBK) where each signing key is asso-
ciated to an expiry time τ . In addition to prove the mem-
bership of the group, a signer needs to prove that the ex-
piry time has not passed, i.e., t < τ where t is the current
time. A signer whose expiry time has passed is automatically
revoked, and this revocation is called natural revocation.
Simultaneously, signers can be revoked before their expiry
times have passed due to the compromise of the credential.
This revocation is called premature revocation. A nice prop-
erty of the Chu et al. proposal is that the size of revocation
lists can be reduced compared to those of Veriﬁer-Local Re-
vocation (VLR) group signature schemes, by assuming that
natural revocation accounts for most of signer revocations in
practice, and prematurely revoked signers are only a small
fraction. In this paper, we point out that the deﬁnition of
traceability of Chu et al. did not capture unforgeability of
expiry time of signing keys which guarantees that no adver-
sary who has a signing key associated to an expiry time τ can
compute a valid signature after τ has passed. We introduce
a security model that captures unforgeability, and propose
a GS-TBK scheme secure in the new model. Our scheme
also provides the constant signing costs whereas those of
the previous schemes depend on the bit-...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Group Signatures with Time-bound Keys Revisited: A New Model and
an Efficient Construction
author:Keita Emura and
Takuya Hayashi and
Ai Ishida
Group Signatures with Time-bound Keys Revisited:
A New Model and an Efﬁcient Construction
Keita Emura
National Institute of
Information and
Takuya Hayashi
National Institute of
Information and
Communications Technology
Communications Technology
(NICT)
(NICT)
k-emura@nict.go.jp
takuya.hayashi@nict.go.jp
Ai Ishida
Tokyo Institute of
Technology/National Institute
of Advanced Industrial
Science and Technology
(AIST)
ishida0@is.titech.ac.jp
ABSTRACT
Chu et al. (ASIACCS 2012) proposed group signature with
time-bound keys (GS-TBK) where each signing key is asso-
ciated to an expiry time τ . In addition to prove the mem-
bership of the group, a signer needs to prove that the ex-
piry time has not passed, i.e., t < τ where t is the current
time. A signer whose expiry time has passed is automatically
revoked, and this revocation is called natural revocation.
Simultaneously, signers can be revoked before their expiry
times have passed due to the compromise of the credential.
This revocation is called premature revocation. A nice prop-
erty of the Chu et al. proposal is that the size of revocation
lists can be reduced compared to those of Veriﬁer-Local Re-
vocation (VLR) group signature schemes, by assuming that
natural revocation accounts for most of signer revocations in
practice, and prematurely revoked signers are only a small
fraction. In this paper, we point out that the deﬁnition of
traceability of Chu et al. did not capture unforgeability of
expiry time of signing keys which guarantees that no adver-
sary who has a signing key associated to an expiry time τ can
compute a valid signature after τ has passed. We introduce
a security model that captures unforgeability, and propose
a GS-TBK scheme secure in the new model. Our scheme
also provides the constant signing costs whereas those of
the previous schemes depend on the bit-...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Reviving delay-based TCP for data centers
author:Changhyun Lee and
Keon Jang and
Sue B. Moon
Reviving Delay-based TCP for Data Centers
Changhyun Lee
KAIST
Daejeon, Korea
chlee@an.kaist.ac.kr
Keon Jang
Microsoft Research
Cambridge, UK
keonjang@microsoft.com
Sue Moon
KAIST
Daejeon, Korea
sbmoon@kaist.edu
ABSTRACT
With the rapid growth of data centers, minimizing the queueing de-
lay at network switches has been one of the key challenges. In this
work, we analyze the shortcomings of the current TCP algorithm
when used in data center networks, and we propose to use latency-
based congestion detection and rate-based transfer to achieve ultra-
low queueing delay in data centers.
Categories and Subject Descriptors
C.2.2 [Computer-Communication Networks]: Network Proto-
cols
General Terms
Performance
Keywords
Data centers, Latency, TCP
1.
INTRODUCTION
The recent growth of data centers has brought new challenges
to network research. Among the challenges, minimizing network
delay within a data center is one of the key concerns for service op-
erators. Previous work [1] has well pointed out that user experience
is badly affected in data center applications when even a single ﬂow
suffers from a large latency.
In today’s data centers, the largest part of network delay comes
from the queueing delay at switches since the propagation delay
within a data center can be almost negligible; ideally, 100 meters
of network cabling between two nodes adds only 0.5µs of propa-
gation delay, while a single 1,500 byte packet queued at a 10Gbps
switch already costs 1.2µs. Recently, much effort has been put to
reduce the queueing delay at switches. DCTCP [2] uses ECN mark-
ing to slow down ﬂows before the queue becomes full. HULL [3]
takes a further step and give up a little bandwidth to have even
lower latency than DCTCP. Our work is also motivated to reduce
the queueing delay in data centers, but we focus on the end-to-end
congestion control not on queue management at switches. The ﬁnal
...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Reviving delay-based TCP for data centers
author:Changhyun Lee and
Keon Jang and
Sue B. Moon
Reviving Delay-based TCP for Data Centers
Changhyun Lee
KAIST
Daejeon, Korea
chlee@an.kaist.ac.kr
Keon Jang
Microsoft Research
Cambridge, UK
keonjang@microsoft.com
Sue Moon
KAIST
Daejeon, Korea
sbmoon@kaist.edu
ABSTRACT
With the rapid growth of data centers, minimizing the queueing de-
lay at network switches has been one of the key challenges. In this
work, we analyze the shortcomings of the current TCP algorithm
when used in data center networks, and we propose to use latency-
based congestion detection and rate-based transfer to achieve ultra-
low queueing delay in data centers.
Categories and Subject Descriptors
C.2.2 [Computer-Communication Networks]: Network Proto-
cols
General Terms
Performance
Keywords
Data centers, Latency, TCP
1.
INTRODUCTION
The recent growth of data centers has brought new challenges
to network research. Among the challenges, minimizing network
delay within a data center is one of the key concerns for service op-
erators. Previous work [1] has well pointed out that user experience
is badly affected in data center applications when even a single ﬂow
suffers from a large latency.
