Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Using Frankencerts for Automated Adversarial Testing of Certificate
Validation in SSL/TLS Implementations
author:Chad Brubaker and
Suman Jana and
Baishakhi Ray and
Sarfraz Khurshid and
Vitaly Shmatikov
2014 IEEE Symposium on Security and Privacy
Using Frankencerts for Automated Adversarial
Testing of Certiﬁcate Validation
in SSL/TLS Implementations
Chad Brubaker ∗ †
Suman Jana†
Sarfraz Khurshid†
Vitaly Shmatikov†
Baishakhi Ray‡
∗Google
†The University of Texas at Austin
‡University of California, Davis
Abstract—Modern network security rests on the Secure Sock-
ets Layer (SSL) and Transport Layer Security (TLS) protocols.
Distributed systems, mobile and desktop applications, embedded
devices, and all of secure Web rely on SSL/TLS for protection
against network attacks. This protection critically depends on
whether SSL/TLS clients correctly validate X.509 certiﬁcates
presented by servers during the SSL/TLS handshake protocol.
We design, implement, and apply the ﬁrst methodology for
large-scale testing of certiﬁcate validation logic in SSL/TLS
implementations. Our ﬁrst ingredient is “frankencerts,” synthetic
certiﬁcates that are randomly mutated from parts of real cer-
tiﬁcates and thus include unusual combinations of extensions
and constraints. Our second ingredient is differential testing: if
one SSL/TLS implementation accepts a certiﬁcate while another
rejects the same certiﬁcate, we use the discrepancy as an oracle
for ﬁnding ﬂaws in individual implementations.
Differential testing with frankencerts uncovered 208 dis-
crepancies between popular SSL/TLS implementations such as
OpenSSL, NSS, CyaSSL, GnuTLS, PolarSSL, MatrixSSL, etc.
Many of them are caused by serious security vulnerabilities. For
example, any server with a valid X.509 version 1 certiﬁcate can act
as a rogue certiﬁcate authority and issue fake certiﬁcates for any
domain, enabling man-in-the-middle attacks against MatrixSSL
and GnuTLS. Several
implementations also accept certiﬁcate
authorities cr...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Using Frankencerts for Automated Adversarial Testing of Certificate
Validation in SSL/TLS Implementations
author:Chad Brubaker and
Suman Jana and
Baishakhi Ray and
Sarfraz Khurshid and
Vitaly Shmatikov
2014 IEEE Symposium on Security and Privacy
Using Frankencerts for Automated Adversarial
Testing of Certiﬁcate Validation
in SSL/TLS Implementations
Chad Brubaker ∗ †
Suman Jana†
Sarfraz Khurshid†
Vitaly Shmatikov†
Baishakhi Ray‡
∗Google
†The University of Texas at Austin
‡University of California, Davis
Abstract—Modern network security rests on the Secure Sock-
ets Layer (SSL) and Transport Layer Security (TLS) protocols.
Distributed systems, mobile and desktop applications, embedded
devices, and all of secure Web rely on SSL/TLS for protection
against network attacks. This protection critically depends on
whether SSL/TLS clients correctly validate X.509 certiﬁcates
presented by servers during the SSL/TLS handshake protocol.
We design, implement, and apply the ﬁrst methodology for
large-scale testing of certiﬁcate validation logic in SSL/TLS
implementations. Our ﬁrst ingredient is “frankencerts,” synthetic
certiﬁcates that are randomly mutated from parts of real cer-
tiﬁcates and thus include unusual combinations of extensions
and constraints. Our second ingredient is differential testing: if
one SSL/TLS implementation accepts a certiﬁcate while another
rejects the same certiﬁcate, we use the discrepancy as an oracle
for ﬁnding ﬂaws in individual implementations.
Differential testing with frankencerts uncovered 208 dis-
crepancies between popular SSL/TLS implementations such as
OpenSSL, NSS, CyaSSL, GnuTLS, PolarSSL, MatrixSSL, etc.
Many of them are caused by serious security vulnerabilities. For
example, any server with a valid X.509 version 1 certiﬁcate can act
as a rogue certiﬁcate authority and issue fake certiﬁcates for any
domain, enabling man-in-the-middle attacks against MatrixSSL
and GnuTLS. Several
implementations also accept certiﬁcate
authorities cr...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Countering Persistent Kernel Rootkits through Systematic Hook Discovery
author:Zhi Wang and
Xuxian Jiang and
Weidong Cui and
Xinyuan Wang
Countering Persistent Kernel Rootkits through
Systematic Hook Discovery
Zhi Wang1, Xuxian Jiang1, Weidong Cui2, and Xinyuan Wang3
1 North Carolina State University
2 Microsoft Research
3 George Mason University
Abstract. Kernel rootkits, as one of the most elusive types of malware, pose
signiﬁcant challenges for investigation and defense. Among the most notable are
persistent kernel rootkits, a special type of kernel rootkits that implant persistent
kernel hooks to tamper with the kernel execution to hide their presence. To defend
against them, an effective approach is to ﬁrst identify those kernel hooks and then
protect them from being manipulated by these rootkits. In this paper, we focus on
the ﬁrst step by proposing a systematic approach to identify those kernel hooks.
Our approach is based on two key observations: First, rootkits by design will
attempt to hide its presence from all running rootkit-detection software includ-
ing various system utility programs (e.g., ps and ls). Second, to manipulate OS
kernel control-ﬂows, persistent kernel rootkits by their nature will implant kernel
hooks on the corresponding kernel-side execution paths invoked by the security
programs. In other words, for any persistent kernel rootkit, either it is detectable
by a security program or it has to tamper with one of the kernel hooks on the
corresponding kernel-side execution path(s) of the security program. As a result,
given an authentic security program, we only need to monitor and analyze its
kernel-side execution paths to identify the related set of kernel hooks that could be
potentially hijacked for evasion. We have built a proof-of-concept system called
HookMap and evaluated it with a number of Linux utility programs such as ls, ps,
and netstat in RedHat Fedora Core 5. Our system found that there exist 35 kernel
hooks in the kernel...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Countering Persistent Kernel Rootkits through Systematic Hook Discovery
author:Zhi Wang and
Xuxian Jiang and
Weidong Cui and
Xinyuan Wang
Countering Persistent Kernel Rootkits through
Systematic Hook Discovery
Zhi Wang1, Xuxian Jiang1, Weidong Cui2, and Xinyuan Wang3
1 North Carolina State University
2 Microsoft Research
3 George Mason University
Abstract. Kernel rootkits, as one of the most elusive types of malware, pose
signiﬁcant challenges for investigation and defense. Among the most notable are
persistent kernel rootkits, a special type of kernel rootkits that implant persistent
kernel hooks to tamper with the kernel execution to hide their presence. To defend
against them, an effective approach is to ﬁrst identify those kernel hooks and then
protect them from being manipulated by these rootkits. In this paper, we focus on
the ﬁrst step by proposing a systematic approach to identify those kernel hooks.
Our approach is based on two key observations: First, rootkits by design will
attempt to hide its presence from all running rootkit-detection software includ-
ing various system utility programs (e.g., ps and ls). Second, to manipulate OS
kernel control-ﬂows, persistent kernel rootkits by their nature will implant kernel
hooks on the corresponding kernel-side execution paths invoked by the security
programs. In other words, for any persistent kernel rootkit, either it is detectable
by a security program or it has to tamper with one of the kernel hooks on the
corresponding kernel-side execution path(s) of the security program. As a result,
given an authentic security program, we only need to monitor and analyze its
kernel-side execution paths to identify the related set of kernel hooks that could be
potentially hijacked for evasion. We have built a proof-of-concept system called
HookMap and evaluated it with a number of Linux utility programs such as ls, ps,
and netstat in RedHat Fedora Core 5. Our system found that there exist 35 kernel
hooks in the kernel...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:State Synchronization and Recovery for Strongly Consistent Replicated
CORBA Objects
author:Priya Narasimhan and
Louise E. Moser and
P. M. Melliar-Smith
State Synchronization and Recovery for
Strongly Consistent Replicated CORBA Objects *
P.  Narasimhan, L. E. Moser and P. M. Melliar-Smith
Department of Electrical and Computer Engineering
University  of California, Santa Barbara, CA 93 106
priya@alpha.ece.ucsb.edu,  moser@ece.ucsb.edu, pmms@ece.ucsb.edu
Abstract
The  Eternal  systeni  provides  transparent  fault  tolerance  for
CORBA applications,  without requiring  the niodification  of  ei-
ther the  application  or the  ORB. Eternal  replicates  the  appli-
cation  objects, arid  erisitres strong  replica  consistency  by em-
ploying  reliable totally-ordered nuilticast niessages for convey-
ing the llOP niessages of the application.  To maintain  replica
consistency  even as replicas fail and are recovered, Eternal en-
sures  the  retrieval,  assignment  and  transfer  of  the  three  kinds
of stute  - application-level. ORB/POA-level and infrastructure-
level  state  - that  are  associated  with  each  replicated  object.
Eternal’s  rnechanisnis for recovety  include  the synclzronization
of the state retrieval and the state assignment messages, as well
as the logging and replay of messages arid checkpoints.
1  Introduction
Standards, such  as  the  Object  Management  Group’s Common
Object Request Broker Architecture (CORBA) [ 131, aim to sim-
plify  application  development  by  freeing  the  application  pro-
grammer from low-level  syslem details.  CORBA applications
consist of client  objects and  server objects,  with client objects
invoking server objects  that  return  responses  to  the  client  ob-
jects after performing the desired operations.  CORBAs Object
Rcquest Broker (ORB) acts as an intermediary between a client
object and a server object, allowing them to interact, transcend-
ing differences in their prog...


