Instruction: 总结这篇安全研究的主要观点

Input:
title:SoK: Using Dynamic Binary Instrumentation for Security (And How You
May Get Caught Red Handed)
author:Daniele Cono D'Elia and
Emilio Coppa and
Simone Nicchi and
Federico Palmaro and
Lorenzo Cavallaro
SoK: Using Dynamic Binary Instrumentation for Security
(And How You May Get Caught Red Handed)
Daniele Cono D’Elia
Sapienza University of Rome
delia@diag.uniroma1.it
Emilio Coppa
Sapienza University of Rome
coppa@diag.uniroma1.it
Simone Nicchi
Sapienza University of Rome
nicchi@diag.uniroma1.it
Federico Palmaro
Prisma
f.palmaro@prismaprogetti.it
ABSTRACT
Dynamic binary instrumentation (DBI) techniques allow for moni-
toring and possibly altering the execution of a running program up
to the instruction level granularity. The ease of use and flexibility of
DBI primitives has made them popular in a large body of research in
different domains, including software security. Lately, the suitabil-
ity of DBI for security has been questioned in light of transparency
concerns from artifacts that popular frameworks introduce in the
execution: while they do not perturb benign programs, a dedicated
adversary may detect their presence and defeat the analysis.
The contributions we provide are two-fold. We first present the
abstraction and inner workings of DBI frameworks, how DBI as-
sisted prominent security research works, and alternative solutions.
We then dive into the DBI evasion and escape problems, discussing
attack surfaces, transparency concerns, and possible mitigations.
We make available to the community a library of detection pat-
terns and stopgap measures that could be of interest to DBI users.
CCS CONCEPTS
• Security and privacy → Systems security; Intrusion/anomaly
detection and malware mitigation; Software reverse engineering; Soft-
ware security engineering.
KEYWORDS
Dynamic binary instrumentation, dynamic binary translation, in-
terposition, transparent monitoring, evasion, escape
ACM Reference Format:
Daniele Cono D’Elia, Emilio Coppa, Simone Nicchi, Federico...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Timeouts: Beware Surprisingly High Delay
author:Ramakrishna Padmanabhan and
Patrick Owen and
Aaron Schulman and
Neil Spring
Timeouts: Beware Surprisingly High Delay
Ramakrishna
Padmanabhan
University of Maryland
ramapad@cs.umd.edu
Patrick Owen
University of Maryland
powen@cs.umd.edu
Aaron Schulman
Stanford University
aschulm@stanford.edu
Neil Spring
University of Maryland
nspring@cs.umd.edu
ABSTRACT
Active probing techniques, such as ping, have been used to
detect outages. When a previously responsive end host fails
to respond to a probe, studies sometimes attempt to conﬁrm
the outage by retrying the ping or attempt to identify the
location of the outage by using other tools such as tracer-
oute. The latent problem, however, is, how long should one
wait for a response to the ping? Too short a timeout risks
confusing congestion or other delay with an outage. Too
long a timeout may slow the process and prevent observ-
ing and diagnosing short-duration events, depending on the
experiment’s design.
We believe that conventional timeouts for active probes
are underestimates, and analyze data collected by Heide-
mann et al.
in 2006–2015. We ﬁnd that 5% of pings from
5% of addresses take more than 5 seconds. Put another way,
for 5% of the responsive IP addresses probed by Heidemann,
a false 5% loss rate would be inferred if using a timeout of 5
seconds. To arrive at this observation, we ﬁltered artifacts
of the data that could occur with too-long a timeout, includ-
ing responses to probes sent to broadcast addresses. We also
analyze ICMP data collected by Zmap in 2015 to ﬁnd that
around 5% of all responsive addresses observe a greater than
one second round-trip time consistently. Further, the preva-
lence of high round trip time has been increasing and it is
often associated with the ﬁrst ping, perhaps due to negotiat-
ing a wireless connection. In addition, we ﬁnd that the Au-
tonomous Systems with the most high-latency addresses are
typically cellular. This paper de...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Timeouts: Beware Surprisingly High Delay
author:Ramakrishna Padmanabhan and
Patrick Owen and
Aaron Schulman and
Neil Spring
Timeouts: Beware Surprisingly High Delay
Ramakrishna
Padmanabhan
University of Maryland
ramapad@cs.umd.edu
Patrick Owen
University of Maryland
powen@cs.umd.edu
Aaron Schulman
Stanford University
aschulm@stanford.edu
Neil Spring
University of Maryland
nspring@cs.umd.edu
ABSTRACT
Active probing techniques, such as ping, have been used to
detect outages. When a previously responsive end host fails
to respond to a probe, studies sometimes attempt to conﬁrm
the outage by retrying the ping or attempt to identify the
location of the outage by using other tools such as tracer-
oute. The latent problem, however, is, how long should one
wait for a response to the ping? Too short a timeout risks
confusing congestion or other delay with an outage. Too
long a timeout may slow the process and prevent observ-
ing and diagnosing short-duration events, depending on the
experiment’s design.
We believe that conventional timeouts for active probes
are underestimates, and analyze data collected by Heide-
mann et al.
in 2006–2015. We ﬁnd that 5% of pings from
5% of addresses take more than 5 seconds. Put another way,
for 5% of the responsive IP addresses probed by Heidemann,
a false 5% loss rate would be inferred if using a timeout of 5
seconds. To arrive at this observation, we ﬁltered artifacts
of the data that could occur with too-long a timeout, includ-
ing responses to probes sent to broadcast addresses. We also
analyze ICMP data collected by Zmap in 2015 to ﬁnd that
around 5% of all responsive addresses observe a greater than
one second round-trip time consistently. Further, the preva-
lence of high round trip time has been increasing and it is
often associated with the ﬁrst ping, perhaps due to negotiat-
ing a wireless connection. In addition, we ﬁnd that the Au-
tonomous Systems with the most high-latency addresses are
typically cellular. This paper de...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Order-Revealing Encryption: New Constructions, Applications, and Lower
Bounds
author:Kevin Lewi and
David J. Wu
Order-Revealing Encryption: New Constructions,
Applications, and Lower Bounds
(Extended Version)
Kevin Lewi
Stanford University
David J. Wu
Stanford University
klewi@cs.stanford.edu
dwu4@cs.stanford.edu
Abstract
In the last few years, there has been signiﬁcant interest in developing methods to search over
encrypted data. In the case of range queries, a simple solution is to encrypt the contents of
the database using an order-preserving encryption (OPE) scheme (i.e., an encryption scheme
that supports comparisons over encrypted values). However, Naveed et al. (CCS 2015) recently
showed that OPE-encrypted databases are extremely vulnerable to “inference attacks.”
In this work, we consider a related primitive called order-revealing encryption (ORE), which
is a generalization of OPE that allows for stronger security. We begin by constructing a new ORE
scheme for small message spaces which achieves the “best-possible” notion of security for ORE.
Next, we introduce a “domain-extension” technique and apply it to our small-message-space
ORE. While our domain-extension technique does incur a loss in security, the resulting ORE
scheme we obtain is more secure than all existing (stateless and non-interactive) OPE and ORE
schemes which are practical. All of our constructions rely only on symmetric primitives. As
part of our analysis, we also give a tight lower bound for OPE and show that no eﬃcient OPE
scheme can satisfy best-possible security if the message space contains just three messages. Thus,
achieving strong notions of security for even small message spaces requires moving beyond OPE.
Finally, we examine the properties of our new ORE scheme and show how to use it to
construct an eﬃcient range query protocol that is robust against the inference attacks of Naveed
et al. We also give a full implementation of our new ORE scheme, and show that not only is
our...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Order-Revealing Encryption: New Constructions, Applications, and Lower
Bounds
author:Kevin Lewi and
David J. Wu
Order-Revealing Encryption: New Constructions,
Applications, and Lower Bounds
(Extended Version)
Kevin Lewi
Stanford University
David J. Wu
Stanford University
klewi@cs.stanford.edu
dwu4@cs.stanford.edu
Abstract
In the last few years, there has been signiﬁcant interest in developing methods to search over
encrypted data. In the case of range queries, a simple solution is to encrypt the contents of
the database using an order-preserving encryption (OPE) scheme (i.e., an encryption scheme
that supports comparisons over encrypted values). However, Naveed et al. (CCS 2015) recently
showed that OPE-encrypted databases are extremely vulnerable to “inference attacks.”
In this work, we consider a related primitive called order-revealing encryption (ORE), which
is a generalization of OPE that allows for stronger security. We begin by constructing a new ORE
scheme for small message spaces which achieves the “best-possible” notion of security for ORE.
Next, we introduce a “domain-extension” technique and apply it to our small-message-space
ORE. While our domain-extension technique does incur a loss in security, the resulting ORE
scheme we obtain is more secure than all existing (stateless and non-interactive) OPE and ORE
schemes which are practical. All of our constructions rely only on symmetric primitives. As
part of our analysis, we also give a tight lower bound for OPE and show that no eﬃcient OPE
scheme can satisfy best-possible security if the message space contains just three messages. Thus,
achieving strong notions of security for even small message spaces requires moving beyond OPE.
Finally, we examine the properties of our new ORE scheme and show how to use it to
construct an eﬃcient range query protocol that is robust against the inference attacks of Naveed
et al. We also give a full implementation of our new ORE scheme, and show that not only is
our...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Issues and etiquette concerning use of shared measurement data
author:Mark Allman and
Vern Paxson
Issues and Etiquette
Concerning Use of Shared Measurement Data
Mark Allman
ICSI
Berkeley, CA, USA
mallman@icir.org
ABSTRACT
In this note we discuss issues surrounding how to provide and use
network measurement data made available for sharing among re-
searchers. While previous work has focused on the technical de-
tails of enabling sharing via trafﬁc anonymization, we focus on
higher-level aspects of the process such as potential harm to the
provider (e.g., by de-anonymizing a shared dataset) or interactions
to strengthen subsequent research (e.g., helping to establish ground
truth). We believe the community would beneﬁt from a dialog
regarding expectations and responsibilities of data providers, and
the etiquette involved with using others’ measurement data. To
this end, we provide a set of guidelines that aim to aid the pro-
cess of sharing measurement data. We present these not as speciﬁc
rules, but rather a framework under which providers and users can
better attain a mutual understanding about how to treat particular
datasets.
Categories and Subject Descriptors
C.2.0 [Computer-Communication Networks]: General; C.2.3
[Computer-Communication Networks]: Network Operations;
C.2.m [Computer-Communication Networks]: Miscellaneous
General Terms
Measurement,Experimentation
Keywords
Data Sharing,Anonymization
1.
INTRODUCTION
Collecting a substantive set of network measurements gener-
ally requires both favorable circumstances and hard work. The
circumstances regard having the right opportunity: administrative
and legal permission (particularly for passive measurements), op-
erational support (e.g., installation of the measurement apparatus,
subsequent access to it for maintenance), and access to sufﬁcient
resources (e.g., disk space, network taps, kernel mods, smart stu-
dents). The hard work spans developing and debugging associated
Permission to make digital or hard...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Issues and etiquette concerning use of shared measurement data
author:Mark Allman and
Vern Paxson
Issues and Etiquette
Concerning Use of Shared Measurement Data
Mark Allman
ICSI
Berkeley, CA, USA
mallman@icir.org
ABSTRACT
In this note we discuss issues surrounding how to provide and use
network measurement data made available for sharing among re-
searchers. While previous work has focused on the technical de-
tails of enabling sharing via trafﬁc anonymization, we focus on
higher-level aspects of the process such as potential harm to the
provider (e.g., by de-anonymizing a shared dataset) or interactions
to strengthen subsequent research (e.g., helping to establish ground
truth). We believe the community would beneﬁt from a dialog
regarding expectations and responsibilities of data providers, and
the etiquette involved with using others’ measurement data. To
this end, we provide a set of guidelines that aim to aid the pro-
cess of sharing measurement data. We present these not as speciﬁc
rules, but rather a framework under which providers and users can
better attain a mutual understanding about how to treat particular
datasets.
Categories and Subject Descriptors
C.2.0 [Computer-Communication Networks]: General; C.2.3
[Computer-Communication Networks]: Network Operations;
C.2.m [Computer-Communication Networks]: Miscellaneous
General Terms
Measurement,Experimentation
Keywords
Data Sharing,Anonymization
1.
INTRODUCTION
Collecting a substantive set of network measurements gener-
ally requires both favorable circumstances and hard work. The
circumstances regard having the right opportunity: administrative
and legal permission (particularly for passive measurements), op-
erational support (e.g., installation of the measurement apparatus,
subsequent access to it for maintenance), and access to sufﬁcient
