Instruction: 总结这篇安全研究的主要观点

Input:
title:WiMAC: Rapid Implementation Platform for User Definable MAC Protocols
Through Separation
author:Simon Yau and
Liang Ge and
Ping-Chun Hsieh and
I-Hong Hou and
Shuguang Cui and
P. R. Kumar and
Amal Ekbal and
Nikhil Kundargi
WiMAC: Rapid Implementation Platform for User Deﬁnable
MAC Protocols Through Separation
Simon Yau†, Liang Ge†, Ping-Chun Hsieh†, I-Hong Hou†, Shuguang Cui†, P. R. Kumar†,
Amal Ekbal*, and Nikhil Kundargi*
†Texas A&M University
†{symoyau, geliang87, lleyfede, ihou, cui, prk}@tamu.edu
*National Instruments
*{amal.ekbal, nikhil.kundargi}@ni.com
ABSTRACT
This demo presents WiMAC, a general-purpose wireless testbed for
researchers to quickly prototype a wide variety of real-time MAC
protocols for wireless networks. As the interface between the link
layer and the physical layer, MAC protocols are often tightly cou-
pled with the underlying physical layer, and need to have extremely
small latencies. Implementing a new MAC requires a long time. In
fact, very few MACs have ever been implemented, even though
dozens of new MAC protocols have been proposed. To enable
quick prototyping, we employ the mechanism vs. policy separa-
tion to decompose the functionality in the MAC layer and the PHY
layer. Built on the separation framework, WiMAC achieves the in-
dependence of the software from the hardware, offering a high de-
gree of function reuse and design ﬂexibility. Hence, our platform
not only supports easy cross-layer design but also allows protocol
changes on the ﬂy. Following the 802.11-like reference design, we
demonstrate that deploying a new MAC protocol is quick and sim-
ple on the proposed platform through the implementation of the
CSMA/CA and CHAIN protocols.
CCS Concepts
•Networks → Network experimentation;
Keywords
Wireless testbed; MAC; software-deﬁned radio
1.
INTRODUCTION
Driven by the emerging applications such as multimedia stream-
ing and VoIP, a wide variety of wireless protocols have been pro-
posed to meet the increasingly stringent r...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Enpublic Apps: Security Threats Using iOS Enterprise and Developer
Certificates
author:Min Zheng and
Hui Xue and
Yulong Zhang and
Tao Wei and
John C. S. Lui
Enpublic Apps: Security Threats Using iOS Enterprise and
Developer Certiﬁcates
Min Zheng
x
y
, Hui Xue
y
The Chinese University of Hong Kong,
, Yulong Zhang
x
x
, Tao Wei
x
and John C.S. Lui
y
FireEye Inc.
ABSTRACT
Compared with Android, the conventional wisdom is that
iOS is more secure. However, both jailbroken and non-
jailbroken iOS devices have number of vulnerabilities. For
iOS, apps need to interact with the underlying system using
Application Programming Interfaces (APIs). Some of these
APIs remain undocumented and Apple forbids apps in App
Store from using them. These APIs, also known as “private
APIs”, provide powerful features to developers and yet they
may have serious security consequences if misused. Further-
more, apps which use private APIs can bypass the App Store
and use the “Apple’s Enterprise/Developer Certi(cid:12)cates” for
distribution. This poses a signiﬁcant threat to the iOS e-
cosystem. So far, there is no formal study to understand
these apps and how private APIs are being encapsulated.
We call these iOS apps which distribute to the public using
enterprise certiﬁcates as “enpublic” apps. In this paper, we
present the design and implementation of iAnalytics, which
can automatically analyze “enpublic” apps’ private API us-
ages and vulnerabilities. Using iAnalytics, we crawled and
analyzed 1,408 enpublic iOS apps. We discovered that: 844
(60%) out of the 1408 apps do use private APIs, 14 (1%) app-
s contain URL scheme vulnerabilities, 901 (64%) enpublic
apps transport sensitive information through unencrypted
channel or store the information in plaintext on the phone.
In addition, we summarized 25 private APIs which are cru-
cial and security sensitive on iOS 6/7/8, and we have ﬁled
one CVE (Common Vulnerabilities and Exposures) for iOS
devices.
1.
INTRODUCTION
As of the end of 20...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Enpublic Apps: Security Threats Using iOS Enterprise and Developer
Certificates
author:Min Zheng and
Hui Xue and
Yulong Zhang and
Tao Wei and
John C. S. Lui
Enpublic Apps: Security Threats Using iOS Enterprise and
Developer Certiﬁcates
Min Zheng
x
y
, Hui Xue
y
The Chinese University of Hong Kong,
, Yulong Zhang
x
x
, Tao Wei
x
and John C.S. Lui
y
FireEye Inc.
ABSTRACT
Compared with Android, the conventional wisdom is that
iOS is more secure. However, both jailbroken and non-
jailbroken iOS devices have number of vulnerabilities. For
iOS, apps need to interact with the underlying system using
Application Programming Interfaces (APIs). Some of these
APIs remain undocumented and Apple forbids apps in App
Store from using them. These APIs, also known as “private
APIs”, provide powerful features to developers and yet they
may have serious security consequences if misused. Further-
more, apps which use private APIs can bypass the App Store
and use the “Apple’s Enterprise/Developer Certi(cid:12)cates” for
distribution. This poses a signiﬁcant threat to the iOS e-
cosystem. So far, there is no formal study to understand
these apps and how private APIs are being encapsulated.
We call these iOS apps which distribute to the public using
enterprise certiﬁcates as “enpublic” apps. In this paper, we
present the design and implementation of iAnalytics, which
can automatically analyze “enpublic” apps’ private API us-
ages and vulnerabilities. Using iAnalytics, we crawled and
analyzed 1,408 enpublic iOS apps. We discovered that: 844
(60%) out of the 1408 apps do use private APIs, 14 (1%) app-
s contain URL scheme vulnerabilities, 901 (64%) enpublic
apps transport sensitive information through unencrypted
channel or store the information in plaintext on the phone.
