Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Measurement-based Characterization of a Collection of On-line Games
(Awarded Best Student Paper!)
author:Chris Chambers and
Wu-chang Feng and
Sambit Sahu and
Debanjan Saha
Measurement-based Characterization of a Collection of On-line Games
Chris Chambers Wu-chang Feng
{chambers,wuchang}@cs.pdx.edu
Portland State University
Sambit Sahu Debanjan Saha
{ssahu,dsaha}@us.ibm.com
IBM Research
Abstract
On-line games are a rapidly growing Internet application.
Because of the cost in supporting on-line games and the un-
predictable load on servers, companies are moving toward
sharing infrastructure for game hosting. To efﬁciently pro-
vision on-line games, it is important to understand game
workloads and the behavior of game players. In this pa-
per, we present a comprehensive analysis of a collection
of on-line game players and game workloads using data
from several sources including: a 13-month trace of an ex-
tremely busy game server containing over 2.8 million con-
nections, a two-year trace of the aggregate game popula-
tions of over 550 on-line games, and a 4-month trace of
a content-distribution network used to deliver games. The
key ﬁndings from our measurement study are: (1) these
gamers are an extremely difﬁcult set of users to satisfy and
unless game servers are properly set up and provisioned,
gamers quickly choose to go elsewhere, (2) the popularity
of these games follows a power law making games difﬁ-
cult to provision at launch time, (3) game workloads are
predictable only over short-term intervals, (4) there are sig-
niﬁcant challenges in hosting games on shared infrastruc-
ture due to temporal and geographic synchronization across
different games and other interactive applications, and (5)
game software updates are a signiﬁcent burden on game
hosting that must be planned for. Our results have impli-
cations for both game publishers as well as infrastructure
providers.
1
Introduction
On-line gaming is an increasingly popular form of enter-
tainment on th...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Measurement-based Characterization of a Collection of On-line Games
(Awarded Best Student Paper!)
author:Chris Chambers and
Wu-chang Feng and
Sambit Sahu and
Debanjan Saha
Measurement-based Characterization of a Collection of On-line Games
Chris Chambers Wu-chang Feng
{chambers,wuchang}@cs.pdx.edu
Portland State University
Sambit Sahu Debanjan Saha
{ssahu,dsaha}@us.ibm.com
IBM Research
Abstract
On-line games are a rapidly growing Internet application.
Because of the cost in supporting on-line games and the un-
predictable load on servers, companies are moving toward
sharing infrastructure for game hosting. To efﬁciently pro-
vision on-line games, it is important to understand game
workloads and the behavior of game players. In this pa-
per, we present a comprehensive analysis of a collection
of on-line game players and game workloads using data
from several sources including: a 13-month trace of an ex-
tremely busy game server containing over 2.8 million con-
nections, a two-year trace of the aggregate game popula-
tions of over 550 on-line games, and a 4-month trace of
a content-distribution network used to deliver games. The
key ﬁndings from our measurement study are: (1) these
gamers are an extremely difﬁcult set of users to satisfy and
unless game servers are properly set up and provisioned,
gamers quickly choose to go elsewhere, (2) the popularity
of these games follows a power law making games difﬁ-
cult to provision at launch time, (3) game workloads are
predictable only over short-term intervals, (4) there are sig-
niﬁcant challenges in hosting games on shared infrastruc-
ture due to temporal and geographic synchronization across
different games and other interactive applications, and (5)
game software updates are a signiﬁcent burden on game
hosting that must be planned for. Our results have impli-
cations for both game publishers as well as infrastructure
providers.
1
Introduction
On-line gaming is an increasingly popular form of enter-
tainment on th...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:OSLO: Improving the Security of Trusted Computing
author:Bernhard Kauer
OSLO: Improving the security of Trusted Computing
Bernhard Kauer
Technische Universität Dresden
Department of Computer Science
01062 Dresden, Germany
kauer@os.inf.tu-dresden.de
Abstract
• How to ensure that only a particular software stack
can access a stored secret? (Sealed Memory)
In this paper we describe bugs and ways to attack
trusted computing systems based on a static root of trust
such as Microsoft’s Bitlocker. We propose to use the dy-
namic root of trust feature of newer x86 processors as
this shortens the trust chain, can minimize the Trusted
Computing Base of applications and is less vulnerable
to TPM and BIOS attacks. To support our claim we
implemented the Open Secure LOader (OSLO), the ﬁrst
publicly available bootloader based on AMDs skinit
instruction.
1
Introduction
An increasing number of Computing Platforms with
a Trusted Platform Module (TPM) [33] are deployed.
Applications using these chips are not widely used yet
[5, 37]. This will change rapidly with the distribution
of Microsoft’s Bitlocker [2], a disk encryption utility
which is part of Windows Vista Ultimate. As the trusted
computing technology behind these applications is quite
new, there is not much experience concerning the secu-
rity of trusted computing systems.
In this context we
analyzed the security of TPMs, BIOSes and bootloaders
that consitute the basic building blocks of trusted com-
puting implementations. Furthermore, we propose a de-
sign that can improve the security of such implementa-
tions.
1.1 Trusted Computing
Trusted Computing [9,23,25,33] is a technology that
tries two answer two questions:
• Which software is running on a remote computer?
(Remote Attestation)
Different scenarios can be built on top of trusted com-
puting, for example, multi-factor authentication [37],
hard disk encryption [2,5] or the widely disputed Digital
Rights Management. All of these applications are based
on a small c...


Instruction: 总结这篇安全研究的主要观点

Input:
title:OSLO: Improving the Security of Trusted Computing
author:Bernhard Kauer
OSLO: Improving the security of Trusted Computing
Bernhard Kauer
Technische Universität Dresden
Department of Computer Science
01062 Dresden, Germany
kauer@os.inf.tu-dresden.de
Abstract
• How to ensure that only a particular software stack
can access a stored secret? (Sealed Memory)
In this paper we describe bugs and ways to attack
trusted computing systems based on a static root of trust
such as Microsoft’s Bitlocker. We propose to use the dy-
namic root of trust feature of newer x86 processors as
this shortens the trust chain, can minimize the Trusted
Computing Base of applications and is less vulnerable
to TPM and BIOS attacks. To support our claim we
implemented the Open Secure LOader (OSLO), the ﬁrst
publicly available bootloader based on AMDs skinit
instruction.
1
Introduction
An increasing number of Computing Platforms with
a Trusted Platform Module (TPM) [33] are deployed.
Applications using these chips are not widely used yet
[5, 37]. This will change rapidly with the distribution
of Microsoft’s Bitlocker [2], a disk encryption utility
which is part of Windows Vista Ultimate. As the trusted
computing technology behind these applications is quite
new, there is not much experience concerning the secu-
rity of trusted computing systems.
In this context we
analyzed the security of TPMs, BIOSes and bootloaders
that consitute the basic building blocks of trusted com-
puting implementations. Furthermore, we propose a de-
sign that can improve the security of such implementa-
tions.
1.1 Trusted Computing
Trusted Computing [9,23,25,33] is a technology that
tries two answer two questions:
• Which software is running on a remote computer?
(Remote Attestation)
Different scenarios can be built on top of trusted com-
puting, for example, multi-factor authentication [37],
hard disk encryption [2,5] or the widely disputed Digital
Rights Management. All of these applications are based
on a small c...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Finding Dependencies between Cyber-Physical Domains for Security Testing
of Industrial Control Systems
author:John Henry Castellanos and
Mart'ın Ochoa and
Jianying Zhou
Finding Dependencies between Cyber-Physical Domains for
Security Testing of Industrial Control Systems
John H. Castellanos
Martín Ochoa
Singapore University of Technology
Department of Applied Mathematics
Singapore University of Technology
Jianying Zhou
and Design
Singapore
jianying_zhou@sutd.edu.sg
john_castellanos@mymail.sutd.edu.
and Design
Singapore
sg
and Computer Science
Universidad del Rosario
Bogotá, Colombia
martin.ochoa@urosario.edu.co
ABSTRACT
In modern societies, critical services such as transportation, power
supply, water treatment and distribution are strongly dependent
on Industrial Control Systems (ICS). As technology moves along,
new features improve services provided by such ICS. On the other
hand, this progress also introduces new risks of cyber attacks due
to the multiple direct and indirect dependencies between cyber and
physical components of such systems. Performing rigorous security
tests and risk analysis in these critical systems is thus a challenging
task, because of the non-trivial interactions between digital and
physical assets and the domain-specic knowledge necessary to
analyse a particular system. In this work, we propose a methodology
to model and analyse a System Under Test (SUT) as a data ow graph
that highlights interactions among internal entities throughout
the SUT. This model is automatically extracted from production
code available in Programmable Logic Controllers (PLCs). We also
propose a reachability algorithm and an attack diagram that will
emphasize the dependencies between cyber and physical domains,
thus enabling a human analyst to gauge various attack vectors that
arise from subtle dependencies in data and information propagation.
We test our methodology in a functional water treatment testbed
and demonstrate how an analyst could make use...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Finding Dependencies between Cyber-Physical Domains for Security Testing
of Industrial Control Systems
author:John Henry Castellanos and
Mart'ın Ochoa and
Jianying Zhou
Finding Dependencies between Cyber-Physical Domains for
Security Testing of Industrial Control Systems
John H. Castellanos
Martín Ochoa
Singapore University of Technology
Department of Applied Mathematics
Singapore University of Technology
Jianying Zhou
and Design
Singapore
jianying_zhou@sutd.edu.sg
john_castellanos@mymail.sutd.edu.
and Design
Singapore
sg
and Computer Science
Universidad del Rosario
Bogotá, Colombia
martin.ochoa@urosario.edu.co
ABSTRACT
In modern societies, critical services such as transportation, power
supply, water treatment and distribution are strongly dependent
on Industrial Control Systems (ICS). As technology moves along,
new features improve services provided by such ICS. On the other
hand, this progress also introduces new risks of cyber attacks due
to the multiple direct and indirect dependencies between cyber and
physical components of such systems. Performing rigorous security
tests and risk analysis in these critical systems is thus a challenging
task, because of the non-trivial interactions between digital and
physical assets and the domain-specic knowledge necessary to
analyse a particular system. In this work, we propose a methodology
to model and analyse a System Under Test (SUT) as a data ow graph
that highlights interactions among internal entities throughout
the SUT. This model is automatically extracted from production
code available in Programmable Logic Controllers (PLCs). We also
propose a reachability algorithm and an attack diagram that will
emphasize the dependencies between cyber and physical domains,
thus enabling a human analyst to gauge various attack vectors that
arise from subtle dependencies in data and information propagation.
We test our methodology in a functional water treatment testbed
and demonstrate how an analyst could make use...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:DAIS: A Real-Time Data Attack Isolation System for Commercial
Database Applications
author:Peng Liu
DAIS: A Real-time Data Attack Isolation System for Commercial Database
Applications
Department of Information Systems, UMBC
Peng Liu
Baltimore, MD 21250
pliu@umbc.edu
Abstract
Traditional database security mechanisms are very lim-
ited in defending successful data attacks. Authorized but
malicious transactions can make a database useless by im-
pairing its integrity and availability. This paper presents the
design of a real-time data attack isolation system, denoted
DAIS. DAIS isolates likely suspicious actions before a deﬁ-
nite determination of intrusion is reported. In this way, the
database can be immunized from many malicious transac-
tions. DAIS is a COTS-DBMS-speciﬁc implementation of a
general isolation algorithm that we developed in [19]. In
this paper, the design of the ﬁrst DAIS prototype, which is
for Oracle Server 8.1.6, is discussed. DAIS uses triggers
and transaction proﬁles to keep track of the items read and
written by transactions, isolates attacks by rewriting user
SQL statements, and is transparent to end users. The DAIS
design is very general. In addition to Oracle, it can be easily
adapted to support many other database application plat-
forms such as Microsoft SQL Server, Sybase, and Informix.