In today’s data centers, the largest part of network delay comes
from the queueing delay at switches since the propagation delay
within a data center can be almost negligible; ideally, 100 meters
of network cabling between two nodes adds only 0.5µs of propa-
gation delay, while a single 1,500 byte packet queued at a 10Gbps
switch already costs 1.2µs. Recently, much effort has been put to
reduce the queueing delay at switches. DCTCP [2] uses ECN mark-
ing to slow down ﬂows before the queue becomes full. HULL [3]
takes a further step and give up a little bandwidth to have even
lower latency than DCTCP. Our work is also motivated to reduce
the queueing delay in data centers, but we focus on the end-to-end
congestion control not on queue management at switches. The ﬁnal
...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:On the Feasibility of Automating Stock Market Manipulation
author:Carter Yagemann and
Simon P. Chung and
Erkam Uzun and
Sai Ragam and
Brendan Saltaformaggio and
Wenke Lee
On the Feasibility of Automating Stock
Market Manipulation
Carter Yagemann
yagemann@gatech.edu
Georgia Institute of Technology
Atlanta, Georgia
Sai Ragam
sragam3@gatech.edu
Georgia Institute of Technology
Atlanta, Georgia
Simon P. Chung
pchung34@mail.gatech.edu
Georgia Institute of Technology
Atlanta, Georgia
Brendan Saltaformaggio
brendan@ece.gatech.edu
Georgia Institute of Technology
Atlanta, Georgia
Georgia Institute of Technology
Erkam Uzun
euzun@gatech.edu
Atlanta, Georgia
Wenke Lee
wenke@cc.gatech.edu
Georgia Institute of Technology
Atlanta, Georgia
ABSTRACT
This work presents the first findings on the feasibility of using
botnets to automate stock market manipulation. Our analysis incor-
porates data gathered from SEC case files, security surveys of online
brokerages, and dark web marketplace data. We address several
technical challenges, including how to adapt existing techniques
for automation, the cost of hijacking brokerage accounts, avoiding
detection, and more. We consolidate our findings into a working
proof-of-concept, man-in-the-browser malware, Bot2Stock, capable
of controlling victim email and brokerage accounts to commit fraud.
We evaluate our bots and protocol using agent-based market simu-
lations, where we find that a 1.5% ratio of bots to benign traders
yields a 2.8% return on investment (ROI) per attack. Given the short
duration of each attack (< 1 minute), achieving this ratio is trivial,
requiring only 4 bots to target stocks like IBM. 1,000 bots, cumu-
latively gathered over 1 year, can turn $100,000 into $1,022,000,
placing Bot2Stock on par with existing botnet scams.
CCS CONCEPTS
• Security and privacy → Economics of security and privacy;
Distributed systems security.
KEYWORDS
fraud, stock markets, economics, botnets, malware
ACM Reference Format:
Carter Yagemann,...


Instruction: 总结这篇安全研究的主要观点

Input:
title:On the Feasibility of Automating Stock Market Manipulation
author:Carter Yagemann and
Simon P. Chung and
Erkam Uzun and
Sai Ragam and
Brendan Saltaformaggio and
Wenke Lee
On the Feasibility of Automating Stock
Market Manipulation
Carter Yagemann
yagemann@gatech.edu
Georgia Institute of Technology
Atlanta, Georgia
Sai Ragam
sragam3@gatech.edu
Georgia Institute of Technology
Atlanta, Georgia
Simon P. Chung
pchung34@mail.gatech.edu
Georgia Institute of Technology
Atlanta, Georgia
Brendan Saltaformaggio
brendan@ece.gatech.edu
Georgia Institute of Technology
Atlanta, Georgia
Georgia Institute of Technology
Erkam Uzun
euzun@gatech.edu
Atlanta, Georgia
Wenke Lee
wenke@cc.gatech.edu
Georgia Institute of Technology
Atlanta, Georgia
ABSTRACT
This work presents the first findings on the feasibility of using
botnets to automate stock market manipulation. Our analysis incor-
porates data gathered from SEC case files, security surveys of online
brokerages, and dark web marketplace data. We address several
technical challenges, including how to adapt existing techniques
for automation, the cost of hijacking brokerage accounts, avoiding
detection, and more. We consolidate our findings into a working
proof-of-concept, man-in-the-browser malware, Bot2Stock, capable
of controlling victim email and brokerage accounts to commit fraud.
We evaluate our bots and protocol using agent-based market simu-
lations, where we find that a 1.5% ratio of bots to benign traders
yields a 2.8% return on investment (ROI) per attack. Given the short
duration of each attack (< 1 minute), achieving this ratio is trivial,
requiring only 4 bots to target stocks like IBM. 1,000 bots, cumu-
latively gathered over 1 year, can turn $100,000 into $1,022,000,
placing Bot2Stock on par with existing botnet scams.
CCS CONCEPTS
• Security and privacy → Economics of security and privacy;
Distributed systems security.
KEYWORDS
fraud, stock markets, economics, botnets, malware
ACM Reference Format:
Carter Yagemann,...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A4NT: Author Attribute Anonymity by Adversarial Training of Neural
Machine Translation
author:Rakshith Shetty and
Bernt Schiele and
Mario Fritz
A4NT: Author Attribute Anonymity by Adversarial
Training of Neural Machine Translation
Rakshith Shetty, Bernt Schiele, and Mario Fritz, Max Planck Institute for Informatics
https://www.usenix.org/conference/usenixsecurity18/presentation/shetty
This paper is included in the Proceedings of the
27th USENIX Security Symposium.
August 15–17, 2018 • Baltimore, MD, USA
978-1-939133-04-5
Open access to the Proceedings of the 27th USENIX Security Symposium is sponsored by USENIX.A4NT: Author Attribute Anonymity
by Adversarial Training of Neural Machine Translation
Rakshith Shetty Bernt Schiele Mario Fritz
Max Planck Institute for Informatics
Saarland Informatics Campus
Saarbr¨ucken, Germany
Email: firstname.lastname@mpi-inf.mpg.de
Abstract
Text-based analysis methods enable an adversary to reveal
privacy relevant author attributes such as gender, age and
can identify the text’s author. Such methods can compro-
mise the privacy of an anonymous author even when the
author tries to remove privacy sensitive content. In this
paper, we propose an automatic method, called the Ad-
versarial Author Attribute Anonymity Neural Translation
(A4NT), to combat such text-based adversaries. Unlike
prior works on obfuscation, we propose a system that
is fully automatic and learns to perform obfuscation en-
tirely from the data. This allows us to easily apply the
A4NT system to obfuscate different author attributes. We
propose a sequence-to-sequence language model, inspired
by machine translation, and an adversarial training frame-
work to design a system which learns to transform the
input text to obfuscate the author attributes without paired
data. We also propose and evaluate techniques to impose
constraints on our A4NT model to preserve the semantics
of the input text. A4NT learns to make minimal changes
to the input to successfully fool a...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A4NT: Author Attribute Anonymity by Adversarial Training of Neural
Machine Translation
author:Rakshith Shetty and
Bernt Schiele and
Mario Fritz
A4NT: Author Attribute Anonymity by Adversarial
Training of Neural Machine Translation
Rakshith Shetty, Bernt Schiele, and Mario Fritz, Max Planck Institute for Informatics
https://www.usenix.org/conference/usenixsecurity18/presentation/shetty
This paper is included in the Proceedings of the
27th USENIX Security Symposium.