In addition, we summarized 25 private APIs which are cru-
cial and security sensitive on iOS 6/7/8, and we have ﬁled
one CVE (Common Vulnerabilities and Exposures) for iOS
devices.
1.
INTRODUCTION
As of the end of 20...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Robustness and Security Hardening of COTS Software Libraries
author:Martin S"ußkraut and
Christof Fetzer
Robustness and Security Hardening of COTS Software Libraries
Martin S¨ußkraut
Christof Fetzer
Department of Computer Science
Technische Universit¨at Dresden, Germany
{martin.suesskraut,christof.fetzer}@tu-dresden.de
Abstract
COTS components, like software libraries, can be used to
reduce the development effort. Unfortunately, many COTS
components have been developed without a focus on robust-
ness and security. We propose a novel approach to harden
software libraries to improve their robustness and security.
Our approach is automated, general and extensible and
consists of the following stages. First, we use a static anal-
ysis to prepare and guide the following fault injection. In
the dynamic analysis stage, fault injection experiments exe-
cute the library functions with both usual and extreme input
values. The experiments are used to derive and verify one
protection hypothesis per function (for instance, function
foo fails if argument 1 is a NULL pointer). In the hard-
ening stage, a protection wrapper is generated from these
hypothesis to reject unrobust input values of library func-
tions. We evaluate our approach by hardening a library
used by Apache (a web server).
1 Introduction
When building dependable systems, one can rarely af-
ford to built everything from scratch. This means that one
needs to build systems using software components imple-
mented by third parties. These software components might
have been designed and implemented for less critical appli-
cation domains. The use of such components without fur-
ther hardening is therefore not recommended for depend-
able systems.
Third party software components are often provided in
form of libraries. Experience with our previous library
hardening tool [8] has shown that tools like HEALERS can
help developers to harden libraries. The idea of HEALERS
was to use automated fault injection experi...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Robustness and Security Hardening of COTS Software Libraries
author:Martin S"ußkraut and
Christof Fetzer
Robustness and Security Hardening of COTS Software Libraries
Martin S¨ußkraut
Christof Fetzer
Department of Computer Science
Technische Universit¨at Dresden, Germany
{martin.suesskraut,christof.fetzer}@tu-dresden.de
Abstract
COTS components, like software libraries, can be used to
reduce the development effort. Unfortunately, many COTS
components have been developed without a focus on robust-
ness and security. We propose a novel approach to harden
software libraries to improve their robustness and security.
Our approach is automated, general and extensible and
consists of the following stages. First, we use a static anal-
ysis to prepare and guide the following fault injection. In
the dynamic analysis stage, fault injection experiments exe-
cute the library functions with both usual and extreme input
values. The experiments are used to derive and verify one
protection hypothesis per function (for instance, function
foo fails if argument 1 is a NULL pointer). In the hard-
ening stage, a protection wrapper is generated from these
hypothesis to reject unrobust input values of library func-
tions. We evaluate our approach by hardening a library
used by Apache (a web server).
1 Introduction
When building dependable systems, one can rarely af-
ford to built everything from scratch. This means that one
needs to build systems using software components imple-
mented by third parties. These software components might
have been designed and implemented for less critical appli-
cation domains. The use of such components without fur-
ther hardening is therefore not recommended for depend-
able systems.
Third party software components are often provided in
form of libraries. Experience with our previous library
hardening tool [8] has shown that tools like HEALERS can
help developers to harden libraries. The idea of HEALERS
was to use automated fault injection experi...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Fault Tolerant Energy Aware Data Dissemination Protocol in Sensor
Networks
author:Gunjan Khanna and
Saurabh Bagchi and
Yu-Sung Wu
Fault Tolerant Energy Aware Data Dissemination Protocol in Sensor Networks
Gunjan Khanna, Saurabh Bagchi, Yu-Sung Wu
Dependable Computing Systems Lab
School of Electrical & Computer Engineering, Purdue University
465 Northwestern Avenue, West Lafayette, IN 47907.
Email: {gkhanna, sbagchi, yswu}@purdue.edu
Abstract
In  this  paper  we  present  a  data  dissemination
protocol  for  efficiently  distributing  data  through  a
sensor network in the face of node and link failures. Our
work  is  motivated  by  the  SPIN  protocol  which  uses
metadata  negotiation  to  minimize  data  transmissions.
We  propose  a  protocol  called  Shortest  Path  Minded
SPIN (SPMS) in which every node has a zone defined by
its  maximum  transmission  radius.  A  data  source  node
advertises the availability of data to all the nodes in its
zone. Any interested node requests the data and gets sent
the data using multi-hop communication via the shortest
path. The failure of any node in the path is detected and
recovered  using  backup  routes.  We  build  simulation
models to compare SPMS against SPIN. The simulation
results show that SPMS reduces the delay over 10 times
and consumes 30% less energy in the static failure free
scenario.  Even  with  the  addition  of  mobility,  SPMS
outperforms  SPIN  by  energy  gains  between  5%  and
21%.  An  analytical  model  is  also  constructed  to
compare the two protocols under a simplified topology.
Keywords:  Sensor  network,  Energy  efficient  data
distribution,  FT  Communication,  Modeling,  FT  Mobile
Computing/Networking.
