Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:us-21 Bridging Security Infrastructure Between the Data Center and AWS Lambda
While serverless is all the rage, creating secure infrastructure that integrates serverless technology with existing Data Center (DC) services remains a challenge. Square's DC uses a microservice architecture. Services communicate over an envoy service mesh with short-lived mTLS certificates using SPIFFE identity for zero-trust based authentication. To achieve higher flexibility and scalability we have been migrating to the cloud, a gradual process that is still in progress.Why bother? Workloads have different characteristics, while a payment system might be required to be available all the time and have predictable traffic, other applications might have unpredictable bursts of use but otherwise receive no traffic. This flexibility draws developers to Lambda. Applications can scale up immediately, but also scale down when demand is low. However, these characteristics also make security engineering challenging. In this talk we will explain what challenges we were confronted with and how we solved them, bridging security properties we require in the DC to be compatible with AWS Lambda.How is this challenging? Complications with AWS Lambda fall broadly into two categories. One, operational requirements for Lambda that make developers choose it in the first place, such as near immediate response time. Two, providing parity with our DC security infrastructure so developers can engineer in a fashion they are used to while observing security best practices. Simply reimplementing the systems we use in the DC was not possible, but using native cloud functionality alone wasn't possible either.How did we solve this? This talk will cover how we architected workload identity in AWS Lambda, sharing identity between DC and the cloud. We built a custom certificate issuance on top of AWS Private CA that is compatible with the SPIFFE standard, but issues certificates ahead of time to not bloc...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

titleblackhat:us-20 A Little Less Speculation, a Little More Action: A Deep Dive into Fuchsia's Mitigations for Specific CPU Side-Channel Attacks
We know the story by now: researchers find a new side-channel attack and disclose it under embargo. Vendors build patches and ship them. We read about it on $TechSite and move on.But what happens if you show up after the party's over and want to understand and mitigate these problems in your own codebase? That's the problem faced by the Fuchsia team at Google, which is building a new open-source operating system based on a microkernel called Zircon. Fuchsia needs to handle user, kernel, and hypervisor attacks across x86 and ARM processors.In this talk, we will walk through how the Fuchsia team enumerated existing CPU side-channels, explored how they are mitigated in well-known operating systems, and undertook the engineering work of applying these mitigations to Fuchsia. We will also describe how Fuchsia is testing those mitigations to make sure they keep working.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0681
ATT&CK Technique Name:Lizar
Lizar has a plugin designed to obtain a list of processes.[158][159]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:C0012
ATT&CK Technique Name:Operation CuckooBees
During Operation CuckooBees, the threat actors executed an encoded VBScript file using wscript and wrote the decoded output to a text file.[108]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1014
ATT&CK Technique Name:DanBot
DanBot can use VNC for remote access to targeted systems.[11]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0408
ATT&CK Technique Name:FlexiSpy
FlexiSpy can monitor device photos and can also access browser history and bookmarks.[13]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0520
ATT&CK Technique Name:BLINDINGCAN
BLINDINGCAN has sent user and system information to a C2 server via HTTP POST requests.[15][16]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

titleblackhat:us-19 Debug for Bug: Crack and Hack Apple Core by Itself - Fun and Profit to Debug and Fuzz Apple Kernel by lldb Script
As we know for security researchers, almost every operation system vendor has highly raised the bar of security vulnerability credit or bonus criteria and lots of security mitigations such CFI on Android 9 or PAC based on hardware on iOS 12 have been integrated to vendor system.What is more, industrial standard fuzzers (typical as AFL, syzkaller based on code coverage feedback) have been deployed on large scale. The survival space of bug hunting left for security researchers seems to be much smaller. Code reviewing based on threat expert knowledge seems to be the only way but which is obvious time consuming and dummy effort.Any idea on how to break the deadlock now? As security researchers, maybe you could try our debug fuzzer for bug hunt. This method we pledged has been verified to be effective to find and expand new attack interface but also flexible, scalable and scriptable for vulnerability research utilities. Based on our fuzzing methodology, we found dozens of vulnerabilities, including double free, oob read/write etc. which we will provide a detailed analysis of. However, these 10 vulnerabilities is the only part of we found, others will be analyzed later and submitted to Apple.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0687
ATT&CK Technique Name:Cyclops Blink
Cyclops Blink has the ability to query device information.[102]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1061
ATT&CK Technique Name:AbstractEmu
AbstractEmu can check device system properties to potentially avoid running while under analysis.[1]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0106
ATT&CK Technique Name:Rocke
Rocke has used Pastebin, Gitee, and GitLab for Command and Control.[29][30]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0618
ATT&CK Technique Name:FIVEHANDS
FIVEHANDS can receive a command line argument to limit file encryption to specified directories.[22][23]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0595
ATT&CK Technique Name:ThiefQuest
ThiefQuest uses the function kill_unwanted to obtain a list of running processes and kills each process matching a list of security related processes.[88]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0661
ATT&CK Technique Name:FoggyWeb
FoggyWeb can compile and execute source code sent to the compromised AD FS server via a specific HTTP POST.[5]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0529
ATT&CK Technique Name:CarbonSteal
CarbonSteal can dynamically load additional functionality.[7]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0114
ATT&CK Technique Name:Chimera
Chimera has used Cobalt Strike C2 beacons for data exfiltration.[27]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0222
ATT&CK Technique Name:CCBkdr
CCBkdr was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site.[4][5][1]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0615
ATT&CK Technique Name:SombRAT
SombRAT has the ability to use TCP sockets to send data and ICMP to ping the C2 server.[65][66]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1021
ATT&CK Technique Name:Restrict Web-Based Content
In some cases a local DNS sinkhole may be used to help prevent behaviors associated with dynamic resolution.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1590.005
ATT&CK Technique Name:IP Addresses
Adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Information about assigned IP addresses may include a variety of details, such as which IP addresses are in use. IP addresses may also enable an adversary to derive other details about a victim, such as organizational size, physical location(s), Internet service provider, and or where/how their publicly-facing infrastructure is hosted.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:C0015
ATT&CK Technique Name:C0015
During C0015, the threat actors used the command net localgroup "adminstrator" to identify accounts with local administrator rights.[3]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1031
ATT&CK Technique Name:Network Intrusion Prevention
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Malware researchers can reverse engineer malware variants that use DGAs and determine future domains that the malware will attempt to contact, but this is a time and resource intensive effort.[1][32] Malware is also increasingly incorporating seed values that can be unique for each instance, which would then need to be determined to extract future generated domains. In some cases, the seed that a particular sample uses can be extracted from DNS traffic.[5] Even so, there can be thousands of possible domains generated per day; this makes it impractical for defenders to preemptively register all possible C2 domains due to the cost.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0587
ATT&CK Technique Name:Penquin
Penquin can delete downloaded executables after running them.[175]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G1003
ATT&CK Technique Name:Ember Bear
Ember Bear has attempted to lure users to click on a malicious link within a spearphishing email.[30]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0082
ATT&CK Technique Name:Emissary
Emissary has the capability to execute the command ipconfig /all.[80]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0690
ATT&CK Technique Name:Green Lambert
Green Lambert can delete the original executable after initial installation in addition to unused functions.[89][90]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0650
ATT&CK Technique Name:QakBot
The QakBot dropper can delay dropping the payload to evade detection.[34][35]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1056.004
ATT&CK Technique Name:Credential API Hooking
Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials. Unlike Keylogging,  this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G1005
ATT&CK Technique Name:POLONIUM
POLONIUM has used valid compromised credentials to gain access to victim environments.[53]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1030
ATT&CK Technique Name:Network Segmentation
Enable firewall rules to block RDP traffic between network security zones within a network.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0658
ATT&CK Technique Name:XCSSET
XCSSET uses scp to access the ~/Library/Cookies/Cookies.binarycookies file.[16]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0024
ATT&CK Technique Name:Dyre
Dyre has the ability to identify running services on a compromised host.[15]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1461
ATT&CK Technique Name:Lockscreen Bypass
An adversary with physical access to a mobile device may seek to bypass the device’s lockscreen. Several methods exist to accomplish this, including:


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M0804
ATT&CK Technique Name:Human User Authentication
Devices that allow remote management of firmware should require authentication before allowing any changes. The authentication mechanisms should also support Account Use Policies, Password Policies, and User Account Management.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0363
ATT&CK Technique Name:Empire
Empire has the ability to gather browser data such as bookmarks and visited sites.[9]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1018
ATT&CK Technique Name:Saint Bot
Saint Bot has used the command timeout 20 to pause the execution of its initial loader.[37]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0455
ATT&CK Technique Name:Metamorfo
Metamorfo has displayed fake forms on top of banking sites to intercept credentials from victims.[12]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:botconf2013 Spam and All Things Salty: Spambot v2013
This presentation will discuss our research on a threat that involves the massive attacks on WordPress, Joomla and Drupal sites and where they attempt to test the waters on a new spamming cycle. This routine involves different forms of web threats working independently of each other and has posed a challenge when it comes to email authentication. We will look into the (1) compromised website, (2) compromised machine, (3) command and control server, the (4) payloads and/or aliates involved and (5) the telemetry of the data we collected.
pdf下载:https://www.botconf.eu/wp-content/uploads/formidable/2/03-JessadelaTorre-SpamBot-1.pdf


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1026
ATT&CK Technique Name:Privileged Account Management
Limit permissions associated with creating and modifying platform images or containers based on the principle of least privilege.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0349
ATT&CK Technique Name:LaZagne
LaZagne can perform credential dumping from memory to obtain account and password information.[46]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1012
ATT&CK Technique Name:Enterprise Policy
Enterprise policies should prevent enabling USB debugging on Android devices unless specifically needed (e.g., if the device is used for application development).