resources (e.g., disk space, network taps, kernel mods, smart stu-
dents). The hard work spans developing and debugging associated
Permission to make digital or hard...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Human-Seeded Attacks and Exploiting Hot-Spots in Graphical Passwords
author:Julie Thorpe and
Paul C. van Oorschot
Human-Seeded Attacks and
Exploiting Hot-Spots in Graphical Passwords1
Julie Thorpe and P.C. van Oorschot
School of Computer Science, Carleton University
{jthorpe, paulv}@scs.carleton.ca
Abstract
Although motivated by both usability and security con-
cerns, the existing literature on click-based graphical
password schemes using a single background image
(e.g., PassPoints) has focused largely on usability. We
examine the security of such schemes, including the im-
pact of different background images, and strategies for
guessing user passwords. We report on both short- and
long-term user studies: one lab-controlled, involving 43
users and 17 diverse images, and the other a ﬁeld test of
223 user accounts. We provide empirical evidence that
popular points (hot-spots) do exist for many images, and
explore two different types of attack to exploit this hot-
spotting: (1) a “human-seeded” attack based on harvest-
ing click-points from a small set of users, and (2) an en-
tirely automated attack based on image processing tech-
niques. Our most effective attacks are generated by har-
vesting password data from a small set of users to attack
other targets. These attacks can guess 36% of user pass-
words within 231 guesses (or 12% within 216 guesses)
in one instance, and 20% within 233 guesses (or 10%
within 218 guesses) in a second instance. We perform
an image-processing attack by implementing and adapt-
ing a bottom-up model of visual attention, resulting in a
purely automated tool that can guess up to 30% of user
passwords in 235 guesses for some instances, but under
3% on others. Our results suggest that these graphical
password schemes appear to be at least as susceptible to
ofﬂine attack as the traditional text passwords they were
proposed to replace.
1
Introduction
The bane of password authentication using text-based
passwords is that users choose passw...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Human-Seeded Attacks and Exploiting Hot-Spots in Graphical Passwords
author:Julie Thorpe and
Paul C. van Oorschot
Human-Seeded Attacks and
Exploiting Hot-Spots in Graphical Passwords1
Julie Thorpe and P.C. van Oorschot
School of Computer Science, Carleton University
{jthorpe, paulv}@scs.carleton.ca
Abstract
Although motivated by both usability and security con-
cerns, the existing literature on click-based graphical
password schemes using a single background image
(e.g., PassPoints) has focused largely on usability. We
examine the security of such schemes, including the im-
pact of different background images, and strategies for
guessing user passwords. We report on both short- and
long-term user studies: one lab-controlled, involving 43
users and 17 diverse images, and the other a ﬁeld test of
223 user accounts. We provide empirical evidence that
popular points (hot-spots) do exist for many images, and
explore two different types of attack to exploit this hot-
spotting: (1) a “human-seeded” attack based on harvest-
ing click-points from a small set of users, and (2) an en-
tirely automated attack based on image processing tech-
niques. Our most effective attacks are generated by har-
vesting password data from a small set of users to attack
other targets. These attacks can guess 36% of user pass-
words within 231 guesses (or 12% within 216 guesses)
in one instance, and 20% within 233 guesses (or 10%
within 218 guesses) in a second instance. We perform
an image-processing attack by implementing and adapt-
ing a bottom-up model of visual attention, resulting in a
purely automated tool that can guess up to 30% of user
passwords in 235 guesses for some instances, but under
3% on others. Our results suggest that these graphical
password schemes appear to be at least as susceptible to
ofﬂine attack as the traditional text passwords they were
proposed to replace.
1
Introduction
The bane of password authentication using text-based
passwords is that users choose passw...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
author:Weilin Xu and
David Evans and
Yanjun Qi
Detecting Adversarial Examples in Deep Neural Networks
Feature Squeezing:
Weilin Xu, David Evans, Yanjun Qi
University of Virginia
evadeML.org
Abstract—Although deep neural networks
(DNNs) have
achieved great success in many tasks, recent studies have shown
they are vulnerable to adversarial examples. Such examples,
typically generated by adding small but purposeful distortions,
can frequently fool DNN models. Previous studies to defend
against adversarial examples mostly focused on reﬁning the
DNN models, but have either shown limited success or suﬀered
from expensive computation. We propose a new strategy, feature
squeezing, that can be used to harden DNN models by detecting
adversarial examples. Feature squeezing reduces the search space
available to an adversary by coalescing samples that correspond
to many diﬀerent feature vectors in the original space into a single
sample. By comparing a DNN model’s prediction on the original
input with that on squeezed inputs, feature squeezing detects
adversarial examples with high accuracy and few false positives.
This paper explores two types of feature squeezing: reducing
the color bit depth of each pixel and spatial smoothing. These
strategies are inexpensive and complementary to other defenses,
and can be combined in a joint detection framework to achieve
high detection rates against state-of-the-art attacks.
I.
Introduction
Deep Neural Networks (DNNs) perform exceptionally
well on many artiﬁcial intelligence tasks, including security-
sensitive applications like malware classiﬁcation [26], [8] and
face recognition [35]. Unlike when machine learning is used
in other ﬁelds, security applications involve intelligent and
adaptive adversaries responding to the deployed systems. Re-
cent studies have shown that attackers can force deep learning
object classiﬁcation models to mis-classify images by ma...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
author:Weilin Xu and
David Evans and
Yanjun Qi
Detecting Adversarial Examples in Deep Neural Networks
Feature Squeezing:
Weilin Xu, David Evans, Yanjun Qi
University of Virginia
evadeML.org
Abstract—Although deep neural networks
(DNNs) have
achieved great success in many tasks, recent studies have shown
they are vulnerable to adversarial examples. Such examples,
typically generated by adding small but purposeful distortions,
can frequently fool DNN models. Previous studies to defend
against adversarial examples mostly focused on reﬁning the
DNN models, but have either shown limited success or suﬀered
from expensive computation. We propose a new strategy, feature
squeezing, that can be used to harden DNN models by detecting
adversarial examples. Feature squeezing reduces the search space
available to an adversary by coalescing samples that correspond
to many diﬀerent feature vectors in the original space into a single
sample. By comparing a DNN model’s prediction on the original
input with that on squeezed inputs, feature squeezing detects
adversarial examples with high accuracy and few false positives.
This paper explores two types of feature squeezing: reducing
the color bit depth of each pixel and spatial smoothing. These
strategies are inexpensive and complementary to other defenses,
and can be combined in a joint detection framework to achieve
high detection rates against state-of-the-art attacks.
I.
Introduction
Deep Neural Networks (DNNs) perform exceptionally
well on many artiﬁcial intelligence tasks, including security-
sensitive applications like malware classiﬁcation [26], [8] and
face recognition [35]. Unlike when machine learning is used
in other ﬁelds, security applications involve intelligent and
adaptive adversaries responding to the deployed systems. Re-
cent studies have shown that attackers can force deep learning
object classiﬁcation models to mis-classify images by ma...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A new framework against privilege escalation attacks on android
author:Wenming Zhou and
Yuqing Zhang and
Xuefeng Liu
POSTER: A New Framework against Privilege
Escalation Attacks on Android
Wenming Zhou
State Key Lab of Integrated Service
Network, Xidian University
Xi’an, China, 710126
wmzhou@stu.xidian.edu.cn
Yuqing Zhang
National Computer Network Instrusion
Protection Center, UCAS
Beijing, China, 100048
zhangyq@nipc.org.cn
Xuefeng Liu
State Key Lab of Integrated Service
Network, Xidian University
Xi’an, China, 710071
liuxf@mail.xidian.edu.cn
from
previous
schemes,
policy-centered
the  permissions.  Specially,  we  allow
ABSTRACT
The Android provides a permission-based security model to restrict
the  operations  that  each  application  can  perform;  however,  it  has
been  shown  to  be  vulnerable  to  privilege  escalation  attacks.
Applications can cooperate to perform operations that forbidden to
perform  separately  which  may  lead  to  privacy  leakage.  In  this
poster,  we  present  the  design  of  a  new  policy-centered  security
framework against the application-level privilege escalation attacks.
Different
the
communication  content  is  also  considered  into  the  inspection
besides
the  privacy
information selectively to be passed in the middleware and deploy a
mandatory access control at the kernel based on the dynamical taint
tracking.  Test  results  show  that  it  can  prevent  known  confused
deputy  attacks  and  is  also  flexible  to  prevent  the  unknowns;
furthermore it can reduce the false positives of preventing colluding
attacks compared to the previous work.
Categories and Subject Descriptors: D.4.6 [Operating Systems]:
Security and Protection
General Terms: Security
Keywords
 Privilege Escalation Attacks, Taint Tracking, Privacy Protection
1.  INTRODUCTION
In the Android’s permission-based security model, applications are
only granted permissions that they really need and ea...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A new framework against privilege escalation attacks on android
author:Wenming Zhou and
Yuqing Zhang and
Xuefeng Liu
POSTER: A New Framework against Privilege
Escalation Attacks on Android
Wenming Zhou
State Key Lab of Integrated Service
Network, Xidian University
Xi’an, China, 710126
wmzhou@stu.xidian.edu.cn
Yuqing Zhang
National Computer Network Instrusion
Protection Center, UCAS
Beijing, China, 100048
zhangyq@nipc.org.cn
Xuefeng Liu
State Key Lab of Integrated Service
Network, Xidian University
Xi’an, China, 710071
liuxf@mail.xidian.edu.cn
from
previous
schemes,
policy-centered
the  permissions.  Specially,  we  allow
ABSTRACT
The Android provides a permission-based security model to restrict
the  operations  that  each  application  can  perform;  however,  it  has
been  shown  to  be  vulnerable  to  privilege  escalation  attacks.
Applications can cooperate to perform operations that forbidden to
perform  separately  which  may  lead  to  privacy  leakage.  In  this
poster,  we  present  the  design  of  a  new  policy-centered  security
framework against the application-level privilege escalation attacks.
Different
the
communication  content  is  also  considered  into  the  inspection
besides
the  privacy
information selectively to be passed in the middleware and deploy a
mandatory access control at the kernel based on the dynamical taint
tracking.  Test  results  show  that  it  can  prevent  known  confused
deputy  attacks  and  is  also  flexible  to  prevent  the  unknowns;
furthermore it can reduce the false positives of preventing colluding
attacks compared to the previous work.
Categories and Subject Descriptors: D.4.6 [Operating Systems]:
Security and Protection
General Terms: Security
Keywords
 Privilege Escalation Attacks, Taint Tracking, Privacy Protection
1.  INTRODUCTION
In the Android’s permission-based security model, applications are
only granted permissions that they really need and ea...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative
Models
author:Dingfan Chen and
Ning Yu and
Yang Zhang and
Mario Fritz
GAN-Leaks: A Taxonomy of Membership Inference Attacks
against Generative Models
Dingfan Chen
CISPA Helmholtz Center for Information Security
Ning Yu
University of Maryland, College Park
Max Planck Institute for Informatics
Yang Zhang
CISPA Helmholtz Center for Information Security
Mario Fritz
CISPA Helmholtz Center for Information Security
ABSTRACT
Deep learning has achieved overwhelming success, spanning from
discriminative models to generative models. In particular, deep
generative models have facilitated a new level of performance in
a myriad of areas, ranging from media manipulation to sanitized
dataset generation. Despite the great success, the potential risks of
privacy breach caused by generative models have not been analyzed
systematically. In this paper, we focus on membership inference at-
tack against deep generative models that reveals information about
the training data used for victim models. Specifically, we present
the first taxonomy of membership inference attacks, encompassing
not only existing attacks but also our novel ones. In addition, we
propose the first generic attack model that can be instantiated in a
large range of settings and is applicable to various kinds of deep
generative models. Moreover, we provide a theoretically grounded
attack calibration technique, which consistently boosts the attack
performance in all cases, across different attack settings, data modal-
ities, and training configurations. We complement the systematic
analysis of attack performance by a comprehensive experimental
study, that investigates the effectiveness of various attacks w.r.t.
model type and training configurations, over three diverse applica-
tion scenarios (i.e., images, medical data, and location data).
CCS CONCEPTS
• Computing methodologies → Machine learning; • Security
and privacy;
KEYWORDS
Membership in...