August 15–17, 2018 • Baltimore, MD, USA
978-1-939133-04-5
Open access to the Proceedings of the 27th USENIX Security Symposium is sponsored by USENIX.A4NT: Author Attribute Anonymity
by Adversarial Training of Neural Machine Translation
Rakshith Shetty Bernt Schiele Mario Fritz
Max Planck Institute for Informatics
Saarland Informatics Campus
Saarbr¨ucken, Germany
Email: firstname.lastname@mpi-inf.mpg.de
Abstract
Text-based analysis methods enable an adversary to reveal
privacy relevant author attributes such as gender, age and
can identify the text’s author. Such methods can compro-
mise the privacy of an anonymous author even when the
author tries to remove privacy sensitive content. In this
paper, we propose an automatic method, called the Ad-
versarial Author Attribute Anonymity Neural Translation
(A4NT), to combat such text-based adversaries. Unlike
prior works on obfuscation, we propose a system that
is fully automatic and learns to perform obfuscation en-
tirely from the data. This allows us to easily apply the
A4NT system to obfuscate different author attributes. We
propose a sequence-to-sequence language model, inspired
by machine translation, and an adversarial training frame-
work to design a system which learns to transform the
input text to obfuscate the author attributes without paired
data. We also propose and evaluate techniques to impose
constraints on our A4NT model to preserve the semantics
of the input text. A4NT learns to make minimal changes
to the input to successfully fool a...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Wide-area routing dynamics of malicious networks
author:Maria Konte and
Nick Feamster
Wide-area Routing Dynamics of Malicious Networks
Maria Konte, Nick Feamster
Georgia Tech
{mkonte, feamster}@cc.gatech.edu
ABSTRACT
This paper studies the routing dynamics of malicious networks. We
characterize the routing behavior of malicious networks on both
short and long timescales. We ﬁnd that malicious networks more
consistently advertise preﬁxes with short durations and long inter-
arrival times; over longer timescales, we ﬁnd that malicious ASes
connect with more upstream providers than legitimate ASes, and
they also change upstream providers more frequently.
Categories and Subject Descriptors: C.2.0 [Computer Commu-
nication Networks]: Security and protection.
General Terms: Measurement, Security, Management.
Keywords: Hostexploit, malicious networks, BGP, routing dynam-
ics, security.
1.
INTRODUCTION
Attackers use advanced techniques to launch spam campaigns or
mount attacks; in particular, Ramchandran et al. [?] observed that
some some attackers send spam from hijacked preﬁxes. Previous
studies have studied different malicious activities in isolation such
as worms, botnets, spam, and Internet scam infrastructure [?, ?]
and proposed detection solutions for each of them. Unfortunately,
observing just the nature of the attack itself is not sufﬁcient, be-
cause any given network or host may mount different attacks on
different days. Rather than attempting to detect any individual at-
tack, we characterize the routing behavior of malicious networks
that are primarily responsible for cybercriminal activities and iden-
tify features of this behavior that may be more stable across time.
Although our initial goal is simply to characterize this behavior,
our belief is that ultimately certain aspects of routing behavior may
serve as invariants for detecting malicious infrastructure, even as
the attacks themselves evolve. Speciﬁcally, we believe that rout-
ing behavior may ult...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Wide-area routing dynamics of malicious networks
author:Maria Konte and
Nick Feamster
Wide-area Routing Dynamics of Malicious Networks
Maria Konte, Nick Feamster
Georgia Tech
{mkonte, feamster}@cc.gatech.edu
ABSTRACT
This paper studies the routing dynamics of malicious networks. We
characterize the routing behavior of malicious networks on both
short and long timescales. We ﬁnd that malicious networks more
consistently advertise preﬁxes with short durations and long inter-
arrival times; over longer timescales, we ﬁnd that malicious ASes
connect with more upstream providers than legitimate ASes, and
they also change upstream providers more frequently.
Categories and Subject Descriptors: C.2.0 [Computer Commu-
nication Networks]: Security and protection.
General Terms: Measurement, Security, Management.
Keywords: Hostexploit, malicious networks, BGP, routing dynam-
ics, security.
1.
INTRODUCTION
Attackers use advanced techniques to launch spam campaigns or
mount attacks; in particular, Ramchandran et al. [?] observed that
some some attackers send spam from hijacked preﬁxes. Previous
studies have studied different malicious activities in isolation such
as worms, botnets, spam, and Internet scam infrastructure [?, ?]
and proposed detection solutions for each of them. Unfortunately,
observing just the nature of the attack itself is not sufﬁcient, be-
cause any given network or host may mount different attacks on
different days. Rather than attempting to detect any individual at-
tack, we characterize the routing behavior of malicious networks
that are primarily responsible for cybercriminal activities and iden-
tify features of this behavior that may be more stable across time.
Although our initial goal is simply to characterize this behavior,
our belief is that ultimately certain aspects of routing behavior may
serve as invariants for detecting malicious infrastructure, even as
the attacks themselves evolve. Speciﬁcally, we believe that rout-
ing behavior may ult...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Sys: A Static/Symbolic Tool for Finding Good Bugs in Good (Browser)
Code
author:Fraser Brown and
Deian Stefan and
Dawson R. Engler
Sys: a Static/Symbolic Tool for Finding Good Bugs
in Good (Browser) Code
Fraser Brown, Stanford University; Deian Stefan, UC San Diego;
Dawson Engler, Stanford University
https://www.usenix.org/conference/usenixsecurity20/presentation/brown
This paper is included in the Proceedings of the 29th USENIX Security Symposium.August 12–14, 2020978-1-939133-17-5Open access to the Proceedings of the 29th USENIX Security Symposium is sponsored by USENIX.Sys: a Static/Symbolic Tool for Finding Good Bugs in Good (Browser) Code
Fraser Brown
Stanford University
Deian Stefan
UC San Diego
Dawson Engler
Stanford University
Abstract
We describe and evaluate an extensible bug-ﬁnding tool, Sys,
designed to automatically ﬁnd security bugs in huge code-
bases, even when easy-to-ﬁnd bugs have been already picked
clean by years of aggressive automatic checking. Sys uses a
two-step approach to ﬁnd such tricky errors. First, it breaks
down large—tens of millions of lines—systems into small
pieces using user-extensible static checkers to quickly ﬁnd and
mark potential errorsites. Second, it uses user-extensible sym-
bolic execution to deeply examine these potential errorsites
for actual bugs. Both the checkers and the system itself are
small (6KLOC total). Sys is ﬂexible, because users must be
able to exploit domain- or system-speciﬁc knowledge in order
to detect errors and suppress false positives in real codebases.