1. Introduction
Sensor  networks  are  a  particular  class  of  wireless  ad
hoc  networks  in  which  the  nodes  have  micro-electro-
mechanical  (MEMS)  components,  including  sensors,
actuators  and  RF  communication  components.  Sensor
nodes ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Fault Tolerant Energy Aware Data Dissemination Protocol in Sensor
Networks
author:Gunjan Khanna and
Saurabh Bagchi and
Yu-Sung Wu
Fault Tolerant Energy Aware Data Dissemination Protocol in Sensor Networks
Gunjan Khanna, Saurabh Bagchi, Yu-Sung Wu
Dependable Computing Systems Lab
School of Electrical & Computer Engineering, Purdue University
465 Northwestern Avenue, West Lafayette, IN 47907.
Email: {gkhanna, sbagchi, yswu}@purdue.edu
Abstract
In  this  paper  we  present  a  data  dissemination
protocol  for  efficiently  distributing  data  through  a
sensor network in the face of node and link failures. Our
work  is  motivated  by  the  SPIN  protocol  which  uses
metadata  negotiation  to  minimize  data  transmissions.
We  propose  a  protocol  called  Shortest  Path  Minded
SPIN (SPMS) in which every node has a zone defined by
its  maximum  transmission  radius.  A  data  source  node
advertises the availability of data to all the nodes in its
zone. Any interested node requests the data and gets sent
the data using multi-hop communication via the shortest
path. The failure of any node in the path is detected and
recovered  using  backup  routes.  We  build  simulation
models to compare SPMS against SPIN. The simulation
results show that SPMS reduces the delay over 10 times
and consumes 30% less energy in the static failure free
scenario.  Even  with  the  addition  of  mobility,  SPMS
outperforms  SPIN  by  energy  gains  between  5%  and
21%.  An  analytical  model  is  also  constructed  to
compare the two protocols under a simplified topology.
Keywords:  Sensor  network,  Energy  efficient  data
distribution,  FT  Communication,  Modeling,  FT  Mobile
Computing/Networking.
1. Introduction
Sensor  networks  are  a  particular  class  of  wireless  ad
hoc  networks  in  which  the  nodes  have  micro-electro-
mechanical  (MEMS)  components,  including  sensors,
actuators  and  RF  communication  components.  Sensor
nodes ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Does Certificate Transparency Break the Web? Measuring Adoption and
Error Rate
author:Emily Stark and
Ryan Sleevi and
Rijad Muminovic and
Devon O'Brien and
Eran Messeri and
Adrienne Porter Felt and
Brendan McMillion and
Parisa Tabriz
(cid:19)(cid:17)(cid:18)(cid:26)(cid:1)(cid:42)(cid:38)(cid:38)(cid:38)(cid:1)(cid:52)(cid:90)(cid:78)(cid:81)(cid:80)(cid:84)(cid:74)(cid:86)(cid:78)(cid:1)(cid:80)(cid:79)(cid:1)(cid:52)(cid:70)(cid:68)(cid:86)(cid:83)(cid:74)(cid:85)(cid:90)(cid:1)(cid:66)(cid:79)(cid:69)(cid:1)(cid:49)(cid:83)(cid:74)(cid:87)(cid:66)(cid:68)(cid:90)
Does Certiﬁcate Transparency Break the Web?
Measuring Adoption and Error Rate
Emily Stark1, Ryan Sleevi1, Rijad Muminovi´c2, Devon O’Brien1, Eran Messeri1,
Adrienne Porter Felt1, Brendan McMillion3, Parisa Tabriz1
1Google, 2University of Sarajevo, 3Cloudﬂare
1estark,rsleevi,asymmetric,eranm,felt,parisa@chromium.org, 2rmuminovic1@etf.unsa.ba, 3brendan@cloudﬂare.com
Abstract—Certiﬁcate Transparency (CT) is an emerging system
for enabling the rapid discovery of malicious or misissued
certiﬁcates. Initially standardized in 2013, CT is now ﬁnally
beginning to see widespread support. Although CT provides
desirable security beneﬁts, web browsers cannot begin requiring
all websites to support CT at once, due to the risk of breaking
large numbers of websites. We discuss challenges for deployment,
analyze the adoption of CT on the web, and measure the error
rates experienced by users of the Google Chrome web browser.
We ﬁnd that CT has so far been widely adopted with minimal
breakage and warnings.
Security researchers often struggle with the tradeoff between
security and user frustration: rolling out new security require-
ments often causes breakage. We view CT as a case study for
deploying ecosystem-wide change while trying to minimize end
user impact. We discuss the design properties of CT that made its
success possible, as well as draw lessons from its risks and pitfalls
that could be avoided in future la...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Does Certificate Transparency Break the Web? Measuring Adoption and
Error Rate
author:Emily Stark and
Ryan Sleevi and
Rijad Muminovic and
Devon O'Brien and
Eran Messeri and
Adrienne Porter Felt and
Brendan McMillion and
Parisa Tabriz
(cid:19)(cid:17)(cid:18)(cid:26)(cid:1)(cid:42)(cid:38)(cid:38)(cid:38)(cid:1)(cid:52)(cid:90)(cid:78)(cid:81)(cid:80)(cid:84)(cid:74)(cid:86)(cid:78)(cid:1)(cid:80)(cid:79)(cid:1)(cid:52)(cid:70)(cid:68)(cid:86)(cid:83)(cid:74)(cid:85)(cid:90)(cid:1)(cid:66)(cid:79)(cid:69)(cid:1)(cid:49)(cid:83)(cid:74)(cid:87)(cid:66)(cid:68)(cid:90)
Does Certiﬁcate Transparency Break the Web?
Measuring Adoption and Error Rate
Emily Stark1, Ryan Sleevi1, Rijad Muminovi´c2, Devon O’Brien1, Eran Messeri1,
Adrienne Porter Felt1, Brendan McMillion3, Parisa Tabriz1
1Google, 2University of Sarajevo, 3Cloudﬂare
1estark,rsleevi,asymmetric,eranm,felt,parisa@chromium.org, 2rmuminovic1@etf.unsa.ba, 3brendan@cloudﬂare.com
Abstract—Certiﬁcate Transparency (CT) is an emerging system
for enabling the rapid discovery of malicious or misissued
certiﬁcates. Initially standardized in 2013, CT is now ﬁnally
beginning to see widespread support. Although CT provides
desirable security beneﬁts, web browsers cannot begin requiring
all websites to support CT at once, due to the risk of breaking
large numbers of websites. We discuss challenges for deployment,
analyze the adoption of CT on the web, and measure the error
rates experienced by users of the Google Chrome web browser.