Instruction: 总结这篇安全研究的主要观点

Input:
title:GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative
Models
author:Dingfan Chen and
Ning Yu and
Yang Zhang and
Mario Fritz
GAN-Leaks: A Taxonomy of Membership Inference Attacks
against Generative Models
Dingfan Chen
CISPA Helmholtz Center for Information Security
Ning Yu
University of Maryland, College Park
Max Planck Institute for Informatics
Yang Zhang
CISPA Helmholtz Center for Information Security
Mario Fritz
CISPA Helmholtz Center for Information Security
ABSTRACT
Deep learning has achieved overwhelming success, spanning from
discriminative models to generative models. In particular, deep
generative models have facilitated a new level of performance in
a myriad of areas, ranging from media manipulation to sanitized
dataset generation. Despite the great success, the potential risks of
privacy breach caused by generative models have not been analyzed
systematically. In this paper, we focus on membership inference at-
tack against deep generative models that reveals information about
the training data used for victim models. Specifically, we present
the first taxonomy of membership inference attacks, encompassing
not only existing attacks but also our novel ones. In addition, we
propose the first generic attack model that can be instantiated in a
large range of settings and is applicable to various kinds of deep
generative models. Moreover, we provide a theoretically grounded
attack calibration technique, which consistently boosts the attack
performance in all cases, across different attack settings, data modal-
ities, and training configurations. We complement the systematic
analysis of attack performance by a comprehensive experimental
study, that investigates the effectiveness of various attacks w.r.t.
model type and training configurations, over three diverse applica-
tion scenarios (i.e., images, medical data, and location data).
CCS CONCEPTS
• Computing methodologies → Machine learning; • Security
and privacy;
KEYWORDS
Membership in...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Measurement-based Characterization of a Collection of On-line Games
(Awarded Best Student Paper!)
author:Chris Chambers and
Wu-chang Feng and
Sambit Sahu and
Debanjan Saha
Measurement-based Characterization of a Collection of On-line Games
Chris Chambers Wu-chang Feng
{chambers,wuchang}@cs.pdx.edu
Portland State University
Sambit Sahu Debanjan Saha
{ssahu,dsaha}@us.ibm.com
IBM Research
Abstract
On-line games are a rapidly growing Internet application.
Because of the cost in supporting on-line games and the un-
predictable load on servers, companies are moving toward
sharing infrastructure for game hosting. To efﬁciently pro-
vision on-line games, it is important to understand game
workloads and the behavior of game players. In this pa-
per, we present a comprehensive analysis of a collection
of on-line game players and game workloads using data
from several sources including: a 13-month trace of an ex-
tremely busy game server containing over 2.8 million con-
nections, a two-year trace of the aggregate game popula-
tions of over 550 on-line games, and a 4-month trace of
a content-distribution network used to deliver games. The
key ﬁndings from our measurement study are: (1) these
gamers are an extremely difﬁcult set of users to satisfy and
unless game servers are properly set up and provisioned,
gamers quickly choose to go elsewhere, (2) the popularity
of these games follows a power law making games difﬁ-
cult to provision at launch time, (3) game workloads are
predictable only over short-term intervals, (4) there are sig-
niﬁcant challenges in hosting games on shared infrastruc-
ture due to temporal and geographic synchronization across
different games and other interactive applications, and (5)
game software updates are a signiﬁcent burden on game
hosting that must be planned for. Our results have impli-
cations for both game publishers as well as infrastructure
providers.
1
Introduction
On-line gaming is an increasingly popular form of enter-
tainment on th...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Measurement-based Characterization of a Collection of On-line Games
(Awarded Best Student Paper!)
author:Chris Chambers and
Wu-chang Feng and
Sambit Sahu and
Debanjan Saha
Measurement-based Characterization of a Collection of On-line Games
Chris Chambers Wu-chang Feng
{chambers,wuchang}@cs.pdx.edu
Portland State University
Sambit Sahu Debanjan Saha
{ssahu,dsaha}@us.ibm.com
IBM Research
Abstract
On-line games are a rapidly growing Internet application.
Because of the cost in supporting on-line games and the un-
predictable load on servers, companies are moving toward
sharing infrastructure for game hosting. To efﬁciently pro-
vision on-line games, it is important to understand game
workloads and the behavior of game players. In this pa-
per, we present a comprehensive analysis of a collection
of on-line game players and game workloads using data
from several sources including: a 13-month trace of an ex-
tremely busy game server containing over 2.8 million con-
nections, a two-year trace of the aggregate game popula-
tions of over 550 on-line games, and a 4-month trace of
a content-distribution network used to deliver games. The
key ﬁndings from our measurement study are: (1) these
gamers are an extremely difﬁcult set of users to satisfy and
unless game servers are properly set up and provisioned,
gamers quickly choose to go elsewhere, (2) the popularity
of these games follows a power law making games difﬁ-
cult to provision at launch time, (3) game workloads are
predictable only over short-term intervals, (4) there are sig-
niﬁcant challenges in hosting games on shared infrastruc-
ture due to temporal and geographic synchronization across
different games and other interactive applications, and (5)
game software updates are a signiﬁcent burden on game
hosting that must be planned for. Our results have impli-
cations for both game publishers as well as infrastructure
providers.
1
Introduction
On-line gaming is an increasingly popular form of enter-
tainment on th...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:OSLO: Improving the Security of Trusted Computing
author:Bernhard Kauer
OSLO: Improving the security of Trusted Computing
Bernhard Kauer
Technische Universität Dresden
Department of Computer Science
01062 Dresden, Germany
kauer@os.inf.tu-dresden.de
Abstract
• How to ensure that only a particular software stack
can access a stored secret? (Sealed Memory)
In this paper we describe bugs and ways to attack
trusted computing systems based on a static root of trust
such as Microsoft’s Bitlocker. We propose to use the dy-
namic root of trust feature of newer x86 processors as
this shortens the trust chain, can minimize the Trusted
Computing Base of applications and is less vulnerable
to TPM and BIOS attacks. To support our claim we
implemented the Open Secure LOader (OSLO), the ﬁrst
publicly available bootloader based on AMDs skinit
instruction.
1
Introduction
An increasing number of Computing Platforms with
a Trusted Platform Module (TPM) [33] are deployed.
Applications using these chips are not widely used yet
[5, 37]. This will change rapidly with the distribution
of Microsoft’s Bitlocker [2], a disk encryption utility
which is part of Windows Vista Ultimate. As the trusted
computing technology behind these applications is quite
new, there is not much experience concerning the secu-
rity of trusted computing systems.
In this context we
analyzed the security of TPMs, BIOSes and bootloaders
that consitute the basic building blocks of trusted com-
puting implementations. Furthermore, we propose a de-
sign that can improve the security of such implementa-
tions.
1.1 Trusted Computing
Trusted Computing [9,23,25,33] is a technology that
tries two answer two questions:
• Which software is running on a remote computer?
(Remote Attestation)
Different scenarios can be built on top of trusted com-
puting, for example, multi-factor authentication [37],
hard disk encryption [2,5] or the widely disputed Digital
Rights Management. All of these applications are based
on a small c...