Instruction: 总结这篇安全研究的主要观点

Input:
title:State Synchronization and Recovery for Strongly Consistent Replicated
CORBA Objects
author:Priya Narasimhan and
Louise E. Moser and
P. M. Melliar-Smith
State Synchronization and Recovery for
Strongly Consistent Replicated CORBA Objects *
P.  Narasimhan, L. E. Moser and P. M. Melliar-Smith
Department of Electrical and Computer Engineering
University  of California, Santa Barbara, CA 93 106
priya@alpha.ece.ucsb.edu,  moser@ece.ucsb.edu, pmms@ece.ucsb.edu
Abstract
The  Eternal  systeni  provides  transparent  fault  tolerance  for
CORBA applications,  without requiring  the niodification  of  ei-
ther the  application  or the  ORB. Eternal  replicates  the  appli-
cation  objects, arid  erisitres strong  replica  consistency  by em-
ploying  reliable totally-ordered nuilticast niessages for convey-
ing the llOP niessages of the application.  To maintain  replica
consistency  even as replicas fail and are recovered, Eternal en-
sures  the  retrieval,  assignment  and  transfer  of  the  three  kinds
of stute  - application-level. ORB/POA-level and infrastructure-
level  state  - that  are  associated  with  each  replicated  object.
Eternal’s  rnechanisnis for recovety  include  the synclzronization
of the state retrieval and the state assignment messages, as well
as the logging and replay of messages arid checkpoints.
1  Introduction
Standards, such  as  the  Object  Management  Group’s Common
Object Request Broker Architecture (CORBA) [ 131, aim to sim-
plify  application  development  by  freeing  the  application  pro-
grammer from low-level  syslem details.  CORBA applications
consist of client  objects and  server objects,  with client objects
invoking server objects  that  return  responses  to  the  client  ob-
jects after performing the desired operations.  CORBAs Object
Rcquest Broker (ORB) acts as an intermediary between a client
object and a server object, allowing them to interact, transcend-
ing differences in their prog...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Unicorn: two-factor attestation for data security
author:Mohammad Mannan and
Beom Heyn Kim and
Afshar Ganjali and
David Lie
Unicorn: Two-Factor Attestation for Data Security∗
Mohammad Mannan
Concordia Institute for
Information Systems
Engineering
Concordia University
Montreal, Canada
Beom Heyn Kim
Computer Science
University of Toronto
Toronto, Canada
Afshar Ganjali and David Lie
Electrical and Computer
Engineering
University of Toronto
Toronto, Canada
ABSTRACT
Malware and phishing are two major threats for users seek-
ing to perform security-sensitive tasks using computers to-
day. To mitigate these threats, we introduce Unicorn, which
combines the phishing protection of standard security to-
kens and malware protection of trusted computing hard-
ware. The Unicorn security token holds user authentication
credentials, but only releases them if it can verify an attesta-
tion that the user’s computer is free of malware. In this way,
the user is released from having to remember passwords, as
well as having to decide when it is safe to use them. The
user’s computer is further veriﬁed by either a TPM or a
remote server to produce a two-factor attestation scheme.
We have implemented a Unicorn prototype using com-
modity software and hardware, and two Unicorn example
applications (termed as uApps, short for Unicorn Applica-
tions), to secure access to both remote data services and
encrypted local data. Each uApp consists of a small, hard-
ened and immutable OS image, and a single application.
Our Unicorn prototype co-exists with a regular user OS, and
signiﬁcantly reduces the time to switch between the secure
environment and general purpose environment using a novel
mechanism that removes the BIOS from the switch time.
Categories and Subject Descriptors
D.4.6 [Security and Protection]: Access controls, Au-
thentication
General Terms
Human Factors, Security
Keywords
Trusted Computing, Authentication, Attestation, Security
Token, Malware, Phishing
∗Contact: mmannan@cii...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Unicorn: two-factor attestation for data security
author:Mohammad Mannan and
Beom Heyn Kim and
Afshar Ganjali and
David Lie
Unicorn: Two-Factor Attestation for Data Security∗
Mohammad Mannan
Concordia Institute for
Information Systems
Engineering
Concordia University
Montreal, Canada
Beom Heyn Kim
Computer Science
University of Toronto
Toronto, Canada
Afshar Ganjali and David Lie
Electrical and Computer
Engineering
University of Toronto
Toronto, Canada
ABSTRACT
Malware and phishing are two major threats for users seek-
ing to perform security-sensitive tasks using computers to-
day. To mitigate these threats, we introduce Unicorn, which
combines the phishing protection of standard security to-
kens and malware protection of trusted computing hard-
ware. The Unicorn security token holds user authentication
credentials, but only releases them if it can verify an attesta-
tion that the user’s computer is free of malware. In this way,
the user is released from having to remember passwords, as
well as having to decide when it is safe to use them. The
user’s computer is further veriﬁed by either a TPM or a
remote server to produce a two-factor attestation scheme.
We have implemented a Unicorn prototype using com-
modity software and hardware, and two Unicorn example
applications (termed as uApps, short for Unicorn Applica-
tions), to secure access to both remote data services and
encrypted local data. Each uApp consists of a small, hard-
ened and immutable OS image, and a single application.
Our Unicorn prototype co-exists with a regular user OS, and
signiﬁcantly reduces the time to switch between the secure
environment and general purpose environment using a novel
mechanism that removes the BIOS from the switch time.
Categories and Subject Descriptors
D.4.6 [Security and Protection]: Access controls, Au-
thentication
General Terms
Human Factors, Security
Keywords
Trusted Computing, Authentication, Attestation, Security
Token, Malware, Phishing
∗Contact: mmannan@cii...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A Markov Decision Process Approach for Optimal Data Backup Scheduling
author:Ruofan Xia and
Fumio Machida and
Kishor S. Trivedi
2014 44th Annual IEEE/IFIP International Conference on Dependable Systems and Networks
978-1-4799-2233-8/14 $31.00 © 2014 IEEE
DOI 10.1109/DSN.2014.100
660
Authorized licensed use limited to: Tsinghua University. Downloaded on March 19,2021 at 08:31:05 UTC from IEEE Xplore.  Restrictions apply.
661
Authorized licensed use limited to: Tsinghua University. Downloaded on March 19,2021 at 08:31:05 UTC from IEEE Xplore.  Restrictions apply.
662
Authorized licensed use limited to: Tsinghua University. Downloaded on March 19,2021 at 08:31:05 UTC from IEEE Xplore.  Restrictions apply.
663
Authorized licensed use limited to: Tsinghua University. Downloaded on March 19,2021 at 08:31:05 UTC from IEEE Xplore.  Restrictions apply.
664
Authorized licensed use limited to: Tsinghua University. Downloaded on March 19,2021 at 08:31:05 UTC from IEEE Xplore.  Restrictions apply.
665
Authorized licensed use limited to: Tsinghua University. Downloaded on March 19,2021 at 08:31:05 UTC from IEEE Xplore.  Restrictions apply.


Instruction: 总结这篇安全研究的主要观点

Input:
title:A Markov Decision Process Approach for Optimal Data Backup Scheduling
author:Ruofan Xia and
Fumio Machida and
Kishor S. Trivedi
2014 44th Annual IEEE/IFIP International Conference on Dependable Systems and Networks
978-1-4799-2233-8/14 $31.00 © 2014 IEEE
DOI 10.1109/DSN.2014.100
660
Authorized licensed use limited to: Tsinghua University. Downloaded on March 19,2021 at 08:31:05 UTC from IEEE Xplore.  Restrictions apply.
661
Authorized licensed use limited to: Tsinghua University. Downloaded on March 19,2021 at 08:31:05 UTC from IEEE Xplore.  Restrictions apply.
662
Authorized licensed use limited to: Tsinghua University. Downloaded on March 19,2021 at 08:31:05 UTC from IEEE Xplore.  Restrictions apply.
663
Authorized licensed use limited to: Tsinghua University. Downloaded on March 19,2021 at 08:31:05 UTC from IEEE Xplore.  Restrictions apply.
664
Authorized licensed use limited to: Tsinghua University. Downloaded on March 19,2021 at 08:31:05 UTC from IEEE Xplore.  Restrictions apply.
665
Authorized licensed use limited to: Tsinghua University. Downloaded on March 19,2021 at 08:31:05 UTC from IEEE Xplore.  Restrictions apply.

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:ObliviStore: High Performance Oblivious Distributed Cloud Data Store
author:Emil Stefanov and
Elaine Shi
ObliviStore: High Performance Oblivious Distributed Cloud Data Store
Extended Abstract
Emil Stefanov (UC Berkeley)
Elaine Shi (UMD)
1 Introduction
It is well established that access patterns to encrypted data
can leak a considerable amount of sensitive information [13].
Oblivious RAM (or ORAM for short) [5–11, 14, 18–20, 26,
28], originally proposed by Goldreich and Ostrovsky [8], is
a cryptographic construction that allows a client to access
encrypted data residing on an untrusted storage server, while
completely hiding the access patterns to storage.
Particularly, the sequence of physical addresses accessed
is independent of the actual data that the user is accessing. To
achieve this, existing ORAM constructions [5–11,14,18–20,
26,28] continuously re-encrypt and and reshufﬂe data blocks
on the storage server, to cryptographically conceal the logical
access pattern.
Aside from storage outsourcing applications, ORAM (in
combination with trusted hardware in the cloud) has also
been proposed to protect user privacy in a broad range of
online services such as behavioral advertising, location and
map services, web search, and so on [4, 15].
While the idea of relying on trusted hardware and obliv-
ious RAM to enable access privacy in cloud services is
promising, for such an approach to become practical, a key
challenge is the practical efﬁciency of ORAM. ORAM was
initially proposed and studied mostly as a theoretic con-
cept. However, several recent works demonstrated the po-
tential of making ORAM practical in real-world scenar-
ios [15, 25, 28, 29].
1.1 Our Contributions
We design and build ObliviStore, an efﬁcient ORAM-
based cloud data store, securing data and access patterns
against adversaries in the malicious model. To the best of
our knowledge, ObliviStore is the fastest ORAM implemen-
tation that has ever been built.
Our evaluation suggests that in a si...