We ﬁnd that CT has so far been widely adopted with minimal
breakage and warnings.
Security researchers often struggle with the tradeoff between
security and user frustration: rolling out new security require-
ments often causes breakage. We view CT as a case study for
deploying ecosystem-wide change while trying to minimize end
user impact. We discuss the design properties of CT that made its
success possible, as well as draw lessons from its risks and pitfalls
that could be avoided in future la...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Tempest: Soft state replication in the service tier
author:Tudor Marian and
Mahesh Balakrishnan and
Ken Birman and
Robbert van Renesse
International Conference on Dependable Systems & Networks: Anchorage, Alaska, June 24-27 2008
Tempest: Soft State Replication in the Service Tier*
Tudor Marian, Mahesh Balakrishnan, Ken Birman, Robbert van Renesse
Department of Computer Science
Cornell University, Ithaca, NY 14853
{tudorm,mahesh,ken,rvr}@cs.comell.edu
Abstract
Soft state in the middle tier is key to enabling scalable
and responsive three tier service architectures. While soft(cid:173)
state can be reconstructed upon failure, replicating it across
multiple service instances is critical for rapid fail-over and
high availability. Current techniques for storing and man(cid:173)
aging replicated soft state require mapping data structures
to different abstractions such as database records, which
can be difficult and introduce inefficiencies. Tempest is a
system that provides programmers with data structures that
look very similar to conventional Java Collections but are
automatically replicated. We evaluate Tempest against al(cid:173)
ternatives such as in-memory databases and we show that
Tempest does scale well in real world service architectures.
1 Introduction
Service-Oriented Architectures (SOAs) have emerged as
the paradigm of choice for structuring large datacenter(cid:173)
hosted systems. Most contemporary large-scale applica(cid:173)
tions are built as SOAs: online stores, search engines, en(cid:173)
terprise software and financial infrastructure are some ex(cid:173)
amples. The canonical design for such systems is a three(cid:173)
tier architecture: a first tier load-balancing proxies sends
requests to a second tier of state-less service logic which in
tum accesses and updates a third tier of durable databases
or filesystems.
Soft state in the service tier is key to building highly re(cid:173)
sponsive and scalable SOAs. Soft state is characterized as
data ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Tempest: Soft state replication in the service tier
author:Tudor Marian and
Mahesh Balakrishnan and
Ken Birman and
Robbert van Renesse
International Conference on Dependable Systems & Networks: Anchorage, Alaska, June 24-27 2008
Tempest: Soft State Replication in the Service Tier*
Tudor Marian, Mahesh Balakrishnan, Ken Birman, Robbert van Renesse
Department of Computer Science
Cornell University, Ithaca, NY 14853
{tudorm,mahesh,ken,rvr}@cs.comell.edu
Abstract
Soft state in the middle tier is key to enabling scalable
and responsive three tier service architectures. While soft(cid:173)
state can be reconstructed upon failure, replicating it across
multiple service instances is critical for rapid fail-over and
high availability. Current techniques for storing and man(cid:173)
aging replicated soft state require mapping data structures
to different abstractions such as database records, which
can be difficult and introduce inefficiencies. Tempest is a
system that provides programmers with data structures that
look very similar to conventional Java Collections but are
automatically replicated. We evaluate Tempest against al(cid:173)
ternatives such as in-memory databases and we show that
Tempest does scale well in real world service architectures.
1 Introduction
Service-Oriented Architectures (SOAs) have emerged as
the paradigm of choice for structuring large datacenter(cid:173)
hosted systems. Most contemporary large-scale applica(cid:173)
tions are built as SOAs: online stores, search engines, en(cid:173)
terprise software and financial infrastructure are some ex(cid:173)
amples. The canonical design for such systems is a three(cid:173)
tier architecture: a first tier load-balancing proxies sends
requests to a second tier of state-less service logic which in
tum accesses and updates a third tier of durable databases
or filesystems.
Soft state in the service tier is key to building highly re(cid:173)
sponsive and scalable SOAs. Soft state is characterized as
data ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Mitigating DNS DoS attacks
author:Hitesh Ballani and
Paul Francis
Mitigating DNS DoS Attacks
Hitesh Ballani
Cornell University
Ithaca, NY
hitesh@cs.cornell.edu
Paul Francis
Cornell University
Ithaca, NY
francis@cs.cornell.edu
ABSTRACT
This paper considers DoS attacks on DNS wherein attackers ﬂood
the nameservers of a zone to disrupt resolution of resource records
belonging to the zone and consequently, any of its sub-zones. We
propose a minor change in the caching behavior of DNS resolvers
that can significantly alleviate the impact of such attacks. In our
proposal, DNS resolvers do not completely evict cached records
whose TTL has expired; rather, such records are stored in a sepa-
rate “stale cache”. If, during the resolution of a query, a resolver
does not receive any response from the nameservers that are re-
sponsible for authoritatively answering the query, it can use the
information stored in the stale cache to answer the query.
In effect, the stale cache is the part of the global DNS database
that has been accessed by the resolver and represents an insurance
policy that the resolver uses only when the relevant DNS servers are
unavailable. We analyze a 65-day DNS trace to quantify the bene-
fits of a stale cache under different attack scenarios. Further, while
the proposed change to DNS resolvers also changes DNS seman-
tics, we argue that it does not adversely impact any of the funda-
mental DNS characteristics such as the autonomy of zone operators
and hence, is a very simple and practical candidate for mitigating
the impact of DoS attacks on DNS.