Instruction: 总结这篇安全研究的主要观点

Input:
title:OSLO: Improving the Security of Trusted Computing
author:Bernhard Kauer
OSLO: Improving the security of Trusted Computing
Bernhard Kauer
Technische Universität Dresden
Department of Computer Science
01062 Dresden, Germany
kauer@os.inf.tu-dresden.de
Abstract
• How to ensure that only a particular software stack
can access a stored secret? (Sealed Memory)
In this paper we describe bugs and ways to attack
trusted computing systems based on a static root of trust
such as Microsoft’s Bitlocker. We propose to use the dy-
namic root of trust feature of newer x86 processors as
this shortens the trust chain, can minimize the Trusted
Computing Base of applications and is less vulnerable
to TPM and BIOS attacks. To support our claim we
implemented the Open Secure LOader (OSLO), the ﬁrst
publicly available bootloader based on AMDs skinit
instruction.
1
Introduction
An increasing number of Computing Platforms with
a Trusted Platform Module (TPM) [33] are deployed.
Applications using these chips are not widely used yet
[5, 37]. This will change rapidly with the distribution
of Microsoft’s Bitlocker [2], a disk encryption utility
which is part of Windows Vista Ultimate. As the trusted
computing technology behind these applications is quite
new, there is not much experience concerning the secu-
rity of trusted computing systems.
In this context we
analyzed the security of TPMs, BIOSes and bootloaders
that consitute the basic building blocks of trusted com-
puting implementations. Furthermore, we propose a de-
sign that can improve the security of such implementa-
tions.
1.1 Trusted Computing
Trusted Computing [9,23,25,33] is a technology that
tries two answer two questions:
• Which software is running on a remote computer?
(Remote Attestation)
Different scenarios can be built on top of trusted com-
puting, for example, multi-factor authentication [37],
hard disk encryption [2,5] or the widely disputed Digital
Rights Management. All of these applications are based
on a small c...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Finding Dependencies between Cyber-Physical Domains for Security Testing
of Industrial Control Systems
author:John Henry Castellanos and
Mart'ın Ochoa and
Jianying Zhou
Finding Dependencies between Cyber-Physical Domains for
Security Testing of Industrial Control Systems
John H. Castellanos
Martín Ochoa
Singapore University of Technology
Department of Applied Mathematics
Singapore University of Technology
Jianying Zhou
and Design
Singapore
jianying_zhou@sutd.edu.sg
john_castellanos@mymail.sutd.edu.
and Design
Singapore
sg
and Computer Science
Universidad del Rosario
Bogotá, Colombia
martin.ochoa@urosario.edu.co
ABSTRACT
In modern societies, critical services such as transportation, power
supply, water treatment and distribution are strongly dependent
on Industrial Control Systems (ICS). As technology moves along,
new features improve services provided by such ICS. On the other
hand, this progress also introduces new risks of cyber attacks due
to the multiple direct and indirect dependencies between cyber and
physical components of such systems. Performing rigorous security
tests and risk analysis in these critical systems is thus a challenging
task, because of the non-trivial interactions between digital and
physical assets and the domain-specic knowledge necessary to
analyse a particular system. In this work, we propose a methodology
to model and analyse a System Under Test (SUT) as a data ow graph
that highlights interactions among internal entities throughout
the SUT. This model is automatically extracted from production
code available in Programmable Logic Controllers (PLCs). We also
propose a reachability algorithm and an attack diagram that will
emphasize the dependencies between cyber and physical domains,
thus enabling a human analyst to gauge various attack vectors that
arise from subtle dependencies in data and information propagation.
We test our methodology in a functional water treatment testbed
and demonstrate how an analyst could make use...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Finding Dependencies between Cyber-Physical Domains for Security Testing
of Industrial Control Systems
author:John Henry Castellanos and
Mart'ın Ochoa and
Jianying Zhou
Finding Dependencies between Cyber-Physical Domains for
Security Testing of Industrial Control Systems
John H. Castellanos
Martín Ochoa
Singapore University of Technology
Department of Applied Mathematics
Singapore University of Technology
Jianying Zhou
and Design
Singapore
jianying_zhou@sutd.edu.sg
john_castellanos@mymail.sutd.edu.
and Design
Singapore
sg
and Computer Science
Universidad del Rosario
Bogotá, Colombia
martin.ochoa@urosario.edu.co
ABSTRACT
In modern societies, critical services such as transportation, power
supply, water treatment and distribution are strongly dependent
on Industrial Control Systems (ICS). As technology moves along,
new features improve services provided by such ICS. On the other
hand, this progress also introduces new risks of cyber attacks due
to the multiple direct and indirect dependencies between cyber and
physical components of such systems. Performing rigorous security
tests and risk analysis in these critical systems is thus a challenging
task, because of the non-trivial interactions between digital and
physical assets and the domain-specic knowledge necessary to
analyse a particular system. In this work, we propose a methodology
to model and analyse a System Under Test (SUT) as a data ow graph
that highlights interactions among internal entities throughout
the SUT. This model is automatically extracted from production
code available in Programmable Logic Controllers (PLCs). We also
propose a reachability algorithm and an attack diagram that will
emphasize the dependencies between cyber and physical domains,
thus enabling a human analyst to gauge various attack vectors that
arise from subtle dependencies in data and information propagation.
We test our methodology in a functional water treatment testbed
and demonstrate how an analyst could make use...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:DAIS: A Real-Time Data Attack Isolation System for Commercial
Database Applications
author:Peng Liu
DAIS: A Real-time Data Attack Isolation System for Commercial Database
Applications
Department of Information Systems, UMBC
Peng Liu
Baltimore, MD 21250
pliu@umbc.edu
Abstract
Traditional database security mechanisms are very lim-
ited in defending successful data attacks. Authorized but
malicious transactions can make a database useless by im-
pairing its integrity and availability. This paper presents the
design of a real-time data attack isolation system, denoted
DAIS. DAIS isolates likely suspicious actions before a deﬁ-
nite determination of intrusion is reported. In this way, the
database can be immunized from many malicious transac-
tions. DAIS is a COTS-DBMS-speciﬁc implementation of a
general isolation algorithm that we developed in [19]. In
this paper, the design of the ﬁrst DAIS prototype, which is
for Oracle Server 8.1.6, is discussed. DAIS uses triggers
and transaction proﬁles to keep track of the items read and
written by transactions, isolates attacks by rewriting user
SQL statements, and is transparent to end users. The DAIS
design is very general. In addition to Oracle, it can be easily
adapted to support many other database application plat-
forms such as Microsoft SQL Server, Sybase, and Informix.
Keywords: Isolation, Intrusion Tolerance, Database Secu-
rity
1 Introduction
Database security concerns the conﬁdentiality, integrity,
and availability of data stored in a database. A broad span of
research from authorization [9, 28, 14], to inference control
[1], to multilevel secure databases [33, 31], and to multi-
level secure transaction processing [3], addresses primarily
how to protect the security of a database, especially its con-
ﬁdentiality. However, very limited research has been done
on how to survive successful database attacks, which can
seriously impair the integrity and availability of a database.
Experience with data-intensive appl...