Sys ﬁnds many security bugs (51 bugs, 43 conﬁrmed) in well-
checked code—the Chrome and Firefox web browsers—and
code that some symbolic tools struggle with—the FreeBSD
operating system. Sys’s most interesting results include: an
exploitable, cash bountied CVE in Chrome that was ﬁxed in
seven hours (and whose patch was backported in two days); a
trio of bountied bugs with a CVE in Firefox; and a bountied
bug in Chrome’s audio support.
1 Intro...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Sys: A Static/Symbolic Tool for Finding Good Bugs in Good (Browser)
Code
author:Fraser Brown and
Deian Stefan and
Dawson R. Engler
Sys: a Static/Symbolic Tool for Finding Good Bugs
in Good (Browser) Code
Fraser Brown, Stanford University; Deian Stefan, UC San Diego;
Dawson Engler, Stanford University
https://www.usenix.org/conference/usenixsecurity20/presentation/brown
This paper is included in the Proceedings of the 29th USENIX Security Symposium.August 12–14, 2020978-1-939133-17-5Open access to the Proceedings of the 29th USENIX Security Symposium is sponsored by USENIX.Sys: a Static/Symbolic Tool for Finding Good Bugs in Good (Browser) Code
Fraser Brown
Stanford University
Deian Stefan
UC San Diego
Dawson Engler
Stanford University
Abstract
We describe and evaluate an extensible bug-ﬁnding tool, Sys,
designed to automatically ﬁnd security bugs in huge code-
bases, even when easy-to-ﬁnd bugs have been already picked
clean by years of aggressive automatic checking. Sys uses a
two-step approach to ﬁnd such tricky errors. First, it breaks
down large—tens of millions of lines—systems into small
pieces using user-extensible static checkers to quickly ﬁnd and
mark potential errorsites. Second, it uses user-extensible sym-
bolic execution to deeply examine these potential errorsites
for actual bugs. Both the checkers and the system itself are
small (6KLOC total). Sys is ﬂexible, because users must be
able to exploit domain- or system-speciﬁc knowledge in order
to detect errors and suppress false positives in real codebases.
Sys ﬁnds many security bugs (51 bugs, 43 conﬁrmed) in well-
checked code—the Chrome and Firefox web browsers—and
code that some symbolic tools struggle with—the FreeBSD
operating system. Sys’s most interesting results include: an
exploitable, cash bountied CVE in Chrome that was ﬁxed in
seven hours (and whose patch was backported in two days); a
trio of bountied bugs with a CVE in Firefox; and a bountied
bug in Chrome’s audio support.
1 Intro...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:MTD 2014: First ACM Workshop on Moving Target Defense
author:Sushil Jajodia and
Kun Sun
Toward Proactive, Adaptive Defense:
A Survey on Moving Target Defense
Jin-Hee Cho, Dilli P. Sharma, Hooman Alavizadeh, Seunghyun Yoon, Noam Ben-Asher, Terrence J. Moore, Dong
Seong Kim, Hyuk Lim, and Frederica F. Nelson
1
Abstract—Reactive defense mechanisms, such as intrusion
detection systems, have made signiﬁcant efforts to secure a system
or network for the last several decades. However, the nature of
reactive security mechanisms has limitations because potential
attackers cannot be prevented in advance. We are facing a
reality with the proliferation of persistent, advanced, intelligent
attacks while defenders are often way behind attackers in taking
appropriate actions to thwart potential attackers. The concept
of moving target defense (MTD) has emerged as a proactive
defense mechanism aiming to prevent attacks. In this work,
we conducted a comprehensive, in-depth survey to discuss the
following aspects of MTD: key roles, design principles, classiﬁca-
tions, common attacks, key methodologies, important algorithms,
metrics, evaluation methods, and application domains. We discuss
the pros and cons of all aspects of MTD surveyed in this work.
Lastly, we highlight insights and lessons learned from this study
and suggest future work directions. The aim of this paper is
to provide the overall trends of MTD research in terms of
critical aspects of defense systems for researchers who seek for
developing proactive, adaptive MTD mechanisms.
Index Terms—Moving target defense, proactive defense, cyber-
security, attack surface, shufﬂing, diversity, redundancy
I. INTRODUCTION
A. Motivation
In the classic “shell game,” dating at least to the times of
ancient Greece, a pea or ball is hidden under one of three
shells or cups, and players gamble to guess the location of the
pea after the shells have been moved. This game is also known
as “thimblerig,” “three shells and a pea,” and the ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:MTD 2014: First ACM Workshop on Moving Target Defense
author:Sushil Jajodia and
Kun Sun
Toward Proactive, Adaptive Defense:
A Survey on Moving Target Defense
Jin-Hee Cho, Dilli P. Sharma, Hooman Alavizadeh, Seunghyun Yoon, Noam Ben-Asher, Terrence J. Moore, Dong
Seong Kim, Hyuk Lim, and Frederica F. Nelson
1
Abstract—Reactive defense mechanisms, such as intrusion
detection systems, have made signiﬁcant efforts to secure a system
or network for the last several decades. However, the nature of
reactive security mechanisms has limitations because potential
attackers cannot be prevented in advance. We are facing a
reality with the proliferation of persistent, advanced, intelligent
attacks while defenders are often way behind attackers in taking
appropriate actions to thwart potential attackers. The concept
of moving target defense (MTD) has emerged as a proactive
defense mechanism aiming to prevent attacks. In this work,
we conducted a comprehensive, in-depth survey to discuss the
following aspects of MTD: key roles, design principles, classiﬁca-
tions, common attacks, key methodologies, important algorithms,
metrics, evaluation methods, and application domains. We discuss
the pros and cons of all aspects of MTD surveyed in this work.
Lastly, we highlight insights and lessons learned from this study
and suggest future work directions. The aim of this paper is
to provide the overall trends of MTD research in terms of
critical aspects of defense systems for researchers who seek for
developing proactive, adaptive MTD mechanisms.