Categories and Subject Descriptors: C.4 [Performance of Sys-
tems]: Reliability, Availability.
General Terms: Reliability, Security.
Keywords: DNS, Denial of Service, stale cache.
1.
INTRODUCTION
In the recent past, there have been many instances of ﬂooding
attacks on the Domain Name System (DNS) aimed at preventing
clients from resolving resource records belonging to the zone un-
der attack [26-29]. While t...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Mitigating DNS DoS attacks
author:Hitesh Ballani and
Paul Francis
Mitigating DNS DoS Attacks
Hitesh Ballani
Cornell University
Ithaca, NY
hitesh@cs.cornell.edu
Paul Francis
Cornell University
Ithaca, NY
francis@cs.cornell.edu
ABSTRACT
This paper considers DoS attacks on DNS wherein attackers ﬂood
the nameservers of a zone to disrupt resolution of resource records
belonging to the zone and consequently, any of its sub-zones. We
propose a minor change in the caching behavior of DNS resolvers
that can significantly alleviate the impact of such attacks. In our
proposal, DNS resolvers do not completely evict cached records
whose TTL has expired; rather, such records are stored in a sepa-
rate “stale cache”. If, during the resolution of a query, a resolver
does not receive any response from the nameservers that are re-
sponsible for authoritatively answering the query, it can use the
information stored in the stale cache to answer the query.
In effect, the stale cache is the part of the global DNS database
that has been accessed by the resolver and represents an insurance
policy that the resolver uses only when the relevant DNS servers are
unavailable. We analyze a 65-day DNS trace to quantify the bene-
fits of a stale cache under different attack scenarios. Further, while
the proposed change to DNS resolvers also changes DNS seman-
tics, we argue that it does not adversely impact any of the funda-
mental DNS characteristics such as the autonomy of zone operators
and hence, is a very simple and practical candidate for mitigating
the impact of DoS attacks on DNS.
Categories and Subject Descriptors: C.4 [Performance of Sys-
tems]: Reliability, Availability.
General Terms: Reliability, Security.
Keywords: DNS, Denial of Service, stale cache.
1.
INTRODUCTION
In the recent past, there have been many instances of ﬂooding
attacks on the Domain Name System (DNS) aimed at preventing
clients from resolving resource records belonging to the zone un-
der attack [26-29]. While t...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A Longitudinal and Comprehensive Study of the DANE Ecosystem in
Email
author:Hyeonmin Lee and
Aniketh Gireesh and
Roland van Rijswijk-Deij and
Taekyoung Kwon and
Taejoong Chung
A Longitudinal and Comprehensive Study of the
DANE Ecosystem in Email
Hyeonmin Lee, Seoul National University; Aniketh Gireesh, Amrita Vishwa Vidyapeetham;
Roland van Rijswijk-Deij, University of Twente & NLnet Labs; Taekyoung “Ted” Kwon,
Seoul National University; Taejoong Chung, Rochester Institute of Technology
https://www.usenix.org/conference/usenixsecurity20/presentation/lee-hyeonmin
This paper is included in the Proceedings of the 29th USENIX Security Symposium.August 12–14, 2020978-1-939133-17-5Open access to the Proceedings of the 29th USENIX Security Symposium is sponsored by USENIX.A Longitudinal and Comprehensive Study of the DANE Ecosystem in Email
Hyeonmin Lee∗
Seoul National University
Aniketh Girish∗
Amrita Vishwa Vidyapeetham
Roland van Rijswijk-Deij
University of Twente & NLnet Labs
Taekyoung “Ted” Kwon
Seoul National University
Taejoong Chung
Rochester Institute of Technology
Abstract
1
Introduction
The DNS-based Authentication of Named Entities (DANE)
standard allows clients and servers to establish a TLS connec-
tion without relying on trusted third parties like CAs by pub-
lishing TLSA records. DANE uses the Domain Name System
Security Extensions (DNSSEC) PKI to achieve integrity and
authenticity. However, DANE can only work correctly if each
principal in its PKI properly performs its duty: through their
DNSSEC-aware DNS servers, DANE servers (e.g., SMTP
servers) must publish their TLSA records, which are consistent
with their certiﬁcates. Similarly, DANE clients (e.g., SMTP
clients) must verify the DANE servers’ TLSA records, which
are also used to validate the fetched certiﬁcates.
DANE is rapidly gaining popularity in the email ecosystem,
to help improve transport security between mail servers. Yet
its security beneﬁts hinge on deploying DANE correctly. In
th...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A Longitudinal and Comprehensive Study of the DANE Ecosystem in
Email
author:Hyeonmin Lee and
Aniketh Gireesh and
Roland van Rijswijk-Deij and
Taekyoung Kwon and
Taejoong Chung
A Longitudinal and Comprehensive Study of the
DANE Ecosystem in Email
Hyeonmin Lee, Seoul National University; Aniketh Gireesh, Amrita Vishwa Vidyapeetham;
Roland van Rijswijk-Deij, University of Twente & NLnet Labs; Taekyoung “Ted” Kwon,
Seoul National University; Taejoong Chung, Rochester Institute of Technology
https://www.usenix.org/conference/usenixsecurity20/presentation/lee-hyeonmin
This paper is included in the Proceedings of the 29th USENIX Security Symposium.August 12–14, 2020978-1-939133-17-5Open access to the Proceedings of the 29th USENIX Security Symposium is sponsored by USENIX.A Longitudinal and Comprehensive Study of the DANE Ecosystem in Email
Hyeonmin Lee∗
Seoul National University
Aniketh Girish∗
Amrita Vishwa Vidyapeetham
Roland van Rijswijk-Deij
University of Twente & NLnet Labs
Taekyoung “Ted” Kwon
Seoul National University
Taejoong Chung
Rochester Institute of Technology
Abstract
1
Introduction
The DNS-based Authentication of Named Entities (DANE)
standard allows clients and servers to establish a TLS connec-
tion without relying on trusted third parties like CAs by pub-
lishing TLSA records. DANE uses the Domain Name System
Security Extensions (DNSSEC) PKI to achieve integrity and
authenticity. However, DANE can only work correctly if each
principal in its PKI properly performs its duty: through their
DNSSEC-aware DNS servers, DANE servers (e.g., SMTP
servers) must publish their TLSA records, which are consistent
with their certiﬁcates. Similarly, DANE clients (e.g., SMTP
clients) must verify the DANE servers’ TLSA records, which
are also used to validate the fetched certiﬁcates.