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:C0022
ATT&CK Technique Name:Operation Dream Job
During Operation Dream Job, Lazarus Group performed brute force attacks against administrator accounts.[18]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0654
ATT&CK Technique Name:ProLock
ProLock can encrypt files on a compromised host with RC6, and encrypts the key with RSA-1024.[65]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0435
ATT&CK Technique Name:PLEAD
PLEAD has been executed via malicious links in e-mails.[18]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0496
ATT&CK Technique Name:REvil
REvil utilizes JavaScript, WScript, and PowerShell scripts to execute. The malicious JavaScript attachment has an obfuscated PowerShell script that executes the malware. [5]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0266
ATT&CK Technique Name:TrickBot
TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge, sometimes using esentutl.[87][88][89]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1584
ATT&CK Technique Name:Compromise Infrastructure
Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle. Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0085
ATT&CK Technique Name:S-Type
S-Type has uploaded data and files from a compromised host to its C2 servers.[87]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0405
ATT&CK Technique Name:Exodus
Exodus Two can take pictures with the device cameras.[7]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1564.007
ATT&CK Technique Name:VBA Stomping
Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0269
ATT&CK Technique Name:QUADAGENT
QUADAGENT stores a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications within a Registry key (such as HKCU\Office365DCOMCheck) in the HKCU hive.[20]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1051
ATT&CK Technique Name:Update Software
Microsoft released an optional patch update - KB3045645 - that will remove the "auto-elevate" flag within the sdbinst.exe. This will prevent use of application shimming to bypass UAC.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0671
ATT&CK Technique Name:Tomiris
Tomiris can download files and execute them on a victim's system.[444]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1039
ATT&CK Technique Name:Bumblebee
Bumblebee can use asynchronous procedure call (APC) injection to execute commands received from C2.[6]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:us-19 Breaking Encrypted Databases: Generic Attacks on Range Queries
Security researchers and practitioners have proposed many techniques for securely storing and querying outsourced data. I'll start this talk with an overview of common building blocks and the latest commercial and academic solutions, focusing on those that support range queries (e.g., selecting all records where the age attribute is between 18 and 65). These techniques are tailored to specific threat models. For example, if the database server is trusted but not the network, connections can be encrypted with TLS. If the database server is trusted but there is a risk of disk theft, full-disk encryption or page-level encryption of database files and logs (e.g., Transparent Data Encryption) can be enabled. If the database server isn't trusted at all, a system that encrypts all data before uploading it (e.g., via a CipherCloud gateway or CryptDB proxy server) could be employed.All of these solutions, however, leak some information when a query is processed -- like the set of records matching the query, or the size of this set. This information leaks even to an observer who doesn't have any cryptographic keys. The source of the leakage can vary; it could be network traffic, observed memory accesses, or database logs recovered by forensic analysis. I'll explain how this leakage can be exploited by an attacker to break the encryption and recover values in the database. These attacks are entirely generic and don't depend on the database implementation. They have connections to graph theory, Golomb rulers, and machine learning. I'll discuss proposed countermeasures, and finish by offering guidelines that practitioners can use when assessing the security claims of the latest and greatest database encryption solutions.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0059
ATT&CK Technique Name:Magic Hound
Magic Hound has named a malicious script CacheTask.bat to mimic a legitimate task.[46]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M0813
ATT&CK Technique Name:Software Process and Device Authentication
Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0332
ATT&CK Technique Name:Remcos
Remcos has full control of the Registry, including the ability to modify it.[132]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1026
ATT&CK Technique Name:Privileged Account Management
Ensure containers are not running as root by default. In Kubernetes environments, consider defining Pod Security Standards that prevent pods from running privileged containers.[4]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1205
ATT&CK Technique Name:Traffic Signaling
Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. Port Knocking), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0130
ATT&CK Technique Name:Unknown Logger
Unknown Logger is capable of recording keystrokes.[25]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0631
ATT&CK Technique Name:Chaes
Chaes has used search order hijacking to load a malicious DLL.[15]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1054
ATT&CK Technique Name:Software Configuration
Configure browsers/applications to regularly delete persistent web cookies.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0037
ATT&CK Technique Name:HAMMERTOSS
HAMMERTOSS exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later.[14]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0502
ATT&CK Technique Name:Drovorub
Drovorub can use TCP to communicate between its agent and client modules.[23]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0102
ATT&CK Technique Name:Wizard Spider
Wizard Spider has used valid credentials for privileged accounts with the goal of accessing domain controllers.[64]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1061
ATT&CK Technique Name:AbstractEmu
AbstractEmu can intercept SMS messages containing two factor authentication codes.[1]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

titleblackhat:us-21 Demystify AI Security Products With a Universal Pluggable XAI Translator
In the past years, we witnessed a dramatic rise in the platforms and apps based on machine learning and artificial intelligence. Inevitably, nearly every security product claims to be powered by deep learning technology and achieve an incredible detection rate. Confused by the various fancy terms advertised by security companies, the dilemma faced by customers is how to determine the quality of these products and how to choose the suitable one. Previous studies have proposed various ways to evaluate many kinds of ML-based security products (e.g malware detection, cloud-based, endpoint av). Our presentation tends to bridge the research‐to‐practice gap by sharing our experience when evaluating the real-world vendor's products.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

titleblackhat:us-22 I Am Whoever I Say I Am: Infiltrating Identity Providers Using a 0Click Exploit
Single Sign On (SSO) has become the dominant authentication scheme to login to several related, yet independent, software systems. At the core of this are the identity providers (IdP). Their role is to perform credential verification and to supply a signed token that service providers (SP) can consume for access control.On the other hand, when an application requests resources on behalf of a user and they're granted, then an authorization request is made to an authorization server (AS). The AS exchanges a code for a token which is presented to a resource server (RS) and the requested resources are consumed by the requesting application.Whilst OAuth2 handles authorization, and SAML handles authentication and as such Identity and Access Management (IAM) solutions have become very popular in the enterprise environment to handle both use cases. What if IAM solutions are vulnerable to critical remote attacks? They need to be exposed on the internet, trusted to guard identities and facilitate access to hundreds if not thousands of users and applications.To begin with, I will cover the foundational use-case for IAM solutions and some past in the wild attacks (ITW) attacks with the extent of their impact.Continuing, I will present the approach I took with the audit including the challenges and pitfalls that I was faced with and how I overcame them. The result concluding with an unauthenticated remote code execution as root by chaining multiple vulnerabilities on a very popular IAM solution used by several Fortune 500 companies and government organizations.The vulnerabilities will be discussed in detail including novel exploitation strategies for bypassing strict outbound network access. Finally, a live demo will be presented with a release of functional exploit code so that penetration testers and network administrators can validate and remediate these critical findings.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0056
ATT&CK Technique Name:PROMETHIUM
PROMETHIUM has created admin accounts on a compromised host.[11]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0182
ATT&CK Technique Name:FinFisher
FinFisher probes the system to check for antimalware processes.[40][41]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1574.011
ATT&CK Technique Name:Services Registry Permissions Weakness
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe,  PowerShell, or Reg. Access to Registry keys is controlled through access control lists and user permissions.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0486
ATT&CK Technique Name:Bonadan
Bonadan has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.[2]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0516
ATT&CK Technique Name:SoreFang
SoreFang can collect the TCP/IP, DNS, DHCP, and network adapter configuration on a compromised host via ipconfig.exe /all.[214]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0572
ATT&CK Technique Name:Caterpillar WebShell
Caterpillar WebShell has a command to modify a Registry key.[32]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1032
ATT&CK Technique Name:PyDCrypt
PyDCrypt has decrypted and dropped the DCSrv payload to disk.[180]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