Instruction: 总结这篇安全研究的主要观点

Input:
title:ObliviStore: High Performance Oblivious Distributed Cloud Data Store
author:Emil Stefanov and
Elaine Shi
ObliviStore: High Performance Oblivious Distributed Cloud Data Store
Extended Abstract
Emil Stefanov (UC Berkeley)
Elaine Shi (UMD)
1 Introduction
It is well established that access patterns to encrypted data
can leak a considerable amount of sensitive information [13].
Oblivious RAM (or ORAM for short) [5–11, 14, 18–20, 26,
28], originally proposed by Goldreich and Ostrovsky [8], is
a cryptographic construction that allows a client to access
encrypted data residing on an untrusted storage server, while
completely hiding the access patterns to storage.
Particularly, the sequence of physical addresses accessed
is independent of the actual data that the user is accessing. To
achieve this, existing ORAM constructions [5–11,14,18–20,
26,28] continuously re-encrypt and and reshufﬂe data blocks
on the storage server, to cryptographically conceal the logical
access pattern.
Aside from storage outsourcing applications, ORAM (in
combination with trusted hardware in the cloud) has also
been proposed to protect user privacy in a broad range of
online services such as behavioral advertising, location and
map services, web search, and so on [4, 15].
While the idea of relying on trusted hardware and obliv-
ious RAM to enable access privacy in cloud services is
promising, for such an approach to become practical, a key
challenge is the practical efﬁciency of ORAM. ORAM was
initially proposed and studied mostly as a theoretic con-
cept. However, several recent works demonstrated the po-
tential of making ORAM practical in real-world scenar-
ios [15, 25, 28, 29].
1.1 Our Contributions
We design and build ObliviStore, an efﬁcient ORAM-
based cloud data store, securing data and access patterns
against adversaries in the malicious model. To the best of
our knowledge, ObliviStore is the fastest ORAM implemen-
tation that has ever been built.
Our evaluation suggests that in a si...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Revisiting Route Caching: The World Should Be Flat
author:Changhoon Kim and
Matthew Caesar and
Alexandre Gerber and
Jennifer Rexford
Revisiting Route Caching:
The World Should Be Flat
Changhoon Kim1, Matthew Caesar2, Alexandre Gerber3, and Jennifer Rexford1
1 Princeton University,
2 UIUC,
3 AT&T Labs–Research
Abstract. Internet routers’ forwarding tables (FIBs), which must be stored in
expensive fast memory for high-speed packet forwarding, are growing quickly in
size due to increased multihoming, ﬁner-grained trafﬁc engineering, and
deployment of IPv6 and VPNs. To address this problem, several Internet archi-
tectures have been proposed to reduce FIB size by returning to the earlier ap-
proach of route caching: storing only the working set of popular routes in the
FIB. This paper revisits route caching. We build upon previous work by study-
ing ﬂat, uni-class (/24) preﬁx caching, with modern trafﬁc traces from more than
60 routers in a tier-1 ISP. We ﬁrst characterize routers’ working sets and then
evaluate route-caching performance under different cache replacement strategies
and cache sizes. Surprisingly, despite the large number of deaggregated /24 sub-
nets, caching uni-class preﬁxes can effectively curb the increase of FIB sizes.
Moreover, uni-class preﬁxes substantially simplify a cache design by eliminating
longest-preﬁx matching, enabling FIB design with slower memory technologies.
Finally, by comparing our results with previous work, we show that the distri-
bution of trafﬁc across preﬁxes is becoming increasingly skewed, making route
caching more appealing.
1 Introduction
Packet forwarding on core Internet routers is an extremely challenging process. Upon
receiving an IP packet, routers have just a few nanoseconds to buffer the packet, select
the longest-matching preﬁx covering the packet’s destination, and forward the packet to
the corresponding outbound interface. To allow this process to happen quickly, routers
often make use of special-purpose h...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Revisiting Route Caching: The World Should Be Flat
author:Changhoon Kim and
Matthew Caesar and
Alexandre Gerber and
Jennifer Rexford
Revisiting Route Caching:
The World Should Be Flat
Changhoon Kim1, Matthew Caesar2, Alexandre Gerber3, and Jennifer Rexford1
1 Princeton University,
2 UIUC,
3 AT&T Labs–Research
Abstract. Internet routers’ forwarding tables (FIBs), which must be stored in
expensive fast memory for high-speed packet forwarding, are growing quickly in
size due to increased multihoming, ﬁner-grained trafﬁc engineering, and
deployment of IPv6 and VPNs. To address this problem, several Internet archi-
tectures have been proposed to reduce FIB size by returning to the earlier ap-
proach of route caching: storing only the working set of popular routes in the
FIB. This paper revisits route caching. We build upon previous work by study-
ing ﬂat, uni-class (/24) preﬁx caching, with modern trafﬁc traces from more than
60 routers in a tier-1 ISP. We ﬁrst characterize routers’ working sets and then
evaluate route-caching performance under different cache replacement strategies
and cache sizes. Surprisingly, despite the large number of deaggregated /24 sub-
nets, caching uni-class preﬁxes can effectively curb the increase of FIB sizes.
Moreover, uni-class preﬁxes substantially simplify a cache design by eliminating
longest-preﬁx matching, enabling FIB design with slower memory technologies.
Finally, by comparing our results with previous work, we show that the distri-
bution of trafﬁc across preﬁxes is becoming increasingly skewed, making route
caching more appealing.
1 Introduction
Packet forwarding on core Internet routers is an extremely challenging process. Upon
receiving an IP packet, routers have just a few nanoseconds to buffer the packet, select
the longest-matching preﬁx covering the packet’s destination, and forward the packet to
the corresponding outbound interface. To allow this process to happen quickly, routers
often make use of special-purpose h...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:FP-STALKER: Tracking Browser Fingerprint Evolutions
author:Antoine Vastel and
Pierre Laperdrix and
Walter Rudametkin and
Romain Rouvoy
2018 IEEE Symposium on Security and Privacy
FP-STALKER:
Tracking Browser Fingerprint Evolutions
Antoine Vastel
Univ. Lille / Inria
Pierre Laperdrix
INSA / Inria
Walter Rudametkin
Univ. Lille / Inria
Romain Rouvoy
Univ. Lille / Inria / IUF
antoine.vastel@univ-lille.fr
pierre.laperdrix@inria.fr
walter.rudametkin@univ-lille.fr
romain.rouvoy@univ-lille.fr
Abstract—Browser ﬁngerprinting has emerged as a technique
to track users without their consent. Unlike cookies, ﬁngerprint-
ing is a stateless technique that does not store any information
on devices, but instead exploits unique combinations of attributes
handed over freely by browsers. The uniqueness of ﬁngerprints
allows them to be used for identiﬁcation. However, browser
ﬁngerprints change over time and the effectiveness of tracking
users over longer durations has not been properly addressed.
In this paper, we show that browser ﬁngerprints tend to
change frequently—from every few hours to days—due to, for
example, software updates or conﬁguration changes. Yet, despite
these frequent changes, we show that browser ﬁngerprints can
still be linked, thus enabling long-term tracking.
FP-STALKER is an approach to link browser ﬁngerprint
evolutions. It compares ﬁngerprints to determine if they originate
from the same browser. We created two variants of FP-STALKER,
a rule-based variant that is faster, and a hybrid variant that
exploits machine learning to boost accuracy. To evaluate FP-
STALKER, we conduct an empirical study using 98, 598 ﬁnger-
prints we collected from 1, 905 distinct browser instances. We
compare our algorithm with the state of the art and show that,
on average, we can track browsers for 54.48 days, and 26 % of
browsers can be tracked for more than 100 days.
I.
INTRODUCTION
Websites track their users for different reasons, including
targeted advertising, content perso...