Keywords: Isolation, Intrusion Tolerance, Database Secu-
rity
1 Introduction
Database security concerns the conﬁdentiality, integrity,
and availability of data stored in a database. A broad span of
research from authorization [9, 28, 14], to inference control
[1], to multilevel secure databases [33, 31], and to multi-
level secure transaction processing [3], addresses primarily
how to protect the security of a database, especially its con-
ﬁdentiality. However, very limited research has been done
on how to survive successful database attacks, which can
seriously impair the integrity and availability of a database.
Experience with data-intensive appl...


Instruction: 总结这篇安全研究的主要观点

Input:
title:DAIS: A Real-Time Data Attack Isolation System for Commercial
Database Applications
author:Peng Liu
DAIS: A Real-time Data Attack Isolation System for Commercial Database
Applications
Department of Information Systems, UMBC
Peng Liu
Baltimore, MD 21250
pliu@umbc.edu
Abstract
Traditional database security mechanisms are very lim-
ited in defending successful data attacks. Authorized but
malicious transactions can make a database useless by im-
pairing its integrity and availability. This paper presents the
design of a real-time data attack isolation system, denoted
DAIS. DAIS isolates likely suspicious actions before a deﬁ-
nite determination of intrusion is reported. In this way, the
database can be immunized from many malicious transac-
tions. DAIS is a COTS-DBMS-speciﬁc implementation of a
general isolation algorithm that we developed in [19]. In
this paper, the design of the ﬁrst DAIS prototype, which is
for Oracle Server 8.1.6, is discussed. DAIS uses triggers
and transaction proﬁles to keep track of the items read and
written by transactions, isolates attacks by rewriting user
SQL statements, and is transparent to end users. The DAIS
design is very general. In addition to Oracle, it can be easily
adapted to support many other database application plat-
forms such as Microsoft SQL Server, Sybase, and Informix.
Keywords: Isolation, Intrusion Tolerance, Database Secu-
rity
1 Introduction
Database security concerns the conﬁdentiality, integrity,
and availability of data stored in a database. A broad span of
research from authorization [9, 28, 14], to inference control
[1], to multilevel secure databases [33, 31], and to multi-
level secure transaction processing [3], addresses primarily
how to protect the security of a database, especially its con-
ﬁdentiality. However, very limited research has been done
on how to survive successful database attacks, which can
seriously impair the integrity and availability of a database.
Experience with data-intensive appl...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Sequence Number-Based MAC Address Spoof Detection
author:Fanglu Guo and
Tzi-cker Chiueh
Sequence Number-Based MAC Address Spoof
Detection
Fanglu Guo and Tzi-cker Chiueh
Computer Science Department,
Stony Brook University, NY 11794
{fanglu, chiueh}@cs.sunysb.edu
Abstract. The exponential growth in the deployment of IEEE 802.11-
based wireless LAN (WLAN) in enterprises and homes makes WLAN
an attractive target for attackers. Attacks that exploit vulnerabilities at
the IP layer or above can be readily addressed by intrusion detection
systems designed for wired networks. However, attacks exploiting link-
layer protocol vulnerabilities require a diﬀerent set of intrusion detection
mechanism. Most link-layer attacks in WLANs are denial of service at-
tacks and work by spooﬁng either access points (APs) or wireless sta-
tions. Spooﬁng is possible because the IEEE 802.11 standard does not
provide per-frame source authentication, but can be eﬀectively prevented
if a proper authentication is added into the standard. Unfortunately, it is
unlikely that commercial WLANs will support link-layer source authen-
tication that covers both management and control frames in the near
future. Even if it is available in next-generation WLANs equipments, it
cannot protect the large installed base of legacy WLAN devices. This pa-
per proposes an algorithm to detect spooﬁng by leveraging the sequence
number ﬁeld in the link-layer header of IEEE 802.11 frames, and demon-
strates how it can detect various spooﬁng without modifying the APs
or wireless stations. The false positive rate of the proposed algorithm is
zero, and the false negative rate is close to zero. In the worst case, the
proposed algorithm can detect a spooﬁng activity, even though it can
only detect some but not all spoofed frames.
Keywords: Wireless LAN MAC spoof detection, Sequence number,
WLAN monitoring and intrusion detection.
1 Introduction
The enormous popularity of IEEE 802.11-based wireless LAN (WLAN) makes it
a h...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Sequence Number-Based MAC Address Spoof Detection
author:Fanglu Guo and
Tzi-cker Chiueh
Sequence Number-Based MAC Address Spoof
Detection
Fanglu Guo and Tzi-cker Chiueh
Computer Science Department,
Stony Brook University, NY 11794
{fanglu, chiueh}@cs.sunysb.edu
Abstract. The exponential growth in the deployment of IEEE 802.11-
based wireless LAN (WLAN) in enterprises and homes makes WLAN
an attractive target for attackers. Attacks that exploit vulnerabilities at
the IP layer or above can be readily addressed by intrusion detection
systems designed for wired networks. However, attacks exploiting link-
layer protocol vulnerabilities require a diﬀerent set of intrusion detection
mechanism. Most link-layer attacks in WLANs are denial of service at-
tacks and work by spooﬁng either access points (APs) or wireless sta-
tions. Spooﬁng is possible because the IEEE 802.11 standard does not
provide per-frame source authentication, but can be eﬀectively prevented
if a proper authentication is added into the standard. Unfortunately, it is
unlikely that commercial WLANs will support link-layer source authen-
tication that covers both management and control frames in the near
future. Even if it is available in next-generation WLANs equipments, it
cannot protect the large installed base of legacy WLAN devices. This pa-
per proposes an algorithm to detect spooﬁng by leveraging the sequence
number ﬁeld in the link-layer header of IEEE 802.11 frames, and demon-
strates how it can detect various spooﬁng without modifying the APs
or wireless stations. The false positive rate of the proposed algorithm is
zero, and the false negative rate is close to zero. In the worst case, the
proposed algorithm can detect a spooﬁng activity, even though it can
only detect some but not all spoofed frames.
Keywords: Wireless LAN MAC spoof detection, Sequence number,
WLAN monitoring and intrusion detection.
1 Introduction
The enormous popularity of IEEE 802.11-based wireless LAN (WLAN) makes it
a h...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Assessing DNS Vulnerability to Record Injection
author:Kyle Schomp and
Tom Callahan and
Michael Rabinovich and
Mark Allman
Assessing DNS Vulnerability to Record Injection(cid:2)
Kyle Schomp1, Tom Callahan1, Michael Rabinovich1, and Mark Allman2
1 Case Western Reserve University, Cleveland, OH, USA
2 International Computer Science Institute, Berkeley, CA, USA
Abstract. The Domain Name System (DNS) is a critical component of the In-
ternet infrastructure as it maps human-readable names to IP addresses. Injecting
fraudulent mappings allows an attacker to divert users from intended destinations
to those of an attacker’s choosing. In this paper, we measure the Internet’s vul-
nerability to DNS record injection attacks—including a new attack we uncover.
We ﬁnd that record injection vulnerabilities are fairly common—even years after
some of them were ﬁrst uncovered.
Keywords: Domain Name System (DNS), Measurement, Security, Cache
Poisoning.
1 Introduction
The Domain Name System (DNS) is a critical component of the Internet infrastruc-
ture. DNS maps human-readable hostnames (e.g., “amazon.com”) to IP addresses and
is involved to some degree in most Internet transactions. Given the foundational role
of DNS in today’s Internet, DNS security has a profound effect on the overall security,
trust, and operability of the network. In particular, substituting an authoritative map-
ping with a fraudulent record allows an attacker to divert user access to nefarious hosts
with implications ranging from replacing the original content and phishing attacks to
installing malware on client hosts. In this paper, we measure the prevalence of DNS
vulnerabilities to attacks designed to substitute the authoritative mapping. Collectively,
these attacks are known as “record injection” attacks. We consider known attacks and a
new vulnerability we uncover, as well as the extent of the adoption of suggested best-
practice defenses.
Fraudulent hostname-to-IP address mappings originate in two pl...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Assessing DNS Vulnerability to Record Injection
author:Kyle Schomp and
Tom Callahan and
Michael Rabinovich and
Mark Allman
Assessing DNS Vulnerability to Record Injection(cid:2)
Kyle Schomp1, Tom Callahan1, Michael Rabinovich1, and Mark Allman2
1 Case Western Reserve University, Cleveland, OH, USA
2 International Computer Science Institute, Berkeley, CA, USA
Abstract. The Domain Name System (DNS) is a critical component of the In-
ternet infrastructure as it maps human-readable names to IP addresses. Injecting
fraudulent mappings allows an attacker to divert users from intended destinations
to those of an attacker’s choosing. In this paper, we measure the Internet’s vul-
nerability to DNS record injection attacks—including a new attack we uncover.
We ﬁnd that record injection vulnerabilities are fairly common—even years after
some of them were ﬁrst uncovered.
Keywords: Domain Name System (DNS), Measurement, Security, Cache
Poisoning.
1 Introduction
The Domain Name System (DNS) is a critical component of the Internet infrastruc-
ture. DNS maps human-readable hostnames (e.g., “amazon.com”) to IP addresses and
is involved to some degree in most Internet transactions. Given the foundational role
of DNS in today’s Internet, DNS security has a profound effect on the overall security,
trust, and operability of the network. In particular, substituting an authoritative map-
ping with a fraudulent record allows an attacker to divert user access to nefarious hosts
with implications ranging from replacing the original content and phishing attacks to
installing malware on client hosts. In this paper, we measure the prevalence of DNS
vulnerabilities to attacks designed to substitute the authoritative mapping. Collectively,
these attacks are known as “record injection” attacks. We consider known attacks and a
new vulnerability we uncover, as well as the extent of the adoption of suggested best-
practice defenses.
Fraudulent hostname-to-IP address mappings originate in two pl...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Return to the Zombie Gadgets: Undermining Destructive Code Reads via
Code Inference Attacks
author:Kevin Z. Snow and
Roman Rogowski and
Jan Werner and
Hyungjoon Koo and
Fabian Monrose and
Michalis Polychronakis
2016 IEEE Symposium on Security and Privacy
2016 IEEE Symposium on Security and Privacy
Return to the Zombie Gadgets: Undermining
Destructive Code Reads via Code Inference Attacks
Kevin Z. Snow, Roman Rogowski, Fabian Monrose
Department of Computer Science
University of North Carolina at Chapel Hill, USA
Email: kzsnow,rogowski,fabian@cs.unc.edu
Jan Werner
Renaissance Computing Institute (RENCI)
Chapel Hill, USA
Email: jjwerner@cs.unc.edu
Hyungjoon Koo, Michalis Polychronakis
Department of Computer Science
Stony Brook University, USA
Email: hykoo,mikepo@cs.stonybrook.edu
by chaining together existing code fragments within the ex-
ploited program. These code reuse attacks either link together
entire functions (i.e., return-to-libc attacks) or combine short
instruction sequences (dubbed gadgets) ending with ret,
call, or jmp instructions.