Instruction: 总结这篇安全研究的主要观点

Input:
title:DAIS: A Real-Time Data Attack Isolation System for Commercial
Database Applications
author:Peng Liu
DAIS: A Real-time Data Attack Isolation System for Commercial Database
Applications
Department of Information Systems, UMBC
Peng Liu
Baltimore, MD 21250
pliu@umbc.edu
Abstract
Traditional database security mechanisms are very lim-
ited in defending successful data attacks. Authorized but
malicious transactions can make a database useless by im-
pairing its integrity and availability. This paper presents the
design of a real-time data attack isolation system, denoted
DAIS. DAIS isolates likely suspicious actions before a deﬁ-
nite determination of intrusion is reported. In this way, the
database can be immunized from many malicious transac-
tions. DAIS is a COTS-DBMS-speciﬁc implementation of a
general isolation algorithm that we developed in [19]. In
this paper, the design of the ﬁrst DAIS prototype, which is
for Oracle Server 8.1.6, is discussed. DAIS uses triggers
and transaction proﬁles to keep track of the items read and
written by transactions, isolates attacks by rewriting user
SQL statements, and is transparent to end users. The DAIS
design is very general. In addition to Oracle, it can be easily
adapted to support many other database application plat-
forms such as Microsoft SQL Server, Sybase, and Informix.
Keywords: Isolation, Intrusion Tolerance, Database Secu-
rity
1 Introduction
Database security concerns the conﬁdentiality, integrity,
and availability of data stored in a database. A broad span of
research from authorization [9, 28, 14], to inference control
[1], to multilevel secure databases [33, 31], and to multi-
level secure transaction processing [3], addresses primarily
how to protect the security of a database, especially its con-
ﬁdentiality. However, very limited research has been done
on how to survive successful database attacks, which can
seriously impair the integrity and availability of a database.
Experience with data-intensive appl...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Sequence Number-Based MAC Address Spoof Detection
author:Fanglu Guo and
Tzi-cker Chiueh
Sequence Number-Based MAC Address Spoof
Detection
Fanglu Guo and Tzi-cker Chiueh
Computer Science Department,
Stony Brook University, NY 11794
{fanglu, chiueh}@cs.sunysb.edu
Abstract. The exponential growth in the deployment of IEEE 802.11-
based wireless LAN (WLAN) in enterprises and homes makes WLAN
an attractive target for attackers. Attacks that exploit vulnerabilities at
the IP layer or above can be readily addressed by intrusion detection
systems designed for wired networks. However, attacks exploiting link-
layer protocol vulnerabilities require a diﬀerent set of intrusion detection
mechanism. Most link-layer attacks in WLANs are denial of service at-
tacks and work by spooﬁng either access points (APs) or wireless sta-
tions. Spooﬁng is possible because the IEEE 802.11 standard does not
provide per-frame source authentication, but can be eﬀectively prevented
if a proper authentication is added into the standard. Unfortunately, it is
unlikely that commercial WLANs will support link-layer source authen-
tication that covers both management and control frames in the near
future. Even if it is available in next-generation WLANs equipments, it
cannot protect the large installed base of legacy WLAN devices. This pa-
per proposes an algorithm to detect spooﬁng by leveraging the sequence
number ﬁeld in the link-layer header of IEEE 802.11 frames, and demon-
strates how it can detect various spooﬁng without modifying the APs
or wireless stations. The false positive rate of the proposed algorithm is
zero, and the false negative rate is close to zero. In the worst case, the
proposed algorithm can detect a spooﬁng activity, even though it can
only detect some but not all spoofed frames.
Keywords: Wireless LAN MAC spoof detection, Sequence number,
WLAN monitoring and intrusion detection.
1 Introduction
The enormous popularity of IEEE 802.11-based wireless LAN (WLAN) makes it
a h...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Sequence Number-Based MAC Address Spoof Detection
author:Fanglu Guo and
Tzi-cker Chiueh
Sequence Number-Based MAC Address Spoof
Detection
Fanglu Guo and Tzi-cker Chiueh
Computer Science Department,
Stony Brook University, NY 11794
{fanglu, chiueh}@cs.sunysb.edu
Abstract. The exponential growth in the deployment of IEEE 802.11-
based wireless LAN (WLAN) in enterprises and homes makes WLAN
an attractive target for attackers. Attacks that exploit vulnerabilities at
the IP layer or above can be readily addressed by intrusion detection
systems designed for wired networks. However, attacks exploiting link-
layer protocol vulnerabilities require a diﬀerent set of intrusion detection
mechanism. Most link-layer attacks in WLANs are denial of service at-
tacks and work by spooﬁng either access points (APs) or wireless sta-
tions. Spooﬁng is possible because the IEEE 802.11 standard does not
provide per-frame source authentication, but can be eﬀectively prevented
if a proper authentication is added into the standard. Unfortunately, it is
unlikely that commercial WLANs will support link-layer source authen-
tication that covers both management and control frames in the near
future. Even if it is available in next-generation WLANs equipments, it
cannot protect the large installed base of legacy WLAN devices. This pa-
per proposes an algorithm to detect spooﬁng by leveraging the sequence
number ﬁeld in the link-layer header of IEEE 802.11 frames, and demon-
strates how it can detect various spooﬁng without modifying the APs
or wireless stations. The false positive rate of the proposed algorithm is
zero, and the false negative rate is close to zero. In the worst case, the
proposed algorithm can detect a spooﬁng activity, even though it can
only detect some but not all spoofed frames.
Keywords: Wireless LAN MAC spoof detection, Sequence number,
WLAN monitoring and intrusion detection.
1 Introduction
The enormous popularity of IEEE 802.11-based wireless LAN (WLAN) makes it
a h...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Assessing DNS Vulnerability to Record Injection
author:Kyle Schomp and
Tom Callahan and
Michael Rabinovich and
Mark Allman
Assessing DNS Vulnerability to Record Injection(cid:2)
Kyle Schomp1, Tom Callahan1, Michael Rabinovich1, and Mark Allman2
1 Case Western Reserve University, Cleveland, OH, USA
2 International Computer Science Institute, Berkeley, CA, USA
Abstract. The Domain Name System (DNS) is a critical component of the In-
ternet infrastructure as it maps human-readable names to IP addresses. Injecting
fraudulent mappings allows an attacker to divert users from intended destinations
to those of an attacker’s choosing. In this paper, we measure the Internet’s vul-
nerability to DNS record injection attacks—including a new attack we uncover.
We ﬁnd that record injection vulnerabilities are fairly common—even years after
some of them were ﬁrst uncovered.
Keywords: Domain Name System (DNS), Measurement, Security, Cache
Poisoning.
1 Introduction
The Domain Name System (DNS) is a critical component of the Internet infrastruc-
ture. DNS maps human-readable hostnames (e.g., “amazon.com”) to IP addresses and
is involved to some degree in most Internet transactions. Given the foundational role
of DNS in today’s Internet, DNS security has a profound effect on the overall security,
trust, and operability of the network. In particular, substituting an authoritative map-
ping with a fraudulent record allows an attacker to divert user access to nefarious hosts
with implications ranging from replacing the original content and phishing attacks to
installing malware on client hosts. In this paper, we measure the prevalence of DNS
vulnerabilities to attacks designed to substitute the authoritative mapping. Collectively,
these attacks are known as “record injection” attacks. We consider known attacks and a
new vulnerability we uncover, as well as the extent of the adoption of suggested best-
practice defenses.
Fraudulent hostname-to-IP address mappings originate in two pl...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Assessing DNS Vulnerability to Record Injection
author:Kyle Schomp and
Tom Callahan and
Michael Rabinovich and
Mark Allman
Assessing DNS Vulnerability to Record Injection(cid:2)
Kyle Schomp1, Tom Callahan1, Michael Rabinovich1, and Mark Allman2
1 Case Western Reserve University, Cleveland, OH, USA
2 International Computer Science Institute, Berkeley, CA, USA
Abstract. The Domain Name System (DNS) is a critical component of the In-
ternet infrastructure as it maps human-readable names to IP addresses. Injecting
fraudulent mappings allows an attacker to divert users from intended destinations
to those of an attacker’s choosing. In this paper, we measure the Internet’s vul-
nerability to DNS record injection attacks—including a new attack we uncover.
We ﬁnd that record injection vulnerabilities are fairly common—even years after
some of them were ﬁrst uncovered.
Keywords: Domain Name System (DNS), Measurement, Security, Cache
Poisoning.
1 Introduction
The Domain Name System (DNS) is a critical component of the Internet infrastruc-
ture. DNS maps human-readable hostnames (e.g., “amazon.com”) to IP addresses and
is involved to some degree in most Internet transactions. Given the foundational role
of DNS in today’s Internet, DNS security has a profound effect on the overall security,
trust, and operability of the network. In particular, substituting an authoritative map-
ping with a fraudulent record allows an attacker to divert user access to nefarious hosts
with implications ranging from replacing the original content and phishing attacks to
installing malware on client hosts. In this paper, we measure the prevalence of DNS
vulnerabilities to attacks designed to substitute the authoritative mapping. Collectively,
these attacks are known as “record injection” attacks. We consider known attacks and a
new vulnerability we uncover, as well as the extent of the adoption of suggested best-
practice defenses.
Fraudulent hostname-to-IP address mappings originate in two pl...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Return to the Zombie Gadgets: Undermining Destructive Code Reads via
Code Inference Attacks
author:Kevin Z. Snow and
Roman Rogowski and
Jan Werner and
Hyungjoon Koo and
Fabian Monrose and
Michalis Polychronakis
2016 IEEE Symposium on Security and Privacy
2016 IEEE Symposium on Security and Privacy
Return to the Zombie Gadgets: Undermining
Destructive Code Reads via Code Inference Attacks
Kevin Z. Snow, Roman Rogowski, Fabian Monrose
Department of Computer Science
University of North Carolina at Chapel Hill, USA
Email: kzsnow,rogowski,fabian@cs.unc.edu
Jan Werner
Renaissance Computing Institute (RENCI)
Chapel Hill, USA
Email: jjwerner@cs.unc.edu
Hyungjoon Koo, Michalis Polychronakis
Department of Computer Science
Stony Brook University, USA
Email: hykoo,mikepo@cs.stonybrook.edu
by chaining together existing code fragments within the ex-
ploited program. These code reuse attacks either link together
entire functions (i.e., return-to-libc attacks) or combine short
instruction sequences (dubbed gadgets) ending with ret,
call, or jmp instructions.
Abstract—The concept of destructive code reads is a new defen-
sive strategy that prevents code reuse attacks by coupling ﬁne-
grained address space layout randomization with a mitigation
for online knowledge gathering that destroys potentially useful
gadgets as they are disclosed by an adversary. The intuition is
that by destroying code as it is read, an adversary is left with
no usable gadgets to reuse in a control-ﬂow hijacking attack. In
this paper, we examine the security of this new mitigation. We
show that while the concept initially appeared promising, there
are several unforeseen attack tactics that render destructive code
reads ineffective in practice.
Speciﬁcally, we introduce techniques for leveraging constructive
reloads, wherein multiple copies of native code are loaded
into a process’ address space (either side-by-side or one-after-
another). Constructive reloads allow the adversary to disclose
one code cop...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Return to the Zombie Gadgets: Undermining Destructive Code Reads via
Code Inference Attacks
author:Kevin Z. Snow and
Roman Rogowski and
Jan Werner and
Hyungjoon Koo and
Fabian Monrose and
Michalis Polychronakis
2016 IEEE Symposium on Security and Privacy
2016 IEEE Symposium on Security and Privacy
Return to the Zombie Gadgets: Undermining
Destructive Code Reads via Code Inference Attacks
Kevin Z. Snow, Roman Rogowski, Fabian Monrose
Department of Computer Science
University of North Carolina at Chapel Hill, USA
Email: kzsnow,rogowski,fabian@cs.unc.edu
Jan Werner
Renaissance Computing Institute (RENCI)
Chapel Hill, USA
Email: jjwerner@cs.unc.edu
Hyungjoon Koo, Michalis Polychronakis
Department of Computer Science
Stony Brook University, USA
Email: hykoo,mikepo@cs.stonybrook.edu
by chaining together existing code fragments within the ex-
ploited program. These code reuse attacks either link together
entire functions (i.e., return-to-libc attacks) or combine short
instruction sequences (dubbed gadgets) ending with ret,
call, or jmp instructions.
Abstract—The concept of destructive code reads is a new defen-
sive strategy that prevents code reuse attacks by coupling ﬁne-
grained address space layout randomization with a mitigation
for online knowledge gathering that destroys potentially useful
gadgets as they are disclosed by an adversary. The intuition is
that by destroying code as it is read, an adversary is left with
no usable gadgets to reuse in a control-ﬂow hijacking attack. In
this paper, we examine the security of this new mitigation. We
show that while the concept initially appeared promising, there
are several unforeseen attack tactics that render destructive code
reads ineffective in practice.
Speciﬁcally, we introduce techniques for leveraging constructive
reloads, wherein multiple copies of native code are loaded
into a process’ address space (either side-by-side or one-after-
another). Constructive reloads allow the adversary to disclose
one code cop...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Pseudo-Honeypot: Toward Efficient and Scalable Spam Sniffer
author:Yihe Zhang and
Hao Zhang and
Xu Yuan and
Nian-Feng Tzeng
2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
Pseudo-honeypot: Toward Efﬁcient and Scalable
Spam Sniffer
Yihe Zhang∗, Hao Zhang†, Xu Yuan∗, and Nian-Feng Tzeng∗
∗ University of Louisiana at Lafayette, Lafayette, LA, USA
† IEEE Member, USA
affected users who inadvertently interacted with spammers
during the 2016 U.S. presidential election.
Abstract—Honeypot-based spammer gathering solutions usu-
ally lack attribute variability, deployment ﬂexibility, and net-
work scalability, deemed as their common drawbacks. This
paper explores pseudo-honeypot, a novel honeypot-like system
to overcome such drawbacks, for efﬁcient and scalable spammer
snifﬁng. The pseudo-honeypot takes advantage of user diversity
and selects normal accounts, with attributes that have the higher
potential of attracting spammers, as the parasitic bodies. By
harnessing such category of users, pseudo-honeypot can monitor
their streaming posts and behavioral patterns transparently.
When compared with its traditional honeypot counterpart, the
proposed solution offers the substantial advantages of attribute
variability, deployment ﬂexibility, network scalability, and system
portability. Meanwhile, it offers a novel method to collect the
social network dataset that has a higher probability of includ-
ing spams and spammers, without being noticed by advanced
spammers. We take the Twitter social network as an example
to exhibit its system design, including pseudo-honeypot nodes
selection, monitoring, feature extraction, ground truth label-
ing, and learning-based classiﬁcation. Through experiments, we
demonstrate the efﬁciency of pseudo-honeypot in terms of spams
and spammers gathering. In particular, we conﬁrm our solution
can garner spammers at least 19 times faster than the state-of-
the-art honeypot-based counterpart.
I. INTRODUCTI...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Pseudo-Honeypot: Toward Efficient and Scalable Spam Sniffer
author:Yihe Zhang and
Hao Zhang and
Xu Yuan and
Nian-Feng Tzeng
2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
Pseudo-honeypot: Toward Efﬁcient and Scalable
Spam Sniffer
Yihe Zhang∗, Hao Zhang†, Xu Yuan∗, and Nian-Feng Tzeng∗
∗ University of Louisiana at Lafayette, Lafayette, LA, USA
† IEEE Member, USA
affected users who inadvertently interacted with spammers
during the 2016 U.S. presidential election.
Abstract—Honeypot-based spammer gathering solutions usu-
ally lack attribute variability, deployment ﬂexibility, and net-
work scalability, deemed as their common drawbacks. This
paper explores pseudo-honeypot, a novel honeypot-like system
to overcome such drawbacks, for efﬁcient and scalable spammer
snifﬁng. The pseudo-honeypot takes advantage of user diversity
and selects normal accounts, with attributes that have the higher
potential of attracting spammers, as the parasitic bodies. By
harnessing such category of users, pseudo-honeypot can monitor
their streaming posts and behavioral patterns transparently.
When compared with its traditional honeypot counterpart, the
proposed solution offers the substantial advantages of attribute
variability, deployment ﬂexibility, network scalability, and system
portability. Meanwhile, it offers a novel method to collect the
social network dataset that has a higher probability of includ-
ing spams and spammers, without being noticed by advanced
spammers. We take the Twitter social network as an example
to exhibit its system design, including pseudo-honeypot nodes
selection, monitoring, feature extraction, ground truth label-
ing, and learning-based classiﬁcation. Through experiments, we
demonstrate the efﬁciency of pseudo-honeypot in terms of spams
and spammers gathering. In particular, we conﬁrm our solution
can garner spammers at least 19 times faster than the state-of-
the-art honeypot-based counterpart.
I. INTRODUCTI...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Turning the postal system into a generic digital communication mechanism
author:Randolph Y. Wang and
Sumeet Sobti and
Nitin Garg and
Elisha Ziskind and
Junwen Lai and
Arvind Krishnamurthy
Turning the Postal System into a Generic Digital
Communication Mechanism
Randolph Y. Wang∗
Sumeet Sobti∗
Nitin Garg∗
Elisha Ziskind∗
Junwen Lai∗
Arvind Krishnamurthy†
ABSTRACT
The phenomenon that rural residents and people with low incomes
lag behind in Internet access is known as the “digital divide.” This
problem is particularly acute in developing countries, where most
of the world’s population lives. Bridging this digital divide, es-
pecially by attempting to increase the accessibility of broadband
connectivity, can be challenging. The improvement of wide-area
connectivity is constrained by factors such as how quickly we can
dig ditches to bury ﬁbers in the ground; and the cost of furnishing
“last-mile” wiring can be prohibitively high.
In this paper, we explore the use of digital storage media trans-
ported by the postal system as a general digital communication
mechanism. While some companies have used the postal system
to deliver software and movies, none of them has turned the postal
system into a truly generic digital communication medium support-
ing a wide variety of applications. We call such a generic system
a Postmanet. Compared to traditional wide-area connectivity op-
tions, the Postmanet has several important advantages, including
wide global reach, great bandwidth potential and low cost.
Manually preparing mobile storage devices for shipment may ap-
pear deceptively simple, but with many applications, communicat-
ing parties and messages, manual management becomes infeasi-
ble, and systems support at several levels becomes necessary. We
explore the simultaneous exploitation of the Internet and the Post-
manet, so we can combine their latency and bandwidth advantages
to enable sophisticated bandwidth-intensive applications.
Categories and Subject Descriptors
...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Turning the postal system into a generic digital communication mechanism
author:Randolph Y. Wang and
Sumeet Sobti and
Nitin Garg and
Elisha Ziskind and
Junwen Lai and
Arvind Krishnamurthy
Turning the Postal System into a Generic Digital
Communication Mechanism
Randolph Y. Wang∗
Sumeet Sobti∗
Nitin Garg∗
Elisha Ziskind∗
Junwen Lai∗
Arvind Krishnamurthy†
ABSTRACT
The phenomenon that rural residents and people with low incomes
lag behind in Internet access is known as the “digital divide.” This
problem is particularly acute in developing countries, where most
of the world’s population lives. Bridging this digital divide, es-
pecially by attempting to increase the accessibility of broadband
connectivity, can be challenging. The improvement of wide-area
connectivity is constrained by factors such as how quickly we can
dig ditches to bury ﬁbers in the ground; and the cost of furnishing
“last-mile” wiring can be prohibitively high.
In this paper, we explore the use of digital storage media trans-
ported by the postal system as a general digital communication
mechanism. While some companies have used the postal system
to deliver software and movies, none of them has turned the postal
system into a truly generic digital communication medium support-
ing a wide variety of applications. We call such a generic system
a Postmanet. Compared to traditional wide-area connectivity op-
tions, the Postmanet has several important advantages, including
wide global reach, great bandwidth potential and low cost.
Manually preparing mobile storage devices for shipment may ap-
pear deceptively simple, but with many applications, communicat-
ing parties and messages, manual management becomes infeasi-
ble, and systems support at several levels becomes necessary. We
explore the simultaneous exploitation of the Internet and the Post-
manet, so we can combine their latency and bandwidth advantages
to enable sophisticated bandwidth-intensive applications.
Categories and Subject Descriptors
...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:SemFuzz: Semantics-based Automatic Generation of Proof-of-Concept
Exploits
author:Wei You and
Peiyuan Zong and
Kai Chen and
XiaoFeng Wang and
Xiaojing Liao and
Pan Bian and
Bin Liang
SemFuzz: Semantics-based Automatic Generation of
Proof-of-Concept Exploits
Wei You1, Peiyuan Zong2,3, Kai Chen2,3,∗, XiaoFeng Wang1,∗, Xiaojing Liao4, Pan Bian5, Bin Liang5
1School of Informatics and Computing, Indiana University Bloomington, Indiana, USA
2SKLOIS, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China
3School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China
4Department of Computer Science, William and Mary, Virginia, USA
5School of Information, Renmin University of China, Beijing, China
{youwei,xw7}@indiana.edu,{zongpeiyuan,chenkai}@iie.ac.cn,{xliao02}@wm.edu,{bianpan,liangb}@ruc.edu.cn
ABSTRACT
Patches and related information about so(cid:137)ware vulnerabilities are
o(cid:137)en made available to the public, aiming to facilitate timely (cid:128)xes.
Unfortunately, the slow paces of system updates (30 days on aver-
age) o(cid:137)en present to the a(cid:138)ackers enough time to recover hidden
bugs for a(cid:138)acking the unpatched systems. Making things worse is
the potential to automatically generate exploits on input-validation
(cid:131)aws through reverse-engineering patches, even though such vul-
nerabilities are relatively rare (e.g., 5% among all Linux kernel
vulnerabilities in last few years). Less understood, however, are the
implications of other bug-related information (e.g., bug descriptions
in CVE), particularly whether utilization of such information can
facilitate exploit generation, even on other vulnerability types that
have never been automatically a(cid:138)acked.
In this paper, we seek to use such information to generate proof-
of-concept (PoC) exploits for the vulnerability types never automat-
ically a(cid:138)acked. Unlike an input validation (cid:131)aw that is o(cid:137)en patched
by...