titleblackhat:asia-23 Prototype Pollution Leads to RCE: Gadgets Everywhere
Many have heard about Prototype Pollution vulnerabilities in JavaScript applications. This kind of vulnerability allows an attacker to inject properties into an object's root prototype that may lead to flow control alteration and unexpected program behavior. Every time a successful exploit looks like magic or is limited to a denial of service (DoS). Would you be surprised if I told you that every application has a chain of methods that can be triggered by Prototype Pollution and leads to arbitrary code execution? Such gadgets populated Node.js core code and popular NPM packages. Keep calm. Not every app can be exploited! However, this fact increases the risk of exploitation many times over.In our research, we studied Prototype Pollution beyond DoS and analyzed Node.js source code against the gadgets. We then analyzed 15 popular Node.js apps from GitHub and got 8 RCEs. Through this talk, I will elaborate on the detected gadgets and vulnerabilities. We will also take a look at how the recent changes in Node.js mitigate these issues.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0606
ATT&CK Technique Name:Bad Rabbit
Bad Rabbit is disguised as an Adobe Flash installer. When the file is opened it starts locking the infected computer. [5]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0094
ATT&CK Technique Name:Kimsuky
Kimsuky has used a proprietary tool to intercept one time passwords required for two-factor authentication.[5]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0515
ATT&CK Technique Name:WellMail
WellMail can exfiltrate files from the victim machine.[191]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0499
ATT&CK Technique Name:Hancitor
Hancitor has the ability to download additional files from C2.[209]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0570
ATT&CK Technique Name:BitPaymer
BitPaymer can use the tokens of users to create processes on infected systems.[3]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1031
ATT&CK Technique Name:Network Intrusion Prevention
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools. [18]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0535
ATT&CK Technique Name:Golden Cup
Golden Cup can collect sent and received SMS messages.[25]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0032
ATT&CK Technique Name:Lazarus Group
Lazarus Group has used mshta.exe to execute HTML pages downloaded by initial access documents.[23][24]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1021
ATT&CK Technique Name:DnsSystem
DnsSystem can download files to compromised systems after receiving a command with the string downloaddd.[146]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0002
ATT&CK Technique Name:Mimikatz
Mimikatz’s LSADUMP::DCSync and KERBEROS::PTT modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets.[8][9][10][11]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0059
ATT&CK Technique Name:Magic Hound
Magic Hound malware has used base64-encoded files and has also encrypted embedded strings with AES.[202][203]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0652
ATT&CK Technique Name:MarkiRAT
MarkiRAT can capture all keystrokes on a compromised host.[109]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0119
ATT&CK Technique Name:Indrik Spider
Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.[74]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0531
ATT&CK Technique Name:Grandoreiro
Grandoreiro can capture clipboard data from a compromised host.[24]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0096
ATT&CK Technique Name:APT41
APT41 used compromised credentials to log on to other systems.[13][14]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1009
ATT&CK Technique Name:Triton
Triton leverages a reconstructed TriStation protocol within its framework to trigger APIs related to program download, program allocation, and program changes. [1]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0697
ATT&CK Technique Name:HermeticWiper
HermeticWiper can recursively wipe folders and files in Windows, Program Files, Program Files(x86), PerfLogs, Boot, System, Volume Information, and AppData folders using FSCTL_MOVE_FILE. HermeticWiper can also overwrite symbolic links and big files in My Documents and on the Desktop with random bytes.[16]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1015
ATT&CK Technique Name:Active Directory Configuration
For containing the impact of a previously generated golden ticket, reset the built-in KRBTGT account password twice, which will invalidate any existing golden tickets that have been created with the KRBTGT hash and other Kerberos tickets derived from it. For each domain, change the KRBTGT account password once, force replication, and then change the password a second time. Consider rotating the KRBTGT account password every 180 days.[10]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1018
ATT&CK Technique Name:User Account Management
Regularly audit user accounts for activity and deactivate or remove any that are no longer needed.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0162
ATT&CK Technique Name:Komplex
The Komplex trojan creates a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist with launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist.[5]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0093
ATT&CK Technique Name:GALLIUM
GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration.[15][16]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0434
ATT&CK Technique Name:Imminent Monitor
Imminent Monitor has deleted files related to its dynamic debugger feature.[109]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0050
ATT&CK Technique Name:APT32
APT32 has set up Facebook pages in tandem with fake websites.[3]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0367
ATT&CK Technique Name:Emotet
Emotet has used Powershell to retrieve the malicious payload and download additional resources like Mimikatz. [82][83][84][85][86]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0134
ATT&CK Technique Name:Transparent Tribe
Transparent Tribe can hide legitimate directories and replace them with malicious copies of the same name.[48]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0615
ATT&CK Technique Name:SombRAT
SombRAT can execute loadfromfile, loadfromstorage, and loadfrommem to inject a DLL  from disk, storage, or memory respectively.[54]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M0922
ATT&CK Technique Name:Restrict File and Directory Permissions
Protect files stored locally with proper permissions to limit opportunities for adversaries to interact and collect information from databases. [8] [9]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0631
ATT&CK Technique Name:Chaes
Chaes has a module to perform any API hooking it desires.[2]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:us-21 CnCHunter: An MITM-Approach to Identify Live CnC Servers
How can we identify active CnC servers? Answering this question is critical for containing and combating botnets. Finding CnC servers is not trivial because: CnC servers can change locations expressly to avoid detection, use proprietary communication protocols, and often use end-to-end encryption. Most prior efforts first "learn" a malware communication protocol, and then, scan the Internet in search of live CnC servers. Although useful, this approach will not work with sophisticated malware that may use encryption or communication protocol that is hard to reverse engineer.In this session, we propose CnCHunter, a systematic tool that discovers live CnC servers efficiently. The novelty of our approach is that it uses real "activated" malware to search for live CnC servers, with CnCHunter acting as a Man-In-The-Middle. As a result, our approach overcomes the limitations of prior efforts. For example, the malware binary knows how to communicate with its server even if in the presence of encryption. We randomly selected 50 IoT malware samples collected between 2017 and 2021, and found their CnC servers. CnCHunter could automatically activate 96% of the malware and dynamically find the CnC servers.Additionally, we demonstrate the potential of our system by activating an old Gafgyt malware sample and enabling it to communicate with a live CnC server for a recent sample of the same family. This proves that an old malware binary of a family can be used to scan the Internet and find live Cnc servers for that malware family.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0377
ATT&CK Technique Name:Ebury
Ebury can exfiltrate SSH credentials through custom DNS queries.[39]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0040
ATT&CK Technique Name:Patchwork
Patchwork has obtained and used open-source tools such as QuasarRAT.[83]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

titleblackhat:us-22 Fault-Injection Detection Circuits: Design, Calibration, Validation and Tuning
This session covers the tunable replica circuit (TRC), a fault-injection detection circuit that has been integrated into Intel® Converged Security and Management Engine (Intel® CSME) in the recent 12th Gen Intel® Core™ Processor.  This is Intel's first foray into active fault-injection attack detection in high-volume products such as CPUs and chipsets.Ultimately, since a timing failure is the primary goal of fault-injection attacks and has been shown as the vehicle to cause unsigned code to run on other security engines, using the TRC to explicitly detect timing failures is Intel's current approach to fault-injection detection in client security engines. Unlike traditional analog voltage and clock monitors, the TRC detects timing failures that result from voltage, clock, temperature, and other glitch attacks, such as electromagnetic radiation. This session will introduce the TRC technology, how the TRC was integrated into Intel CSME, the process for calibrating the TRC in high volume manufacturing (HVM), as well as the false-positive and fault-injection testing that occurred in our physical attack labs.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0107
ATT&CK Technique Name:Whitefly