Abstract—The concept of destructive code reads is a new defen-
sive strategy that prevents code reuse attacks by coupling ﬁne-
grained address space layout randomization with a mitigation
for online knowledge gathering that destroys potentially useful
gadgets as they are disclosed by an adversary. The intuition is
that by destroying code as it is read, an adversary is left with
no usable gadgets to reuse in a control-ﬂow hijacking attack. In
this paper, we examine the security of this new mitigation. We
show that while the concept initially appeared promising, there
are several unforeseen attack tactics that render destructive code
reads ineffective in practice.
Speciﬁcally, we introduce techniques for leveraging constructive
reloads, wherein multiple copies of native code are loaded
into a process’ address space (either side-by-side or one-after-
another). Constructive reloads allow the adversary to disclose
one code cop...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Return to the Zombie Gadgets: Undermining Destructive Code Reads via
Code Inference Attacks
author:Kevin Z. Snow and
Roman Rogowski and
Jan Werner and
Hyungjoon Koo and
Fabian Monrose and
Michalis Polychronakis
2016 IEEE Symposium on Security and Privacy
2016 IEEE Symposium on Security and Privacy
Return to the Zombie Gadgets: Undermining
Destructive Code Reads via Code Inference Attacks
Kevin Z. Snow, Roman Rogowski, Fabian Monrose
Department of Computer Science
University of North Carolina at Chapel Hill, USA
Email: kzsnow,rogowski,fabian@cs.unc.edu
Jan Werner
Renaissance Computing Institute (RENCI)
Chapel Hill, USA
Email: jjwerner@cs.unc.edu
Hyungjoon Koo, Michalis Polychronakis
Department of Computer Science
Stony Brook University, USA
Email: hykoo,mikepo@cs.stonybrook.edu
by chaining together existing code fragments within the ex-
ploited program. These code reuse attacks either link together
entire functions (i.e., return-to-libc attacks) or combine short
instruction sequences (dubbed gadgets) ending with ret,
call, or jmp instructions.
Abstract—The concept of destructive code reads is a new defen-
sive strategy that prevents code reuse attacks by coupling ﬁne-
grained address space layout randomization with a mitigation
for online knowledge gathering that destroys potentially useful
gadgets as they are disclosed by an adversary. The intuition is
that by destroying code as it is read, an adversary is left with
no usable gadgets to reuse in a control-ﬂow hijacking attack. In
this paper, we examine the security of this new mitigation. We
show that while the concept initially appeared promising, there
are several unforeseen attack tactics that render destructive code
reads ineffective in practice.
Speciﬁcally, we introduce techniques for leveraging constructive
reloads, wherein multiple copies of native code are loaded
into a process’ address space (either side-by-side or one-after-
another). Constructive reloads allow the adversary to disclose
one code cop...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Pseudo-Honeypot: Toward Efficient and Scalable Spam Sniffer
author:Yihe Zhang and
Hao Zhang and
Xu Yuan and
Nian-Feng Tzeng
2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
Pseudo-honeypot: Toward Efﬁcient and Scalable
Spam Sniffer
Yihe Zhang∗, Hao Zhang†, Xu Yuan∗, and Nian-Feng Tzeng∗
∗ University of Louisiana at Lafayette, Lafayette, LA, USA
† IEEE Member, USA
affected users who inadvertently interacted with spammers
during the 2016 U.S. presidential election.
Abstract—Honeypot-based spammer gathering solutions usu-
ally lack attribute variability, deployment ﬂexibility, and net-
work scalability, deemed as their common drawbacks. This
paper explores pseudo-honeypot, a novel honeypot-like system
to overcome such drawbacks, for efﬁcient and scalable spammer
snifﬁng. The pseudo-honeypot takes advantage of user diversity
and selects normal accounts, with attributes that have the higher
potential of attracting spammers, as the parasitic bodies. By
harnessing such category of users, pseudo-honeypot can monitor
their streaming posts and behavioral patterns transparently.
When compared with its traditional honeypot counterpart, the
proposed solution offers the substantial advantages of attribute
variability, deployment ﬂexibility, network scalability, and system
portability. Meanwhile, it offers a novel method to collect the
social network dataset that has a higher probability of includ-
ing spams and spammers, without being noticed by advanced
spammers. We take the Twitter social network as an example
to exhibit its system design, including pseudo-honeypot nodes
selection, monitoring, feature extraction, ground truth label-
ing, and learning-based classiﬁcation. Through experiments, we
demonstrate the efﬁciency of pseudo-honeypot in terms of spams
and spammers gathering. In particular, we conﬁrm our solution
can garner spammers at least 19 times faster than the state-of-
the-art honeypot-based counterpart.
I. INTRODUCTI...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Pseudo-Honeypot: Toward Efficient and Scalable Spam Sniffer
author:Yihe Zhang and
Hao Zhang and
Xu Yuan and
Nian-Feng Tzeng
2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
Pseudo-honeypot: Toward Efﬁcient and Scalable
Spam Sniffer
Yihe Zhang∗, Hao Zhang†, Xu Yuan∗, and Nian-Feng Tzeng∗
∗ University of Louisiana at Lafayette, Lafayette, LA, USA
† IEEE Member, USA
affected users who inadvertently interacted with spammers
during the 2016 U.S. presidential election.
Abstract—Honeypot-based spammer gathering solutions usu-
ally lack attribute variability, deployment ﬂexibility, and net-
work scalability, deemed as their common drawbacks. This
paper explores pseudo-honeypot, a novel honeypot-like system
to overcome such drawbacks, for efﬁcient and scalable spammer
snifﬁng. The pseudo-honeypot takes advantage of user diversity
and selects normal accounts, with attributes that have the higher
potential of attracting spammers, as the parasitic bodies. By
harnessing such category of users, pseudo-honeypot can monitor
their streaming posts and behavioral patterns transparently.
When compared with its traditional honeypot counterpart, the
proposed solution offers the substantial advantages of attribute
variability, deployment ﬂexibility, network scalability, and system
portability. Meanwhile, it offers a novel method to collect the
social network dataset that has a higher probability of includ-
ing spams and spammers, without being noticed by advanced
spammers. We take the Twitter social network as an example
to exhibit its system design, including pseudo-honeypot nodes
selection, monitoring, feature extraction, ground truth label-
ing, and learning-based classiﬁcation. Through experiments, we
demonstrate the efﬁciency of pseudo-honeypot in terms of spams
and spammers gathering. In particular, we conﬁrm our solution
can garner spammers at least 19 times faster than the state-of-
the-art honeypot-based counterpart.
I. INTRODUCTI...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Turning the postal system into a generic digital communication mechanism
author:Randolph Y. Wang and
Sumeet Sobti and
Nitin Garg and
Elisha Ziskind and
Junwen Lai and
Arvind Krishnamurthy
Turning the Postal System into a Generic Digital
Communication Mechanism
Randolph Y. Wang∗
Sumeet Sobti∗
Nitin Garg∗
Elisha Ziskind∗
Junwen Lai∗
Arvind Krishnamurthy†
ABSTRACT
The phenomenon that rural residents and people with low incomes
lag behind in Internet access is known as the “digital divide.” This
problem is particularly acute in developing countries, where most
of the world’s population lives. Bridging this digital divide, es-
pecially by attempting to increase the accessibility of broadband
connectivity, can be challenging. The improvement of wide-area
connectivity is constrained by factors such as how quickly we can
dig ditches to bury ﬁbers in the ground; and the cost of furnishing
“last-mile” wiring can be prohibitively high.
In this paper, we explore the use of digital storage media trans-
ported by the postal system as a general digital communication
mechanism. While some companies have used the postal system
to deliver software and movies, none of them has turned the postal
system into a truly generic digital communication medium support-
ing a wide variety of applications. We call such a generic system
a Postmanet. Compared to traditional wide-area connectivity op-
tions, the Postmanet has several important advantages, including
wide global reach, great bandwidth potential and low cost.
Manually preparing mobile storage devices for shipment may ap-
pear deceptively simple, but with many applications, communicat-
ing parties and messages, manual management becomes infeasi-
ble, and systems support at several levels becomes necessary. We
explore the simultaneous exploitation of the Internet and the Post-
manet, so we can combine their latency and bandwidth advantages
to enable sophisticated bandwidth-intensive applications.
Categories and Subject Descriptors
...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Turning the postal system into a generic digital communication mechanism
author:Randolph Y. Wang and
Sumeet Sobti and
Nitin Garg and
Elisha Ziskind and
Junwen Lai and
Arvind Krishnamurthy
Turning the Postal System into a Generic Digital
Communication Mechanism
Randolph Y. Wang∗
Sumeet Sobti∗
Nitin Garg∗
Elisha Ziskind∗
Junwen Lai∗
Arvind Krishnamurthy†
ABSTRACT
The phenomenon that rural residents and people with low incomes
lag behind in Internet access is known as the “digital divide.” This
problem is particularly acute in developing countries, where most
of the world’s population lives. Bridging this digital divide, es-
pecially by attempting to increase the accessibility of broadband
connectivity, can be challenging. The improvement of wide-area
connectivity is constrained by factors such as how quickly we can
dig ditches to bury ﬁbers in the ground; and the cost of furnishing
“last-mile” wiring can be prohibitively high.
In this paper, we explore the use of digital storage media trans-
ported by the postal system as a general digital communication
mechanism. While some companies have used the postal system
to deliver software and movies, none of them has turned the postal
system into a truly generic digital communication medium support-
ing a wide variety of applications. We call such a generic system
a Postmanet. Compared to traditional wide-area connectivity op-
tions, the Postmanet has several important advantages, including
wide global reach, great bandwidth potential and low cost.
Manually preparing mobile storage devices for shipment may ap-
pear deceptively simple, but with many applications, communicat-
ing parties and messages, manual management becomes infeasi-
ble, and systems support at several levels becomes necessary. We
explore the simultaneous exploitation of the Internet and the Post-
manet, so we can combine their latency and bandwidth advantages
to enable sophisticated bandwidth-intensive applications.
Categories and Subject Descriptors
...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:SemFuzz: Semantics-based Automatic Generation of Proof-of-Concept
Exploits
author:Wei You and
Peiyuan Zong and
Kai Chen and
XiaoFeng Wang and
Xiaojing Liao and
Pan Bian and
Bin Liang
SemFuzz: Semantics-based Automatic Generation of
Proof-of-Concept Exploits
Wei You1, Peiyuan Zong2,3, Kai Chen2,3,∗, XiaoFeng Wang1,∗, Xiaojing Liao4, Pan Bian5, Bin Liang5
1School of Informatics and Computing, Indiana University Bloomington, Indiana, USA
2SKLOIS, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China
3School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China
4Department of Computer Science, William and Mary, Virginia, USA
5School of Information, Renmin University of China, Beijing, China
{youwei,xw7}@indiana.edu,{zongpeiyuan,chenkai}@iie.ac.cn,{xliao02}@wm.edu,{bianpan,liangb}@ruc.edu.cn
ABSTRACT
Patches and related information about so(cid:137)ware vulnerabilities are
o(cid:137)en made available to the public, aiming to facilitate timely (cid:128)xes.