Instruction: 总结这篇安全研究的主要观点

Input:
title:SemFuzz: Semantics-based Automatic Generation of Proof-of-Concept
Exploits
author:Wei You and
Peiyuan Zong and
Kai Chen and
XiaoFeng Wang and
Xiaojing Liao and
Pan Bian and
Bin Liang
SemFuzz: Semantics-based Automatic Generation of
Proof-of-Concept Exploits
Wei You1, Peiyuan Zong2,3, Kai Chen2,3,∗, XiaoFeng Wang1,∗, Xiaojing Liao4, Pan Bian5, Bin Liang5
1School of Informatics and Computing, Indiana University Bloomington, Indiana, USA
2SKLOIS, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China
3School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China
4Department of Computer Science, William and Mary, Virginia, USA
5School of Information, Renmin University of China, Beijing, China
{youwei,xw7}@indiana.edu,{zongpeiyuan,chenkai}@iie.ac.cn,{xliao02}@wm.edu,{bianpan,liangb}@ruc.edu.cn
ABSTRACT
Patches and related information about so(cid:137)ware vulnerabilities are
o(cid:137)en made available to the public, aiming to facilitate timely (cid:128)xes.
Unfortunately, the slow paces of system updates (30 days on aver-
age) o(cid:137)en present to the a(cid:138)ackers enough time to recover hidden
bugs for a(cid:138)acking the unpatched systems. Making things worse is
the potential to automatically generate exploits on input-validation
(cid:131)aws through reverse-engineering patches, even though such vul-
nerabilities are relatively rare (e.g., 5% among all Linux kernel
vulnerabilities in last few years). Less understood, however, are the
implications of other bug-related information (e.g., bug descriptions
in CVE), particularly whether utilization of such information can
facilitate exploit generation, even on other vulnerability types that
have never been automatically a(cid:138)acked.
In this paper, we seek to use such information to generate proof-
of-concept (PoC) exploits for the vulnerability types never automat-
ically a(cid:138)acked. Unlike an input validation (cid:131)aw that is o(cid:137)en patched
by...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:The Gap Game
author:Itay Tsabary and
Ittay Eyal
The Gap Game
Ittay Eyal
Technion
Haifa, Israel
ittay@technion.ac.il
incentivizes large miner coalitions, reducing system decen-
tralization. We describe the required conditions to avoid
the incentive misalignment, providing guidelines for future
cryptocurrency design.
REFERENCES
[1] Miles Carlsten, Harry Kalodner, S. Matthew Weinberg, and Arvind
Narayanan. 2016. On the Instability of Bitcoin Without the Block
Reward. In Proceedings of the 2016 ACM SIGSAC Conference on Computer
and Communications Security (CCS ’16). ACM, New York, NY, USA, 154–
167. https://doi.org/10.1145/2976749.2978408
Itay Tsabary
Technion
Haifa, Israel
itaytsabary@gmail.com
CCS CONCEPTS
• Security and privacy → Distributed systems security;
KEYWORDS
Blockchains; Cryptocurrency; Mining Gap; Centralization;
Game Theory
Blockchain-based cryptocurrencies secure a decentralized
consensus protocol by incentives. The protocol participants,
called miners, generate (mine) a series of blocks, each con-
taining monetary transactions created by system users. As
incentive for participation, miners receive newly minted
currency and transaction fees paid by transaction creators.
Blockchain bandwidth limits lead users to pay increasing
fees in order to prioritize their transactions. However, most
prior work focused on models where fees are negligible. In a
notable exception, Carlsten et al. [1] postulated in CCS’16
that if incentives come only from fees then a mining gap
would form — miners would avoid mining when the available
fees are insufficient.
In this work, we analyze cryptocurrency security in realis-
tic settings, taking into account all elements of expenses and
rewards. To study when gaps form, we analyze the system
as a game we call the gap game. We analyze the game with
a combination of symbolic and numeric analysis tools in a
wide range of scenarios.
Our analysis confirms Carlsten et al.’s postulate; indeed,
we show that gaps form well before fe...