Index Terms—Moving target defense, proactive defense, cyber-
security, attack surface, shufﬂing, diversity, redundancy
I. INTRODUCTION
A. Motivation
In the classic “shell game,” dating at least to the times of
ancient Greece, a pea or ball is hidden under one of three
shells or cups, and players gamble to guess the location of the
pea after the shells have been moved. This game is also known
as “thimblerig,” “three shells and a pea,” and the ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 总结这篇安全研究的主要观点

Input:
title:The Return of Coppersmith's Attack: Practical Factorization of Widely
Used RSA Moduli
author:Mat'us Nemec and
Marek S'ys and
Petr Svenda and
Dusan Klinec and
Vashek Matyas
The Return of Coppersmith’s A(cid:130)ack:
Practical Factorization of Widely Used RSA Moduli
Matus Nemec
Petr Svenda
Masaryk University,
Marek Sys∗
Ca’ Foscari University of Venice
mnemec@mail.muni.cz
Masaryk University
syso@(cid:128).muni.cz
Masaryk University
svenda@(cid:128).muni.cz
Dusan Klinec
EnigmaBridge, Masaryk University
dusan@enigmabridge.com
ABSTRACT
We report on our discovery of an algorithmic (cid:131)aw in the construc-
tion of primes for RSA key generation in a widely-used library
of a major manufacturer of cryptographic hardware. (cid:140)e primes
generated by the library su(cid:130)er from a signi(cid:128)cant loss of entropy.
We propose a practical factorization method for various key lengths
including 1024 and 2048 bits. Our method requires no additional
information except for the value of the public modulus and does
not depend on a weak or a faulty random number generator. We
devised an extension of Coppersmith’s factorization a(cid:138)ack utilizing
an alternative form of the primes in question. (cid:140)e library in ques-
tion is found in NIST FIPS 140-2 and CC EAL 5+ certi(cid:128)ed devices
used for a wide range of real-world applications, including identity
cards, passports, Trusted Platform Modules, PGP and tokens for
authentication or so(cid:137)ware signing. As the relevant library code was
introduced in 2012 at the latest (and probably earlier), the impacted
devices are now widespread. Tens of thousands of such keys were
directly identi(cid:128)ed, many with signi(cid:128)cant impacts, especially for
electronic identity documents, so(cid:137)ware signing, Trusted Comput-
ing and PGP. We estimate the number of a(cid:130)ected devices to be in
the order of at least tens of millions.
(cid:140)e worst cases for the factorization of 1024 and 2048-bit keys
a...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Advanced Client/Server Authentication in TLS
author:Adam Hess and
Jared Jacobson and
Hyrum Mills and
Ryan Wamsley and
Kent E. Seamons and
Bryan Smith
Advanced Client/Server Authentication in TLS
Adam Hess, Jared Jacobson, Hyrum Mills, Ryan Wamsley, Kent E. Seamons, Bryan Smith
Computer Science Department
Brigham Young University
Provo, Utah, USA 84602
seamons@cs.byu.edu
ABSTRACT
  This  paper  describes
Many  business  transactions  on  the  Internet  occur
between  strangers,  that  is,  between  entities  with  no  prior
relationship and no common security domain.  Traditional
security  approaches  based  on  identity  or  capabilities  do
not  solve  the  problem  of  establishing  trust  between
strangers.    New  approaches  to  trust  establishment  are
required that are secure, scalable, and portable.  One new
approach to mutual trust establishment is trust negotiation,
the  bilateral  exchange  of  digital  credentials  to  establish
trust  gradually.
the  Trust
Negotiation  in  TLS  (TNT)  protocol,  an  extension  to  the
TLS handshake protocol that incorporates recent advances
in
to  provide  advanced
client/server  authentication  in  TLS.    In  this  paper  we
describe  the  current  limitations  in  TLS  client/server
authentication  with  respect  to  trust  establishment,  and
show  how  the  TNT  protocol  overcomes  them.    We  also
describe our implementation of TNT, built using PureTLS,
a  Java  TLS  package  that  is  freely  available.    This
implementation  is  the  first  to  provide  confidential  trust
negotiation,  verification  of  private  keys  during  trust
negotiation,  and  a  single  trust  negotiation  protocol
supporting interoperable trust negotiation strategies.
trust  negotiation
into  TLS
1.  Introduction
that
Many  interactions  on  the  Internet  occur  between
strangers,
is,  between  entities  with  no  prior
relationship and no common security domain.  Traditional
security...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Advanced Client/Server Authentication in TLS
author:Adam Hess and
Jared Jacobson and
Hyrum Mills and
Ryan Wamsley and
Kent E. Seamons and
Bryan Smith
Advanced Client/Server Authentication in TLS
Adam Hess, Jared Jacobson, Hyrum Mills, Ryan Wamsley, Kent E. Seamons, Bryan Smith
Computer Science Department
Brigham Young University
Provo, Utah, USA 84602
seamons@cs.byu.edu
ABSTRACT
  This  paper  describes
Many  business  transactions  on  the  Internet  occur
between  strangers,  that  is,  between  entities  with  no  prior
relationship and no common security domain.  Traditional
security  approaches  based  on  identity  or  capabilities  do
not  solve  the  problem  of  establishing  trust  between
strangers.    New  approaches  to  trust  establishment  are
required that are secure, scalable, and portable.  One new
approach to mutual trust establishment is trust negotiation,
the  bilateral  exchange  of  digital  credentials  to  establish
trust  gradually.
the  Trust
Negotiation  in  TLS  (TNT)  protocol,  an  extension  to  the
TLS handshake protocol that incorporates recent advances
in
to  provide  advanced
client/server  authentication  in  TLS.    In  this  paper  we
describe  the  current  limitations  in  TLS  client/server
authentication  with  respect  to  trust  establishment,  and
show  how  the  TNT  protocol  overcomes  them.    We  also
describe our implementation of TNT, built using PureTLS,
a  Java  TLS  package  that  is  freely  available.    This
implementation  is  the  first  to  provide  confidential  trust
negotiation,  verification  of  private  keys  during  trust
negotiation,  and  a  single  trust  negotiation  protocol
supporting interoperable trust negotiation strategies.