Whitefly has named the malicious DLL the same name as DLLs belonging to legitimate software from various security vendors.[175]


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Disavowable Public Key Encryption with Non-interactive Opening
author:Ai Ishida and
Keita Emura and
Goichiro Hanaoka and
Yusuke Sakai and
Keisuke Tanaka
Disavowable Public Key Encryption
with Non-interactive Opening
Ai Ishida
Tokyo Instutitute of Technology
National Institute of Advanced
Industrial Science and
Technology, Japan
ishida0@is.titech.ac.jp
Keita Emura
National Institute of
Information and
Communications Technology,
Japan
k-emura@nict.go.jp
Goichiro Hanaoka
National Institute of Advanced
Industrial Science and
Technology, Japan
hanaoka-
goichiro@aist.go.jp
Yusuke Sakai
National Institute of Advanced
Industrial Science and
Technology, Japan
yusuke.sakai@aist.go.jp
ABSTRACT
We propose the notion of disavowable public key encryption
with non-interactive opening (disavowable PKENO) where,
for a ciphertext and a message, the receiver of the ciphertext
can issue a proof that the plaintext of the ciphertext is NOT
the message, and give a fairly practical construction.
Categories and Subject Descriptors
E.3 [Data]: Data Encryption|public key cryptosystems
General Terms
Theory, Security
Keywords
PKENO, disavowability, Groth-Sahai proof
1.
INTRODUCTION
The primitive public key encryption with non-interactive
opening (PKENO) [1] is a class of public key encryption with
additional functionality. By using this, a user can prove
that a ciphertext is an encryption of a certain message and
it is publicly veriﬁed. In some situation that a user needs
to claim that a ciphertext is NOT decrypted to a certain
message, if he proves the fact by using PKENO, the real
message of the ciphertext is revealed and a veriﬁer checks
that it is diﬀerent from the certain message about which
the user wants to prove. However, this naive solution is
problematic in terms of privacy. For example, a customer
of a store is required to prove that he did not buy a certain
Permission to make digital or hard copies of part or all of this work for personal or
classroom use is granted without fe...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Disavowable Public Key Encryption with Non-interactive Opening
author:Ai Ishida and
Keita Emura and
Goichiro Hanaoka and
Yusuke Sakai and
Keisuke Tanaka
Disavowable Public Key Encryption
with Non-interactive Opening
Ai Ishida
Tokyo Instutitute of Technology
National Institute of Advanced
Industrial Science and
Technology, Japan
ishida0@is.titech.ac.jp
Keita Emura
National Institute of
Information and
Communications Technology,
Japan
k-emura@nict.go.jp
Goichiro Hanaoka
National Institute of Advanced
Industrial Science and
Technology, Japan
hanaoka-
goichiro@aist.go.jp
Yusuke Sakai
National Institute of Advanced
Industrial Science and
Technology, Japan
yusuke.sakai@aist.go.jp
ABSTRACT
We propose the notion of disavowable public key encryption
with non-interactive opening (disavowable PKENO) where,
for a ciphertext and a message, the receiver of the ciphertext
can issue a proof that the plaintext of the ciphertext is NOT
the message, and give a fairly practical construction.
Categories and Subject Descriptors
E.3 [Data]: Data Encryption|public key cryptosystems
General Terms
Theory, Security
Keywords
PKENO, disavowability, Groth-Sahai proof
1.
INTRODUCTION
The primitive public key encryption with non-interactive
opening (PKENO) [1] is a class of public key encryption with
additional functionality. By using this, a user can prove
that a ciphertext is an encryption of a certain message and
it is publicly veriﬁed. In some situation that a user needs
to claim that a ciphertext is NOT decrypted to a certain
message, if he proves the fact by using PKENO, the real
message of the ciphertext is revealed and a veriﬁer checks
that it is diﬀerent from the certain message about which
the user wants to prove. However, this naive solution is
problematic in terms of privacy. For example, a customer
of a store is required to prove that he did not buy a certain
Permission to make digital or hard copies of part or all of this work for personal or
classroom use is granted without fe...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Neural Machine Translation Inspired Binary Code Similarity Comparison
beyond Function Pairs
author:Fei Zuo and
Xiaopeng Li and
Patrick Young and
Lannan Luo and
Qiang Zeng and
Zhexin Zhang
Neural Machine Translation Inspired Binary Code
Similarity Comparison beyond Function Pairs
Fei Zuo†, Xiaopeng Li†, Patrick Young‡, Lannan Luo†*, Qiang Zeng†*, Zhexin Zhang†
†University of South Carolina, ‡Temple University
{fzuo, xl4, zhexin}@email.sc.edu, {lluo, zeng1}@cse.sc.edu
Abstract—Binary code analysis allows analyzing binary code
without having access to the corresponding source code. A binary,
after disassembly, is expressed in an assembly language. This
inspires us to approach binary analysis by leveraging ideas and
techniques from Natural Language Processing (NLP), a fruitful
area focused on processing text of various natural languages. We
notice that binary code analysis and NLP share many analogical
topics, such as semantics extraction, classiﬁcation, and code/text
comparison. This work thus borrows ideas from NLP to address
two important code similarity comparison problems. (I) Given
a pair of basic blocks of different instruction set architectures
(ISAs), determining whether their semantics is similar; and (II)
given a piece of code of interest, determining if it is contained in
another piece of code of a different ISA. The solutions to these
two problems have many applications, such as cross-architecture
vulnerability discovery and code plagiarism detection.
Despite the evident importance of Problem I, existing solutions
are either inefﬁcient or imprecise. Inspired by Neural Machine
Translation (NMT), which is a new approach that tackles text
across natural languages very well, we regard instructions as
words and basic blocks as sentences, and propose a novel cross-
(assembly)-lingual deep learning approach to solving Problem I,
attaining high efﬁciency and precision. Many solutions have been
proposed to determine whether two pieces of code, e.g., functions,...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Neural Machine Translation Inspired Binary Code Similarity Comparison
beyond Function Pairs
author:Fei Zuo and
Xiaopeng Li and
Patrick Young and
Lannan Luo and
Qiang Zeng and
Zhexin Zhang
Neural Machine Translation Inspired Binary Code
Similarity Comparison beyond Function Pairs
Fei Zuo†, Xiaopeng Li†, Patrick Young‡, Lannan Luo†*, Qiang Zeng†*, Zhexin Zhang†
†University of South Carolina, ‡Temple University
{fzuo, xl4, zhexin}@email.sc.edu, {lluo, zeng1}@cse.sc.edu
Abstract—Binary code analysis allows analyzing binary code
without having access to the corresponding source code. A binary,
after disassembly, is expressed in an assembly language. This
inspires us to approach binary analysis by leveraging ideas and
techniques from Natural Language Processing (NLP), a fruitful
area focused on processing text of various natural languages. We
notice that binary code analysis and NLP share many analogical
topics, such as semantics extraction, classiﬁcation, and code/text
comparison. This work thus borrows ideas from NLP to address
two important code similarity comparison problems. (I) Given
a pair of basic blocks of different instruction set architectures
(ISAs), determining whether their semantics is similar; and (II)
given a piece of code of interest, determining if it is contained in
another piece of code of a different ISA. The solutions to these
two problems have many applications, such as cross-architecture
vulnerability discovery and code plagiarism detection.
Despite the evident importance of Problem I, existing solutions
are either inefﬁcient or imprecise. Inspired by Neural Machine
Translation (NMT), which is a new approach that tackles text
across natural languages very well, we regard instructions as
words and basic blocks as sentences, and propose a novel cross-
(assembly)-lingual deep learning approach to solving Problem I,
attaining high efﬁciency and precision. Many solutions have been
proposed to determine whether two pieces of code, e.g., functions,...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:What Mobile Ads Know About Mobile Users
author:Sooel Son and
Daehyeok Kim and
Vitaly Shmatikov
What Mobile Ads Know About Mobile Users
Sooel Son
Daehyeok Kim
Vitaly Shmatikov
Google
KAIST
Cornell Tech
Abstract
We analyze the software stack of popular mobile adver-
tising libraries on Android and investigate how they protect
the users of advertising-supported apps from malicious
advertising. We ﬁnd that, by and large, Android adver-
tising libraries properly separate the privileges of the ads
from the host app by conﬁning ads to dedicated browser
instances that correctly apply the same origin policy.
We then demonstrate how malicious ads can infer sensi-
tive information about users by accessing external storage,
which is essential for media-rich ads in order to cache
video and images. Even though the same origin policy
prevents conﬁned ads from reading other apps’ external-
storage ﬁles, it does not prevent them from learning that a
ﬁle with a particular name exists. We show how, depending
on the app, the mere existence of a ﬁle can reveal sensitive
information about the user. For example, if the user has
a pharmacy price-comparison app installed on the device,
the presence of external-storage ﬁles with certain names
reveals which drugs the user has looked for.
We conclude with our recommendations for redesigning
mobile advertising software to better protect users from
malicious advertising.
I.
Introduction
Many mobile apps rely on advertising for at least part of
their revenue. An advertising-supported app typically in-
corporates multiple advertising libraries (AdSDKs). While
the app is running, each AdSDK fetches ads from its
servers, where they have been uploaded by advertisers, and
displays them to the app’s user.
Business imperatives are driving the development of
re-
mobile advertising technology. To increase users’
Permission to freely reproduce all or part of this paper for noncommercial
purposes is granted provided that copies bear this notice and th...