Instruction: 总结这篇安全研究的主要观点

Input:
title:The Gap Game
author:Itay Tsabary and
Ittay Eyal
The Gap Game
Ittay Eyal
Technion
Haifa, Israel
ittay@technion.ac.il
incentivizes large miner coalitions, reducing system decen-
tralization. We describe the required conditions to avoid
the incentive misalignment, providing guidelines for future
cryptocurrency design.
REFERENCES
[1] Miles Carlsten, Harry Kalodner, S. Matthew Weinberg, and Arvind
Narayanan. 2016. On the Instability of Bitcoin Without the Block
Reward. In Proceedings of the 2016 ACM SIGSAC Conference on Computer
and Communications Security (CCS ’16). ACM, New York, NY, USA, 154–
167. https://doi.org/10.1145/2976749.2978408
Itay Tsabary
Technion
Haifa, Israel
itaytsabary@gmail.com
CCS CONCEPTS
• Security and privacy → Distributed systems security;
KEYWORDS
Blockchains; Cryptocurrency; Mining Gap; Centralization;
Game Theory
Blockchain-based cryptocurrencies secure a decentralized
consensus protocol by incentives. The protocol participants,
called miners, generate (mine) a series of blocks, each con-
taining monetary transactions created by system users. As
incentive for participation, miners receive newly minted
currency and transaction fees paid by transaction creators.
Blockchain bandwidth limits lead users to pay increasing
fees in order to prioritize their transactions. However, most
prior work focused on models where fees are negligible. In a
notable exception, Carlsten et al. [1] postulated in CCS’16
that if incentives come only from fees then a mining gap
would form — miners would avoid mining when the available
fees are insufficient.
In this work, we analyze cryptocurrency security in realis-
tic settings, taking into account all elements of expenses and
rewards. To study when gaps form, we analyze the system
as a game we call the gap game. We analyze the game with
a combination of symbolic and numeric analysis tools in a
wide range of scenarios.
Our analysis confirms Carlsten et al.’s postulate; indeed,
we show that gaps form well before fe...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Swords and shields: a study of mobile game hacks and existing defenses
author:Yuan Tian and
Eric Y. Chen and
Xiaojun Ma and
Shuo Chen and
Xiao Wang and
Patrick Tague
Swords and Shields – A Study of
Mobile Game Hacks and Existing Defenses
Yuan Tian
Carnegie Mellon University
yuan.tian@sv.cmu.edu
Shuo Chen
Microsoft Research
shuochen@microsoft.com
Eric Chen
Gridspace
eric.chen@sv.cmu.edu
Xiao Wang
Carnegie Mellon University
sean.wang@sv.cmu.edu
Xiaojun Ma
Carnegie Mellon University
xiaojun.ma@sv.cmu.edu
Patrick Tague
Carnegie Mellon University
tague@cmu.edu
ABSTRACT
The mobile game industry has been growing signiﬁcantly.
Mobile games are increasingly including abilities to purchase
in-game objects with real currency, share achievements and
updates with friends, and post high scores to global leader
boards. Because of these abilities, there are new ﬁnancial
and social incentives for gamers to cheat. Developers and
researchers have tried to apply various protection mecha-
nisms in games, but the degrees of eﬀectiveness vary con-
siderably. There has not been a real-world study in this
problem space. In this work, we investigate diﬀerent pro-
tections in real-world applications, and we compare these
approaches from diﬀerent aspects such as security and de-
ployment eﬀorts systematically.
We ﬁrst investigate 100 popular mobile games in order to
understand how developers adopt these protection mecha-
nisms, including those for protecting memory, local ﬁles, and
network traﬃc, for obfuscating source code, and for main-
taining the integrity of the game state. We have conﬁrmed
that 77 out of the 100 games can be successfully attacked,
and believe that at least ﬁve more are vulnerable. Based on
this ﬁrst-hand experience, we propose an evaluation frame-
work for the security of mobile game defenses. We deﬁne
a ﬁve-level hierarchy to rate the protection mechanisms to
help developers understand how well their games are pro-
tected relative to others in the market. Addition...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Swords and shields: a study of mobile game hacks and existing defenses
author:Yuan Tian and
Eric Y. Chen and
Xiaojun Ma and
Shuo Chen and
Xiao Wang and
Patrick Tague
Swords and Shields – A Study of
Mobile Game Hacks and Existing Defenses
Yuan Tian
Carnegie Mellon University
yuan.tian@sv.cmu.edu
Shuo Chen
Microsoft Research
shuochen@microsoft.com
Eric Chen
Gridspace
eric.chen@sv.cmu.edu
Xiao Wang
Carnegie Mellon University
sean.wang@sv.cmu.edu
Xiaojun Ma
Carnegie Mellon University
xiaojun.ma@sv.cmu.edu
Patrick Tague
Carnegie Mellon University
tague@cmu.edu
ABSTRACT
The mobile game industry has been growing signiﬁcantly.
Mobile games are increasingly including abilities to purchase
in-game objects with real currency, share achievements and
updates with friends, and post high scores to global leader
boards. Because of these abilities, there are new ﬁnancial
and social incentives for gamers to cheat. Developers and
researchers have tried to apply various protection mecha-
nisms in games, but the degrees of eﬀectiveness vary con-
siderably. There has not been a real-world study in this
problem space. In this work, we investigate diﬀerent pro-
tections in real-world applications, and we compare these
approaches from diﬀerent aspects such as security and de-
ployment eﬀorts systematically.
We ﬁrst investigate 100 popular mobile games in order to
understand how developers adopt these protection mecha-
nisms, including those for protecting memory, local ﬁles, and
network traﬃc, for obfuscating source code, and for main-
taining the integrity of the game state. We have conﬁrmed
that 77 out of the 100 games can be successfully attacked,
and believe that at least ﬁve more are vulnerable. Based on
this ﬁrst-hand experience, we propose an evaluation frame-
work for the security of mobile game defenses. We deﬁne
a ﬁve-level hierarchy to rate the protection mechanisms to
help developers understand how well their games are pro-
tected relative to others in the market. Addition...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:POSTER: Construct macOS Cyber Range for Red/Blue Teams
author:Yi-Hsien Chen and
Yen-Da Lin and
Chung-Kuan Chen and
Chin-Laung Lei and
Chun-Ying Huang
POSTER: Construct macOS Cyber Range for Red/Blue Teams
Yi-Hsien Chen1,2, Yen-Da Lin2, Chung-Kuan Chen2, Chin-Laung Lei1, Chun-Ying Huang3
1Department of Electrical Engineering, National Taiwan University 2CyCraft Technology Corporation
3Department of Computer Science, National Chiao Tung University
Email:csjh21010@gmail.com,segno.dada@gmail.com,ck.chen@cycraft.com,cllei@ntu.edu.tw,chuang@cs.nctu.edu.tw
ABSTRACT
More and more malicious apps and APT attacks now target macOS,
making it crucial for researchers to develop threat countermeasures
on macOS. In this paper, we attempt to construct a macOS cyber
range for the evaluation of red team and blue team performances.
Our proposed system is composed of three fundamental compo-
nents: an attack-defense association graph, a Go language-based
red team emulation tool, and a toolkit for blue team performance
evaluation. We demonstrate the effectiveness of our proposed cyber
range with real-world scenarios, and believe it will stimulate more
research innovations on threat analysis for macOS.
CCS CONCEPTS
• Security and privacy → Intrusion/anomaly detection and mal-
ware mitigation;
KEYWORDS
Forensic, Blue Team, Cyber Range, Red Team, Penetration Testing
1 INTRODUCTION
There is an increasing number of users using macOS and therefore
more and more threat actors target on attacking macOS. For in-
stance, state-sponsored APT28 utilized Trojan.MAC.APT2 to attack
military and government organizations [1]. Malware examples such
as OSX.AppleJeus [5] and OSX.NetWire.A [4] are widely used by
malicious actors to attack cryptocurrency exchanges. Although
macOS is popular, we observed that research works seldom discuss
attack and defense techniques on macOS. As a result, both blue
teams and red teams are not acquainted with macOS security tech-
niques which include attack methods, pro...


Instruction: 总结这篇安全研究的主要观点

Input:
title:POSTER: Construct macOS Cyber Range for Red/Blue Teams
author:Yi-Hsien Chen and
Yen-Da Lin and
Chung-Kuan Chen and
Chin-Laung Lei and
Chun-Ying Huang
POSTER: Construct macOS Cyber Range for Red/Blue Teams
Yi-Hsien Chen1,2, Yen-Da Lin2, Chung-Kuan Chen2, Chin-Laung Lei1, Chun-Ying Huang3
1Department of Electrical Engineering, National Taiwan University 2CyCraft Technology Corporation
3Department of Computer Science, National Chiao Tung University
Email:csjh21010@gmail.com,segno.dada@gmail.com,ck.chen@cycraft.com,cllei@ntu.edu.tw,chuang@cs.nctu.edu.tw
ABSTRACT
More and more malicious apps and APT attacks now target macOS,
making it crucial for researchers to develop threat countermeasures
on macOS. In this paper, we attempt to construct a macOS cyber
range for the evaluation of red team and blue team performances.
Our proposed system is composed of three fundamental compo-
nents: an attack-defense association graph, a Go language-based
red team emulation tool, and a toolkit for blue team performance
evaluation. We demonstrate the effectiveness of our proposed cyber
range with real-world scenarios, and believe it will stimulate more
research innovations on threat analysis for macOS.
CCS CONCEPTS
• Security and privacy → Intrusion/anomaly detection and mal-
ware mitigation;
KEYWORDS
Forensic, Blue Team, Cyber Range, Red Team, Penetration Testing
1 INTRODUCTION
There is an increasing number of users using macOS and therefore
more and more threat actors target on attacking macOS. For in-
stance, state-sponsored APT28 utilized Trojan.MAC.APT2 to attack
military and government organizations [1]. Malware examples such
as OSX.AppleJeus [5] and OSX.NetWire.A [4] are widely used by
malicious actors to attack cryptocurrency exchanges. Although
macOS is popular, we observed that research works seldom discuss
attack and defense techniques on macOS. As a result, both blue
teams and red teams are not acquainted with macOS security tech-
niques which include attack methods, pro...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:ClearShot: Eavesdropping on Keyboard Input from Video
author:Davide Balzarotti and
Marco Cova and
Giovanni Vigna
2008 IEEE Symposium on Security and Privacy
ClearShot: Eavesdropping on Keyboard Input from Video
Davide Balzarotti, Marco Cova, and Giovanni Vigna
Department of Computer Science,
University of California Santa Barbara
Santa Barbara, CA, USA
{balzarot,marco,vigna}@cs.ucsb.edu
Abstract
Eavesdropping on electronic communication is usually
prevented by using cryptography-based mechanisms. How-
ever, these mechanisms do not prevent one from obtaining
private information through side channels, such as the elec-
tromagnetic emissions of monitors or the sound produced by
keyboards. While extracting the same information by watch-
ing somebody typing on a keyboard might seem to be an easy
task, it becomes extremely challenging if it has to be auto-
mated. However, an automated tool is needed in the case of
long-lasting surveillance procedures or long user activity,
as a human being is able to reconstruct only a few charac-
ters per minute. This paper presents a novel approach to au-
tomatically recovering the text being typed on a keyboard,
based solely on a video of the user typing. As part of the
approach, we developed a number of novel techniques for
motion tracking, sentence reconstruction, and error correc-
tion. The approach has been implemented in a tool, called
ClearShot, which has been tested in a number of realistic
settings where it was able to reconstruct a substantial part
of the typed information.
1 Introduction
MARTIN BISHOP: What’s he doing?
CARL ARBEGAST: He’s logging on the computer.
MARTIN BISHOP (watching through a video camera):
Oh, this is good.
He’s going to type in his password
and we’re going to get a clear shot.
From the movie “Sneakers,” 1992, Universal Pictures.
Spying on people has always been an effective way of ob-
taining information since the beginning of history. With the
advent of technology, new ways of spying on somebody’...