DANE is rapidly gaining popularity in the email ecosystem,
to help improve transport security between mail servers. Yet
its security beneﬁts hinge on deploying DANE correctly. In
th...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Characterizing Web Pornography Consumption from Passive Measurements
author:Andrea Morichetta and
Martino Trevisan and
Luca Vassio
Characterizing Web Pornography
Consumption from Passive Measurements
Andrea Morichetta, Martino Trevisan, and Luca Vassio(B)
{andrea.morichetta,martino.trevisan,luca.vassio}@polito.it
Politecnico di Torino, Turin, Italy
Abstract. Web pornography represents a large fraction of the Internet
traﬃc, with thousands of websites and millions of users. Studying web
pornography consumption allows understanding human behaviors and it
is crucial for medical and psychological research. However, given the lack
of public data, these works typically build on surveys, limited by diﬀer-
ent factors, e.g., unreliable answers that volunteers may (involuntarily)
provide.
In this work, we collect anonymized accesses to pornography web-
sites using HTTP-level passive traces. Our dataset includes about 15 000
broadband subscribers over a period of 3 years. We use it to provide
quantitative information about the interactions of users with porno-
graphic websites, focusing on time and frequency of use, habits, and
trends. We distribute our anonymized dataset to the community to ease
reproducibility and allow further studies.
Keywords: Passive measurements · Web pornography ·
Adult content · User behaviour · Network monitoring
1 Introduction
Pornography and technology have enjoyed a close relationship in the last decades,
with technology hugely increasing the capabilities of the porn industry. From the
limited market reachable through public theatres, the introduction of the video-
cassette recorder in the 1970s abruptly changed the way of accessing pornog-
raphy, allowing to access pornography in the privacy and comfort of each indi-
vidual home. Then, the birth of cable networks and specialty channels in the
1990s, allowed a further step towards accessibility and privacy, giving the possi-
bility to retrieve content directly from home. Finally, the Intern...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Characterizing Web Pornography Consumption from Passive Measurements
author:Andrea Morichetta and
Martino Trevisan and
Luca Vassio
Characterizing Web Pornography
Consumption from Passive Measurements
Andrea Morichetta, Martino Trevisan, and Luca Vassio(B)
{andrea.morichetta,martino.trevisan,luca.vassio}@polito.it
Politecnico di Torino, Turin, Italy
Abstract. Web pornography represents a large fraction of the Internet
traﬃc, with thousands of websites and millions of users. Studying web
pornography consumption allows understanding human behaviors and it
is crucial for medical and psychological research. However, given the lack
of public data, these works typically build on surveys, limited by diﬀer-
ent factors, e.g., unreliable answers that volunteers may (involuntarily)
provide.
In this work, we collect anonymized accesses to pornography web-
sites using HTTP-level passive traces. Our dataset includes about 15 000
broadband subscribers over a period of 3 years. We use it to provide
quantitative information about the interactions of users with porno-
graphic websites, focusing on time and frequency of use, habits, and
trends. We distribute our anonymized dataset to the community to ease
reproducibility and allow further studies.
Keywords: Passive measurements · Web pornography ·
Adult content · User behaviour · Network monitoring
1 Introduction
Pornography and technology have enjoyed a close relationship in the last decades,
with technology hugely increasing the capabilities of the porn industry. From the
limited market reachable through public theatres, the introduction of the video-
cassette recorder in the 1970s abruptly changed the way of accessing pornog-
raphy, allowing to access pornography in the privacy and comfort of each indi-
vidual home. Then, the birth of cable networks and specialty channels in the
1990s, allowed a further step towards accessibility and privacy, giving the possi-
bility to retrieve content directly from home. Finally, the Intern...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:HVLearn: Automated Black-Box Analysis of Hostname Verification in
SSL/TLS Implementations
author:Suphannee Sivakorn and
George Argyros and
Kexin Pei and
Angelos D. Keromytis and
Suman Jana
2017 IEEE Symposium on Security and Privacy
HVLearn: Automated Black-box Analysis of
Hostname Veriﬁcation in SSL/TLS Implementations
Suphannee Sivakorn, George Argyros, Kexin Pei, Angelos D. Keromytis, and Suman Jana
Department of Computer Science
Columbia University, New York, USA
{suphannee, argyros, kpei, angelos, suman}@cs.columbia.edu
Abstract—SSL/TLS is the most commonly deployed family of
protocols for securing network communications. The security
guarantees of SSL/TLS are critically dependent on the correct
validation of the X.509 server certiﬁcates presented during the
handshake stage of the SSL/TLS protocol. Hostname veriﬁcation
is a critical component of the certiﬁcate validation process that
veriﬁes the remote server’s identity by checking if the hostname
of the server matches any of the names present in the X.509
certiﬁcate. Hostname veriﬁcation is a highly complex process
due to the presence of numerous features and corner cases such
as wildcards, IP addresses, international domain names, and so
forth. Therefore, testing hostname veriﬁcation implementations
present a challenging task.
In this paper, we present HVLearn, a novel black-box testing
framework for analyzing SSL/TLS hostname veriﬁcation imple-
mentations, which is based on automata learning algorithms.
HVLearn utilizes a number of certiﬁcate templates, i.e., certiﬁ-
cates with a common name (CN) set to a speciﬁc pattern, in
order to test different rules from the corresponding speciﬁcation.