Instruction: 总结这篇安全研究的主要观点

Input:
title:FP-STALKER: Tracking Browser Fingerprint Evolutions
author:Antoine Vastel and
Pierre Laperdrix and
Walter Rudametkin and
Romain Rouvoy
2018 IEEE Symposium on Security and Privacy
FP-STALKER:
Tracking Browser Fingerprint Evolutions
Antoine Vastel
Univ. Lille / Inria
Pierre Laperdrix
INSA / Inria
Walter Rudametkin
Univ. Lille / Inria
Romain Rouvoy
Univ. Lille / Inria / IUF
antoine.vastel@univ-lille.fr
pierre.laperdrix@inria.fr
walter.rudametkin@univ-lille.fr
romain.rouvoy@univ-lille.fr
Abstract—Browser ﬁngerprinting has emerged as a technique
to track users without their consent. Unlike cookies, ﬁngerprint-
ing is a stateless technique that does not store any information
on devices, but instead exploits unique combinations of attributes
handed over freely by browsers. The uniqueness of ﬁngerprints
allows them to be used for identiﬁcation. However, browser
ﬁngerprints change over time and the effectiveness of tracking
users over longer durations has not been properly addressed.
In this paper, we show that browser ﬁngerprints tend to
change frequently—from every few hours to days—due to, for
example, software updates or conﬁguration changes. Yet, despite
these frequent changes, we show that browser ﬁngerprints can
still be linked, thus enabling long-term tracking.
FP-STALKER is an approach to link browser ﬁngerprint
evolutions. It compares ﬁngerprints to determine if they originate
from the same browser. We created two variants of FP-STALKER,
a rule-based variant that is faster, and a hybrid variant that
exploits machine learning to boost accuracy. To evaluate FP-
STALKER, we conduct an empirical study using 98, 598 ﬁnger-
prints we collected from 1, 905 distinct browser instances. We
compare our algorithm with the state of the art and show that,
on average, we can track browsers for 54.48 days, and 26 % of
browsers can be tracked for more than 100 days.
I.
INTRODUCTION
Websites track their users for different reasons, including
targeted advertising, content perso...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Screaming Channels: When Electromagnetic Side Channels Meet Radio
Transceivers
author:Giovanni Camurati and
Sebastian Poeplau and
Marius Muench and
Tom Hayes and
Aur'elien Francillon
When Electromagnetic Side Channels Meet Radio Transceivers
Screaming Channels:
Giovanni Camurati, Sebastian Poeplau, Marius Muench, Tom Hayes, Aurélien Francillon
EURECOM
ABSTRACT
This paper presents a new side channel that affects mixed-signal
chips used in widespread wireless communication protocols, such
as Bluetooth and WiFi. This increasingly common type of chip
includes the radio transceiver along with digital logic on the same
integrated circuit. In such systems, the radio transmitter may unin-
tentionally broadcast sensitive information from hardware crypto-
graphic components or software executing on the CPU. The well-
known electromagnetic (EM) leakage from digital logic is inadver-
tently mixed with the radio carrier, which is amplified and then
transmitted by the antenna. We call the resulting leak “screaming
channels”. Attacks exploiting such a side channel may succeed
over a much longer distance than attacks exploiting usual EM side
channels.
The root of the problem is that mixed-signal chips include both
digital circuits and analog circuits on the same silicon die in close
physical proximity. While processing data, the digital circuits on
these chips generate noise, which can be picked up by noise-sensitive
analog radio components, ultimately leading to leakage of sensitive
information. We investigate the physical reasons behind the chan-
nel, we measure it on several popular devices from different ven-
dors (including Nordic Semiconductor nRF52832, and Qualcomm
Atheros AR9271), and we demonstrate a complete key recovery
attack against the nRF52832 chip. In particular, we retrieve the full
key from the AES-128 implementation in tinyAES at a distance of
10 m using template attacks. Additionally, we recover the key used
by the AES-128 implementation in mbedTLS at...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Screaming Channels: When Electromagnetic Side Channels Meet Radio
Transceivers
author:Giovanni Camurati and
Sebastian Poeplau and
Marius Muench and
Tom Hayes and
Aur'elien Francillon
When Electromagnetic Side Channels Meet Radio Transceivers
Screaming Channels:
Giovanni Camurati, Sebastian Poeplau, Marius Muench, Tom Hayes, Aurélien Francillon
EURECOM
ABSTRACT
This paper presents a new side channel that affects mixed-signal
chips used in widespread wireless communication protocols, such
as Bluetooth and WiFi. This increasingly common type of chip
includes the radio transceiver along with digital logic on the same
integrated circuit. In such systems, the radio transmitter may unin-
tentionally broadcast sensitive information from hardware crypto-
graphic components or software executing on the CPU. The well-
known electromagnetic (EM) leakage from digital logic is inadver-
tently mixed with the radio carrier, which is amplified and then
transmitted by the antenna. We call the resulting leak “screaming
channels”. Attacks exploiting such a side channel may succeed
over a much longer distance than attacks exploiting usual EM side
channels.
The root of the problem is that mixed-signal chips include both
digital circuits and analog circuits on the same silicon die in close
physical proximity. While processing data, the digital circuits on
these chips generate noise, which can be picked up by noise-sensitive
analog radio components, ultimately leading to leakage of sensitive
information. We investigate the physical reasons behind the chan-
nel, we measure it on several popular devices from different ven-
dors (including Nordic Semiconductor nRF52832, and Qualcomm
Atheros AR9271), and we demonstrate a complete key recovery
attack against the nRF52832 chip. In particular, we retrieve the full
key from the AES-128 implementation in tinyAES at a distance of
10 m using template attacks. Additionally, we recover the key used
by the AES-128 implementation in mbedTLS at...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Running Language Interpreters Inside SGX: A Lightweight, Legacy-Compatible
Script Code Hardening Approach
author:Huibo Wang and
Erick Bauman and
Vishal Karande and
Zhiqiang Lin and
Yueqiang Cheng and
Yinqian Zhang
Running Language Interpreters Inside SGX: A Lightweight,
Legacy-Compatible Script Code Hardening Approach
Huibo Wang1, Erick Bauman1, Vishal Karande1, Zhiqiang Lin2, Yueqiang Cheng3, Yinqian Zhang2
1The University of Texas at Dallas, 2The Ohio State University, and 3Baidu USA
the execution of the application cannot be trusted. Therefore,
Intel introduced its software guard extensions (SGX) [16], a new
hardware feature that provides secure enclaves in which user level
applications do not have to trust any software outside the enclave,
thereby significantly reducing the attack surface.
From a software development perspective, SGX is merely a set of
new instructions. To really use SGX, it is suggested that application
developers create new applications by using abstractions (e.g.,
APIs) provided by the SGX SDK, partitioning applications into
trusted and untrusted components, and building bridge functions
between enclave and non-enclave code. However, this is tedious,
time consuming, and error prone. By forcing developers to manually
port software to SGX or create new applications from scratch, tons
of legacy software cannot enjoy the benefit provided by SGX.
ABSTRACT
Recent advances in trusted execution environments, specifically
with Intel’s introduction of SGX on consumer processors, have
provided unprecedented opportunities to create secure applications
with a small TCB. While a large number of SGX solutions have
been proposed, nearly all of them focus on protecting native
code applications, leaving scripting languages unprotected. To fill
this gap, this paper presents ScriptShield, a framework capable
of running legacy script code while simultaneously providing
confidentiality and integrity for scripting code and data. In contrast
to the existing sc...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Running Language Interpreters Inside SGX: A Lightweight, Legacy-Compatible
Script Code Hardening Approach
author:Huibo Wang and
Erick Bauman and
Vishal Karande and
Zhiqiang Lin and
Yueqiang Cheng and
Yinqian Zhang
Running Language Interpreters Inside SGX: A Lightweight,
Legacy-Compatible Script Code Hardening Approach
Huibo Wang1, Erick Bauman1, Vishal Karande1, Zhiqiang Lin2, Yueqiang Cheng3, Yinqian Zhang2
1The University of Texas at Dallas, 2The Ohio State University, and 3Baidu USA
the execution of the application cannot be trusted. Therefore,
Intel introduced its software guard extensions (SGX) [16], a new
hardware feature that provides secure enclaves in which user level
applications do not have to trust any software outside the enclave,
thereby significantly reducing the attack surface.
From a software development perspective, SGX is merely a set of
new instructions. To really use SGX, it is suggested that application
developers create new applications by using abstractions (e.g.,
APIs) provided by the SGX SDK, partitioning applications into
trusted and untrusted components, and building bridge functions
between enclave and non-enclave code. However, this is tedious,
time consuming, and error prone. By forcing developers to manually
port software to SGX or create new applications from scratch, tons
of legacy software cannot enjoy the benefit provided by SGX.
ABSTRACT
Recent advances in trusted execution environments, specifically
with Intel’s introduction of SGX on consumer processors, have
provided unprecedented opportunities to create secure applications
with a small TCB. While a large number of SGX solutions have
been proposed, nearly all of them focus on protecting native
code applications, leaving scripting languages unprotected. To fill
this gap, this paper presents ScriptShield, a framework capable
of running legacy script code while simultaneously providing
confidentiality and integrity for scripting code and data. In contrast
to the existing sc...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:FirmUSB: Vetting USB Device Firmware using Domain Informed Symbolic
Execution
author:Grant Hernandez and
Farhaan Fowze and
Dave (Jing) Tian and
Tuba Yavuz and
Kevin R. B. Butler
FirmUSB: Vetting USB Device Firmware using Domain Informed
Symbolic Execution
Grant Hernandez∗
University of Florida
Gainesville, FL, USA
grant.hernandez@ufl.edu
Farhaan Fowze∗
University of Florida
Gainesville, FL, USA
farhaan104@ufl.edu
Dave (Jing) Tian
University of Florida
Gainesville, FL, USA
daveti@ufl.edu
7
1
0
2
g
u
A
0
3
]
R
C
.
s
c
[
1
v
4
1
1
9
0
.
8
0
7
1
:
v
i
X
r
a
Tuba Yavuz
University of Florida
Gainesville, FL, USA
tuba@ece.ufl.edu
ABSTRACT
The USB protocol has become ubiquitous, supporting devices from
high-powered computing devices to small embedded devices and
control systems. USB’s greatest feature, its openness and expand-
ability, is also its weakness, and attacks such as BadUSB exploit the
unconstrained functionality afforded to these devices as a vector
for compromise. Fundamentally, it is virtually impossible to know
whether a USB device is benign or malicious. This work introduces
FirmUSB, a USB-specific firmware analysis framework that uses
domain knowledge of the USB protocol to examine firmware im-
ages and determine the activity that they can produce. Embedded
USB devices use microcontrollers that have not been well studied
by the binary analysis community, and our work demonstrates how
lifters into popular intermediate representations for analysis can
be built, as well as the challenges of doing so. We develop targeting
algorithms and use domain knowledge to speed up these processes
by a factor of 7 compared to unconstrained fully symbolic exe-
cution. We also successfully find malicious activity in embedded
8051 firmwares without the use of source code. Finally, we pro-
vide insights into the challenges of symbolic analysis on embedded
architectures and provide guidance on improving tools to better
handle this important class of devices.
CCS CONCEPTS
• ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:FirmUSB: Vetting USB Device Firmware using Domain Informed Symbolic
Execution
author:Grant Hernandez and
Farhaan Fowze and
Dave (Jing) Tian and
Tuba Yavuz and
Kevin R. B. Butler
FirmUSB: Vetting USB Device Firmware using Domain Informed
Symbolic Execution
Grant Hernandez∗
University of Florida
Gainesville, FL, USA
grant.hernandez@ufl.edu
Farhaan Fowze∗
University of Florida
Gainesville, FL, USA
farhaan104@ufl.edu
Dave (Jing) Tian
University of Florida
Gainesville, FL, USA
daveti@ufl.edu
7
1
0
2
g
u
A
0
3
]
R
C
.
s
c
[
1
v
4
1
1
9
0
.
8
0
7
1
:
v
i
X
r
a
Tuba Yavuz
University of Florida
Gainesville, FL, USA
tuba@ece.ufl.edu
ABSTRACT
The USB protocol has become ubiquitous, supporting devices from
high-powered computing devices to small embedded devices and
control systems. USB’s greatest feature, its openness and expand-
ability, is also its weakness, and attacks such as BadUSB exploit the
unconstrained functionality afforded to these devices as a vector
for compromise. Fundamentally, it is virtually impossible to know
whether a USB device is benign or malicious. This work introduces
FirmUSB, a USB-specific firmware analysis framework that uses
domain knowledge of the USB protocol to examine firmware im-
ages and determine the activity that they can produce. Embedded
USB devices use microcontrollers that have not been well studied
by the binary analysis community, and our work demonstrates how
lifters into popular intermediate representations for analysis can
be built, as well as the challenges of doing so. We develop targeting
algorithms and use domain knowledge to speed up these processes
by a factor of 7 compared to unconstrained fully symbolic exe-
cution. We also successfully find malicious activity in embedded
8051 firmwares without the use of source code. Finally, we pro-
vide insights into the challenges of symbolic analysis on embedded
architectures and provide guidance on improving tools to better
handle this important class of devices.
CCS CONCEPTS
• ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Snout: An Extensible IoT Pen-Testing Tool
author:John Mikulskis and
Johannes K. Becker and
Stefan Gvozdenovic and
David Starobinski
Poster: Snout - An Extensible IoT Pen-Testing Tool
John Mikulskis
jkulskis@bu.edu
Boston University
Boston, MA, USA
Stefan Gvozdenovic
tesla@bu.edu
Boston University
Boston, MA, USA
Johannes K Becker
jkbecker@bu.edu
Boston University
Boston, MA, USA
David Starobinski
staro@bu.edu
Boston University
Boston, MA, USA
ABSTRACT
Network mapping tools designed for IP-based networks generally
do not provide access to non-IP based wireless protocols used by
Internet of Things (IoT) devices, such as Zigbee and Bluetooth LE.
We present Snout, a versatile and extensible software defined radio-
based tool for IoT network mapping and penetration testing. Snout
is geared towards the various IoT protocols that are not accessible
with traditional network enumeration tools, such as Nmap. The tool
allows for device enumeration, vulnerability assessment, as well
as more offensive techniques such as packet replay and spoofing,
which we demonstrate for the Zigbee protocol. Snout is built on an
open-source stack, and is designed for extensibility towards other
IoT protocols and capabilities.
CCS CONCEPTS
• Security and privacy → Penetration testing; Vulnerability
scanners; Mobile and wireless security; • Networks → Cross-
layer protocols; Network performance analysis; Mobile and wireless se-
curity; Wireless local area networks; • Hardware → Analog, mixed-
signal and radio frequency test; • Applied computing → Forecast-
ing.
KEYWORDS
Internet of Things, Device Enumeration, Vulnerability Assessment,
Fuzzing
ACM Reference Format:
John Mikulskis, Johannes K Becker, Stefan Gvozdenovic, and David Starobin-
ski. 2019. Poster: Snout - An Extensible IoT Pen-Testing Tool. In 2019 ACM
SIGSAC Conference on Computer and Communications Security (CCS ’19),
November 11–15, 2019, London, United Kingdom. ACM, New York, NY, USA,
3 pages. https://doi.org/10.1145/3319535.33...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Snout: An Extensible IoT Pen-Testing Tool
author:John Mikulskis and
Johannes K. Becker and
Stefan Gvozdenovic and
David Starobinski
Poster: Snout - An Extensible IoT Pen-Testing Tool
John Mikulskis
jkulskis@bu.edu
Boston University
Boston, MA, USA
Stefan Gvozdenovic
tesla@bu.edu
Boston University
Boston, MA, USA
Johannes K Becker
jkbecker@bu.edu
Boston University
Boston, MA, USA
David Starobinski
staro@bu.edu
Boston University
Boston, MA, USA
ABSTRACT
Network mapping tools designed for IP-based networks generally
do not provide access to non-IP based wireless protocols used by
Internet of Things (IoT) devices, such as Zigbee and Bluetooth LE.
We present Snout, a versatile and extensible software defined radio-
based tool for IoT network mapping and penetration testing. Snout
is geared towards the various IoT protocols that are not accessible
with traditional network enumeration tools, such as Nmap. The tool
allows for device enumeration, vulnerability assessment, as well
as more offensive techniques such as packet replay and spoofing,
which we demonstrate for the Zigbee protocol. Snout is built on an
open-source stack, and is designed for extensibility towards other
IoT protocols and capabilities.
CCS CONCEPTS
• Security and privacy → Penetration testing; Vulnerability
scanners; Mobile and wireless security; • Networks → Cross-
layer protocols; Network performance analysis; Mobile and wireless se-
curity; Wireless local area networks; • Hardware → Analog, mixed-
signal and radio frequency test; • Applied computing → Forecast-
ing.
KEYWORDS
Internet of Things, Device Enumeration, Vulnerability Assessment,
Fuzzing
ACM Reference Format:
John Mikulskis, Johannes K Becker, Stefan Gvozdenovic, and David Starobin-
ski. 2019. Poster: Snout - An Extensible IoT Pen-Testing Tool. In 2019 ACM
SIGSAC Conference on Computer and Communications Security (CCS ’19),
November 11–15, 2019, London, United Kingdom. ACM, New York, NY, USA,
3 pages. https://doi.org/10.1145/3319535.33...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:POSTER: UAFChecker: Scalable Static Detection of Use-After-Free
Vulnerabilities
author:Jiayi Ye and
Chao Zhang and
Xinhui Han
Received March 3, 2020, accepted April 19, 2020, date of publication April 24, 2020, date of current version May 11, 2020.
Digital Object Identifier 10.1109/ACCESS.2020.2990197
Scalable Static Detection of Use-After-Free
Vulnerabilities in Binary Code
KAILONG ZHU , YULIANG LU , AND HUI HUANG
College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China
Corresponding author: Yuliang Lu (cee401_nudt@126.com)
This work was supported in part by the National Key Research and Development Project of China under Grant 2017YFB0802900.
ABSTRACT The number of use-after-free vulnerabilities has been increasing rapidly in recent years, which
is a serious threat to computer systems. However, few effective mitigations exist for large-scale binary code.
In this study, the authors propose a scalable static approach for detecting use-after-free vulnerabilities in
binary code. First, the use-after-free feature model is proposed to provide guidance for detection. Then,
the binary code of the target program is converted to an intermediate representation, and CFGs (control
ﬂow graphs) are constructed. Finally, lightweight pointer tracking is performed to identify the use-after-free
vulnerable point. Compared with state-of-the-art approaches, this approach uses function summaries rather
than naive in-lining technique for the inter-procedural analysis in the vulnerability detection. Therefore, our
approach has the ability to avoid redundant repeat analysis caused by the in-lining technique in the existing
approaches and reduce the unnecessary performance overhead. The authors have implemented a prototype
called UAFDetector and evaluated it using standard benchmarks and real-world programs. The experimental
results show that this approach is effective in detecting use-after-free vulnerabilities in binary code and is
more efﬁc...