Unfortunately, the slow paces of system updates (30 days on aver-
age) o(cid:137)en present to the a(cid:138)ackers enough time to recover hidden
bugs for a(cid:138)acking the unpatched systems. Making things worse is
the potential to automatically generate exploits on input-validation
(cid:131)aws through reverse-engineering patches, even though such vul-
nerabilities are relatively rare (e.g., 5% among all Linux kernel
vulnerabilities in last few years). Less understood, however, are the
implications of other bug-related information (e.g., bug descriptions
in CVE), particularly whether utilization of such information can
facilitate exploit generation, even on other vulnerability types that
have never been automatically a(cid:138)acked.
In this paper, we seek to use such information to generate proof-
of-concept (PoC) exploits for the vulnerability types never automat-
ically a(cid:138)acked. Unlike an input validation (cid:131)aw that is o(cid:137)en patched
by...


Instruction: 总结这篇安全研究的主要观点

Input:
title:SemFuzz: Semantics-based Automatic Generation of Proof-of-Concept
Exploits
author:Wei You and
Peiyuan Zong and
Kai Chen and
XiaoFeng Wang and
Xiaojing Liao and
Pan Bian and
Bin Liang
SemFuzz: Semantics-based Automatic Generation of
Proof-of-Concept Exploits
Wei You1, Peiyuan Zong2,3, Kai Chen2,3,∗, XiaoFeng Wang1,∗, Xiaojing Liao4, Pan Bian5, Bin Liang5
1School of Informatics and Computing, Indiana University Bloomington, Indiana, USA
2SKLOIS, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China
3School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China
4Department of Computer Science, William and Mary, Virginia, USA
5School of Information, Renmin University of China, Beijing, China
{youwei,xw7}@indiana.edu,{zongpeiyuan,chenkai}@iie.ac.cn,{xliao02}@wm.edu,{bianpan,liangb}@ruc.edu.cn
ABSTRACT
Patches and related information about so(cid:137)ware vulnerabilities are
o(cid:137)en made available to the public, aiming to facilitate timely (cid:128)xes.
Unfortunately, the slow paces of system updates (30 days on aver-
age) o(cid:137)en present to the a(cid:138)ackers enough time to recover hidden
bugs for a(cid:138)acking the unpatched systems. Making things worse is
the potential to automatically generate exploits on input-validation
(cid:131)aws through reverse-engineering patches, even though such vul-
nerabilities are relatively rare (e.g., 5% among all Linux kernel
vulnerabilities in last few years). Less understood, however, are the
implications of other bug-related information (e.g., bug descriptions
in CVE), particularly whether utilization of such information can
facilitate exploit generation, even on other vulnerability types that
have never been automatically a(cid:138)acked.
In this paper, we seek to use such information to generate proof-
of-concept (PoC) exploits for the vulnerability types never automat-
ically a(cid:138)acked. Unlike an input validation (cid:131)aw that is o(cid:137)en patched
by...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:The Gap Game
author:Itay Tsabary and
Ittay Eyal
The Gap Game
Ittay Eyal
Technion
Haifa, Israel
ittay@technion.ac.il
incentivizes large miner coalitions, reducing system decen-
tralization. We describe the required conditions to avoid
the incentive misalignment, providing guidelines for future
cryptocurrency design.
REFERENCES
[1] Miles Carlsten, Harry Kalodner, S. Matthew Weinberg, and Arvind
Narayanan. 2016. On the Instability of Bitcoin Without the Block
Reward. In Proceedings of the 2016 ACM SIGSAC Conference on Computer
and Communications Security (CCS ’16). ACM, New York, NY, USA, 154–
167. https://doi.org/10.1145/2976749.2978408
Itay Tsabary
Technion
Haifa, Israel
itaytsabary@gmail.com
CCS CONCEPTS
• Security and privacy → Distributed systems security;
KEYWORDS
Blockchains; Cryptocurrency; Mining Gap; Centralization;
Game Theory
Blockchain-based cryptocurrencies secure a decentralized
consensus protocol by incentives. The protocol participants,
called miners, generate (mine) a series of blocks, each con-
taining monetary transactions created by system users. As
incentive for participation, miners receive newly minted
currency and transaction fees paid by transaction creators.
Blockchain bandwidth limits lead users to pay increasing
fees in order to prioritize their transactions. However, most
prior work focused on models where fees are negligible. In a
notable exception, Carlsten et al. [1] postulated in CCS’16
that if incentives come only from fees then a mining gap
would form — miners would avoid mining when the available
fees are insufficient.
In this work, we analyze cryptocurrency security in realis-
tic settings, taking into account all elements of expenses and
rewards. To study when gaps form, we analyze the system
as a game we call the gap game. We analyze the game with
a combination of symbolic and numeric analysis tools in a
wide range of scenarios.
Our analysis confirms Carlsten et al.’s postulate; indeed,
we show that gaps form well before fe...


Instruction: 总结这篇安全研究的主要观点

Input:
title:The Gap Game
author:Itay Tsabary and
Ittay Eyal
The Gap Game
Ittay Eyal
Technion
Haifa, Israel
ittay@technion.ac.il
incentivizes large miner coalitions, reducing system decen-
tralization. We describe the required conditions to avoid
the incentive misalignment, providing guidelines for future
cryptocurrency design.
REFERENCES
[1] Miles Carlsten, Harry Kalodner, S. Matthew Weinberg, and Arvind
Narayanan. 2016. On the Instability of Bitcoin Without the Block
Reward. In Proceedings of the 2016 ACM SIGSAC Conference on Computer
and Communications Security (CCS ’16). ACM, New York, NY, USA, 154–
167. https://doi.org/10.1145/2976749.2978408
Itay Tsabary
Technion
Haifa, Israel
itaytsabary@gmail.com
CCS CONCEPTS
• Security and privacy → Distributed systems security;
KEYWORDS
Blockchains; Cryptocurrency; Mining Gap; Centralization;
Game Theory
Blockchain-based cryptocurrencies secure a decentralized
consensus protocol by incentives. The protocol participants,
called miners, generate (mine) a series of blocks, each con-
taining monetary transactions created by system users. As
incentive for participation, miners receive newly minted
currency and transaction fees paid by transaction creators.
Blockchain bandwidth limits lead users to pay increasing
fees in order to prioritize their transactions. However, most
prior work focused on models where fees are negligible. In a
notable exception, Carlsten et al. [1] postulated in CCS’16
that if incentives come only from fees then a mining gap
would form — miners would avoid mining when the available
fees are insufficient.
In this work, we analyze cryptocurrency security in realis-
tic settings, taking into account all elements of expenses and
rewards. To study when gaps form, we analyze the system
as a game we call the gap game. We analyze the game with
a combination of symbolic and numeric analysis tools in a
wide range of scenarios.
Our analysis confirms Carlsten et al.’s postulate; indeed,
we show that gaps form well before fe...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Swords and shields: a study of mobile game hacks and existing defenses
author:Yuan Tian and
Eric Y. Chen and
Xiaojun Ma and
Shuo Chen and
Xiao Wang and
Patrick Tague
Swords and Shields – A Study of
Mobile Game Hacks and Existing Defenses
Yuan Tian
Carnegie Mellon University
yuan.tian@sv.cmu.edu
Shuo Chen
Microsoft Research
shuochen@microsoft.com
Eric Chen
Gridspace
eric.chen@sv.cmu.edu
Xiao Wang
Carnegie Mellon University
sean.wang@sv.cmu.edu
Xiaojun Ma
Carnegie Mellon University
xiaojun.ma@sv.cmu.edu
Patrick Tague
Carnegie Mellon University
tague@cmu.edu
ABSTRACT
The mobile game industry has been growing signiﬁcantly.
Mobile games are increasingly including abilities to purchase
in-game objects with real currency, share achievements and
updates with friends, and post high scores to global leader
boards. Because of these abilities, there are new ﬁnancial
and social incentives for gamers to cheat. Developers and
researchers have tried to apply various protection mecha-
nisms in games, but the degrees of eﬀectiveness vary con-
siderably. There has not been a real-world study in this
problem space. In this work, we investigate diﬀerent pro-
tections in real-world applications, and we compare these
approaches from diﬀerent aspects such as security and de-
ployment eﬀorts systematically.
We ﬁrst investigate 100 popular mobile games in order to
understand how developers adopt these protection mecha-
nisms, including those for protecting memory, local ﬁles, and
network traﬃc, for obfuscating source code, and for main-
taining the integrity of the game state. We have conﬁrmed
that 77 out of the 100 games can be successfully attacked,
and believe that at least ﬁve more are vulnerable. Based on
this ﬁrst-hand experience, we propose an evaluation frame-
work for the security of mobile game defenses. We deﬁne
a ﬁve-level hierarchy to rate the protection mechanisms to
help developers understand how well their games are pro-
tected relative to others in the market. Addition...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Swords and shields: a study of mobile game hacks and existing defenses
author:Yuan Tian and
Eric Y. Chen and
Xiaojun Ma and
Shuo Chen and
Xiao Wang and
Patrick Tague
Swords and Shields – A Study of
Mobile Game Hacks and Existing Defenses
Yuan Tian
Carnegie Mellon University
yuan.tian@sv.cmu.edu
Shuo Chen
Microsoft Research
shuochen@microsoft.com
Eric Chen
Gridspace
eric.chen@sv.cmu.edu
Xiao Wang
Carnegie Mellon University
sean.wang@sv.cmu.edu
Xiaojun Ma
Carnegie Mellon University
xiaojun.ma@sv.cmu.edu
Patrick Tague
Carnegie Mellon University
tague@cmu.edu
ABSTRACT
The mobile game industry has been growing signiﬁcantly.
Mobile games are increasingly including abilities to purchase
in-game objects with real currency, share achievements and
updates with friends, and post high scores to global leader
boards. Because of these abilities, there are new ﬁnancial
and social incentives for gamers to cheat. Developers and
researchers have tried to apply various protection mecha-
nisms in games, but the degrees of eﬀectiveness vary con-
siderably. There has not been a real-world study in this
problem space. In this work, we investigate diﬀerent pro-
tections in real-world applications, and we compare these
approaches from diﬀerent aspects such as security and de-
ployment eﬀorts systematically.
We ﬁrst investigate 100 popular mobile games in order to
understand how developers adopt these protection mecha-
nisms, including those for protecting memory, local ﬁles, and
network traﬃc, for obfuscating source code, and for main-
taining the integrity of the game state. We have conﬁrmed
that 77 out of the 100 games can be successfully attacked,
and believe that at least ﬁve more are vulnerable. Based on
this ﬁrst-hand experience, we propose an evaluation frame-
work for the security of mobile game defenses. We deﬁne
a ﬁve-level hierarchy to rate the protection mechanisms to
help developers understand how well their games are pro-
tected relative to others in the market. Addition...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:POSTER: Construct macOS Cyber Range for Red/Blue Teams
author:Yi-Hsien Chen and
Yen-Da Lin and
Chung-Kuan Chen and
Chin-Laung Lei and
Chun-Ying Huang
POSTER: Construct macOS Cyber Range for Red/Blue Teams
Yi-Hsien Chen1,2, Yen-Da Lin2, Chung-Kuan Chen2, Chin-Laung Lei1, Chun-Ying Huang3
1Department of Electrical Engineering, National Taiwan University 2CyCraft Technology Corporation
3Department of Computer Science, National Chiao Tung University
Email:csjh21010@gmail.com,segno.dada@gmail.com,ck.chen@cycraft.com,cllei@ntu.edu.tw,chuang@cs.nctu.edu.tw
ABSTRACT
More and more malicious apps and APT attacks now target macOS,
making it crucial for researchers to develop threat countermeasures
on macOS. In this paper, we attempt to construct a macOS cyber
range for the evaluation of red team and blue team performances.