Instruction: 总结这篇安全研究的主要观点

Input:
title:ClearShot: Eavesdropping on Keyboard Input from Video
author:Davide Balzarotti and
Marco Cova and
Giovanni Vigna
2008 IEEE Symposium on Security and Privacy
ClearShot: Eavesdropping on Keyboard Input from Video
Davide Balzarotti, Marco Cova, and Giovanni Vigna
Department of Computer Science,
University of California Santa Barbara
Santa Barbara, CA, USA
{balzarot,marco,vigna}@cs.ucsb.edu
Abstract
Eavesdropping on electronic communication is usually
prevented by using cryptography-based mechanisms. How-
ever, these mechanisms do not prevent one from obtaining
private information through side channels, such as the elec-
tromagnetic emissions of monitors or the sound produced by
keyboards. While extracting the same information by watch-
ing somebody typing on a keyboard might seem to be an easy
task, it becomes extremely challenging if it has to be auto-
mated. However, an automated tool is needed in the case of
long-lasting surveillance procedures or long user activity,
as a human being is able to reconstruct only a few charac-
ters per minute. This paper presents a novel approach to au-
tomatically recovering the text being typed on a keyboard,
based solely on a video of the user typing. As part of the
approach, we developed a number of novel techniques for
motion tracking, sentence reconstruction, and error correc-
tion. The approach has been implemented in a tool, called
ClearShot, which has been tested in a number of realistic
settings where it was able to reconstruct a substantial part
of the typed information.
1 Introduction
MARTIN BISHOP: What’s he doing?
CARL ARBEGAST: He’s logging on the computer.
MARTIN BISHOP (watching through a video camera):
Oh, this is good.
He’s going to type in his password
and we’re going to get a clear shot.
From the movie “Sneakers,” 1992, Universal Pictures.
Spying on people has always been an effective way of ob-
taining information since the beginning of history. With the
advent of technology, new ways of spying on somebody’...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Automatically Evading Classifiers: A Case Study on PDF Malware
Classifiers
author:Weilin Xu and
Yanjun Qi and
David Evans
In Network and Distributed System Security Symposium 2016 (NDSS), San Diego, February 2016
Automatically Evading Classiﬁers
A Case Study on PDF Malware Classiﬁers
Weilin Xu, Yanjun Qi, and David Evans
University of Virginia
http://www.EvadeML.org
Abstract—Machine learning is widely used to develop classi-
ﬁers for security tasks. However, the robustness of these methods
against motivated adversaries is uncertain. In this work, we
propose a generic method to evaluate the robustness of classiﬁers
under attack. The key idea is to stochastically manipulate a
malicious sample to ﬁnd a variant that preserves the malicious
behavior but is classiﬁed as benign by the classiﬁer. We present
a general approach to search for evasive variants and report on
results from experiments using our techniques against two PDF
malware classiﬁers, PDFrate and Hidost. Our method is able to
automatically ﬁnd evasive variants for both classiﬁers for all of
the 500 malicious seeds in our study. Our results suggest a general
method for evaluating classiﬁers used in security applications, and
raise serious doubts about the effectiveness of classiﬁers based
on superﬁcial features in the presence of adversaries.
I.
INTRODUCTION
Machine learning models are popular in security tasks such
as malware detection, network intrusion detection and spam
detection. From the data scientists’ perspective, these models
are effective since they achieve extremely high accuracy on
test datasets. For example, Dahl et al. reported achieving
99.58% accuracy in classifying Win32 malware using an
ensemble deep neural network with dynamic features [9].
ˇSrndic et al. achieved over 99.9% accuracy in a PDF malware
classiﬁcation task using an SVM-RBF model with structural
path features [28].
However, it is important to realize that these results are for
particular test datasets. Unlike when machine...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Automatically Evading Classifiers: A Case Study on PDF Malware
Classifiers
author:Weilin Xu and
Yanjun Qi and
David Evans
In Network and Distributed System Security Symposium 2016 (NDSS), San Diego, February 2016
Automatically Evading Classiﬁers
A Case Study on PDF Malware Classiﬁers
Weilin Xu, Yanjun Qi, and David Evans
University of Virginia
http://www.EvadeML.org
Abstract—Machine learning is widely used to develop classi-
ﬁers for security tasks. However, the robustness of these methods
against motivated adversaries is uncertain. In this work, we
propose a generic method to evaluate the robustness of classiﬁers
under attack. The key idea is to stochastically manipulate a
malicious sample to ﬁnd a variant that preserves the malicious
behavior but is classiﬁed as benign by the classiﬁer. We present
a general approach to search for evasive variants and report on
results from experiments using our techniques against two PDF
malware classiﬁers, PDFrate and Hidost. Our method is able to
automatically ﬁnd evasive variants for both classiﬁers for all of
the 500 malicious seeds in our study. Our results suggest a general
method for evaluating classiﬁers used in security applications, and
raise serious doubts about the effectiveness of classiﬁers based
on superﬁcial features in the presence of adversaries.
I.
INTRODUCTION
Machine learning models are popular in security tasks such
as malware detection, network intrusion detection and spam
detection. From the data scientists’ perspective, these models
are effective since they achieve extremely high accuracy on
test datasets. For example, Dahl et al. reported achieving
99.58% accuracy in classifying Win32 malware using an
ensemble deep neural network with dynamic features [9].
ˇSrndic et al. achieved over 99.9% accuracy in a PDF malware
classiﬁcation task using an SVM-RBF model with structural
path features [28].
However, it is important to realize that these results are for
particular test datasets. Unlike when machine...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Cubismo: decloaking server-side malware via cubist program analysis
author:Abbas Naderi-Afooshteh and
Yonghwi Kwon and
Anh Nguyen-Tuong and
Mandana Bagheri-Marzijarani and
Jack W. Davidson
Cubismo: Decloaking Server-side Malware via Cubist Program
Analysis
Abbas Naderi-Afooshteh, Yonghwi Kwon, Anh Nguyen-Tuong, Mandana Bagheri-Marzijarani, and
ABSTRACT
Jack W. Davidson
Department of Computer Science, University of Virginia
{abiusx,yongkwon,nguyen,mb3wz,jwd}@virginia.edu
1 INTRODUCTION
Malware written in dynamic languages such as PHP routinely
employ anti-analysis techniques such as obfuscation schemes and
evasive tricks to avoid detection. On top of that, attackers use
automated malware creation tools to create numerous variants
with little to no manual effort.
This paper presents a system called Cubismo to solve this press-
ing problem. It processes potentially malicious files and decloaks
their obfuscations, exposing the hidden malicious code into multiple
files. The resulting files can be scanned by existing malware detec-
tion tools, leading to a much higher chance of detection. Cubismo
achieves improved detection by exploring all executable statements
of a suspect program counterfactually to see through complicated
polymorphism, metamorphism and, obfuscation techniques and
expose any malware.
Our evaluation on a real-world data set collected from a commer-
cial web hosting company shows that Cubismo is highly effective
in dissecting sophisticated metamorphic malware with multiple
layers of obfuscation. In particular, it enables VirusTotal to detect
53 out of 56 zero-day malware samples in the wild, which were
previously undetectable.
CCS CONCEPTS
• Security and privacy → Malware and its mitigation; Web
application security; Systems security.
KEYWORDS
PHP, Security, Malware, Obfuscation, Evasion, Counterfactual
Execution
ACM Reference Format:
Abbas Naderi-Afooshteh, Yonghwi Kwon, Anh Nguyen-Tuong, Mandana
Bagheri-Marzijarani, and Jack W. Davidson. 2019. Cu...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Cubismo: decloaking server-side malware via cubist program analysis
author:Abbas Naderi-Afooshteh and
Yonghwi Kwon and
Anh Nguyen-Tuong and
Mandana Bagheri-Marzijarani and
Jack W. Davidson
Cubismo: Decloaking Server-side Malware via Cubist Program
Analysis
Abbas Naderi-Afooshteh, Yonghwi Kwon, Anh Nguyen-Tuong, Mandana Bagheri-Marzijarani, and
ABSTRACT
Jack W. Davidson
Department of Computer Science, University of Virginia
{abiusx,yongkwon,nguyen,mb3wz,jwd}@virginia.edu
1 INTRODUCTION
Malware written in dynamic languages such as PHP routinely
employ anti-analysis techniques such as obfuscation schemes and
evasive tricks to avoid detection. On top of that, attackers use
automated malware creation tools to create numerous variants
with little to no manual effort.
This paper presents a system called Cubismo to solve this press-
ing problem. It processes potentially malicious files and decloaks
their obfuscations, exposing the hidden malicious code into multiple
files. The resulting files can be scanned by existing malware detec-
tion tools, leading to a much higher chance of detection. Cubismo
achieves improved detection by exploring all executable statements
of a suspect program counterfactually to see through complicated
polymorphism, metamorphism and, obfuscation techniques and
expose any malware.
Our evaluation on a real-world data set collected from a commer-
cial web hosting company shows that Cubismo is highly effective
in dissecting sophisticated metamorphic malware with multiple
layers of obfuscation. In particular, it enables VirusTotal to detect
53 out of 56 zero-day malware samples in the wild, which were
previously undetectable.
CCS CONCEPTS
• Security and privacy → Malware and its mitigation; Web
application security; Systems security.
KEYWORDS
PHP, Security, Malware, Obfuscation, Evasion, Counterfactual
Execution
ACM Reference Format:
Abbas Naderi-Afooshteh, Yonghwi Kwon, Anh Nguyen-Tuong, Mandana
Bagheri-Marzijarani, and Jack W. Davidson. 2019. Cu...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Detecting Credential Spearphishing in Enterprise Settings
author:Grant Ho and
Aashish Sharma and
Mobin Javed and
Vern Paxson and
David A. Wagner
Detecting Credential Spearphishing Attacks
in Enterprise Settings
Grant Ho, UC Berkeley; Aashish Sharma, The Lawrence Berkeley National Laboratory;
Mobin Javed, UC Berkeley; Vern Paxson, UC Berkeley and ICSI; David Wagner, UC Berkeley
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/ho
This paper is included in the Proceedings of the 26th USENIX Security SymposiumAugust 16–18, 2017 • Vancouver, BC, CanadaISBN 978-1-931971-40-9Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIXDetecting Credential Spearphishing Attacks in Enterprise Settings
Grant Ho† Aashish Sharma(cid:5) Mobin Javed† Vern Paxson†∗ David Wagner†
(cid:5)
Lawrence Berkeley National Laboratory
∗
†
UC Berkeley
International Computer Science Institute
Abstract
We present a new approach for detecting credential
spearphishing attacks in enterprise settings. Our method
uses features derived from an analysis of fundamental
characteristics of spearphishing attacks, combined with a
new non-parametric anomaly scoring technique for rank-
ing alerts. We evaluate our technique on a multi-year
dataset of over 370 million emails from a large enterprise
with thousands of employees. Our system successfully
detects 6 known spearphishing campaigns that succeeded
(missing one instance); an additional 9 that failed; plus
2 successful spearphishing attacks that were previously
unknown, thus demonstrating the value of our approach.
We also establish that our detector’s false positive rate is
low enough to be practical: on average, a single analyst
can investigate an entire month’s worth of alerts in un-
der 15 minutes. Comparing our anomaly scoring method
against standard anomaly detection techniques, we ﬁnd
that standard techniques using the same features would
need to generate at least 9 times as...