Instruction: 总结这篇安全研究的主要观点

Input:
title:What Mobile Ads Know About Mobile Users
author:Sooel Son and
Daehyeok Kim and
Vitaly Shmatikov
What Mobile Ads Know About Mobile Users
Sooel Son
Daehyeok Kim
Vitaly Shmatikov
Google
KAIST
Cornell Tech
Abstract
We analyze the software stack of popular mobile adver-
tising libraries on Android and investigate how they protect
the users of advertising-supported apps from malicious
advertising. We ﬁnd that, by and large, Android adver-
tising libraries properly separate the privileges of the ads
from the host app by conﬁning ads to dedicated browser
instances that correctly apply the same origin policy.
We then demonstrate how malicious ads can infer sensi-
tive information about users by accessing external storage,
which is essential for media-rich ads in order to cache
video and images. Even though the same origin policy
prevents conﬁned ads from reading other apps’ external-
storage ﬁles, it does not prevent them from learning that a
ﬁle with a particular name exists. We show how, depending
on the app, the mere existence of a ﬁle can reveal sensitive
information about the user. For example, if the user has
a pharmacy price-comparison app installed on the device,
the presence of external-storage ﬁles with certain names
reveals which drugs the user has looked for.
We conclude with our recommendations for redesigning
mobile advertising software to better protect users from
malicious advertising.
I.
Introduction
Many mobile apps rely on advertising for at least part of
their revenue. An advertising-supported app typically in-
corporates multiple advertising libraries (AdSDKs). While
the app is running, each AdSDK fetches ads from its
servers, where they have been uploaded by advertisers, and
displays them to the app’s user.
Business imperatives are driving the development of
re-
mobile advertising technology. To increase users’
Permission to freely reproduce all or part of this paper for noncommercial
purposes is granted provided that copies bear this notice and th...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Secure Integration of Web Content and Applications on Commodity Mobile
Operating Systems
author:Drew Davidson and
Yaohui Chen and
Franklin George and
Long Lu and
Somesh Jha
Secure Integration of Web Content and Applications on
Commodity Mobile Operating Systems
Drew Davidson
University of Wisconsin
Yaohui Chen
Stony Brook University
Franklin George
Stony Brook University
Long Lu
Stony Brook University
Somesh Jha
University of Wisconsin
ABSTRACT
A majority of today’s mobile apps integrate web content
of various kinds. Unfortunately, the interactions between
app code and web content expose new attack vectors: a
malicious app can subvert its embedded web content to steal
user secrets; on the other hand, malicious web content can
use the privileges of its embedding app to exﬁltrate sensitive
information such as the user’s location and contacts.
In this paper, we discuss security weaknesses of the in-
terface between app code and web content through attacks,
then introduce defenses that can be deployed without mod-
ifying the OS. Our defenses feature WIREframe, a service
that securely embeds and renders external web content in
Android apps, and in turn, prevents attacks between em-
bedded web and host apps. WIREframe fully mediates the
interface between app code and embedded web content. Un-
like the existing web-embedding mechanisms, WIREframe
allows both apps and embedded web content to deﬁne sim-
ple access policies to protect their own resources. These
policies recognize ﬁne-grained security principals, such as
origins, and control all interactions between apps and the
web. We also introduce WIRE (Web Isolation Rewriting
Engine), an o✏ine app rewriting tool that allows app users
to inject WIREframe protections into existing apps. Our
evaluation, based on 7166 popular apps and 20 specially se-
lected apps, shows these techniques work on complex apps
and incur acceptable end-to-end performance overhead.
1.
INTRODUCTION
A common app design paradigm is to embed web...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Secure Integration of Web Content and Applications on Commodity Mobile
Operating Systems
author:Drew Davidson and
Yaohui Chen and
Franklin George and
Long Lu and
Somesh Jha
Secure Integration of Web Content and Applications on
Commodity Mobile Operating Systems
Drew Davidson
University of Wisconsin
Yaohui Chen
Stony Brook University
Franklin George
Stony Brook University
Long Lu
Stony Brook University
Somesh Jha
University of Wisconsin
ABSTRACT
A majority of today’s mobile apps integrate web content
of various kinds. Unfortunately, the interactions between
app code and web content expose new attack vectors: a
malicious app can subvert its embedded web content to steal
user secrets; on the other hand, malicious web content can
use the privileges of its embedding app to exﬁltrate sensitive
information such as the user’s location and contacts.
In this paper, we discuss security weaknesses of the in-
terface between app code and web content through attacks,
then introduce defenses that can be deployed without mod-
ifying the OS. Our defenses feature WIREframe, a service
that securely embeds and renders external web content in
Android apps, and in turn, prevents attacks between em-
bedded web and host apps. WIREframe fully mediates the
interface between app code and embedded web content. Un-
like the existing web-embedding mechanisms, WIREframe
allows both apps and embedded web content to deﬁne sim-
ple access policies to protect their own resources. These
policies recognize ﬁne-grained security principals, such as
origins, and control all interactions between apps and the
web. We also introduce WIRE (Web Isolation Rewriting
Engine), an o✏ine app rewriting tool that allows app users
to inject WIREframe protections into existing apps. Our
evaluation, based on 7166 popular apps and 20 specially se-
lected apps, shows these techniques work on complex apps
and incur acceptable end-to-end performance overhead.
1.
INTRODUCTION
A common app design paradigm is to embed web...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Detecting and Analyzing Automated Activity on Twitter
author:Chao Michael Zhang and
Vern Paxson
Detecting and Analyzing Automated Activity on Twitter
Chao Michael Zhang1 and Vern Paxson1,2,(cid:2)
1 University of California, Berkeley, CA
2 International Computer Science Institute, Berkeley, CA
Abstract. We present a method for determining whether a Twitter account ex-
hibits automated behavior in publishing status updates known as tweets. The ap-
proach uses only the publicly available timestamp information associated with
each tweet. After evaluating its effectiveness, we use it to analyze the Twitter
landscape, ﬁnding that 16% of active accounts exhibit a high degree of automa-
tion. We also ﬁnd that 11% of accounts that appear to publish exclusively through
the browser are in fact automated accounts that spoof the source of the updates.
1 Introduction
Twitter is a microblogging service that allows its members to publish short status up-
dates known as tweets. Over 180 M visitors interact with Twitter each month, generating
55 M tweets/day [13]. User accounts and their status updates are public by default, ac-
cessible by the general public via Twitter’s two application program interfaces (APIs).
The large number of users, low privacy expectations, and easy-to-use API have made
Twitter a target of abuse, whether relatively benign in the form of spam and disruptive
marketing tactics [5], or malicious in the form of links to malware [17] and phishing
schemes [8]. Often abuse on Twitter employs automation for actions such as publishing
tweets, following another user, and sending links through private messages.
Prior research on Twitter has studied the properties of the social network [10], char-
acteristics of users and their behavior [11], and social interactions between users [9], but
not speciﬁcally regarding the issue of automation on Twitter (other than our own use
of the technique we develop here to assist with ﬁnding Twitter “career” spammers [7]).
In th...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Detecting and Analyzing Automated Activity on Twitter
author:Chao Michael Zhang and
Vern Paxson
Detecting and Analyzing Automated Activity on Twitter
Chao Michael Zhang1 and Vern Paxson1,2,(cid:2)
1 University of California, Berkeley, CA
2 International Computer Science Institute, Berkeley, CA
Abstract. We present a method for determining whether a Twitter account ex-
hibits automated behavior in publishing status updates known as tweets. The ap-
proach uses only the publicly available timestamp information associated with
each tweet. After evaluating its effectiveness, we use it to analyze the Twitter
landscape, ﬁnding that 16% of active accounts exhibit a high degree of automa-
tion. We also ﬁnd that 11% of accounts that appear to publish exclusively through
the browser are in fact automated accounts that spoof the source of the updates.
1 Introduction
Twitter is a microblogging service that allows its members to publish short status up-
dates known as tweets. Over 180 M visitors interact with Twitter each month, generating
55 M tweets/day [13]. User accounts and their status updates are public by default, ac-
cessible by the general public via Twitter’s two application program interfaces (APIs).
The large number of users, low privacy expectations, and easy-to-use API have made
Twitter a target of abuse, whether relatively benign in the form of spam and disruptive
marketing tactics [5], or malicious in the form of links to malware [17] and phishing
schemes [8]. Often abuse on Twitter employs automation for actions such as publishing
tweets, following another user, and sending links through private messages.
Prior research on Twitter has studied the properties of the social network [10], char-
acteristics of users and their behavior [11], and social interactions between users [9], but
not speciﬁcally regarding the issue of automation on Twitter (other than our own use
of the technique we develop here to assist with ﬁnding Twitter “career” spammers [7]).
In th...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Structured streams: a new transport abstraction
author:Bryan Ford
Structured Streams: a New Transport Abstraction
Bryan Ford
Massachusetts Institute of Technology
ABSTRACT
Internet applications currently have a choice between stream
and datagram transport abstractions. Datagrams eﬃciently
support small transactions and streams are suited for long-
running conversations, but neither abstraction adequately
supports applications like HTTP that exhibit a mixture of
transaction sizes, or applications like FTP and SIP that use
multiple transport instances. Structured Stream Transport
(SST) enhances the traditional stream abstraction with a hi-
erarchical hereditary structure, allowing applications to cre-
ate lightweight child streams from any existing stream. Un-
like TCP streams, these lightweight streams incur neither
3-way handshaking delays on startup nor TIME-WAIT pe-
riods on close. Each stream oﬀers independent data transfer
and ﬂow control, allowing diﬀerent transactions to proceed
in parallel without head-of-line blocking, but all streams
share one congestion control context. SST supports both
reliable and best-eﬀort delivery in a way that semantically
uniﬁes datagrams with streams and solves the classic “large
datagram” problem, where a datagram’s loss probability in-
creases exponentially with fragment count. Finally, an ap-
plication can prioritize its streams relative to each other and
adjust priorities dynamically through out-of-band signaling.
A user-space prototype shows that SST is TCP-friendly to
within 2%, and performs comparably to a user-space TCP
and to within 10% of kernel TCP on a WiFi network.
Categories and Subject Descriptors
C.2.2 [Computer-Communication Networks]: Network
Protocols; C.2.6 [Computer-Communication Networks]:
Internetworking—Standards (e.g., TCP/IP)
General Terms
Algorithms, Design, Performance, Security, Standardization
Keywords
SST, transport protocols, stream, datagram, reliable, best-
eﬀort, web transport, multimedia, ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Structured streams: a new transport abstraction
author:Bryan Ford
Structured Streams: a New Transport Abstraction
Bryan Ford
Massachusetts Institute of Technology
ABSTRACT
Internet applications currently have a choice between stream
and datagram transport abstractions. Datagrams eﬃciently
support small transactions and streams are suited for long-
running conversations, but neither abstraction adequately
supports applications like HTTP that exhibit a mixture of
transaction sizes, or applications like FTP and SIP that use
multiple transport instances. Structured Stream Transport
(SST) enhances the traditional stream abstraction with a hi-
erarchical hereditary structure, allowing applications to cre-
ate lightweight child streams from any existing stream. Un-
like TCP streams, these lightweight streams incur neither
3-way handshaking delays on startup nor TIME-WAIT pe-
riods on close. Each stream oﬀers independent data transfer
and ﬂow control, allowing diﬀerent transactions to proceed
in parallel without head-of-line blocking, but all streams
share one congestion control context. SST supports both
reliable and best-eﬀort delivery in a way that semantically
uniﬁes datagrams with streams and solves the classic “large
datagram” problem, where a datagram’s loss probability in-
creases exponentially with fragment count. Finally, an ap-
plication can prioritize its streams relative to each other and
adjust priorities dynamically through out-of-band signaling.
A user-space prototype shows that SST is TCP-friendly to
within 2%, and performs comparably to a user-space TCP
and to within 10% of kernel TCP on a WiFi network.
Categories and Subject Descriptors
C.2.2 [Computer-Communication Networks]: Network
Protocols; C.2.6 [Computer-Communication Networks]:
Internetworking—Standards (e.g., TCP/IP)
General Terms
Algorithms, Design, Performance, Security, Standardization
Keywords
SST, transport protocols, stream, datagram, reliable, best-
eﬀort, web transport, multimedia, ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:KHyperLogLog: Estimating Reidentifiability and Joinability of Large
Data at Scale
author:Pern Hui Chia and
Damien Desfontaines and
Irippuge Milinda Perera and
Daniel Simmons-Marengo and
Chao Li and
Wei-Yen Day and
Qiushi Wang and
Miguel Guevara
(cid:19)(cid:17)(cid:18)(cid:26)(cid:1)(cid:42)(cid:38)(cid:38)(cid:38)(cid:1)(cid:52)(cid:90)(cid:78)(cid:81)(cid:80)(cid:84)(cid:74)(cid:86)(cid:78)(cid:1)(cid:80)(cid:79)(cid:1)(cid:52)(cid:70)(cid:68)(cid:86)(cid:83)(cid:74)(cid:85)(cid:90)(cid:1)(cid:66)(cid:79)(cid:69)(cid:1)(cid:49)(cid:83)(cid:74)(cid:87)(cid:66)(cid:68)(cid:90)
KHyperLogLog: Estimating Reidentiﬁability and
∗
, Daniel Simmons-Marengo
,
Joinability of Large Data at Scale
∗
Pern Hui Chia
∗†
∗
, Irippuge Milinda Perera
∗
, Wei-Yen Day
∗
, Miguel Guevara
, Damien Desfontaines
∗
Chao Li
∗
∗
, Qiushi Wang
ETH Z¨urich
†
Google,
∗{pernhc, milinda, dasm, chaoli, wday, qiushi, mgt}@google.com,
†
damien@desfontain.es
Abstract—Understanding the privacy relevant charac-
teristics of data sets, such as reidentiﬁability and joinabil-
ity, is crucial for data governance, yet can be difﬁcult for
large data sets. While computing the data characteristics
by brute force is straightforward, the scale of systems
and data collected by large organizations demands an
efﬁcient approach. We present KHyperLogLog (KHLL),
an algorithm based on approximate counting techniques
that can estimate the reidentiﬁability and joinability risks
of very large databases using linear runtime and minimal
memory. KHLL enables one to measure reidentiﬁability of
data quantitatively, rather than based on expert judgement
or manual reviews. Meanwhile, joinability analysis using
KHLL helps ensure the separation of pseudonymous
and identiﬁed data sets. We describe how organizations
can use KHLL to improve protection of user privacy.
The efﬁciency of KHLL allows one to schedule periodic
analyses that detect any deviations from the expected risks
over time as a regression test for privacy. We vali...