trust  negotiation
into  TLS
1.  Introduction
that
Many  interactions  on  the  Internet  occur  between
strangers,
is,  between  entities  with  no  prior
relationship and no common security domain.  Traditional
security...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:An In-Depth Analysis of Disassembly on Full-Scale x86/x64 Binaries
author:Dennis Andriesse and
Xi Chen and
Victor van der Veen and
Asia Slowinska and
Herbert Bos
An In-Depth Analysis of Disassembly
on Full-Scale x86/x64 Binaries
Dennis Andriesse, Xi Chen, and Victor van der Veen, Vrije Universiteit Amsterdam;
Asia Slowinska, Lastline, Inc.; Herbert Bos, Vrije Universiteit Amsterdam
 https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/andriesse
This paper is included in the Proceedings of the 25th USENIX Security SymposiumAugust 10–12, 2016 • Austin, TXISBN 978-1-931971-32-4Open access to the Proceedings of the 25th USENIX Security Symposium is sponsored by USENIX An In-Depth Analysis of Disassembly on Full-Scale x86/x64 Binaries
Dennis Andriesse†§, Xi Chen†§, Victor van der Veen†§, Asia Slowinska‡, and Herbert Bos†§
†{d.a.andriesse,x.chen,v.vander.veen,h.j.bos}@vu.nl
Computer Science Institute, Vrije Universiteit Amsterdam
§Amsterdam Department of Informatics
‡asia@lastline.com
Lastline, Inc.
Abstract
It is well-known that static disassembly is an unsolved
problem, but how much of a problem is it in real software—
for instance, for binary protection schemes? This work
studies the accuracy of nine state-of-the-art disassemblers
on 981 real-world compiler-generated binaries with a
wide variety of properties. In contrast, prior work focuses
on isolated corner cases; we show that this has led to a
widespread and overly pessimistic view on the prevalence
of complex constructs like inline data and overlapping
code, leading reviewers and researchers to underestimate
the potential of binary-based research. On the other hand,
some constructs, such as function boundaries, are much
harder to recover accurately than is reﬂected in the litera-
ture, which rarely discusses much needed error handling
for these primitives. We study 30 papers recently pub-
lished in six major security venues, and reveal a mismatch
between expectations in the ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:An In-Depth Analysis of Disassembly on Full-Scale x86/x64 Binaries
author:Dennis Andriesse and
Xi Chen and
Victor van der Veen and
Asia Slowinska and
Herbert Bos
An In-Depth Analysis of Disassembly
on Full-Scale x86/x64 Binaries
Dennis Andriesse, Xi Chen, and Victor van der Veen, Vrije Universiteit Amsterdam;
Asia Slowinska, Lastline, Inc.; Herbert Bos, Vrije Universiteit Amsterdam
 https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/andriesse
This paper is included in the Proceedings of the 25th USENIX Security SymposiumAugust 10–12, 2016 • Austin, TXISBN 978-1-931971-32-4Open access to the Proceedings of the 25th USENIX Security Symposium is sponsored by USENIX An In-Depth Analysis of Disassembly on Full-Scale x86/x64 Binaries
Dennis Andriesse†§, Xi Chen†§, Victor van der Veen†§, Asia Slowinska‡, and Herbert Bos†§
†{d.a.andriesse,x.chen,v.vander.veen,h.j.bos}@vu.nl
Computer Science Institute, Vrije Universiteit Amsterdam
§Amsterdam Department of Informatics
‡asia@lastline.com
Lastline, Inc.
Abstract
It is well-known that static disassembly is an unsolved
problem, but how much of a problem is it in real software—
for instance, for binary protection schemes? This work
studies the accuracy of nine state-of-the-art disassemblers
on 981 real-world compiler-generated binaries with a
wide variety of properties. In contrast, prior work focuses
on isolated corner cases; we show that this has led to a
widespread and overly pessimistic view on the prevalence
of complex constructs like inline data and overlapping
code, leading reviewers and researchers to underestimate
the potential of binary-based research. On the other hand,
some constructs, such as function boundaries, are much
harder to recover accurately than is reﬂected in the litera-
ture, which rarely discusses much needed error handling
for these primitives. We study 30 papers recently pub-
lished in six major security venues, and reveal a mismatch
between expectations in the ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:NoSQL Breakdown: A Large-scale Analysis of Misconfigured NoSQL Services
author:Dario Ferrari and
Michele Carminati and
Mario Polino and
Stefano Zanero
A Large-scale Analysis of misconfigured NoSQL Services
NoSQL BreakDown:
Dario Ferrari, Michele Carminati, Mario Polino, and Stefano Zanero
Politecnico di Milano
Annual Computer Security Applications Conference (ACSAC 2020)
Why look at NoSQL Security ?
The requirements of database
storage systems have changed
They become popular
● Scalability
● Redundancy
● Flexibility
● Rapid Development/Deployment
● Low Cost
● Easy to Use
2 | NOSQL BreakDown: A Large-scale Analysis of misconfigured NoSQL Services
NoSQL means “No Security”?
Most NoSQL services offer built-in security features
... but ...
Not enabled by default
Not trivial to configure for non-expert users
Instance is exposed to the Internet
MISCONFIGURATIONS
Information Leakage
Data Tampering
3 | NOSQL BreakDown: A Large-scale Analysis of misconfigured NoSQL Services
Threat Scenarios
Data Leakage
(Reading Privileges)
Ransom Demand
(Writing Privileges)
Web Resource Tampering
(Writing Privileges)
4 | NOSQL BreakDown: A Large-scale Analysis of misconfigured NoSQL Services
Vulnerable Instances...Hacked in the Wild
pandasecurity.com
thehackernews.com
5 | NOSQL BreakDown: A Large-scale Analysis of misconfigured NoSQL Services
Vulnerable Instances...Hacked in the Wild
pandasecurity.co
m
thehackernews.com
6 | NOSQL BreakDown: A Large-scale Analysis of misconfigured NoSQL Services
Vulnerable Instances...Hacked in the Wild
pandasecurity.co
m
thehackernews.com
7 | NOSQL BreakDown: A Large-scale Analysis of misconfigured NoSQL Services
Research Goals
Large-scale analysis of the usage of NoSQL services
1. Identify unprotected instances
2. Measure the impact of the misconfigurations
3. Raise awareness on the risk of data leakage and tampering
8 | NOSQL BreakDown: A Large-scale Analysis of misconfigured NoSQL Services
A Word of Warning: Ethical Concerns
●...


Instruction: 总结这篇安全研究的主要观点

Input:
title:NoSQL Breakdown: A Large-scale Analysis of Misconfigured NoSQL Services
author:Dario Ferrari and
Michele Carminati and
Mario Polino and
Stefano Zanero
A Large-scale Analysis of misconfigured NoSQL Services
NoSQL BreakDown:
Dario Ferrari, Michele Carminati, Mario Polino, and Stefano Zanero
Politecnico di Milano
Annual Computer Security Applications Conference (ACSAC 2020)
Why look at NoSQL Security ?