Instruction: 总结这篇安全研究的主要观点

Input:
title:POSTER: UAFChecker: Scalable Static Detection of Use-After-Free
Vulnerabilities
author:Jiayi Ye and
Chao Zhang and
Xinhui Han
Received March 3, 2020, accepted April 19, 2020, date of publication April 24, 2020, date of current version May 11, 2020.
Digital Object Identifier 10.1109/ACCESS.2020.2990197
Scalable Static Detection of Use-After-Free
Vulnerabilities in Binary Code
KAILONG ZHU , YULIANG LU , AND HUI HUANG
College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China
Corresponding author: Yuliang Lu (cee401_nudt@126.com)
This work was supported in part by the National Key Research and Development Project of China under Grant 2017YFB0802900.
ABSTRACT The number of use-after-free vulnerabilities has been increasing rapidly in recent years, which
is a serious threat to computer systems. However, few effective mitigations exist for large-scale binary code.
In this study, the authors propose a scalable static approach for detecting use-after-free vulnerabilities in
binary code. First, the use-after-free feature model is proposed to provide guidance for detection. Then,
the binary code of the target program is converted to an intermediate representation, and CFGs (control
ﬂow graphs) are constructed. Finally, lightweight pointer tracking is performed to identify the use-after-free
vulnerable point. Compared with state-of-the-art approaches, this approach uses function summaries rather
than naive in-lining technique for the inter-procedural analysis in the vulnerability detection. Therefore, our
approach has the ability to avoid redundant repeat analysis caused by the in-lining technique in the existing
approaches and reduce the unnecessary performance overhead. The authors have implemented a prototype
called UAFDetector and evaluated it using standard benchmarks and real-world programs. The experimental
results show that this approach is effective in detecting use-after-free vulnerabilities in binary code and is
more efﬁc...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Copyright
author:
Copyright © 2005 by The Institute of Electrical and Electronics Engineers, Inc.
All rights reserved.
Copyright and  Reprint  Permissions: Abstracting  is  permitted  with  credit  to  the  source.  Libraries  may  photocopy
beyond the limits of US copyright law, for private use of patrons, those articles in this volume that carry a code at
the  bottom  of  the  first  page,  provided  that  the  per-copy  fee  indicated  in  the  code  is  paid  through  the  Copyright
Clearance Center, 222 Rosewood Drive, Danvers, MA  01923.
Other copying, reprint, or republication requests should be addressed to: IEEE Copyrights Manager, IEEE Service
Center, 445 Hoes Lane, P.O. Box 133, Piscataway, NJ 08855-1331.
The papers in this book comprise the proceedings of the meeting mentioned on the cover and title page. They reflect
the authors’ opinions and, in the interests of timely dissemination, are published as presented and without change.
Their inclusion in this publication does not necessarily constitute endorsement by the editors, the IEEE Computer
Society, or the Institute of Electrical and Electronics Engineers, Inc.
IEEE Computer Society Order Number P2461
ISBN 0-7695-2461-3
ISSN 1063-9527
Additional copies may be ordered from:
IEEE Computer Society
Customer Service Center
10662 Los Vaqueros Circle
P.O. Box 3014
Los Alamitos, CA 90720-1314
Tel: + 1 800 272 6657
Fax: + 1 714 821 4641
http://computer.org/cspress
csbooks@computer.org
IEEE Service Center
445 Hoes Lane
P.O. Box 1331
Piscataway, NJ 08855-1331
Tel: + 1 732 981 0060
Fax: + 1 732 981 9667
http://shop.ieee.org/store/
customer-service@ieee.org
IEEE Computer Society
Asia/Pacific Office
Watanabe Bldg., 1-4-2
Minami-Aoyama
Minato-ku, Tokyo 107-0062
JAPAN
Tel:  + 81 3 3408 3118
Fax: + 81 3 3408 3553
tokyo.ofc@computer.org
Individual paper REPRINTS may be ordered at: reprints@computer.org
..........................................................................................................


Instruction: 总结这篇安全研究的主要观点

Input:
title:Copyright
author:
Copyright © 2005 by The Institute of Electrical and Electronics Engineers, Inc.
All rights reserved.
Copyright and  Reprint  Permissions: Abstracting  is  permitted  with  credit  to  the  source.  Libraries  may  photocopy
beyond the limits of US copyright law, for private use of patrons, those articles in this volume that carry a code at
the  bottom  of  the  first  page,  provided  that  the  per-copy  fee  indicated  in  the  code  is  paid  through  the  Copyright
Clearance Center, 222 Rosewood Drive, Danvers, MA  01923.
Other copying, reprint, or republication requests should be addressed to: IEEE Copyrights Manager, IEEE Service
Center, 445 Hoes Lane, P.O. Box 133, Piscataway, NJ 08855-1331.
The papers in this book comprise the proceedings of the meeting mentioned on the cover and title page. They reflect
the authors’ opinions and, in the interests of timely dissemination, are published as presented and without change.
Their inclusion in this publication does not necessarily constitute endorsement by the editors, the IEEE Computer
Society, or the Institute of Electrical and Electronics Engineers, Inc.
IEEE Computer Society Order Number P2461
ISBN 0-7695-2461-3
ISSN 1063-9527
Additional copies may be ordered from:
IEEE Computer Society
Customer Service Center
10662 Los Vaqueros Circle
P.O. Box 3014
Los Alamitos, CA 90720-1314
Tel: + 1 800 272 6657
Fax: + 1 714 821 4641
http://computer.org/cspress
csbooks@computer.org
IEEE Service Center
445 Hoes Lane
P.O. Box 1331
Piscataway, NJ 08855-1331
Tel: + 1 732 981 0060
Fax: + 1 732 981 9667
http://shop.ieee.org/store/
customer-service@ieee.org
IEEE Computer Society
Asia/Pacific Office
Watanabe Bldg., 1-4-2
Minami-Aoyama
Minato-ku, Tokyo 107-0062
JAPAN
Tel:  + 81 3 3408 3118
Fax: + 81 3 3408 3553
tokyo.ofc@computer.org
Individual paper REPRINTS may be ordered at: reprints@computer.org
..........................................................................................................

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:SoK: Cyber Insurance - Technical Challenges and a System Security
Roadmap
author:Savino Dambra and
Leyla Bilge and
Davide Balzarotti
2020 IEEE Symposium on Security and Privacy
SoK: Cyber Insurance – Technical
Challenges and a System Security Roadmap
Savino Dambra
Eurecom
Leyla Bilge
Symantec Research Labs
Davide Balzarotti
Eurecom
Abstract—Cyber attacks have increased in number and complexity
in recent years, and companies and organizations have accordingly
raised their investments in more robust infrastructure to preserve
their data, assets and reputation. However, the full protection against
these countless and constantly evolving threats is unattainable by
the sole use of preventive measures. Therefore, to handle residual
risks and contain business losses in case of an incident, firms are
increasingly adopting a cyber insurance as part of their corporate
risk management strategy.
As a result, the cyber insurance sector – which offers to transfer
the financial risks related to network and computer incidents to a
third party – is rapidly growing, with recent claims that already
reached a $100M dollars. However, while other insurance sectors rely
on consolidated methodologies to accurately predict risks, the many
peculiarities of the cyber domain resulted in carriers to often resort
to qualitative approaches based on experts opinions.
This paper looks at past research conducted in the area of
cyber insurance and classifies previous studies in four different
areas, focused respectively on studying the economical aspects, the
mathematical models, the risk management methodologies, and the
predictions of cyber events. We then identify, for each insurance
phase, a group of practical research problems where security experts
can help develop new data-driven methodologies and automated tools
to replace the existing qualitative approaches.
I. INTRODUCTION
The modern society is highly dependent on Information and Com-
munication Technologies (ICT). However, despite it...


Instruction: 总结这篇安全研究的主要观点

Input:
title:SoK: Cyber Insurance - Technical Challenges and a System Security
Roadmap
author:Savino Dambra and
Leyla Bilge and
Davide Balzarotti
2020 IEEE Symposium on Security and Privacy
SoK: Cyber Insurance – Technical
Challenges and a System Security Roadmap
Savino Dambra
Eurecom
Leyla Bilge
Symantec Research Labs
Davide Balzarotti
Eurecom
Abstract—Cyber attacks have increased in number and complexity
in recent years, and companies and organizations have accordingly
raised their investments in more robust infrastructure to preserve
their data, assets and reputation. However, the full protection against
these countless and constantly evolving threats is unattainable by
the sole use of preventive measures. Therefore, to handle residual
risks and contain business losses in case of an incident, firms are
increasingly adopting a cyber insurance as part of their corporate
risk management strategy.
As a result, the cyber insurance sector – which offers to transfer
the financial risks related to network and computer incidents to a
third party – is rapidly growing, with recent claims that already
reached a $100M dollars. However, while other insurance sectors rely
on consolidated methodologies to accurately predict risks, the many
peculiarities of the cyber domain resulted in carriers to often resort
to qualitative approaches based on experts opinions.
This paper looks at past research conducted in the area of
cyber insurance and classifies previous studies in four different
areas, focused respectively on studying the economical aspects, the
mathematical models, the risk management methodologies, and the
predictions of cyber events. We then identify, for each insurance
phase, a group of practical research problems where security experts
can help develop new data-driven methodologies and automated tools
to replace the existing qualitative approaches.
I. INTRODUCTION
The modern society is highly dependent on Information and Com-
munication Technologies (ICT). However, despite it...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A Principled Approach for ROP Defense
author:Rui Qiao and
Mingwei Zhang and
R. Sekar
A Principled Approach for ROP Defense
Rui Qiao
Stony Brook University
ruqiao@cs.stonybrook.edu
∗
Mingwei Zhang
Intel Labs
mingwei.zhang@intel.com
R. Sekar
Stony Brook University
sekar@cs.stonybrook.edu
ABSTRACT
Return-Oriented Programming (ROP) is an eﬀective attack
technique that can escape modern defenses such as DEP.
ROP is based on repeated abuse of existing code snippets
ending with return instructions (called gadgets), as com-
pared to using injected code. Several defense mechanisms
have been proposed to counter ROP by enforcing policies
on the targets of return instructions, and/or their frequency.
However, these policies have been repeatedly bypassed by
more advanced ROP attacks. While stricter policies have
the potential to thwart ROP, they lead to incompatibilities
which discourage their deployment.
In this work, we ad-
dress this challenge by presenting a principled approach for
ROP defense on COTS binaries. Our experimental evalu-
ation shows that our approach enforces a stronger policy,
while oﬀering better compatibility and performance as com-
pared to previous research. Our prototype is compatible
with many real-world and low-level programs. On SPEC
2006 benchmark program, it adds just 4% overhead above
the base overhead of 13% imposed by PSI, the platform used
in our implementation.
1.
Introduction
Programs written in C/C++ are not memory safe. Vul-
nerabilities such as buﬀer overﬂow, heap overﬂow and use-
after-free can be exploited by attackers to execute code of
their choice. Traditionally, attackers inject payload (called
shellcode) into the address space of a victim process, and
redirect control to this code. However, with widespread
deployment of Data Execution Prevention (DEP), injected
code is no longer executable, so attackers have come to
rely on code reuse attacks. Return-Oriented Programming
(ROP), which chains together a sequence of “gadgets” (code...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A Principled Approach for ROP Defense
author:Rui Qiao and
Mingwei Zhang and
R. Sekar
A Principled Approach for ROP Defense
Rui Qiao
Stony Brook University
ruqiao@cs.stonybrook.edu
∗
Mingwei Zhang
Intel Labs
mingwei.zhang@intel.com
R. Sekar
Stony Brook University
sekar@cs.stonybrook.edu
ABSTRACT
Return-Oriented Programming (ROP) is an eﬀective attack
technique that can escape modern defenses such as DEP.
ROP is based on repeated abuse of existing code snippets
ending with return instructions (called gadgets), as com-
pared to using injected code. Several defense mechanisms
have been proposed to counter ROP by enforcing policies
on the targets of return instructions, and/or their frequency.
However, these policies have been repeatedly bypassed by
more advanced ROP attacks. While stricter policies have
the potential to thwart ROP, they lead to incompatibilities
which discourage their deployment.
In this work, we ad-
dress this challenge by presenting a principled approach for
ROP defense on COTS binaries. Our experimental evalu-
ation shows that our approach enforces a stronger policy,
while oﬀering better compatibility and performance as com-
pared to previous research. Our prototype is compatible
with many real-world and low-level programs. On SPEC
2006 benchmark program, it adds just 4% overhead above
the base overhead of 13% imposed by PSI, the platform used
in our implementation.
1.
Introduction
Programs written in C/C++ are not memory safe. Vul-
nerabilities such as buﬀer overﬂow, heap overﬂow and use-
after-free can be exploited by attackers to execute code of
their choice. Traditionally, attackers inject payload (called
shellcode) into the address space of a victim process, and
redirect control to this code. However, with widespread
deployment of Data Execution Prevention (DEP), injected
code is no longer executable, so attackers have come to
rely on code reuse attacks. Return-Oriented Programming
(ROP), which chains together a sequence of “gadgets” (code...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:PeerAccess: a logic for distributed authorization
author:Marianne Winslett and
Charles C. Zhang and
Piero A. Bonatti
PeerAccess: A Logic for Distributed Authorization
Marianne Winslett
University of Illinois at
Urbana-Champaign
Urbana, IL 61801, USA
winslett@cs.uiuc.edu
Charles C. Zhang
University of Illinois at
Urbana-Champaign
Urbana, IL 61801, USA
cczhang@cs.uiuc.edu
Piero A. Bonatti
Universit`a di Napoli
FEDERICO II
Napoli, Italy
bonatti@na.infn.it
ABSTRACT
This paper introduces the PeerAccess framework for reasoning about
authorization in open distributed systems, and shows how a param-
eterization of the framework can be used to reason about access
to computational resources in a grid environment. The PeerAc-
cess framework supports a declarative description of the behavior
of peers that selectively push and/or pull information from certain
other peers. PeerAccess local knowledge bases encode the basic
knowledge of each peer (e.g., Alice’s group memberships), its poli-
cies governing the release of each possible piece of information to
other peers, and information that guides and limits its search pro-
cess when trying to obtain particular pieces of information from
other peers. PeerAccess proofs of authorization are veriﬁable and
nonrepudiable, and their construction relies only on the local infor-
mation possessed by peers and their parameterized behavior with
respect to query answering, information push/pull, and informa-
tion release policies (i.e., no omniscient viewpoint is required). We
present the PeerAccess language and peer knowledge base struc-
ture, the associated formal semantics and proof theory, and exam-
ples of the use of PeerAccess in constructing proofs of authoriza-
tion to access computational resources.
Categories and Subject Descriptors
K.6.5 [Management of Computing and Information Systems]:
Security and Protection; D.4.6 [Operating Systems]: Security and
Protection - Access Control
General Terms
Security, Languages, Theory
Keywor...