Our proposed system is composed of three fundamental compo-
nents: an attack-defense association graph, a Go language-based
red team emulation tool, and a toolkit for blue team performance
evaluation. We demonstrate the effectiveness of our proposed cyber
range with real-world scenarios, and believe it will stimulate more
research innovations on threat analysis for macOS.
CCS CONCEPTS
• Security and privacy → Intrusion/anomaly detection and mal-
ware mitigation;
KEYWORDS
Forensic, Blue Team, Cyber Range, Red Team, Penetration Testing
1 INTRODUCTION
There is an increasing number of users using macOS and therefore
more and more threat actors target on attacking macOS. For in-
stance, state-sponsored APT28 utilized Trojan.MAC.APT2 to attack
military and government organizations [1]. Malware examples such
as OSX.AppleJeus [5] and OSX.NetWire.A [4] are widely used by
malicious actors to attack cryptocurrency exchanges. Although
macOS is popular, we observed that research works seldom discuss
attack and defense techniques on macOS. As a result, both blue
teams and red teams are not acquainted with macOS security tech-
niques which include attack methods, pro...


Instruction: 总结这篇安全研究的主要观点

Input:
title:POSTER: Construct macOS Cyber Range for Red/Blue Teams
author:Yi-Hsien Chen and
Yen-Da Lin and
Chung-Kuan Chen and
Chin-Laung Lei and
Chun-Ying Huang
POSTER: Construct macOS Cyber Range for Red/Blue Teams
Yi-Hsien Chen1,2, Yen-Da Lin2, Chung-Kuan Chen2, Chin-Laung Lei1, Chun-Ying Huang3
1Department of Electrical Engineering, National Taiwan University 2CyCraft Technology Corporation
3Department of Computer Science, National Chiao Tung University
Email:csjh21010@gmail.com,segno.dada@gmail.com,ck.chen@cycraft.com,cllei@ntu.edu.tw,chuang@cs.nctu.edu.tw
ABSTRACT
More and more malicious apps and APT attacks now target macOS,
making it crucial for researchers to develop threat countermeasures
on macOS. In this paper, we attempt to construct a macOS cyber
range for the evaluation of red team and blue team performances.
Our proposed system is composed of three fundamental compo-
nents: an attack-defense association graph, a Go language-based
red team emulation tool, and a toolkit for blue team performance
evaluation. We demonstrate the effectiveness of our proposed cyber
range with real-world scenarios, and believe it will stimulate more
research innovations on threat analysis for macOS.
CCS CONCEPTS
• Security and privacy → Intrusion/anomaly detection and mal-
ware mitigation;
KEYWORDS
Forensic, Blue Team, Cyber Range, Red Team, Penetration Testing
1 INTRODUCTION
There is an increasing number of users using macOS and therefore
more and more threat actors target on attacking macOS. For in-
stance, state-sponsored APT28 utilized Trojan.MAC.APT2 to attack
military and government organizations [1]. Malware examples such
as OSX.AppleJeus [5] and OSX.NetWire.A [4] are widely used by
malicious actors to attack cryptocurrency exchanges. Although
macOS is popular, we observed that research works seldom discuss
attack and defense techniques on macOS. As a result, both blue
teams and red teams are not acquainted with macOS security tech-
niques which include attack methods, pro...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:ClearShot: Eavesdropping on Keyboard Input from Video
author:Davide Balzarotti and
Marco Cova and
Giovanni Vigna
2008 IEEE Symposium on Security and Privacy
ClearShot: Eavesdropping on Keyboard Input from Video
Davide Balzarotti, Marco Cova, and Giovanni Vigna
Department of Computer Science,
University of California Santa Barbara
Santa Barbara, CA, USA
{balzarot,marco,vigna}@cs.ucsb.edu
Abstract
Eavesdropping on electronic communication is usually
prevented by using cryptography-based mechanisms. How-
ever, these mechanisms do not prevent one from obtaining
private information through side channels, such as the elec-
tromagnetic emissions of monitors or the sound produced by
keyboards. While extracting the same information by watch-
ing somebody typing on a keyboard might seem to be an easy
task, it becomes extremely challenging if it has to be auto-
mated. However, an automated tool is needed in the case of
long-lasting surveillance procedures or long user activity,
as a human being is able to reconstruct only a few charac-
ters per minute. This paper presents a novel approach to au-
tomatically recovering the text being typed on a keyboard,
based solely on a video of the user typing. As part of the
approach, we developed a number of novel techniques for
motion tracking, sentence reconstruction, and error correc-
tion. The approach has been implemented in a tool, called
ClearShot, which has been tested in a number of realistic
settings where it was able to reconstruct a substantial part
of the typed information.
1 Introduction
MARTIN BISHOP: What’s he doing?
CARL ARBEGAST: He’s logging on the computer.
MARTIN BISHOP (watching through a video camera):
Oh, this is good.
He’s going to type in his password
and we’re going to get a clear shot.
From the movie “Sneakers,” 1992, Universal Pictures.
Spying on people has always been an effective way of ob-
taining information since the beginning of history. With the
advent of technology, new ways of spying on somebody’...


Instruction: 总结这篇安全研究的主要观点

Input:
title:ClearShot: Eavesdropping on Keyboard Input from Video
author:Davide Balzarotti and
Marco Cova and
Giovanni Vigna
2008 IEEE Symposium on Security and Privacy
ClearShot: Eavesdropping on Keyboard Input from Video
Davide Balzarotti, Marco Cova, and Giovanni Vigna
Department of Computer Science,
University of California Santa Barbara
Santa Barbara, CA, USA
{balzarot,marco,vigna}@cs.ucsb.edu
Abstract
Eavesdropping on electronic communication is usually
prevented by using cryptography-based mechanisms. How-
ever, these mechanisms do not prevent one from obtaining
private information through side channels, such as the elec-
tromagnetic emissions of monitors or the sound produced by
keyboards. While extracting the same information by watch-
ing somebody typing on a keyboard might seem to be an easy
task, it becomes extremely challenging if it has to be auto-
mated. However, an automated tool is needed in the case of
long-lasting surveillance procedures or long user activity,
as a human being is able to reconstruct only a few charac-
ters per minute. This paper presents a novel approach to au-
tomatically recovering the text being typed on a keyboard,
based solely on a video of the user typing. As part of the
approach, we developed a number of novel techniques for
motion tracking, sentence reconstruction, and error correc-
tion. The approach has been implemented in a tool, called
ClearShot, which has been tested in a number of realistic
settings where it was able to reconstruct a substantial part
of the typed information.
1 Introduction
MARTIN BISHOP: What’s he doing?
CARL ARBEGAST: He’s logging on the computer.
MARTIN BISHOP (watching through a video camera):
Oh, this is good.
He’s going to type in his password
and we’re going to get a clear shot.
From the movie “Sneakers,” 1992, Universal Pictures.
Spying on people has always been an effective way of ob-
taining information since the beginning of history. With the
advent of technology, new ways of spying on somebody’...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Automatically Evading Classifiers: A Case Study on PDF Malware
Classifiers
author:Weilin Xu and
Yanjun Qi and
David Evans
In Network and Distributed System Security Symposium 2016 (NDSS), San Diego, February 2016
Automatically Evading Classiﬁers
A Case Study on PDF Malware Classiﬁers
Weilin Xu, Yanjun Qi, and David Evans
University of Virginia
http://www.EvadeML.org
Abstract—Machine learning is widely used to develop classi-
ﬁers for security tasks. However, the robustness of these methods
against motivated adversaries is uncertain. In this work, we
propose a generic method to evaluate the robustness of classiﬁers
under attack. The key idea is to stochastically manipulate a
malicious sample to ﬁnd a variant that preserves the malicious
behavior but is classiﬁed as benign by the classiﬁer. We present
a general approach to search for evasive variants and report on
results from experiments using our techniques against two PDF
malware classiﬁers, PDFrate and Hidost. Our method is able to
automatically ﬁnd evasive variants for both classiﬁers for all of
the 500 malicious seeds in our study. Our results suggest a general
method for evaluating classiﬁers used in security applications, and
raise serious doubts about the effectiveness of classiﬁers based
on superﬁcial features in the presence of adversaries.
I.
INTRODUCTION
Machine learning models are popular in security tasks such
as malware detection, network intrusion detection and spam
detection. From the data scientists’ perspective, these models
are effective since they achieve extremely high accuracy on
test datasets. For example, Dahl et al. reported achieving
99.58% accuracy in classifying Win32 malware using an
ensemble deep neural network with dynamic features [9].
ˇSrndic et al. achieved over 99.9% accuracy in a PDF malware
classiﬁcation task using an SVM-RBF model with structural
path features [28].
However, it is important to realize that these results are for
particular test datasets. Unlike when machine...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Automatically Evading Classifiers: A Case Study on PDF Malware
Classifiers
author:Weilin Xu and
Yanjun Qi and
David Evans
In Network and Distributed System Security Symposium 2016 (NDSS), San Diego, February 2016
Automatically Evading Classiﬁers
A Case Study on PDF Malware Classiﬁers
Weilin Xu, Yanjun Qi, and David Evans
University of Virginia
http://www.EvadeML.org
Abstract—Machine learning is widely used to develop classi-
ﬁers for security tasks. However, the robustness of these methods
against motivated adversaries is uncertain. In this work, we
propose a generic method to evaluate the robustness of classiﬁers
under attack. The key idea is to stochastically manipulate a
malicious sample to ﬁnd a variant that preserves the malicious
behavior but is classiﬁed as benign by the classiﬁer. We present
a general approach to search for evasive variants and report on
results from experiments using our techniques against two PDF
malware classiﬁers, PDFrate and Hidost. Our method is able to
automatically ﬁnd evasive variants for both classiﬁers for all of
the 500 malicious seeds in our study. Our results suggest a general
method for evaluating classiﬁers used in security applications, and
raise serious doubts about the effectiveness of classiﬁers based
on superﬁcial features in the presence of adversaries.
I.
INTRODUCTION
Machine learning models are popular in security tasks such
as malware detection, network intrusion detection and spam
detection. From the data scientists’ perspective, these models
are effective since they achieve extremely high accuracy on
test datasets. For example, Dahl et al. reported achieving
99.58% accuracy in classifying Win32 malware using an
ensemble deep neural network with dynamic features [9].
ˇSrndic et al. achieved over 99.9% accuracy in a PDF malware
classiﬁcation task using an SVM-RBF model with structural
path features [28].
However, it is important to realize that these results are for
particular test datasets. Unlike when machine...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Cubismo: decloaking server-side malware via cubist program analysis
author:Abbas Naderi-Afooshteh and
Yonghwi Kwon and
Anh Nguyen-Tuong and
Mandana Bagheri-Marzijarani and
Jack W. Davidson
Cubismo: Decloaking Server-side Malware via Cubist Program
Analysis
Abbas Naderi-Afooshteh, Yonghwi Kwon, Anh Nguyen-Tuong, Mandana Bagheri-Marzijarani, and
ABSTRACT
Jack W. Davidson
Department of Computer Science, University of Virginia
{abiusx,yongkwon,nguyen,mb3wz,jwd}@virginia.edu
1 INTRODUCTION
Malware written in dynamic languages such as PHP routinely
employ anti-analysis techniques such as obfuscation schemes and
evasive tricks to avoid detection. On top of that, attackers use
automated malware creation tools to create numerous variants
with little to no manual effort.