Instruction: 总结这篇安全研究的主要观点

Input:
title:KHyperLogLog: Estimating Reidentifiability and Joinability of Large
Data at Scale
author:Pern Hui Chia and
Damien Desfontaines and
Irippuge Milinda Perera and
Daniel Simmons-Marengo and
Chao Li and
Wei-Yen Day and
Qiushi Wang and
Miguel Guevara
(cid:19)(cid:17)(cid:18)(cid:26)(cid:1)(cid:42)(cid:38)(cid:38)(cid:38)(cid:1)(cid:52)(cid:90)(cid:78)(cid:81)(cid:80)(cid:84)(cid:74)(cid:86)(cid:78)(cid:1)(cid:80)(cid:79)(cid:1)(cid:52)(cid:70)(cid:68)(cid:86)(cid:83)(cid:74)(cid:85)(cid:90)(cid:1)(cid:66)(cid:79)(cid:69)(cid:1)(cid:49)(cid:83)(cid:74)(cid:87)(cid:66)(cid:68)(cid:90)
KHyperLogLog: Estimating Reidentiﬁability and
∗
, Daniel Simmons-Marengo
,
Joinability of Large Data at Scale
∗
Pern Hui Chia
∗†
∗
, Irippuge Milinda Perera
∗
, Wei-Yen Day
∗
, Miguel Guevara
, Damien Desfontaines
∗
Chao Li
∗
∗
, Qiushi Wang
ETH Z¨urich
†
Google,
∗{pernhc, milinda, dasm, chaoli, wday, qiushi, mgt}@google.com,
†
damien@desfontain.es
Abstract—Understanding the privacy relevant charac-
teristics of data sets, such as reidentiﬁability and joinabil-
ity, is crucial for data governance, yet can be difﬁcult for
large data sets. While computing the data characteristics
by brute force is straightforward, the scale of systems
and data collected by large organizations demands an
efﬁcient approach. We present KHyperLogLog (KHLL),
an algorithm based on approximate counting techniques
that can estimate the reidentiﬁability and joinability risks
of very large databases using linear runtime and minimal
memory. KHLL enables one to measure reidentiﬁability of
data quantitatively, rather than based on expert judgement
or manual reviews. Meanwhile, joinability analysis using
KHLL helps ensure the separation of pseudonymous
and identiﬁed data sets. We describe how organizations
can use KHLL to improve protection of user privacy.
The efﬁciency of KHLL allows one to schedule periodic
analyses that detect any deviations from the expected risks
over time as a regression test for privacy. We vali...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Spectrogram: A Mixture-of-Markov-Chains Model for Anomaly Detection
in Web Traffic
author:Yingbo Song and
Angelos D. Keromytis and
Salvatore J. Stolfo
Spectrogram: A Mixture-of-Markov-Chains Model for Anomaly Detection in
Web Trafﬁc
Yingbo Song, Angelos D. Keromytis and Salvatore J. Stolfo
Department of Computer Science
Columbia University
New York, NY, 10027, USA
{yingbo,angelos,sal}@cs.columbia.edu
Abstract
We present Spectrogram, a machine learning based
statistical anomaly detection (AD) sensor for defense
against web-layer code-injection attacks. These attacks
include PHP ﬁle inclusion, SQL-injection and cross-site-
scripting; memory-layer exploits such as buffer overﬂows
are addressed as well. Statistical AD sensors offer the ad-
vantage of being driven by the data that is being protected
and not by malcode samples captured in the wild. While
models using higher order statistics can often improve ac-
curacy, trade-offs with false-positive rates and model ef-
ﬁciency remain a limiting usability factor. This paper
presents a new model and sensor framework that offers a fa-
vorable balance under this constraint and demonstrates im-
provement over some existing approaches. Spectrogram
is a network situated sensor that dynamically assembles
packets to reconstruct content ﬂows and learns to recog-
nize legitimate web-layer script input. We describe an efﬁ-
cient model for this task in the form of a mixture of Markov-
chains and derive the corresponding training algorithm.
Our evaluations show signiﬁcant detection results on an ar-
ray of real world web layer attacks, comparing favorably
against other AD approaches.
1 Introduction
Today’s internet environment is seeing usability out pace
security at unprecedented rates. Web-layer code-injections
target web applications and take advantage of programming
ﬂaws to manipulate the programs behavior, allowing the at-
tacker to manipulate code and data on the target. Whereas
traditional software exploits are often used...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Spectrogram: A Mixture-of-Markov-Chains Model for Anomaly Detection
in Web Traffic
author:Yingbo Song and
Angelos D. Keromytis and
Salvatore J. Stolfo
Spectrogram: A Mixture-of-Markov-Chains Model for Anomaly Detection in
Web Trafﬁc
Yingbo Song, Angelos D. Keromytis and Salvatore J. Stolfo
Department of Computer Science
Columbia University
New York, NY, 10027, USA
{yingbo,angelos,sal}@cs.columbia.edu
Abstract
We present Spectrogram, a machine learning based
statistical anomaly detection (AD) sensor for defense
against web-layer code-injection attacks. These attacks
include PHP ﬁle inclusion, SQL-injection and cross-site-
scripting; memory-layer exploits such as buffer overﬂows
are addressed as well. Statistical AD sensors offer the ad-
vantage of being driven by the data that is being protected
and not by malcode samples captured in the wild. While
models using higher order statistics can often improve ac-
curacy, trade-offs with false-positive rates and model ef-
ﬁciency remain a limiting usability factor. This paper
presents a new model and sensor framework that offers a fa-
vorable balance under this constraint and demonstrates im-
provement over some existing approaches. Spectrogram
is a network situated sensor that dynamically assembles
packets to reconstruct content ﬂows and learns to recog-
nize legitimate web-layer script input. We describe an efﬁ-
cient model for this task in the form of a mixture of Markov-
chains and derive the corresponding training algorithm.
Our evaluations show signiﬁcant detection results on an ar-
ray of real world web layer attacks, comparing favorably
against other AD approaches.
1 Introduction
Today’s internet environment is seeing usability out pace
security at unprecedented rates. Web-layer code-injections
target web applications and take advantage of programming
ﬂaws to manipulate the programs behavior, allowing the at-
tacker to manipulate code and data on the target. Whereas
traditional software exploits are often used...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:COMA: Communication and Obfuscation Management Architecture
author:Kimia Zamiri Azar and
Farnoud Farahmand and
Hadi Mardani Kamali and
Shervin Roshanisefat and
Houman Homayoun and
William Diehl and
Kris Gaj and
Avesta Sasan
COMA: Communication and Obfuscation Management Architecture
Kimia Zamiri Azar∗, Farnoud Farahmand∗, Hadi Mardani Kamali∗, Shervin Roshanisefat∗,
Houman Homayoun‡, William Diehl†, Kris Gaj∗, Avesta Sasan∗
∗ Department of ECE, George Mason University, VA, USA.
{kzamiria, ffarahma, hmardani, sroshani, kgaj, asasan}@gmu.edu
‡ Department of ECE, University of California, Davis, CA, USA. {hhomayoun}@ucdavis.edu
† Department of ECE, Virginia Tech, VA, USA. {wdiehl}@vt.edu
Abstract
In this paper, we introduce a novel Communication and Obfus-
cation Management Architecture (COMA) to handle the stor-
age of the obfuscation key and to secure the communication
to/from untrusted yet obfuscated circuits. COMA addresses
three challenges related to the obfuscated circuits: First, it
removes the need for the storage of the obfuscation unlock key
at the untrusted chip. Second, it implements a mechanism by
which the key sent for unlocking an obfuscated circuit changes
after each activation (even for the same device), transforming
the key into a dynamically changing license. Third, it pro-
tects the communication to/from the COMA protected device
and additionally introduces two novel mechanisms for the
exchange of data to/from COMA protected architectures: (1)
a highly secure but slow double encryption, which is used for
exchange of key and sensitive data (2) a high-performance
and low-energy yet leaky encryption, secured by means of
frequent key renewal. We demonstrate that compared to state-
of-the-art key management architectures, COMA reduces the
area overhead by 14%, while allowing additional features in-
cluding unique chip authentication, enabling activation as a
service (for IoT devices), reducing the side channel threats on
key management architecture...


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Poster: Effective Layers in Coverage Metrics for Deep Neural Networks
author:Leo Hyun Park and
Sangjin Oh and
Jaeuk Kim and
Soochang Chung and
Taekyoung Kwon
Poster: Effective Layers in Coverage Metrics for Deep Neural
Networks
Leo Hyun Park , Sangjin Oh, Jaeuk Kim, Soochang Chung, and Taekyoung Kwon
Yonsei University, Seoul, Korea
{dofi,dhtkdwls537,freak0wk,warpstar,taekyoung}@yonsei.ac.kr
ABSTRACT
Deep neural networks (DNNs) gained in popularity as an effective
machine learning algorithm, but their high complexity leads to the
lack of model interpretability and difficulty in the verification of
deep learning. Fuzzing, which is an automated software testing
technique, is recently applied to DNNs as an effort to address these
problems by following the trend of coverage-based fuzzing. How-
ever, new coverage metrics on DNNs may bring out the question
of which layer to measure the coverage in DNNs. In this poster, we
empirically evaluate the performance of existing coverage metrics.
By the comparative analysis of experimental results, we compile
the most effective layer for each of coverage metrics and discuss a
future direction of DNN fuzzing.
CCS CONCEPTS
• Security and privacy → Software and application security.
KEYWORDS
deep neural network; coverage; fuzzing; adversarial examples
ACM Reference Format:
Leo Hyun Park , Sangjin Oh, Jaeuk Kim, Soochang Chung, and Taekyoung
Kwon. 2019. Poster: Effective Layers in Coverage Metrics for Deep Neural
Networks. In 2019 ACM SIGSAC Conference on Computer& Communications
Security (CCS ’19), November 11–15, 2019, London, United Kingdom. ACM,
New York, NY, USA, 3 pages. https://doi.org/10.1145/3319535.3363286
1 INTRODUCTION
Deep neural networks (DNNs), which have become the mainstream
of machine learning algorithms, demonstrate outstanding perfor-
mance in various fields, including but not limited to NLP, computer
vision, and voice recognition. The complicated structure is a key
factor in the success of DNNs. It enables th...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Poster: Effective Layers in Coverage Metrics for Deep Neural Networks
author:Leo Hyun Park and
Sangjin Oh and
Jaeuk Kim and
Soochang Chung and
Taekyoung Kwon
Poster: Effective Layers in Coverage Metrics for Deep Neural
Networks
Leo Hyun Park , Sangjin Oh, Jaeuk Kim, Soochang Chung, and Taekyoung Kwon
Yonsei University, Seoul, Korea
{dofi,dhtkdwls537,freak0wk,warpstar,taekyoung}@yonsei.ac.kr
ABSTRACT
Deep neural networks (DNNs) gained in popularity as an effective
machine learning algorithm, but their high complexity leads to the
lack of model interpretability and difficulty in the verification of
deep learning. Fuzzing, which is an automated software testing
technique, is recently applied to DNNs as an effort to address these
problems by following the trend of coverage-based fuzzing. How-
ever, new coverage metrics on DNNs may bring out the question
of which layer to measure the coverage in DNNs. In this poster, we
empirically evaluate the performance of existing coverage metrics.
By the comparative analysis of experimental results, we compile
the most effective layer for each of coverage metrics and discuss a
future direction of DNN fuzzing.
CCS CONCEPTS
• Security and privacy → Software and application security.
KEYWORDS
deep neural network; coverage; fuzzing; adversarial examples
ACM Reference Format:
Leo Hyun Park , Sangjin Oh, Jaeuk Kim, Soochang Chung, and Taekyoung
Kwon. 2019. Poster: Effective Layers in Coverage Metrics for Deep Neural
Networks. In 2019 ACM SIGSAC Conference on Computer& Communications
Security (CCS ’19), November 11–15, 2019, London, United Kingdom. ACM,
New York, NY, USA, 3 pages. https://doi.org/10.1145/3319535.3363286
1 INTRODUCTION
Deep neural networks (DNNs), which have become the mainstream
of machine learning algorithms, demonstrate outstanding perfor-
mance in various fields, including but not limited to NLP, computer
vision, and voice recognition. The complicated structure is a key
factor in the success of DNNs. It enables th...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:PCR-Auth: Solving Authentication Puzzle Challenge with Encoded Palm
Contact Response
author:Long Huang and
Chen Wang
4
6
5
3
3
8
9
.
2
2
0
2
.
4
1
2
6
4
P
S
/
9
0
1
1
.
0
1
:
I
O
D
|
E
E
E
I
2
2
0
2
©
0
0
.
1
3
$
/
2
2
/
9
-
6
1
3
1
-
4
5
6
6
-
1
-
8
7
9
|
)
P
S
(
y
c
a
v
i
r
P
d
n
a
y
t
i
r
u
c
e
S
n
o
m
u
i
s
o
p
m
y
S
E
E
E
I
2
2
0
2
2022 IEEE Symposium on Security and Privacy (SP)
PCR-Auth: Solving Authentication Puzzle
Challenge with Encoded Palm Contact Response
Department of Computer Science, Louisiana State University, Baton Rouge, LA 70803, USA
Email: lhuan45@lsu.edu, chenwang1@lsu.edu
Long Huang, Chen Wang
Abstract—Biometrics have been widely applied as personally
identiﬁable data for user authentication. However, existing bio-
metric authentications are vulnerable to biometric spooﬁng. One
reason is that they are easily observable and vulnerable to
physical forgeries. Examples are the apparent surface patterns of
human bodies, such as ﬁngerprints and faces. A more signiﬁcant
issue is that existing authentication methods are entirely built
upon biometric features, which almost never change and could
be obtained or learned by an adversary such as human voices. To
address this inherent security issue of biometric authentications,
we propose a novel acoustically extracted hand-grip biometric,
which is associated with every user’s hand geometry, body-fat
ratio, and gripping strength; It is implicit and available whenever
they grip a handheld device. Furthermore, we integrate a coding
technique in the biometric acquisition process, which encodes
static biometrics into dynamic biometric features to prevent data
reuse. Additionally, this low-cost method can be deployed on any
handheld device that has a speaker and a microphone.
In particular, we develop a challenge-response biometric au-
thentication system, which consists of a pair of biometric encoder
and decoder. We encode the ultrasonic signal according to a
challenge sequence and extract a distinct bio...