Instruction: 总结这篇安全研究的主要观点

Input:
title:PeerAccess: a logic for distributed authorization
author:Marianne Winslett and
Charles C. Zhang and
Piero A. Bonatti
PeerAccess: A Logic for Distributed Authorization
Marianne Winslett
University of Illinois at
Urbana-Champaign
Urbana, IL 61801, USA
winslett@cs.uiuc.edu
Charles C. Zhang
University of Illinois at
Urbana-Champaign
Urbana, IL 61801, USA
cczhang@cs.uiuc.edu
Piero A. Bonatti
Universit`a di Napoli
FEDERICO II
Napoli, Italy
bonatti@na.infn.it
ABSTRACT
This paper introduces the PeerAccess framework for reasoning about
authorization in open distributed systems, and shows how a param-
eterization of the framework can be used to reason about access
to computational resources in a grid environment. The PeerAc-
cess framework supports a declarative description of the behavior
of peers that selectively push and/or pull information from certain
other peers. PeerAccess local knowledge bases encode the basic
knowledge of each peer (e.g., Alice’s group memberships), its poli-
cies governing the release of each possible piece of information to
other peers, and information that guides and limits its search pro-
cess when trying to obtain particular pieces of information from
other peers. PeerAccess proofs of authorization are veriﬁable and
nonrepudiable, and their construction relies only on the local infor-
mation possessed by peers and their parameterized behavior with
respect to query answering, information push/pull, and informa-
tion release policies (i.e., no omniscient viewpoint is required). We
present the PeerAccess language and peer knowledge base struc-
ture, the associated formal semantics and proof theory, and exam-
ples of the use of PeerAccess in constructing proofs of authoriza-
tion to access computational resources.
Categories and Subject Descriptors
K.6.5 [Management of Computing and Information Systems]:
Security and Protection; D.4.6 [Operating Systems]: Security and
Protection - Access Control
General Terms
Security, Languages, Theory
Keywor...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:\(τ\)CFI: Type-Assisted Control Flow Integrity for x86-64 Binaries
author:Paul Muntean and
Matthias Fischer and
Gang Tan and
Zhiqiang Lin and
Jens Grossklags and
Claudia Eckert
τ CFI: Type-Assisted Control Flow
Integrity for x86-64 Binaries
Paul Muntean1(B)
Jens Grossklags1
, and Claudia Eckert1
, Matthias Fischer1, Gang Tan3
, Zhiqiang Lin2
,
1 Technical University of Munich, Munich, Germany
{paul.muntean,matthias.fischer,claudia.eckert}@sec.in.tum.de,
jens.grossklags@in.tum.de
2 The Ohio State University, Columbus, USA
3 The Pennsylvania State University, State College, USA
zlin@cse.ohio-state.edu
gtan@cse.psu.edu
Abstract. Programs aiming for low runtime overhead and high avail-
ability draw on several object-oriented features available in the C/C++
programming language, such as dynamic object dispatch. However, there
is an alarmingly high number of object dispatch (i.e., forward-edge) cor-
ruption vulnerabilities, which undercut security in signiﬁcant ways and
are in need of a thorough solution. In this paper, we propose τ CFI, an
extended control ﬂow integrity (CFI) model that uses both the types and
numbers of function parameters to enforce forward- and backward-edge
control ﬂow transfers. At a high level, it improves the precision of existing
forward-edge recognition approaches by considering the type information
of function parameters, which are directly extracted from the application
binaries. Therefore, τ CFI can be used to harden legacy applications for
which source code may not be available. We have evaluated τ CFI on
real-world binaries including Nginx, NodeJS, Lighttpd, MySql and the
SPEC CPU2006 benchmark and demonstrate that τ CFI is able to eﬀec-
tively protect these applications from forward- and backward-edge cor-
ruptions with low runtime overhead. In direct comparison with state-of-
the-art tools, τ CFI achieves higher forward-edge caller-callee matching
precision.
Keywords: C++ object dispatch · Indirect control ﬂow transfer
Code-reuse at...