This paper presents a system called Cubismo to solve this press-
ing problem. It processes potentially malicious files and decloaks
their obfuscations, exposing the hidden malicious code into multiple
files. The resulting files can be scanned by existing malware detec-
tion tools, leading to a much higher chance of detection. Cubismo
achieves improved detection by exploring all executable statements
of a suspect program counterfactually to see through complicated
polymorphism, metamorphism and, obfuscation techniques and
expose any malware.
Our evaluation on a real-world data set collected from a commer-
cial web hosting company shows that Cubismo is highly effective
in dissecting sophisticated metamorphic malware with multiple
layers of obfuscation. In particular, it enables VirusTotal to detect
53 out of 56 zero-day malware samples in the wild, which were
previously undetectable.
CCS CONCEPTS
• Security and privacy → Malware and its mitigation; Web
application security; Systems security.
KEYWORDS
PHP, Security, Malware, Obfuscation, Evasion, Counterfactual
Execution
ACM Reference Format:
Abbas Naderi-Afooshteh, Yonghwi Kwon, Anh Nguyen-Tuong, Mandana
Bagheri-Marzijarani, and Jack W. Davidson. 2019. Cu...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Cubismo: decloaking server-side malware via cubist program analysis
author:Abbas Naderi-Afooshteh and
Yonghwi Kwon and
Anh Nguyen-Tuong and
Mandana Bagheri-Marzijarani and
Jack W. Davidson
Cubismo: Decloaking Server-side Malware via Cubist Program
Analysis
Abbas Naderi-Afooshteh, Yonghwi Kwon, Anh Nguyen-Tuong, Mandana Bagheri-Marzijarani, and
ABSTRACT
Jack W. Davidson
Department of Computer Science, University of Virginia
{abiusx,yongkwon,nguyen,mb3wz,jwd}@virginia.edu
1 INTRODUCTION
Malware written in dynamic languages such as PHP routinely
employ anti-analysis techniques such as obfuscation schemes and
evasive tricks to avoid detection. On top of that, attackers use
automated malware creation tools to create numerous variants
with little to no manual effort.
This paper presents a system called Cubismo to solve this press-
ing problem. It processes potentially malicious files and decloaks
their obfuscations, exposing the hidden malicious code into multiple
files. The resulting files can be scanned by existing malware detec-
tion tools, leading to a much higher chance of detection. Cubismo
achieves improved detection by exploring all executable statements
of a suspect program counterfactually to see through complicated
polymorphism, metamorphism and, obfuscation techniques and
expose any malware.
Our evaluation on a real-world data set collected from a commer-
cial web hosting company shows that Cubismo is highly effective
in dissecting sophisticated metamorphic malware with multiple
layers of obfuscation. In particular, it enables VirusTotal to detect
53 out of 56 zero-day malware samples in the wild, which were
previously undetectable.
CCS CONCEPTS
• Security and privacy → Malware and its mitigation; Web
application security; Systems security.
KEYWORDS
PHP, Security, Malware, Obfuscation, Evasion, Counterfactual
Execution
ACM Reference Format:
Abbas Naderi-Afooshteh, Yonghwi Kwon, Anh Nguyen-Tuong, Mandana
Bagheri-Marzijarani, and Jack W. Davidson. 2019. Cu...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Detecting Credential Spearphishing in Enterprise Settings
author:Grant Ho and
Aashish Sharma and
Mobin Javed and
Vern Paxson and
David A. Wagner
Detecting Credential Spearphishing Attacks
in Enterprise Settings
Grant Ho, UC Berkeley; Aashish Sharma, The Lawrence Berkeley National Laboratory;
Mobin Javed, UC Berkeley; Vern Paxson, UC Berkeley and ICSI; David Wagner, UC Berkeley
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/ho
This paper is included in the Proceedings of the 26th USENIX Security SymposiumAugust 16–18, 2017 • Vancouver, BC, CanadaISBN 978-1-931971-40-9Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIXDetecting Credential Spearphishing Attacks in Enterprise Settings
Grant Ho† Aashish Sharma(cid:5) Mobin Javed† Vern Paxson†∗ David Wagner†
(cid:5)
Lawrence Berkeley National Laboratory
∗
†
UC Berkeley
International Computer Science Institute
Abstract
We present a new approach for detecting credential
spearphishing attacks in enterprise settings. Our method
uses features derived from an analysis of fundamental
characteristics of spearphishing attacks, combined with a
new non-parametric anomaly scoring technique for rank-
ing alerts. We evaluate our technique on a multi-year
dataset of over 370 million emails from a large enterprise
with thousands of employees. Our system successfully
detects 6 known spearphishing campaigns that succeeded
(missing one instance); an additional 9 that failed; plus
2 successful spearphishing attacks that were previously
unknown, thus demonstrating the value of our approach.
We also establish that our detector’s false positive rate is
low enough to be practical: on average, a single analyst
can investigate an entire month’s worth of alerts in un-
der 15 minutes. Comparing our anomaly scoring method
against standard anomaly detection techniques, we ﬁnd
that standard techniques using the same features would
need to generate at least 9 times as...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Detecting Credential Spearphishing in Enterprise Settings
author:Grant Ho and
Aashish Sharma and
Mobin Javed and
Vern Paxson and
David A. Wagner
Detecting Credential Spearphishing Attacks
in Enterprise Settings
Grant Ho, UC Berkeley; Aashish Sharma, The Lawrence Berkeley National Laboratory;
Mobin Javed, UC Berkeley; Vern Paxson, UC Berkeley and ICSI; David Wagner, UC Berkeley
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/ho
This paper is included in the Proceedings of the 26th USENIX Security SymposiumAugust 16–18, 2017 • Vancouver, BC, CanadaISBN 978-1-931971-40-9Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIXDetecting Credential Spearphishing Attacks in Enterprise Settings
Grant Ho† Aashish Sharma(cid:5) Mobin Javed† Vern Paxson†∗ David Wagner†
(cid:5)
Lawrence Berkeley National Laboratory
∗
†
UC Berkeley
International Computer Science Institute
Abstract
We present a new approach for detecting credential
spearphishing attacks in enterprise settings. Our method
uses features derived from an analysis of fundamental
characteristics of spearphishing attacks, combined with a
new non-parametric anomaly scoring technique for rank-
ing alerts. We evaluate our technique on a multi-year
dataset of over 370 million emails from a large enterprise
with thousands of employees. Our system successfully
detects 6 known spearphishing campaigns that succeeded
(missing one instance); an additional 9 that failed; plus
2 successful spearphishing attacks that were previously
unknown, thus demonstrating the value of our approach.
We also establish that our detector’s false positive rate is
low enough to be practical: on average, a single analyst
can investigate an entire month’s worth of alerts in un-
der 15 minutes. Comparing our anomaly scoring method
against standard anomaly detection techniques, we ﬁnd
that standard techniques using the same features would
need to generate at least 9 times as...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Forum Session: Security for Wireless Sensor Networks
author:David Carman and
Daniel Coffin and
Bruno Dutertre and
Vipin Swarup and
Ronald J. Watro
Forum Session:
Security for Wireless Sensor Networks
David Carman
Network Associates Laboratories
David_Carman@nai.com
Daniel Coffin
BBN Technologies
dcoffin@bbn.com
Bruno Dutertre
SRI International
bruno@sdl.sri.com
Abstract
Wireless  networks  of  low-power  sensing  devices  are
poised  to  become  a  ubiquitous  part  of  the  computing
landscape.    Proposed  applications  of  these  networks
range from health care to warfare.  The challenge for
the  information  security  community  is  to  develop  the
common  security  services  (confidentiality,  integrity,
etc.)  for  sensor  networks  in  a  manner  that  meets  the
very  strict  resource  constraints  of  these  devices.  This
forum  will  describe  a  broad  range  of  on-going
research  efforts  in  order  to  acquaint  the  general
information  security  community  with  the  issues  and
concerns of sensor net security.
1.  Overview
fields,
(MEMS),
The  emergence  of  low-power  sensor  networking  has
been  propelled  by  the  convergence  of  advances  in
several
including  nano-technology,  Micro
Electronic  Mechanical  Systems
radio
frequency  communications,  and  microprocessors.
These  research  efforts  are  culminating  in  programs
such as the UC Berkeley  “Smart Dust” project,  which
recently  announced  a  sensor/transceiver  chip  called
Spec  just  5  mm2  in  size  and  requiring  one  thousand
times  less  power  than  a  conventional  cell  phone  [1].
Ad
such  miniaturized
sensor/transceiver  units  create  a  powerful  tool  for
information  gathering.    These  networks  may  include
relatively  more  powerful  base  stations  or  relay  points
that serve to connect the sensor network to the outside
world.  In other instances, the sensor nodes themselves
serve  as  dynamic  relay  points...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Forum Session: Security for Wireless Sensor Networks
author:David Carman and
Daniel Coffin and
Bruno Dutertre and
Vipin Swarup and
Ronald J. Watro
Forum Session:
Security for Wireless Sensor Networks
David Carman
Network Associates Laboratories
David_Carman@nai.com
Daniel Coffin
BBN Technologies
dcoffin@bbn.com
Bruno Dutertre
SRI International
bruno@sdl.sri.com
Abstract
Wireless  networks  of  low-power  sensing  devices  are
poised  to  become  a  ubiquitous  part  of  the  computing
landscape.    Proposed  applications  of  these  networks
range from health care to warfare.  The challenge for
the  information  security  community  is  to  develop  the
common  security  services  (confidentiality,  integrity,
etc.)  for  sensor  networks  in  a  manner  that  meets  the
very  strict  resource  constraints  of  these  devices.  This
forum  will  describe  a  broad  range  of  on-going
research  efforts  in  order  to  acquaint  the  general
information  security  community  with  the  issues  and
concerns of sensor net security.
1.  Overview
fields,
(MEMS),
The  emergence  of  low-power  sensor  networking  has
been  propelled  by  the  convergence  of  advances  in
several
including  nano-technology,  Micro
Electronic  Mechanical  Systems
radio
frequency  communications,  and  microprocessors.
These  research  efforts  are  culminating  in  programs
such as the UC Berkeley  “Smart Dust” project,  which
recently  announced  a  sensor/transceiver  chip  called
Spec  just  5  mm2  in  size  and  requiring  one  thousand
times  less  power  than  a  conventional  cell  phone  [1].
Ad
such  miniaturized
sensor/transceiver  units  create  a  powerful  tool  for
information  gathering.    These  networks  may  include
relatively  more  powerful  base  stations  or  relay  points
that serve to connect the sensor network to the outside
world.  In other instances, the sensor nodes themselves
serve  as  dynamic  relay  points...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Repackage-Proofing Android Apps
author:Lannan Luo and
Yu Fu and
Dinghao Wu and
Sencun Zhu and
Peng Liu
2016 46th Annual IEEE/IFIP International Conference on Dependable Systems and Networks
Repackage-prooﬁng Android Apps
Lannan Luo, Yu Fu, Dinghao Wu, Sencun Zhu, and Peng Liu
Email: {{lzl144,yuf123,dwu,pliu}@ist,szhu@cse}.psu.edu
The Pennsylvania State University
University Park, PA 16802
Abstract—App repackaging has become a severe threat to the
Android ecosystem. While various protection techniques, such as
watermarking and repackaging detection, have been proposed, a
defense that stops repackaged apps from working on user devices,
i.e., repackage-prooﬁng, is missing. We propose a technique that
builds a reliable and stealthy repackage-prooﬁng capability into
Android apps. A large number of detection nodes are inserted
into the original app without incurring much overhead; each is
woven into the surrounding code to blur itself. Once repackaging
is detected, a response node injects a failure in the form of
delayed malfunctions, making it difﬁcult to trace back. The
response nodes and detection nodes form high-degree connections
and communicate through stealthy communication channels, such
that upon detection several of the many response nodes are
selected stochastically to take actions, which further obfuscates
and enhances the protection. We have built a prototype. The
evaluation shows that the technique is effective and efﬁcient.