Instruction: 总结这篇安全研究的主要观点

Input:
title:PCR-Auth: Solving Authentication Puzzle Challenge with Encoded Palm
Contact Response
author:Long Huang and
Chen Wang
4
6
5
3
3
8
9
.
2
2
0
2
.
4
1
2
6
4
P
S
/
9
0
1
1
.
0
1
:
I
O
D
|
E
E
E
I
2
2
0
2
©
0
0
.
1
3
$
/
2
2
/
9
-
6
1
3
1
-
4
5
6
6
-
1
-
8
7
9
|
)
P
S
(
y
c
a
v
i
r
P
d
n
a
y
t
i
r
u
c
e
S
n
o
m
u
i
s
o
p
m
y
S
E
E
E
I
2
2
0
2
2022 IEEE Symposium on Security and Privacy (SP)
PCR-Auth: Solving Authentication Puzzle
Challenge with Encoded Palm Contact Response
Department of Computer Science, Louisiana State University, Baton Rouge, LA 70803, USA
Email: lhuan45@lsu.edu, chenwang1@lsu.edu
Long Huang, Chen Wang
Abstract—Biometrics have been widely applied as personally
identiﬁable data for user authentication. However, existing bio-
metric authentications are vulnerable to biometric spooﬁng. One
reason is that they are easily observable and vulnerable to
physical forgeries. Examples are the apparent surface patterns of
human bodies, such as ﬁngerprints and faces. A more signiﬁcant
issue is that existing authentication methods are entirely built
upon biometric features, which almost never change and could
be obtained or learned by an adversary such as human voices. To
address this inherent security issue of biometric authentications,
we propose a novel acoustically extracted hand-grip biometric,
which is associated with every user’s hand geometry, body-fat
ratio, and gripping strength; It is implicit and available whenever
they grip a handheld device. Furthermore, we integrate a coding
technique in the biometric acquisition process, which encodes
static biometrics into dynamic biometric features to prevent data
reuse. Additionally, this low-cost method can be deployed on any
handheld device that has a speaker and a microphone.
In particular, we develop a challenge-response biometric au-
thentication system, which consists of a pair of biometric encoder
and decoder. We encode the ultrasonic signal according to a
challenge sequence and extract a distinct bio...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Revisiting next-hop selection in multipath networks
author:Simon van der Linden and
Gregory Detal and
Olivier Bonaventure
Revisiting Next-hop Selection in Multipath Networks
Simon van der Linden
simon.vanderlinden@uclouvain.be
Gregory Detal
gregory.detal@uclouvain.be
Olivier Bonaventure
olivier.bonaventure@uclouvain.be
ICTEAM Institute
Université catholique de Louvain
Louvain-la-Neuve, Belgium
ABSTRACT
Multipath routing strategies such as Equal-Cost MultiPath
(ECMP) are widely used in IP and data-center networks.
Most current methods to balance packets over the multiple
next hops toward the destination base their decision on a
hash computed over selected ﬁelds of the packet headers.
Because of the non-invertible nature of hash functions, it is
hard to determine the values of those ﬁelds so as to make
the packet follow a speciﬁc path in the network. However,
several applications might beneﬁt from being able to choose
such a path. Therefore, we propose a novel next-hop se-
lection method based on an invertible function. By encod-
ing the selection of successive routers into common ﬁelds of
packet headers, the proposed method enables end hosts to
force their packets to follow a speciﬁc path.
Categories and Subject Descriptors
C.2.1 [Computer-Communication Networks]: Network
Architecture and Design—Packet-switching networks; C.2.6
[Computer-Communication Networks]: Internetwork-
ing—Routers
General Terms
Algorithms, Management, Performance
Keywords
multipath, load balancing, path selection
1.
INTRODUCTION
Load balancing allows to improve the performance and
the scalability of the Internet by distributing the load evenly
across network links, servers, or other resources, in order to
maximize the throughput, achieve redundant connectivity,
obtain an optimal resource utilization, or avoid congestion.
Diﬀerent forms of load balancing are deployed at various
layers of the protocol stack. At the network layer, multipath
routing strategies such as ECMP are widely deploye...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Revisiting next-hop selection in multipath networks
author:Simon van der Linden and
Gregory Detal and
Olivier Bonaventure
Revisiting Next-hop Selection in Multipath Networks
Simon van der Linden
simon.vanderlinden@uclouvain.be
Gregory Detal
gregory.detal@uclouvain.be
Olivier Bonaventure
olivier.bonaventure@uclouvain.be
ICTEAM Institute
Université catholique de Louvain
Louvain-la-Neuve, Belgium
ABSTRACT
Multipath routing strategies such as Equal-Cost MultiPath
(ECMP) are widely used in IP and data-center networks.
Most current methods to balance packets over the multiple
next hops toward the destination base their decision on a
hash computed over selected ﬁelds of the packet headers.
Because of the non-invertible nature of hash functions, it is
hard to determine the values of those ﬁelds so as to make
the packet follow a speciﬁc path in the network. However,
several applications might beneﬁt from being able to choose
such a path. Therefore, we propose a novel next-hop se-
lection method based on an invertible function. By encod-
ing the selection of successive routers into common ﬁelds of
packet headers, the proposed method enables end hosts to
force their packets to follow a speciﬁc path.
Categories and Subject Descriptors
C.2.1 [Computer-Communication Networks]: Network
Architecture and Design—Packet-switching networks; C.2.6
[Computer-Communication Networks]: Internetwork-
ing—Routers
General Terms
Algorithms, Management, Performance
Keywords
multipath, load balancing, path selection
1.
INTRODUCTION
Load balancing allows to improve the performance and
the scalability of the Internet by distributing the load evenly
across network links, servers, or other resources, in order to
maximize the throughput, achieve redundant connectivity,
obtain an optimal resource utilization, or avoid congestion.
Diﬀerent forms of load balancing are deployed at various
layers of the protocol stack. At the network layer, multipath
routing strategies such as ECMP are widely deploye...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Measuring DNS-over-HTTPS performance around the world
author:Rishabh Chhabra and
Paul Murley and
Deepak Kumar and
Michael Bailey and
Gang Wang
Measuring DNS-over-HTTPS Performance Around the World
Rishabh Chhabra
University of Illinois at
Urbana-Champaign
IL, USA
chhabra4@illinois.edu
Paul Murley
University of Illinois at
Urbana-Champaign
IL, USA
pmurley2@illinois.edu
Deepak Kumar
Stanford University
CA, USA
kumarde@cs.stanford.edu
Michael Bailey
University of Illinois at
Urbana-Champaign
IL, USA
mdbailey@illinois.edu
Gang Wang
University of Illinois at
Urbana-Champaign
IL, USA
gangw@illinois.edu
ABSTRACT
In recent years, DNS-over-HTTPS (DoH) has gained signicant
traction as a privacy-preserving alternative to unencrypted DNS.
While several studies have measured DoH performance relative to
traditional DNS and other encrypted DNS schemes, they are often
incomplete, either conducting measurements from single countries
or are unable to compare encrypted DNS to default client behavior.
To expand on existing research, we use the BrightData proxy net-
work to gather a dataset consisting of 22,052 unique clients across
224 countries and territories. Our data shows that the performance
impact of a switch to DoH is mixed, with a median slowdown of
65ms per query across a 10-query connection, but with 28% of
clients receiving a speedup over that same interval. We compare
four public DoH providers, noting that Cloudare excels in both
DoH resolution time (265ms) and global points-of-presence (146).
Furthermore, we analyze geographic dierences between DoH and
Do53 resolution times, and provide analysis on possible causes,
nding that clients from countries with low Internet infrastructure
investment are almost twice as likely to experience a slowdown
when switching to DoH as those with high Internet infrastructure
investment. We conclude with possible improvements to the DoH
ecosystem. We hope that our ndings can help to inform continuing
DoH deployments.
CCS CONCEPTS
...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Measuring DNS-over-HTTPS performance around the world
author:Rishabh Chhabra and
Paul Murley and
Deepak Kumar and
Michael Bailey and
Gang Wang
Measuring DNS-over-HTTPS Performance Around the World
Rishabh Chhabra
University of Illinois at
Urbana-Champaign
IL, USA
chhabra4@illinois.edu
Paul Murley
University of Illinois at
Urbana-Champaign
IL, USA
pmurley2@illinois.edu
Deepak Kumar
Stanford University
CA, USA
kumarde@cs.stanford.edu
Michael Bailey
University of Illinois at
Urbana-Champaign
IL, USA
mdbailey@illinois.edu
Gang Wang
University of Illinois at
Urbana-Champaign
IL, USA
gangw@illinois.edu
ABSTRACT
In recent years, DNS-over-HTTPS (DoH) has gained signicant
traction as a privacy-preserving alternative to unencrypted DNS.
While several studies have measured DoH performance relative to
traditional DNS and other encrypted DNS schemes, they are often
incomplete, either conducting measurements from single countries
or are unable to compare encrypted DNS to default client behavior.