Instruction: 总结这篇安全研究的主要观点

Input:
title:\(τ\)CFI: Type-Assisted Control Flow Integrity for x86-64 Binaries
author:Paul Muntean and
Matthias Fischer and
Gang Tan and
Zhiqiang Lin and
Jens Grossklags and
Claudia Eckert
τ CFI: Type-Assisted Control Flow
Integrity for x86-64 Binaries
Paul Muntean1(B)
Jens Grossklags1
, and Claudia Eckert1
, Matthias Fischer1, Gang Tan3
, Zhiqiang Lin2
,
1 Technical University of Munich, Munich, Germany
{paul.muntean,matthias.fischer,claudia.eckert}@sec.in.tum.de,
jens.grossklags@in.tum.de
2 The Ohio State University, Columbus, USA
3 The Pennsylvania State University, State College, USA
zlin@cse.ohio-state.edu
gtan@cse.psu.edu
Abstract. Programs aiming for low runtime overhead and high avail-
ability draw on several object-oriented features available in the C/C++
programming language, such as dynamic object dispatch. However, there
is an alarmingly high number of object dispatch (i.e., forward-edge) cor-
ruption vulnerabilities, which undercut security in signiﬁcant ways and
are in need of a thorough solution. In this paper, we propose τ CFI, an
extended control ﬂow integrity (CFI) model that uses both the types and
numbers of function parameters to enforce forward- and backward-edge
control ﬂow transfers. At a high level, it improves the precision of existing
forward-edge recognition approaches by considering the type information
of function parameters, which are directly extracted from the application
binaries. Therefore, τ CFI can be used to harden legacy applications for
which source code may not be available. We have evaluated τ CFI on
real-world binaries including Nginx, NodeJS, Lighttpd, MySql and the
SPEC CPU2006 benchmark and demonstrate that τ CFI is able to eﬀec-
tively protect these applications from forward- and backward-edge cor-
ruptions with low runtime overhead. In direct comparison with state-of-
the-art tools, τ CFI achieves higher forward-edge caller-callee matching
precision.
Keywords: C++ object dispatch · Indirect control ﬂow transfer
Code-reuse at...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Characterizing Eve: Analysing Cybercrime Actors in a Large Underground
Forum
author:Sergio Pastrana and
Alice Hutchings and
Andrew Caines and
Paula Buttery
Characterizing Eve: Analysing
Cybercrime Actors in a Large
Underground Forum
Sergio Pastrana1(B)
, Alice Hutchings1
and Paula Buttery3
, Andrew Caines2
,
1 Cambridge Cybercrime Centre, Department of Computer Science and Technology,
University of Cambridge, Cambridge, UK
{Sergio.Pastrana,Alice.Hutchings}@cl.cam.ac.uk
2 Theoretical and Applied Linguistics, Faculty of Modern and Medieval Languages,
University of Cambridge, Cambridge, UK
apc38@cam.ac.uk
3 Natural Language and Information Processing, Department of Computer Science
and Technology, University of Cambridge, Cambridge, UK
pjb48@cam.ac.uk
Abstract. Underground forums contain many thousands of active users,
but the vast majority will be involved, at most,
in minor levels of
deviance. The number who engage in serious criminal activity is small.
That being said, underground forums have played a signiﬁcant role in
several recent high-proﬁle cybercrime activities. In this work we apply
data science approaches to understand criminal pathways and character-
ize key actors related to illegal activity in one of the largest and longest-
running underground forums. We combine the results of a logistic regres-
sion model with k-means clustering and social network analysis, verifying
the ﬁndings using topic analysis. We identify variables relating to forum
activity that predict the likelihood a user will become an actor of interest
to law enforcement, and would therefore beneﬁt the most from interven-
tion. This work provides the ﬁrst step towards identifying ways to deter
the involvement of young people away from a career in cybercrime.
Keywords: Cybercrime · Underground forums · Social behaviour
Criminal pathways
1 Introduction
Cybercrimes carried out by organized groups using custom tools with political or
military motivations capture the public imagination. H...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Characterizing Eve: Analysing Cybercrime Actors in a Large Underground
Forum
author:Sergio Pastrana and
Alice Hutchings and
Andrew Caines and
Paula Buttery
Characterizing Eve: Analysing
Cybercrime Actors in a Large
Underground Forum
Sergio Pastrana1(B)
, Alice Hutchings1
and Paula Buttery3
, Andrew Caines2
,
1 Cambridge Cybercrime Centre, Department of Computer Science and Technology,
University of Cambridge, Cambridge, UK
{Sergio.Pastrana,Alice.Hutchings}@cl.cam.ac.uk
2 Theoretical and Applied Linguistics, Faculty of Modern and Medieval Languages,
University of Cambridge, Cambridge, UK
apc38@cam.ac.uk
3 Natural Language and Information Processing, Department of Computer Science
and Technology, University of Cambridge, Cambridge, UK
pjb48@cam.ac.uk
Abstract. Underground forums contain many thousands of active users,
but the vast majority will be involved, at most,
in minor levels of
deviance. The number who engage in serious criminal activity is small.
That being said, underground forums have played a signiﬁcant role in
several recent high-proﬁle cybercrime activities. In this work we apply
data science approaches to understand criminal pathways and character-
ize key actors related to illegal activity in one of the largest and longest-
running underground forums. We combine the results of a logistic regres-
sion model with k-means clustering and social network analysis, verifying
the ﬁndings using topic analysis. We identify variables relating to forum
activity that predict the likelihood a user will become an actor of interest
to law enforcement, and would therefore beneﬁt the most from interven-
tion. This work provides the ﬁrst step towards identifying ways to deter
the involvement of young people away from a career in cybercrime.
Keywords: Cybercrime · Underground forums · Social behaviour
Criminal pathways
1 Introduction
Cybercrimes carried out by organized groups using custom tools with political or
military motivations capture the public imagination. H...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Techniques for Estimation of Design Diversity for Combinational Logic
Circuits
author:Subhasish Mitra and
Nirmal R. Saxena and
Edward J. McCluskey
TECHNIQUES FOR ESTIMATION OF DESIGN DIVERSITY FOR COMBINATIONAL
LOGIC CIRCUITS
Subhasish Mitra, Nirmal R. Saxena and Edward J. McCluskey
Center for Reliable Computing
Departments of Electrical Engineering and Computer Science
Stanford University, Stanford, California
http://crc.stanford.edu
Abstract
Design  diversity  has  long  been  used  to  protect
redundunt  systems  against  common-mode  failures.  The
conventional  notion  of diversity  relies on  “independent”
generation  of  “different”  implementations  of  the  same
logic jimction.  This concept  is qualitative  and  does not
provide  a basis to compcire the reliabilities of two diverse
In  a  recent  paper,  we  presented  a  metric  to
systems.
quantiSy diversity  among several designs.  The problem of
calculuting  the  diversity  metric  is NP-complete  and  ccin
be  of  exponential  complexity.
In  this paper,  we  present
techniques  to  estinuite  the  value  of  the  design  diversitv
metric.  For  datupcith designs,  we  have formulated  very
fcist  techniques  to  calculate  the  value  of  the  metric  by
exploiting  the regularity  in the datcipath structures.  For
logic  circuits,  we  present  cin
genercil  combinational
adaptive Monte-Ccirlo simulation technique for estimuting
bounds on the  value  of  the  metric.  The  adaptive  Monte-
Curlo simulation technique provides accurate estimates of
the  design  diversity  metric;  the  number  of  simulations
used  to  reach  this  estimate  is  polynomial  (instead  of
exponentid) in  the  number  of  circuit  inputs.  Moreover,
the number of simulations ccin be tuned depending  on the
desired accurricy.
1.  Introduction
Concurrent  Error  Detection  (CED)  techniques  are
widely  used  for  designing  systems  with  high  data
integrity.  A duplex system is...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Techniques for Estimation of Design Diversity for Combinational Logic
Circuits
author:Subhasish Mitra and
Nirmal R. Saxena and
Edward J. McCluskey
TECHNIQUES FOR ESTIMATION OF DESIGN DIVERSITY FOR COMBINATIONAL
LOGIC CIRCUITS
Subhasish Mitra, Nirmal R. Saxena and Edward J. McCluskey
Center for Reliable Computing
Departments of Electrical Engineering and Computer Science
Stanford University, Stanford, California
http://crc.stanford.edu
Abstract
Design  diversity  has  long  been  used  to  protect
redundunt  systems  against  common-mode  failures.  The
conventional  notion  of diversity  relies on  “independent”
generation  of  “different”  implementations  of  the  same
logic jimction.  This concept  is qualitative  and  does not
provide  a basis to compcire the reliabilities of two diverse
In  a  recent  paper,  we  presented  a  metric  to
systems.
quantiSy diversity  among several designs.  The problem of
calculuting  the  diversity  metric  is NP-complete  and  ccin
be  of  exponential  complexity.
In  this paper,  we  present
techniques  to  estinuite  the  value  of  the  design  diversitv
metric.  For  datupcith designs,  we  have formulated  very
fcist  techniques  to  calculate  the  value  of  the  metric  by
exploiting  the regularity  in the datcipath structures.  For
logic  circuits,  we  present  cin
genercil  combinational
adaptive Monte-Ccirlo simulation technique for estimuting
bounds on the  value  of  the  metric.  The  adaptive  Monte-
Curlo simulation technique provides accurate estimates of
the  design  diversity  metric;  the  number  of  simulations
used  to  reach  this  estimate  is  polynomial  (instead  of
exponentid) in  the  number  of  circuit  inputs.  Moreover,
the number of simulations ccin be tuned depending  on the
desired accurricy.
1.  Introduction
Concurrent  Error  Detection  (CED)  techniques  are
widely  used  for  designing  systems  with  high  data
integrity.  A duplex system is...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:The Last Mile: An Empirical Study of Timing Channels on seL4
author:David Cock and
Qian Ge and
Toby C. Murray and
Gernot Heiser
The Last Mile
An Empirical Study of Timing Channels on seL4
David Cock, Qian Ge, Toby Murray, Gernot Heiser
david.cock@nicta.com.au, qian.ge@nicta.com.au, toby.murray@nicta.com.au, gernot@nicta.com.au
NICTA and UNSW, Sydney, Australia
ABSTRACT
Storage channels can be provably eliminated in well-designed, high-
assurance kernels. Timing channels remain the last mile for conﬁ-
dentiality and are still beyond the reach of formal analysis, so must
be dealt with empirically. We perform such an analysis, collecting
a large data set (2,000 hours of observations) for two representative
timing channels, the locally-exploitable cache channel and a remote
exploit of OpenSSL execution timing, on the veriﬁed seL4 micro-
kernel. We also evaluate the effectiveness, in bandwidth reduction,
of a number of black-box mitigation techniques (cache colouring,
instruction-based scheduling and deterministic delivery of server
responses) across a number of hardware platforms. Our (somewhat
unexpected) results show that while these defences were highly ef-
fective a few processor generations ago, the trend towards impre-
cise events in modern microarchitectures weakens the defences and
introduces new channels. This demonstrates the necessity of care-
ful empirical analysis of timing channels.
Categories and Subject Descriptors
D.4.6 [Operating Systems]: Security and Protection—Informa-
tion Flow Controls
General Terms
Security, Measurement, Performance
Keywords
Conﬁdentiality; covert channels; side channels; mitigation; micro-
kernels; cache coloring; seL4
1.
INTRODUCTION
Unanticipated information leaks are one of the oldest problems
in computer security, with documented cases from as early as the
1940s [NSA, 1972]. Such leaks are traditionally classiﬁed as either
storage or timing channels, depending on whether time is used to
exploit them [Wray, 1991].
Permi...