Keywords—Android apps; repackaging; tamper-prooﬁng; obfus-
cation
I.
INTRODUCTION
The explosive growth of the Android markets over the past
few years has led to a booming app economy [45]. However,
Android app piracy is rampant. Take game apps as an example, a
recent report showed a 95% piracy rate for Android games [16].
Among other forms of piracy, app repackaging is especially
notorious, because it does not only cause ﬁnancial loss to
honest developers, but also threatens the overall app ecosystem
and users. Attackers may repack...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Repackage-Proofing Android Apps
author:Lannan Luo and
Yu Fu and
Dinghao Wu and
Sencun Zhu and
Peng Liu
2016 46th Annual IEEE/IFIP International Conference on Dependable Systems and Networks
Repackage-prooﬁng Android Apps
Lannan Luo, Yu Fu, Dinghao Wu, Sencun Zhu, and Peng Liu
Email: {{lzl144,yuf123,dwu,pliu}@ist,szhu@cse}.psu.edu
The Pennsylvania State University
University Park, PA 16802
Abstract—App repackaging has become a severe threat to the
Android ecosystem. While various protection techniques, such as
watermarking and repackaging detection, have been proposed, a
defense that stops repackaged apps from working on user devices,
i.e., repackage-prooﬁng, is missing. We propose a technique that
builds a reliable and stealthy repackage-prooﬁng capability into
Android apps. A large number of detection nodes are inserted
into the original app without incurring much overhead; each is
woven into the surrounding code to blur itself. Once repackaging
is detected, a response node injects a failure in the form of
delayed malfunctions, making it difﬁcult to trace back. The
response nodes and detection nodes form high-degree connections
and communicate through stealthy communication channels, such
that upon detection several of the many response nodes are
selected stochastically to take actions, which further obfuscates
and enhances the protection. We have built a prototype. The
evaluation shows that the technique is effective and efﬁcient.
Keywords—Android apps; repackaging; tamper-prooﬁng; obfus-
cation
I.
INTRODUCTION
The explosive growth of the Android markets over the past
few years has led to a booming app economy [45]. However,
Android app piracy is rampant. Take game apps as an example, a
recent report showed a 95% piracy rate for Android games [16].
Among other forms of piracy, app repackaging is especially
notorious, because it does not only cause ﬁnancial loss to
honest developers, but also threatens the overall app ecosystem
and users. Attackers may repack...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Lightweight Probabilistic Broadcast
author:Patrick Th. Eugster and
Rachid Guerraoui and
Sidath B. Handurukande and
Petr Kouznetsov and
Anne-Marie Kermarrec
Lightweight Probabilistic Broadcast
P. Th. Eugster’  R. Guerraoui’  S. B. Handurukande’  A.-M. Kermarrec’  P. Kouznetsov’
’ Federal Institute of Technology, Lausanne, Switzerland
Microsoft Research, Cambridge, UK
Abstract
The growing interest in peer-to-peer applications has un-
derlined the importance of scalability in modern distributed
systems. Not surprisingly, much research effort has been in-
vested in gossip-based broadcast protocols.  These trude the
traditional strong  reliability guarantees against  very good
“scalability” properties.  Scalability  is in that context usu-
ally expressed in terms of throughput and delivery  latency,
but there is only little work on how to reduce the overhead
of membership management at large scale.
This  paper  presents  Lightweight  Probabilistic  Broad-
cast  (lpbcast), a  novel  gossip-based  broadcast algorithm
which preserves the inherent throughput scalability of tradi-
tional gossip-based algorithms and adds a notion of mem-
bership management scalability:  every process only knows
a random subset ofjixed size of the processes in the system.
We formally  analyze  our broadcast algorithm  in terms of
scalability with respect to the size of  individual  views, and
compare  the  analytical  results  both  with  simulations  and
concrete measurements.
1.  Introduction
Large scale event dissemination.  Peer-to-peer comput-
ing  has  recently  received  much  attention,  as  shown  by
the  success  of  large  scale  decentralized  applications  like
Gnutella [22] or Groove [lo].  In peer-to-peer computing,
every process acts as client and server, and scaiability is a
major concern.
The scalability  properties solicited  from such  applica-
tions have evolved from hundreds to thousands  of  partici-
pants, but  adequate  algorithms ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Lightweight Probabilistic Broadcast
author:Patrick Th. Eugster and
Rachid Guerraoui and
Sidath B. Handurukande and
Petr Kouznetsov and
Anne-Marie Kermarrec
Lightweight Probabilistic Broadcast
P. Th. Eugster’  R. Guerraoui’  S. B. Handurukande’  A.-M. Kermarrec’  P. Kouznetsov’
’ Federal Institute of Technology, Lausanne, Switzerland
Microsoft Research, Cambridge, UK
Abstract
The growing interest in peer-to-peer applications has un-
derlined the importance of scalability in modern distributed
systems. Not surprisingly, much research effort has been in-
vested in gossip-based broadcast protocols.  These trude the
traditional strong  reliability guarantees against  very good
“scalability” properties.  Scalability  is in that context usu-
ally expressed in terms of throughput and delivery  latency,
but there is only little work on how to reduce the overhead
of membership management at large scale.
This  paper  presents  Lightweight  Probabilistic  Broad-
cast  (lpbcast), a  novel  gossip-based  broadcast algorithm
which preserves the inherent throughput scalability of tradi-
tional gossip-based algorithms and adds a notion of mem-
bership management scalability:  every process only knows
a random subset ofjixed size of the processes in the system.
We formally  analyze  our broadcast algorithm  in terms of
scalability with respect to the size of  individual  views, and
compare  the  analytical  results  both  with  simulations  and
concrete measurements.
1.  Introduction
Large scale event dissemination.  Peer-to-peer comput-
ing  has  recently  received  much  attention,  as  shown  by
the  success  of  large  scale  decentralized  applications  like
Gnutella [22] or Groove [lo].  In peer-to-peer computing,
every process acts as client and server, and scaiability is a
major concern.
The scalability  properties solicited  from such  applica-
tions have evolved from hundreds to thousands  of  partici-
pants, but  adequate  algorithms ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Hiding in Plain Signal: Physical Signal Overshadowing Attack on LTE
author:Hojoon Yang and
Sangwook Bae and
Mincheol Son and
Hongil Kim and
Song Min Kim and
Yongdae Kim
Hiding in Plain Signal:
Physical Signal Overshadowing Attack on LTE
Hojoon Yang, Sangwook Bae, Mincheol Son, Hongil Kim, Song Min Kim, and
Yongdae Kim, KAIST
https://www.usenix.org/conference/usenixsecurity19/presentation/yang-hojoon
This paper is included in the Proceedings of the 28th USENIX Security Symposium.August 14–16, 2019 • Santa Clara, CA, USA978-1-939133-06-9Open access to the Proceedings of the 28th USENIX Security Symposium is sponsored by USENIX.Hiding in Plain Signal: Physical Signal Overshadowing Attack on LTE
Hojoon Yang, Sangwook Bae, Mincheol Son, Hongil Kim, Song Min Kim, and Yongdae Kim
Korea Advanced Institute of Science and Technology (KAIST)
{omnibusor, hoops, mcson, hongilk, songmin, yongdaek}@kaist.ac.kr
Abstract
Long-Term Evolution (LTE) communication is based on
an open medium; thus, a legitimate signal can potentially
be counterfeited by a malicious signal. Although most LTE
signaling messages are protected from modiﬁcation using
cryptographic primitives, broadcast messages in LTE have
never been integrity protected. In this paper, for the ﬁrst time,
we present a signal injection attack that exploits the funda-
mental weaknesses of broadcast messages in LTE and mod-
iﬁes a transmitted signal over the air. This attack, which is
referred to as signal overshadowing (named SigOver) has sev-
eral advantages and differences when compared with existing
attacks using a fake base station. For example, with a 3 dB
power difference from a legitimate signal, the SigOver attack
demonstrated a 98% success rate when compared with the
80% success rate of attacks achieved using a fake base station,
even with a 35 dB power difference. Given that the SigOver
attack is a novel primitive attack, it yields ﬁve new attack
scenarios and implications. Finally, a discussion on two po-
ten...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Hiding in Plain Signal: Physical Signal Overshadowing Attack on LTE
author:Hojoon Yang and
Sangwook Bae and
Mincheol Son and
Hongil Kim and
Song Min Kim and
Yongdae Kim
Hiding in Plain Signal:
Physical Signal Overshadowing Attack on LTE
Hojoon Yang, Sangwook Bae, Mincheol Son, Hongil Kim, Song Min Kim, and
Yongdae Kim, KAIST
https://www.usenix.org/conference/usenixsecurity19/presentation/yang-hojoon
This paper is included in the Proceedings of the 28th USENIX Security Symposium.August 14–16, 2019 • Santa Clara, CA, USA978-1-939133-06-9Open access to the Proceedings of the 28th USENIX Security Symposium is sponsored by USENIX.Hiding in Plain Signal: Physical Signal Overshadowing Attack on LTE
Hojoon Yang, Sangwook Bae, Mincheol Son, Hongil Kim, Song Min Kim, and Yongdae Kim
Korea Advanced Institute of Science and Technology (KAIST)
{omnibusor, hoops, mcson, hongilk, songmin, yongdaek}@kaist.ac.kr
Abstract
Long-Term Evolution (LTE) communication is based on
an open medium; thus, a legitimate signal can potentially
be counterfeited by a malicious signal. Although most LTE
signaling messages are protected from modiﬁcation using
cryptographic primitives, broadcast messages in LTE have
never been integrity protected. In this paper, for the ﬁrst time,
we present a signal injection attack that exploits the funda-
mental weaknesses of broadcast messages in LTE and mod-
iﬁes a transmitted signal over the air. This attack, which is
referred to as signal overshadowing (named SigOver) has sev-
eral advantages and differences when compared with existing
attacks using a fake base station. For example, with a 3 dB
power difference from a legitimate signal, the SigOver attack
demonstrated a 98% success rate when compared with the
80% success rate of attacks achieved using a fake base station,
even with a 35 dB power difference. Given that the SigOver
attack is a novel primitive attack, it yields ﬁve new attack
scenarios and implications. Finally, a discussion on two po-
ten...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Extending Nymble-like Systems
author:Ryan Henry and
Ian Goldberg
2011 IEEE Symposium on Security and Privacy
Extending Nymble-like Systems
Ryan Henry and Ian Goldberg
Cheriton School of Computer Science
University of Waterloo
Waterloo, ON, Canada N2L 3G1
{rhenry,iang}@cs.uwaterloo.ca
Abstract—We present several extensions to the Nymble
framework for anonymous blacklisting systems. First, we show
how to distribute the Verinym Issuer as a threshold entity. This
provides liveness against a threshold Byzantine adversary and
protects against denial-of-service attacks. Second, we describe
how to revoke a user for a period spanning multiple linkability
windows. This gives service providers more ﬂexibility in decid-
ing how long to block individual users. We also point out how
our solution enables efﬁcient blacklist transferability among
service providers. Third, we augment the Verinym Acquisition
Protocol for Tor-aware systems (that utilize IP addresses as
a unique identiﬁer) to handle two additional cases: 1) the
operator of a Tor exit node wishes to access services protected
by the system, and 2) a user’s access to the Verinym Issuer
(and the Tor network) is blocked by a ﬁrewall. Finally, we
revisit the objective blacklisting mechanism used in Jack, and
generalize this idea to enable objective blacklisting in other
Nymble-like systems. We illustrate the approach by showing
how to implement it in Nymble and Nymbler.