To expand on existing research, we use the BrightData proxy net-
work to gather a dataset consisting of 22,052 unique clients across
224 countries and territories. Our data shows that the performance
impact of a switch to DoH is mixed, with a median slowdown of
65ms per query across a 10-query connection, but with 28% of
clients receiving a speedup over that same interval. We compare
four public DoH providers, noting that Cloudare excels in both
DoH resolution time (265ms) and global points-of-presence (146).
Furthermore, we analyze geographic dierences between DoH and
Do53 resolution times, and provide analysis on possible causes,
nding that clients from countries with low Internet infrastructure
investment are almost twice as likely to experience a slowdown
when switching to DoH as those with high Internet infrastructure
investment. We conclude with possible improvements to the DoH
ecosystem. We hope that our ndings can help to inform continuing
DoH deployments.
CCS CONCEPTS
...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Ghost Installer in the Shadow: Security Analysis of App Installation
on Android
author:Yeonjoon Lee and
Tongxin Li and
Nan Zhang and
Soteris Demetriou and
Mingming Zha and
XiaoFeng Wang and
Kai Chen and
Xiao-yong Zhou and
Xinhui Han and
Michael Grace
2017 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks
Ghost Installer in the Shadow: Security Analysis of
App Installation on Android
Yeonjoon Lee1, Tongxin Li 2, Nan Zhang1, Soteris Demetriou3, Mingming Zha4
XiaoFeng Wang1, Kai Chen4, Xiaoyong Zhou5, Xinhui Han2, Michael Grace5
1Indiana University, Bloomington {yl52, nz3, xw7}@indiana.edu
2Peking University litongxin1991@gmail.com, hanxinhui@pku.edu.cn
3University of Illinois at Urbana-Champaign sdemetr2@illinois.edu
4Institute of Information Engineering, Chinese Academy of Sciences mmzha2013@gmail.com, chenkai@iie.ac.cn
5Samsung Research America zhou.xiaoyong@gmail.com, m1.grace@samsung.com
Abstract—Android allows developers to build apps with app
installation functionality themselves with minimal restriction and
support like any other functionalities. Given the critical impor-
tance of app installation, the security implications of the approach
can be signiﬁcant. This paper reports the ﬁrst systematic study on
this issue, focusing on the security guarantees of different steps
of the App Installation Transaction (AIT). We demonstrate the
serious consequences of leaving AIT development to individual
developers: most installers (e.g., Amazon AppStore, DTIgnite,
Baidu) are riddled with various security-critical loopholes, which
can be exploited by attackers to silently install any apps, ac-
quiring dangerous-level permissions or even unauthorized access
to system resources. Surprisingly, vulnerabilities were found in
all steps of AIT. The attacks we present, dubbed Ghost Installer
Attack (GIA), are found to pose a realistic threat to Android
ecosystem. Further, we developed both a user-app-level and a
system-level defense that are i...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Ghost Installer in the Shadow: Security Analysis of App Installation
on Android
author:Yeonjoon Lee and
Tongxin Li and
Nan Zhang and
Soteris Demetriou and
Mingming Zha and
XiaoFeng Wang and
Kai Chen and
Xiao-yong Zhou and
Xinhui Han and
Michael Grace
2017 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks
Ghost Installer in the Shadow: Security Analysis of
App Installation on Android
Yeonjoon Lee1, Tongxin Li 2, Nan Zhang1, Soteris Demetriou3, Mingming Zha4
XiaoFeng Wang1, Kai Chen4, Xiaoyong Zhou5, Xinhui Han2, Michael Grace5
1Indiana University, Bloomington {yl52, nz3, xw7}@indiana.edu
2Peking University litongxin1991@gmail.com, hanxinhui@pku.edu.cn
3University of Illinois at Urbana-Champaign sdemetr2@illinois.edu
4Institute of Information Engineering, Chinese Academy of Sciences mmzha2013@gmail.com, chenkai@iie.ac.cn
5Samsung Research America zhou.xiaoyong@gmail.com, m1.grace@samsung.com
Abstract—Android allows developers to build apps with app
installation functionality themselves with minimal restriction and
support like any other functionalities. Given the critical impor-
tance of app installation, the security implications of the approach
can be signiﬁcant. This paper reports the ﬁrst systematic study on
this issue, focusing on the security guarantees of different steps
of the App Installation Transaction (AIT). We demonstrate the
serious consequences of leaving AIT development to individual
developers: most installers (e.g., Amazon AppStore, DTIgnite,
Baidu) are riddled with various security-critical loopholes, which
can be exploited by attackers to silently install any apps, ac-
quiring dangerous-level permissions or even unauthorized access
to system resources. Surprisingly, vulnerabilities were found in
all steps of AIT. The attacks we present, dubbed Ghost Installer
Attack (GIA), are found to pose a realistic threat to Android
ecosystem. Further, we developed both a user-app-level and a
system-level defense that are i...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A General Framework for Scalability and Performance Analysis of DHT
Routing Systems
author:Joseph S. Kong and
Jesse S. A. Bridgewater and
Vwani P. Roychowdhury
A General Framework for Scalability and Performance Analysis of DHT
Routing Systems
Joseph S. Kong, Jesse S. A. Bridgewater and Vwani P. Roychowdhury
Department of Electrical Engineering
University of California, Los Angeles
{jskong, jsab, vwani}@ee.ucla.edu
Abstract
In recent years, many DHT-based P2P systems have
been proposed, analyzed, and certain deployments have
reached a global scale with nearly one million nodes. One
is thus faced with the question of which particular DHT sys-
tem to choose, and whether some are inherently more ro-
bust and scalable. Toward developing such a comparative
framework, we present the reachable component method
(RCM) for analyzing the performance of different DHT
routing systems subject to random failures. We apply RCM
to ﬁve DHT systems and obtain analytical expressions that
characterize their routability as a continuous function of
system size and node failure probability. An important con-
sequence is that in the large-network limit, the routability of
certain DHT systems go to zero for any non-zero probability
of node failure. These DHT routing algorithms are therefore
unscalable, while some others, including Kademlia, which
powers the popular eDonkey P2P system, are found to be
scalable.
1
Introduction
Developing scalable and fault tolerant systems to lever-
age and utilize the shared resources of distributed comput-
ers has been an important research topic since the dawn of
computer networking. In recent years, the popularity and
wide deployment of peer-to-peer (P2P) systems has inspired
the development of distributed hash tables (DHTs). DHTs
typically offer scalable O(log n) routing latency and efﬁ-
cient lookup interface. According to a recent study [13],
the DHT based ﬁle-sharing network eDonkey is emerging
as one of the largest P2P systems with millions of u...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A General Framework for Scalability and Performance Analysis of DHT
Routing Systems
author:Joseph S. Kong and
Jesse S. A. Bridgewater and
Vwani P. Roychowdhury
A General Framework for Scalability and Performance Analysis of DHT
Routing Systems
Joseph S. Kong, Jesse S. A. Bridgewater and Vwani P. Roychowdhury
Department of Electrical Engineering
University of California, Los Angeles
{jskong, jsab, vwani}@ee.ucla.edu
Abstract
In recent years, many DHT-based P2P systems have
been proposed, analyzed, and certain deployments have
reached a global scale with nearly one million nodes. One
is thus faced with the question of which particular DHT sys-
tem to choose, and whether some are inherently more ro-
bust and scalable. Toward developing such a comparative
framework, we present the reachable component method
(RCM) for analyzing the performance of different DHT
routing systems subject to random failures. We apply RCM
to ﬁve DHT systems and obtain analytical expressions that
characterize their routability as a continuous function of
system size and node failure probability. An important con-
sequence is that in the large-network limit, the routability of
certain DHT systems go to zero for any non-zero probability
of node failure. These DHT routing algorithms are therefore
unscalable, while some others, including Kademlia, which
powers the popular eDonkey P2P system, are found to be
scalable.
1
Introduction
Developing scalable and fault tolerant systems to lever-
age and utilize the shared resources of distributed comput-
ers has been an important research topic since the dawn of
computer networking. In recent years, the popularity and
wide deployment of peer-to-peer (P2P) systems has inspired
the development of distributed hash tables (DHTs). DHTs
typically offer scalable O(log n) routing latency and efﬁ-
cient lookup interface. According to a recent study [13],
the DHT based ﬁle-sharing network eDonkey is emerging
as one of the largest P2P systems with millions of u...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。