Instruction: 总结这篇安全研究的主要观点

Input:
title:The Last Mile: An Empirical Study of Timing Channels on seL4
author:David Cock and
Qian Ge and
Toby C. Murray and
Gernot Heiser
The Last Mile
An Empirical Study of Timing Channels on seL4
David Cock, Qian Ge, Toby Murray, Gernot Heiser
david.cock@nicta.com.au, qian.ge@nicta.com.au, toby.murray@nicta.com.au, gernot@nicta.com.au
NICTA and UNSW, Sydney, Australia
ABSTRACT
Storage channels can be provably eliminated in well-designed, high-
assurance kernels. Timing channels remain the last mile for conﬁ-
dentiality and are still beyond the reach of formal analysis, so must
be dealt with empirically. We perform such an analysis, collecting
a large data set (2,000 hours of observations) for two representative
timing channels, the locally-exploitable cache channel and a remote
exploit of OpenSSL execution timing, on the veriﬁed seL4 micro-
kernel. We also evaluate the effectiveness, in bandwidth reduction,
of a number of black-box mitigation techniques (cache colouring,
instruction-based scheduling and deterministic delivery of server
responses) across a number of hardware platforms. Our (somewhat
unexpected) results show that while these defences were highly ef-
fective a few processor generations ago, the trend towards impre-
cise events in modern microarchitectures weakens the defences and
introduces new channels. This demonstrates the necessity of care-
ful empirical analysis of timing channels.
Categories and Subject Descriptors
D.4.6 [Operating Systems]: Security and Protection—Informa-
tion Flow Controls
General Terms
Security, Measurement, Performance
Keywords
Conﬁdentiality; covert channels; side channels; mitigation; micro-
kernels; cache coloring; seL4
1.
INTRODUCTION
Unanticipated information leaks are one of the oldest problems
in computer security, with documented cases from as early as the
1940s [NSA, 1972]. Such leaks are traditionally classiﬁed as either
storage or timing channels, depending on whether time is used to
exploit them [Wray, 1991].
Permi...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A Re-evaluation of Intrusion Detection Accuracy: Alternative Evaluation
Strategy
author:Said Al-Riyami and
Frans Coenen and
Alexei Lisitsa
POSTER: A Re-evaluation of Intrusion Detection Accuracy: an
Alternative Evaluation Strategy
Said Al-Riyami
Liverpool University
Liverpool, UK
alriyami@liverpool.ac.uk
Frans Coenen
Liverpool University
Liverpool, UK
coenen@liverpool.ac.uk
Alexei Lisitsa
Liverpool University
Liverpool, UK
lisitsa@liverpool.ac.uk
ABSTRACT
This work tries to evaluate the existing approaches used to bench-
mark the performance of machine learning models applied to network-
based intrusion detection systems (NIDS). First, we demonstrate
that we can reach a very high accuracy with most of the traditional
machine learning and deep learning models by using the existing
performance evaluation strategy. It just requires the right hyper-
parameter tuning to outperform the existing reported accuracy
results in deep learning models. We further question the value of
the existing evaluation methods in which the same datasets are
used for training and testing the models. We are proposing the
use of an alternative strategy that aims to evaluate the practicality
and the performance of the models and datasets as well. In this
approach, different datasets with compatible sets of features are
used for training and testing. When we evaluate the models that
we created with the proposed strategy, we demonstrate that the
performance is very bad. Thus, models have no practical usage, and
it performs based on a pure randomness. This research is important
for security-based machine learning applications to re-think about
the datasets and the model’s quality.
KEYWORDS
Intrusion detection system, Network Security, Security and Privacy,
Domain Adaptation, Machine Learning, Deep Learning
1 INTRODUCTION
In recent years, the number of malware and intrusion attacks has
escalated dramatically. Symantec claims that it detected more than
357 millions new variants of malware in 2...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A Re-evaluation of Intrusion Detection Accuracy: Alternative Evaluation
Strategy
author:Said Al-Riyami and
Frans Coenen and
Alexei Lisitsa
POSTER: A Re-evaluation of Intrusion Detection Accuracy: an
Alternative Evaluation Strategy
Said Al-Riyami
Liverpool University
Liverpool, UK
alriyami@liverpool.ac.uk
Frans Coenen
Liverpool University
Liverpool, UK
coenen@liverpool.ac.uk
Alexei Lisitsa
Liverpool University
Liverpool, UK
lisitsa@liverpool.ac.uk
ABSTRACT
This work tries to evaluate the existing approaches used to bench-
mark the performance of machine learning models applied to network-
based intrusion detection systems (NIDS). First, we demonstrate
that we can reach a very high accuracy with most of the traditional
machine learning and deep learning models by using the existing
performance evaluation strategy. It just requires the right hyper-
parameter tuning to outperform the existing reported accuracy
results in deep learning models. We further question the value of
the existing evaluation methods in which the same datasets are
used for training and testing the models. We are proposing the
use of an alternative strategy that aims to evaluate the practicality
and the performance of the models and datasets as well. In this
approach, different datasets with compatible sets of features are
used for training and testing. When we evaluate the models that
we created with the proposed strategy, we demonstrate that the
performance is very bad. Thus, models have no practical usage, and
it performs based on a pure randomness. This research is important
for security-based machine learning applications to re-think about
the datasets and the model’s quality.
KEYWORDS
Intrusion detection system, Network Security, Security and Privacy,
Domain Adaptation, Machine Learning, Deep Learning
1 INTRODUCTION
In recent years, the number of malware and intrusion attacks has
escalated dramatically. Symantec claims that it detected more than
357 millions new variants of malware in 2...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Back to the future part 4: the internet
author:Simon S. Lam
SIGCOMM Award Winner
Simon S. Lam
University of Texas at Austin
lam@cs.utexas.edu
Back to the Future Part 4: The Internet
Keynote Talk
The award to Simon Lam is in recognition of his vision, breadth, and rigor in contributing
to,  among  other  areas:  secure  network  communication,  the  analysis  of  network  and
multiaccess protocols, the analysis of queueing networks, and the design of mechanisms
for quality of service.
Biography
Simon S. Lam is Professor and Regents Chair in Computer Sciences at the University of
Texas at Austin. He received the BSEE degree with Distinction from Washington State
University, Pullman, in 1969, and the M.S. and Ph.D. degrees in engineering from UCLA
in 1970 and 1974, respectively.
From  1971  to  1974,  he  was  a  Postgraduate  Research  Engineer  at  the  ARPA  Network
Measurement  Center,  UCLA,  where  he  worked  on  satellite  and  radio packet  switching
networks. From 1974 to 1977, he was a Research Staff Member at the IBM T.J. Watson
Research Center, Yorktown Heights, New York.  Since 1977, he has been on the faculty
of the University of Texas at Austin. He served as Department Chair from 1992 to 1994.
His  current  research  interests  are  in  network  protocol  design  and  analysis,  distributed
multimedia, and Internet security services.
Simon served on the editorial boards of IEEE/ACM Transactions on Networking, IEEE
Transactions  on  Software  Engineering,  IEEE  Transactions  on  Communications,
Proceedings  of  the  IEEE,  and  Performance  Evaluation.  He  was  Editor-in-Chief  of
IEEE/ACM Transactions on Networking from 1995 to 1999. He currently serves on the
editorial  board  of  Computer  Networks.  He  organized,  as  Program  Chair,  the  inaugural
ACM SIGCOMM Symposium held at the University of Texas at Austin in 1983. He is a
founding Steering Committee member of the IEEE International Conference on Network
P...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Back to the future part 4: the internet
author:Simon S. Lam
SIGCOMM Award Winner
Simon S. Lam
University of Texas at Austin
lam@cs.utexas.edu
Back to the Future Part 4: The Internet
Keynote Talk
The award to Simon Lam is in recognition of his vision, breadth, and rigor in contributing
to,  among  other  areas:  secure  network  communication,  the  analysis  of  network  and
multiaccess protocols, the analysis of queueing networks, and the design of mechanisms
for quality of service.
Biography
Simon S. Lam is Professor and Regents Chair in Computer Sciences at the University of
Texas at Austin. He received the BSEE degree with Distinction from Washington State
University, Pullman, in 1969, and the M.S. and Ph.D. degrees in engineering from UCLA
in 1970 and 1974, respectively.
From  1971  to  1974,  he  was  a  Postgraduate  Research  Engineer  at  the  ARPA  Network
Measurement  Center,  UCLA,  where  he  worked  on  satellite  and  radio packet  switching
networks. From 1974 to 1977, he was a Research Staff Member at the IBM T.J. Watson
Research Center, Yorktown Heights, New York.  Since 1977, he has been on the faculty
of the University of Texas at Austin. He served as Department Chair from 1992 to 1994.
His  current  research  interests  are  in  network  protocol  design  and  analysis,  distributed
multimedia, and Internet security services.
Simon served on the editorial boards of IEEE/ACM Transactions on Networking, IEEE
Transactions  on  Software  Engineering,  IEEE  Transactions  on  Communications,
Proceedings  of  the  IEEE,  and  Performance  Evaluation.  He  was  Editor-in-Chief  of
IEEE/ACM Transactions on Networking from 1995 to 1999. He currently serves on the
editorial  board  of  Computer  Networks.  He  organized,  as  Program  Chair,  the  inaugural
ACM SIGCOMM Symposium held at the University of Texas at Austin in 1983. He is a
founding Steering Committee member of the IEEE International Conference on Network
P...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:TACK: Improving Wireless Transport Performance by Taming Acknowledgments
author:Tong Li and
Kai Zheng and
Ke Xu and
Rahul Arvind Jadhav and
Tao Xiong and
Keith Winstein and
Kun Tan
TACK: Improving Wireless Transport Performance by Taming
Acknowledgments
Tong Li
Huawei
Kai Zheng
Huawei
Ke Xu
Rahul Arvind Jadhav
Tsinghua University &
Huawei
li.tong@huawei.com
kai.zheng@huawei.com
BNRist & PCL
nyrahul@gmail.com
xuke@tsinghua.edu.cn
Tao Xiong
Huawei
Keith Winstein
Stanford University
Kun Tan
Huawei
yahz81@gmail.com
keithw@cs.stanford.edu
kun.tan@huawei.com
ABSTRACT
High-throughput transport over wireless local area network
(WLAN) becomes a demanding requirement with the emer-
gence of 4K wireless projection, VR/AR-based interactive
gaming, and more. However, the shared nature of the wireless
medium induces contention between data transport and back-
ward signaling, such as acknowledgement. The current way
of TCP acknowledgment induces control overhead which is
counter-productive for TCP performance especially in WLAN
scenarios.
In this paper, we present a new acknowledgement called
TACK (“Tame ACK”), as well as its TCP implementation
TCP-TACK. TCP-TACK works on top of commodity WLAN,
delivering high wireless transport goodput with minimal con-
trol overhead in the form of ACKs, without any hardware
modification. To minimize ACK frequency, TACK abandons
the legacy received-packet-driven ACK. Instead, it balances
byte-counting ACK and periodic ACK so as to achieve a
controlled ACK frequency. Evaluation results show that TCP-
TACK achieves significant advantages over legacy TCP in
WLAN scenarios due to less contention between data packets
and ACKs. Specifically, TCP-TACK reduces over 90% of
ACKs and also obtains an improvement of ∼ 28% on good-
put. We further find it performs equally well as high-speed
TCP variants in wide area network (WAN) scenarios, this is
attributed to the advancements of the TACK-based proto-
col design in loss recovery, round-trip timing, and...


Instruction: 总结这篇安全研究的主要观点

Input:
title:TACK: Improving Wireless Transport Performance by Taming Acknowledgments
author:Tong Li and
Kai Zheng and
Ke Xu and
Rahul Arvind Jadhav and
Tao Xiong and
Keith Winstein and
Kun Tan
TACK: Improving Wireless Transport Performance by Taming
Acknowledgments
Tong Li
Huawei
Kai Zheng
Huawei
Ke Xu
Rahul Arvind Jadhav
Tsinghua University &
Huawei
li.tong@huawei.com
kai.zheng@huawei.com
BNRist & PCL
nyrahul@gmail.com
xuke@tsinghua.edu.cn
Tao Xiong
Huawei
Keith Winstein
Stanford University
Kun Tan
Huawei
yahz81@gmail.com
keithw@cs.stanford.edu
kun.tan@huawei.com
ABSTRACT
High-throughput transport over wireless local area network
(WLAN) becomes a demanding requirement with the emer-
gence of 4K wireless projection, VR/AR-based interactive
gaming, and more. However, the shared nature of the wireless
medium induces contention between data transport and back-
ward signaling, such as acknowledgement. The current way
of TCP acknowledgment induces control overhead which is
counter-productive for TCP performance especially in WLAN
scenarios.
In this paper, we present a new acknowledgement called
TACK (“Tame ACK”), as well as its TCP implementation
TCP-TACK. TCP-TACK works on top of commodity WLAN,
delivering high wireless transport goodput with minimal con-
trol overhead in the form of ACKs, without any hardware
modification. To minimize ACK frequency, TACK abandons
the legacy received-packet-driven ACK. Instead, it balances
byte-counting ACK and periodic ACK so as to achieve a
controlled ACK frequency. Evaluation results show that TCP-
TACK achieves significant advantages over legacy TCP in
WLAN scenarios due to less contention between data packets
and ACKs. Specifically, TCP-TACK reduces over 90% of
ACKs and also obtains an improvement of ∼ 28% on good-
put. We further find it performs equally well as high-speed
TCP variants in wide area network (WAN) scenarios, this is
attributed to the advancements of the TACK-based proto-
col design in loss recovery, round-trip timing, and...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:WiMAC: Rapid Implementation Platform for User Definable MAC Protocols
Through Separation
author:Simon Yau and
Liang Ge and
Ping-Chun Hsieh and
I-Hong Hou and
Shuguang Cui and
P. R. Kumar and
Amal Ekbal and
Nikhil Kundargi
WiMAC: Rapid Implementation Platform for User Deﬁnable
MAC Protocols Through Separation
Simon Yau†, Liang Ge†, Ping-Chun Hsieh†, I-Hong Hou†, Shuguang Cui†, P. R. Kumar†,
Amal Ekbal*, and Nikhil Kundargi*
†Texas A&M University
†{symoyau, geliang87, lleyfede, ihou, cui, prk}@tamu.edu
*National Instruments
*{amal.ekbal, nikhil.kundargi}@ni.com
ABSTRACT
This demo presents WiMAC, a general-purpose wireless testbed for
researchers to quickly prototype a wide variety of real-time MAC
protocols for wireless networks. As the interface between the link
layer and the physical layer, MAC protocols are often tightly cou-
pled with the underlying physical layer, and need to have extremely
small latencies. Implementing a new MAC requires a long time. In
fact, very few MACs have ever been implemented, even though
dozens of new MAC protocols have been proposed. To enable
quick prototyping, we employ the mechanism vs. policy separa-
tion to decompose the functionality in the MAC layer and the PHY
layer. Built on the separation framework, WiMAC achieves the in-
dependence of the software from the hardware, offering a high de-
gree of function reuse and design ﬂexibility. Hence, our platform
not only supports easy cross-layer design but also allows protocol
changes on the ﬂy. Following the 802.11-like reference design, we
demonstrate that deploying a new MAC protocol is quick and sim-
ple on the proposed platform through the implementation of the
CSMA/CA and CHAIN protocols.
CCS Concepts
•Networks → Network experimentation;
Keywords
Wireless testbed; MAC; software-deﬁned radio
1.
INTRODUCTION
Driven by the emerging applications such as multimedia stream-
ing and VoIP, a wide variety of wireless protocols have been pro-
posed to meet the increasingly stringent r...