For each certiﬁcate template, HVLearn uses automata learning
algorithms to infer a Deterministic Finite Automaton (DFA) that
describes the set of all hostnames that match the CN of a given
certiﬁcate. Once a model is inferred for a certiﬁcate template,
HVLearn checks the model for bugs by ﬁnding discrepancies
with t...


Instruction: 总结这篇安全研究的主要观点

Input:
title:HVLearn: Automated Black-Box Analysis of Hostname Verification in
SSL/TLS Implementations
author:Suphannee Sivakorn and
George Argyros and
Kexin Pei and
Angelos D. Keromytis and
Suman Jana
2017 IEEE Symposium on Security and Privacy
HVLearn: Automated Black-box Analysis of
Hostname Veriﬁcation in SSL/TLS Implementations
Suphannee Sivakorn, George Argyros, Kexin Pei, Angelos D. Keromytis, and Suman Jana
Department of Computer Science
Columbia University, New York, USA
{suphannee, argyros, kpei, angelos, suman}@cs.columbia.edu
Abstract—SSL/TLS is the most commonly deployed family of
protocols for securing network communications. The security
guarantees of SSL/TLS are critically dependent on the correct
validation of the X.509 server certiﬁcates presented during the
handshake stage of the SSL/TLS protocol. Hostname veriﬁcation
is a critical component of the certiﬁcate validation process that
veriﬁes the remote server’s identity by checking if the hostname
of the server matches any of the names present in the X.509
certiﬁcate. Hostname veriﬁcation is a highly complex process
due to the presence of numerous features and corner cases such
as wildcards, IP addresses, international domain names, and so
forth. Therefore, testing hostname veriﬁcation implementations
present a challenging task.
In this paper, we present HVLearn, a novel black-box testing
framework for analyzing SSL/TLS hostname veriﬁcation imple-
mentations, which is based on automata learning algorithms.
HVLearn utilizes a number of certiﬁcate templates, i.e., certiﬁ-
cates with a common name (CN) set to a speciﬁc pattern, in
order to test different rules from the corresponding speciﬁcation.
For each certiﬁcate template, HVLearn uses automata learning
algorithms to infer a Deterministic Finite Automaton (DFA) that
describes the set of all hostnames that match the CN of a given
certiﬁcate. Once a model is inferred for a certiﬁcate template,
HVLearn checks the model for bugs by ﬁnding discrepancies
with t...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Rethinking about guessing attacks
author:Zhiwei Li and
Weichao Wang
Rethinking about Guessing Attacks
Zhiwei Li
Department of SIS
UNC Charlotte
Charlotte, NC 28223
zli19@uncc.edu
ABSTRACT
Although various past e(cid:11)orts have been made to character-
ize and detect guessing attacks, there is no consensus on the
de(cid:12)nition of guessing attacks. Such a lack of generic de(cid:12)ni-
tion makes it extremely di(cid:14)cult to evaluate the resilience of
security protocols to guessing attacks.
To overcome this hurdle, we seek a new de(cid:12)nition in this
paper to fully characterize the attacker’s guessing capabili-
ties (i.e., guessability). This provides a general framework
to reason about guessing attacks in a symbolic setting, in-
dependent of speci(cid:12)c intruder models. We show how the
framework can be used to analyze both passive and active
guessing attacks.
Categories and Subject Descriptors
C.2.2 [Computer-Communication Networks]: Network
Protocols|Protocol veri(cid:12)cation; D.2.4 [Software]: Soft-
ware/Program Veri(cid:12)cation|Formal methods
General Terms
Security, Theory, Veri(cid:12)cation
1.
INTRODUCTION
Many security protocols are vulnerable to guessing attack-
s, which aim to obtain a poorly chosen password or data by
trying every possible value for it. Let us consider a simple
one-way authentication protocol:
Message 1.
Message 2.
A → B : {NA}KAB
B → A : {f(NA)}KAB
Here NA is a fresh nonce generated by A and KAB is the
symmetric key shared between A and B, and f is a given
function (e.g., f(NA) = NA + 1). An attacker may obtain
KAB by trying to decrypt both messages with a guessed key
k and then to compare the results, say r1 and r2: if r2 equals
f(r1), then k is the correct guess. Such attacks become more
feasible when one chooses a low entropy secret.
Permission to make digital or hard copies of all or part of this work for
personal or classroom use is granted without fee provided that copies are
not made or distributed for proﬁt or c...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Rethinking about guessing attacks
author:Zhiwei Li and
Weichao Wang
Rethinking about Guessing Attacks
Zhiwei Li
Department of SIS
UNC Charlotte
Charlotte, NC 28223
zli19@uncc.edu
ABSTRACT
Although various past e(cid:11)orts have been made to character-
ize and detect guessing attacks, there is no consensus on the
de(cid:12)nition of guessing attacks. Such a lack of generic de(cid:12)ni-
tion makes it extremely di(cid:14)cult to evaluate the resilience of
security protocols to guessing attacks.
To overcome this hurdle, we seek a new de(cid:12)nition in this
paper to fully characterize the attacker’s guessing capabili-
ties (i.e., guessability). This provides a general framework
to reason about guessing attacks in a symbolic setting, in-
dependent of speci(cid:12)c intruder models. We show how the
framework can be used to analyze both passive and active
guessing attacks.
Categories and Subject Descriptors
C.2.2 [Computer-Communication Networks]: Network
Protocols|Protocol veri(cid:12)cation; D.2.4 [Software]: Soft-
ware/Program Veri(cid:12)cation|Formal methods
General Terms
Security, Theory, Veri(cid:12)cation
1.
INTRODUCTION
Many security protocols are vulnerable to guessing attack-
s, which aim to obtain a poorly chosen password or data by
trying every possible value for it. Let us consider a simple
one-way authentication protocol:
Message 1.