The requirements of database
storage systems have changed
They become popular
● Scalability
● Redundancy
● Flexibility
● Rapid Development/Deployment
● Low Cost
● Easy to Use
2 | NOSQL BreakDown: A Large-scale Analysis of misconfigured NoSQL Services
NoSQL means “No Security”?
Most NoSQL services offer built-in security features
... but ...
Not enabled by default
Not trivial to configure for non-expert users
Instance is exposed to the Internet
MISCONFIGURATIONS
Information Leakage
Data Tampering
3 | NOSQL BreakDown: A Large-scale Analysis of misconfigured NoSQL Services
Threat Scenarios
Data Leakage
(Reading Privileges)
Ransom Demand
(Writing Privileges)
Web Resource Tampering
(Writing Privileges)
4 | NOSQL BreakDown: A Large-scale Analysis of misconfigured NoSQL Services
Vulnerable Instances...Hacked in the Wild
pandasecurity.com
thehackernews.com
5 | NOSQL BreakDown: A Large-scale Analysis of misconfigured NoSQL Services
Vulnerable Instances...Hacked in the Wild
pandasecurity.co
m
thehackernews.com
6 | NOSQL BreakDown: A Large-scale Analysis of misconfigured NoSQL Services
Vulnerable Instances...Hacked in the Wild
pandasecurity.co
m
thehackernews.com
7 | NOSQL BreakDown: A Large-scale Analysis of misconfigured NoSQL Services
Research Goals
Large-scale analysis of the usage of NoSQL services
1. Identify unprotected instances
2. Measure the impact of the misconfigurations
3. Raise awareness on the risk of data leakage and tampering
8 | NOSQL BreakDown: A Large-scale Analysis of misconfigured NoSQL Services
A Word of Warning: Ethical Concerns
●...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Honeypots: Catching the Insider Threat
author:Lance Spitzner
Honeypots: Catching the Insider Threat
Lance Spitzner
Honeypot Technologies Inc
lance@honeypots.com
Abstract
into  honeypot
technologies,  primarily
In  the  past  several  years  there  has  been  extensive
research
for
detection  and  information  gathering  against  external
threats.  However, little research has been done for one of
the  most  dangerous  threats,  the  advance  insider,  the
trusted  individual who knows your internal organization.
These  individuals  are  not  after  your  systems,  they  are
after  your  information.    This  presentation  discusses  how
honeypot technologies can be used to detect, identify, and
gather information on these specific threats.
1.
Introduction
Honeypots  are  a  powerful,  new  technology  with
incredible  potential.    They  can  do  everything  from
detecting  new  attacks  never  seen  in  the  wild  before,  to
tracking automated credit card fraud and identity theft.  In
the past several years we have seen the technology rapidly
develop,  with  new  concepts  such  as  honeypot  farms,
commercial  and  open  source  solutions,  and  documented
findings  released.   However, a  great deal  of  research has
been  focused  on  identifying,  capturing,  and  researching
external  threats.    While  malicious  and  dangerous,  these
attacks are often random with attackers more interested in
how  many  systems  they  can  break  into  then  which
systems  they  break  into.    To  date,  limited  research  has
been  done  on  how  honeypots  can  apply  to  a  far  more
dangerous  and  devastating  threat,  the  advanced  insider.
This
individual  knows  your  networks  and
organization.    Often,  these  individuals  are  not  after
computers,  but  specific  information.    This  is  a  risk  that
has  proven  far  more  dangerous,  and  far  more  difficult  to
mitigate.
trusted
This  paper  attempts  to  ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Honeypots: Catching the Insider Threat
author:Lance Spitzner
Honeypots: Catching the Insider Threat
Lance Spitzner
Honeypot Technologies Inc
lance@honeypots.com
Abstract
into  honeypot
technologies,  primarily
In  the  past  several  years  there  has  been  extensive
research
for
detection  and  information  gathering  against  external
threats.  However, little research has been done for one of
the  most  dangerous  threats,  the  advance  insider,  the
trusted  individual who knows your internal organization.
These  individuals  are  not  after  your  systems,  they  are
after  your  information.    This  presentation  discusses  how
honeypot technologies can be used to detect, identify, and
gather information on these specific threats.
1.
Introduction
Honeypots  are  a  powerful,  new  technology  with
incredible  potential.    They  can  do  everything  from
detecting  new  attacks  never  seen  in  the  wild  before,  to
tracking automated credit card fraud and identity theft.  In
the past several years we have seen the technology rapidly
develop,  with  new  concepts  such  as  honeypot  farms,
commercial  and  open  source  solutions,  and  documented
findings  released.   However, a  great deal  of  research has
been  focused  on  identifying,  capturing,  and  researching
external  threats.    While  malicious  and  dangerous,  these
attacks are often random with attackers more interested in
how  many  systems  they  can  break  into  then  which
systems  they  break  into.    To  date,  limited  research  has
been  done  on  how  honeypots  can  apply  to  a  far  more
dangerous  and  devastating  threat,  the  advanced  insider.
This
individual  knows  your  networks  and
organization.    Often,  these  individuals  are  not  after
computers,  but  specific  information.    This  is  a  risk  that
has  proven  far  more  dangerous,  and  far  more  difficult  to
mitigate.
trusted
This  paper  attempts  to  ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Dynamic Application-Layer Protocol Analysis for Network Intrusion
Detection
author:Holger Dreger and
Anja Feldmann
Dynamic Application-Layer Protocol Analysis
for Network Intrusion Detection
Holger Dreger
TU M¨unchen
dreger@in.tum.de
Anja Feldmann
TU M¨unchen
feldmann@in.tum.de
Michael Mai
TU M¨unchen
maim@in.tum.de
Vern Paxson
ICSI/LBNL
vern@icir.org
Robin Sommer
ICSI
robin@icir.org
Abstract
Many network intrusion detection systems (NIDS) rely
on protocol-speciﬁc analyzers to extract the higher-level
semantic context from a trafﬁc stream. To select the cor-
rect kind of analysis, traditional systems exclusively de-
pend on well-known port numbers. However, based on
our experience, increasingly signiﬁcant portions of to-
day’s trafﬁc are not classiﬁable by such a scheme. Yet for
a NIDS, this trafﬁc is very interesting, as a primary rea-
son for not using a standard port is to evade security and
policy enforcement monitoring. In this paper, we dis-
cuss the design and implementation of a NIDS extension
to perform dynamic application-layer protocol analysis.