Keywords-privacy enhancing technologies; anonymity; authen-
tication; anonymous blacklisting; privacy-enhanced revocation.
I. INTRODUCTION
In [21], [35], Tsang et al. proposed Nymble as a so-
lution to the problem of allowing service providers on
the Internet—such as websites,
IRC networks or mail
servers—to revoke access from individual misbehaving users
of anonymous communications networks. Nymble uses a
novel construction to build mutually unlinkable (and efﬁ-
ciently veriﬁable) authentication tokens for users of anony-
mous communications networks, w...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Extending Nymble-like Systems
author:Ryan Henry and
Ian Goldberg
2011 IEEE Symposium on Security and Privacy
Extending Nymble-like Systems
Ryan Henry and Ian Goldberg
Cheriton School of Computer Science
University of Waterloo
Waterloo, ON, Canada N2L 3G1
{rhenry,iang}@cs.uwaterloo.ca
Abstract—We present several extensions to the Nymble
framework for anonymous blacklisting systems. First, we show
how to distribute the Verinym Issuer as a threshold entity. This
provides liveness against a threshold Byzantine adversary and
protects against denial-of-service attacks. Second, we describe
how to revoke a user for a period spanning multiple linkability
windows. This gives service providers more ﬂexibility in decid-
ing how long to block individual users. We also point out how
our solution enables efﬁcient blacklist transferability among
service providers. Third, we augment the Verinym Acquisition
Protocol for Tor-aware systems (that utilize IP addresses as
a unique identiﬁer) to handle two additional cases: 1) the
operator of a Tor exit node wishes to access services protected
by the system, and 2) a user’s access to the Verinym Issuer
(and the Tor network) is blocked by a ﬁrewall. Finally, we
revisit the objective blacklisting mechanism used in Jack, and
generalize this idea to enable objective blacklisting in other
Nymble-like systems. We illustrate the approach by showing
how to implement it in Nymble and Nymbler.
Keywords-privacy enhancing technologies; anonymity; authen-
tication; anonymous blacklisting; privacy-enhanced revocation.
I. INTRODUCTION
In [21], [35], Tsang et al. proposed Nymble as a so-
lution to the problem of allowing service providers on
the Internet—such as websites,
IRC networks or mail
servers—to revoke access from individual misbehaving users
of anonymous communications networks. Nymble uses a
novel construction to build mutually unlinkable (and efﬁ-
ciently veriﬁable) authentication tokens for users of anony-
mous communications networks, w...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Third Workshop on Hot Topics in System Dependability HotDep'07
author:Miguel Castro and
John Wilkes
Third Workshop on Hot Topics in System Dependability
HotDep’07
Miguel Castro
Microsoft Research
Cambridge, UK
John Wilkes
Hewlett Packard Laboratories
Palo Alto, CA, USA
1. Introduction
Illinois at Urbana Champaign)
The goals of HotDep are to bring forth cutting-
edge research ideas spanning the domains of fault toler-
ance/reliability and systems, and to build linkages between
the two communities (e.g., between people who attend tra-
ditional ”dependability” conferences such as DSN and IS-
SRE, and those who attend ”systems” conferences such as
OSDI, SOSP, and EuroSys). Previous HotDep workshop
programs are available at
http://hotdep.org/
To achieve these goals, we selected a program com-
mittee for HotDep’07 with a mix of people from both
communities.
The program committee for this year’s
workshop was composed of:
Marcos K. Aguilera, Hewlett-Packard Labs
Lorenzo Alvisi, University of Texas at Austin
Paul Barham, Microsoft Research, Cambridge
Garth Gibson, Carnegie Mellon University
Anne-Marie Kermarrec, INRIA, Rennes
Petros Maniatis, Intel Research
Armando Fox, University of California, Berkeley
Ashvin Goel, University of Toronto
Rick Schlichting, AT&T Labs
Paulo Verissimo, University of Lisboa, Portugal
Yuanyuan Zhou, UIUC
Willy Zwaenepoel, EPFL, Lausanne
We received 22 submissions. The program committee
wrote a total of 118 reviews and each paper was reviewed
by at least 5 program committee members. After a meeting
in Lisbon on March 23, we decided to accept 6 papers
and to accept 16 of the other submissions as posters to be
presented at the workshop. The 6 accepted papers were:
Delta Execution for Software Reliability Yuanyuan Zhou,
Darkov Marinov, Craig Zilles, William Sanders, Joe Tucek,
Marcelo D’Amorim, and Steven Lauterburg (University of
Reliable Device Drivers Require Well-Deﬁned Protocols
Leonid Ryzhyk, Timothy Bourke, and Ihor Kuz (NICTA
and the Un...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Third Workshop on Hot Topics in System Dependability HotDep'07
author:Miguel Castro and
John Wilkes
Third Workshop on Hot Topics in System Dependability
HotDep’07
Miguel Castro
Microsoft Research
Cambridge, UK
John Wilkes
Hewlett Packard Laboratories
Palo Alto, CA, USA
1. Introduction
Illinois at Urbana Champaign)
The goals of HotDep are to bring forth cutting-
edge research ideas spanning the domains of fault toler-
ance/reliability and systems, and to build linkages between
the two communities (e.g., between people who attend tra-
ditional ”dependability” conferences such as DSN and IS-
SRE, and those who attend ”systems” conferences such as
OSDI, SOSP, and EuroSys). Previous HotDep workshop
programs are available at
http://hotdep.org/
To achieve these goals, we selected a program com-
mittee for HotDep’07 with a mix of people from both
communities.
The program committee for this year’s
workshop was composed of:
Marcos K. Aguilera, Hewlett-Packard Labs
Lorenzo Alvisi, University of Texas at Austin
Paul Barham, Microsoft Research, Cambridge
Garth Gibson, Carnegie Mellon University
Anne-Marie Kermarrec, INRIA, Rennes
Petros Maniatis, Intel Research
Armando Fox, University of California, Berkeley
Ashvin Goel, University of Toronto
Rick Schlichting, AT&T Labs
Paulo Verissimo, University of Lisboa, Portugal
Yuanyuan Zhou, UIUC
Willy Zwaenepoel, EPFL, Lausanne
We received 22 submissions. The program committee
wrote a total of 118 reviews and each paper was reviewed
by at least 5 program committee members. After a meeting
in Lisbon on March 23, we decided to accept 6 papers
and to accept 16 of the other submissions as posters to be
presented at the workshop. The 6 accepted papers were:
Delta Execution for Software Reliability Yuanyuan Zhou,
Darkov Marinov, Craig Zilles, William Sanders, Joe Tucek,
Marcelo D’Amorim, and Steven Lauterburg (University of
Reliable Device Drivers Require Well-Deﬁned Protocols
Leonid Ryzhyk, Timothy Bourke, and Ihor Kuz (NICTA
and the Un...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Utilizing Dynamically Coupled Cores to Form a Resilient Chip Multiprocessor
author:Christopher LaFrieda and
Engin Ipek and
Jos'e F. Mart'ınez and
Rajit Manohar
Utilizing Dynamically Coupled Cores to Form
a Resilient Chip Multiprocessor
Christopher LaFrieda Engin ˙Ipek Jos´e F. Mart´ınez Rajit Manohar
Computer Systems Laboratory
Cornell University
Ithaca, NY 14853 USA
http://csl.cornell.edu/
Abstract
Aggressive CMOS scaling will make future chip multiproces-
sors (CMPs) increasingly susceptible to transient faults, hard er-
rors, manufacturing defects, and process variations. Existing
fault-tolerant CMP proposals that implement dual modular redun-
dancy (DMR) do so by statically binding pairs of adjacent cores
via dedicated communication channels and buffers. This can re-
sult in unnecessary power and performance losses in cases where
one core is defective (in which case the entire DMR pair must be
disabled), or when cores exhibit different frequency/leakage char-
acteristics due to process variations (in which case the pair runs at
the speed of the slowest core). Static DMR also hinders power den-
sity/thermal management, as DMR pairs running code with simi-
lar power/thermal characteristics are necessarily placed next to
each other on the die.
We present dynamic core coupling (DCC), an architectural
technique that allows arbitrary CMP cores to verify each other’s
execution while requiring no static core binding at design time or
dedicated communication hardware. Our evaluation shows that
the performance overhead of DCC over a CMP without fault tol-
erance is 3% on SPEC2000 benchmarks, and is within 5% for a set
of scalable parallel scientiﬁc and data mining applications with up
to eight threads (16 processors). Our results also show that DCC
has the potential to signiﬁcantly outperform existing static DMR
schemes.
1
Introduction
Aggressive CMOS scaling has permitted exponential increases
in the microprocessor’s transistor budget for the last three d...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Utilizing Dynamically Coupled Cores to Form a Resilient Chip Multiprocessor
author:Christopher LaFrieda and
Engin Ipek and
Jos'e F. Mart'ınez and
Rajit Manohar
Utilizing Dynamically Coupled Cores to Form
a Resilient Chip Multiprocessor
Christopher LaFrieda Engin ˙Ipek Jos´e F. Mart´ınez Rajit Manohar
Computer Systems Laboratory
Cornell University
Ithaca, NY 14853 USA
http://csl.cornell.edu/
Abstract
Aggressive CMOS scaling will make future chip multiproces-
sors (CMPs) increasingly susceptible to transient faults, hard er-
rors, manufacturing defects, and process variations. Existing
fault-tolerant CMP proposals that implement dual modular redun-
dancy (DMR) do so by statically binding pairs of adjacent cores
via dedicated communication channels and buffers. This can re-
sult in unnecessary power and performance losses in cases where
one core is defective (in which case the entire DMR pair must be
disabled), or when cores exhibit different frequency/leakage char-
acteristics due to process variations (in which case the pair runs at
the speed of the slowest core). Static DMR also hinders power den-
sity/thermal management, as DMR pairs running code with simi-
lar power/thermal characteristics are necessarily placed next to
each other on the die.
We present dynamic core coupling (DCC), an architectural
technique that allows arbitrary CMP cores to verify each other’s
execution while requiring no static core binding at design time or
dedicated communication hardware. Our evaluation shows that
the performance overhead of DCC over a CMP without fault tol-
erance is 3% on SPEC2000 benchmarks, and is within 5% for a set
of scalable parallel scientiﬁc and data mining applications with up
to eight threads (16 processors). Our results also show that DCC
has the potential to signiﬁcantly outperform existing static DMR
schemes.
1
Introduction
Aggressive CMOS scaling has permitted exponential increases
in the microprocessor’s transistor budget for the last three d...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。