For each connection, the system ﬁrst identiﬁes potential
protocols in use and then activates appropriate analyz-
ers to verify the decision and extract higher-level seman-
tics. We demonstrate the power of our enhancement with
three examples: reliable detection of applications not us-
ing their standard ports, payload inspection of FTP data
transfers, and detection of IRC-based botnet clients and
servers. Prototypes of our system currently run at the
border of three large-scale operational networks. Due to
its success, the bot-detection is already integrated into a
dynamic inline blocking of production trafﬁc at one of
the sites.
1 Introduction
Network intrusion detection systems (NIDSs) analyze
streams of network packets in order to detect attacks
and, more generally, violations of a site’s security pol-
icy. NIDSs often rely on protocol-speciﬁc analyzers to
extract the higher-level semantic context associa...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Dynamic Application-Layer Protocol Analysis for Network Intrusion
Detection
author:Holger Dreger and
Anja Feldmann
Dynamic Application-Layer Protocol Analysis
for Network Intrusion Detection
Holger Dreger
TU M¨unchen
dreger@in.tum.de
Anja Feldmann
TU M¨unchen
feldmann@in.tum.de
Michael Mai
TU M¨unchen
maim@in.tum.de
Vern Paxson
ICSI/LBNL
vern@icir.org
Robin Sommer
ICSI
robin@icir.org
Abstract
Many network intrusion detection systems (NIDS) rely
on protocol-speciﬁc analyzers to extract the higher-level
semantic context from a trafﬁc stream. To select the cor-
rect kind of analysis, traditional systems exclusively de-
pend on well-known port numbers. However, based on
our experience, increasingly signiﬁcant portions of to-
day’s trafﬁc are not classiﬁable by such a scheme. Yet for
a NIDS, this trafﬁc is very interesting, as a primary rea-
son for not using a standard port is to evade security and
policy enforcement monitoring. In this paper, we dis-
cuss the design and implementation of a NIDS extension
to perform dynamic application-layer protocol analysis.
For each connection, the system ﬁrst identiﬁes potential
protocols in use and then activates appropriate analyz-
ers to verify the decision and extract higher-level seman-
tics. We demonstrate the power of our enhancement with
three examples: reliable detection of applications not us-
ing their standard ports, payload inspection of FTP data
transfers, and detection of IRC-based botnet clients and
servers. Prototypes of our system currently run at the
border of three large-scale operational networks. Due to
its success, the bot-detection is already integrated into a
dynamic inline blocking of production trafﬁc at one of
the sites.
1 Introduction
Network intrusion detection systems (NIDSs) analyze
streams of network packets in order to detect attacks
and, more generally, violations of a site’s security pol-
icy. NIDSs often rely on protocol-speciﬁc analyzers to
extract the higher-level semantic context associa...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:RiskTeller: Predicting the Risk of Cyber Incidents
author:Leyla Bilge and
Yufei Han and
Matteo Dell'Amico
RiskTeller: Predicting the Risk of Cyber Incidents
Leyla Bilge
Yufei Han
Matteo Dell’Amico
Symantec Research Labs
matteo_dellamico@symantec.com
Symantec Research Labs
leyla_bilge@symantec.com
Symantec Research Labs
yufei_han@symantec.com
ABSTRACT
The current evolution of the cyber-threat ecosystem shows that no
system can be considered invulnerable. It is therefore important
to quantify the risk level within a system and devise risk predic-
tion methods such that proactive measures can be taken to reduce
the damage of cyber attacks. We present RiskTeller, a system that
analyzes binary file appearance logs of machines to predict which
machines are at risk of infection months in advance. Risk prediction
models are built by creating, for each machine, a comprehensive
profile capturing its usage patterns, and then associating each pro-
file to a risk level through both fully and semi-supervised learning
methods. We evaluate RiskTeller on a year-long dataset containing
information about all the binaries appearing on machines of 18
enterprises. We show that RiskTeller can use the machine profile
computed for a given machine to predict subsequent infections
with the highest prediction precision achieved to date.
1 INTRODUCTION
Over the last two decades, the cyber-threat ecosystem faced dra-
matic changes. On the one hand, attackers now use sophisticated
tools and techniques to breach systems [32]; on the other hand,
the stakes at risk become larger every year. Experian reports that
almost half of business organizations suffer at least one security
incident per year [8]; despite the efforts in developing and defend-
ing secure systems, hardly anybody in the industry – especially in
large organizations – can feel that their infrastructure is invulnera-
ble. Rather than wondering if they would be victims of malicious
actions, IT administrators are shifting towards t...


Instruction: 总结这篇安全研究的主要观点

Input:
title:RiskTeller: Predicting the Risk of Cyber Incidents
author:Leyla Bilge and
Yufei Han and
Matteo Dell'Amico
RiskTeller: Predicting the Risk of Cyber Incidents
Leyla Bilge
Yufei Han
Matteo Dell’Amico
Symantec Research Labs
matteo_dellamico@symantec.com
Symantec Research Labs
leyla_bilge@symantec.com
Symantec Research Labs
yufei_han@symantec.com
ABSTRACT
The current evolution of the cyber-threat ecosystem shows that no
system can be considered invulnerable. It is therefore important
to quantify the risk level within a system and devise risk predic-
tion methods such that proactive measures can be taken to reduce
the damage of cyber attacks. We present RiskTeller, a system that
analyzes binary file appearance logs of machines to predict which
machines are at risk of infection months in advance. Risk prediction
models are built by creating, for each machine, a comprehensive
profile capturing its usage patterns, and then associating each pro-
file to a risk level through both fully and semi-supervised learning
methods. We evaluate RiskTeller on a year-long dataset containing
information about all the binaries appearing on machines of 18
enterprises. We show that RiskTeller can use the machine profile
computed for a given machine to predict subsequent infections
with the highest prediction precision achieved to date.
1 INTRODUCTION
Over the last two decades, the cyber-threat ecosystem faced dra-
matic changes. On the one hand, attackers now use sophisticated
tools and techniques to breach systems [32]; on the other hand,
the stakes at risk become larger every year. Experian reports that
almost half of business organizations suffer at least one security
incident per year [8]; despite the efforts in developing and defend-
ing secure systems, hardly anybody in the industry – especially in
large organizations – can feel that their infrastructure is invulnera-
ble. Rather than wondering if they would be victims of malicious
actions, IT administrators are shifting towards t...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。