Message 2.
A → B : {NA}KAB
B → A : {f(NA)}KAB
Here NA is a fresh nonce generated by A and KAB is the
symmetric key shared between A and B, and f is a given
function (e.g., f(NA) = NA + 1). An attacker may obtain
KAB by trying to decrypt both messages with a guessed key
k and then to compare the results, say r1 and r2: if r2 equals
f(r1), then k is the correct guess. Such attacks become more
feasible when one chooses a low entropy secret.
Permission to make digital or hard copies of all or part of this work for
personal or classroom use is granted without fee provided that copies are
not made or distributed for proﬁt or c...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:SoftArch: An Architecture Level Tool for Modeling and Analyzing Soft
Errors
author:Xiaodong Li and
Sarita V. Adve and
Pradip Bose and
Jude A. Rivers
SoftArch: An Architecture-Level Tool for Modeling and Analyzing Soft Errors ∗
Xiaodong Li
†‡1
, Sarita V. Adve
‡
†
, Pradip Bose
, Jude A. Rivers
†
†
IBM T. J. Watson Research Center
{xjli, jarivers, pbose}@us.ibm.com
Yorktown Heights, NY 10598
Abstract
Soft errors are a growing concern for processor reliabil-
ity. Recent work has motivated architecture-level studies of
soft errors since the architecture can mask many raw errors
and architectural solutions can exploit workload knowl-
edge. This paper proposes a model and tool, called Soft-
Arch, to enable analysis of soft errors at the architecture-
level in modern processors. SoftArch is based on a proba-
bilistic model of the error generation and propagation pro-
cess in a processor. Compared to prior architecture-level
tools, SoftArch is more comprehensive or faster. We demon-
strate the use of SoftArch for an out-of-order superscalar
processor running SPEC2000 benchmarks. Our results are
consistent with, but more comprehensive than, prior work,
and motivate selective and dynamic architecture-level soft
error protection mechanisms.
1 Introduction
CMOS technology scaling has brought tremendous im-
provement in performance for semiconductor devices. As
we move to sub-100nm lithographies however, these gains
appear to face fundamental reliability related challenges. In
particular, soft errors are emerging as a new challenge in
processor design. Soft errors or single event upsets are tran-
sient errors caused by high energy particle strikes such as
neutrons from cosmic rays and alpha particles from pack-
aging material. Such strikes can ﬂip the bit stored in a
storage cell and change the value being computed by a
logic element. Various studies have predicted an increase in
soft error rates (SER) in different types of circuits (SRAM,
∗
This work was supported in par...


Instruction: 总结这篇安全研究的主要观点

Input:
title:SoftArch: An Architecture Level Tool for Modeling and Analyzing Soft
Errors
author:Xiaodong Li and
Sarita V. Adve and
Pradip Bose and
Jude A. Rivers
SoftArch: An Architecture-Level Tool for Modeling and Analyzing Soft Errors ∗
Xiaodong Li
†‡1
, Sarita V. Adve
‡
†
, Pradip Bose
, Jude A. Rivers
†
†
IBM T. J. Watson Research Center
{xjli, jarivers, pbose}@us.ibm.com
Yorktown Heights, NY 10598
Abstract
Soft errors are a growing concern for processor reliabil-
ity. Recent work has motivated architecture-level studies of
soft errors since the architecture can mask many raw errors
and architectural solutions can exploit workload knowl-
edge. This paper proposes a model and tool, called Soft-
Arch, to enable analysis of soft errors at the architecture-
level in modern processors. SoftArch is based on a proba-
bilistic model of the error generation and propagation pro-
cess in a processor. Compared to prior architecture-level
tools, SoftArch is more comprehensive or faster. We demon-
strate the use of SoftArch for an out-of-order superscalar
processor running SPEC2000 benchmarks. Our results are
consistent with, but more comprehensive than, prior work,
and motivate selective and dynamic architecture-level soft
error protection mechanisms.
1 Introduction
CMOS technology scaling has brought tremendous im-
provement in performance for semiconductor devices. As
we move to sub-100nm lithographies however, these gains
appear to face fundamental reliability related challenges. In
particular, soft errors are emerging as a new challenge in
processor design. Soft errors or single event upsets are tran-
sient errors caused by high energy particle strikes such as
neutrons from cosmic rays and alpha particles from pack-
aging material. Such strikes can ﬂip the bit stored in a
storage cell and change the value being computed by a
logic element. Various studies have predicted an increase in
soft error rates (SER) in different types of circuits (SRAM,
∗
This work was supported in par...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Users Really Do Answer Telephone Scams
author:Huahong Tu and
Adam Doup'e and
Ziming Zhao and
Gail-Joon Ahn
Users Really Do Answer Telephone Scams
Huahong Tu, University of Maryland; Adam Doupé, Arizona State University; Ziming Zhao,
Rochester Institute of Technology; Gail-Joon Ahn, Arizona State University and
Samsung Research
https://www.usenix.org/conference/usenixsecurity19/presentation/tu
This paper is included in the Proceedings of the 28th USENIX Security Symposium.August 14–16, 2019 • Santa Clara, CA, USA978-1-939133-06-9Open access to the Proceedings of the 28th USENIX Security Symposium is sponsored by USENIX.Users Really Do Answer Telephone Scams
Huahong Tu1, Adam Doupé2, Ziming Zhao3, and Gail-Joon Ahn2,4
1University of Maryland, hh2@umd.edu
2Arizona State University, {doupe, gahn}@asu.edu
3Rochester Institute of Technology, zxzics@rit.edu
4Samsung Research
Abstract
As telephone scams become increasingly prevalent, it is cru-
cial to understand what causes recipients to fall victim to
these scams. Armed with this knowledge, effective counter-
measures can be developed to challenge the key foundations
of successful telephone phishing attacks.
In this paper, we present the methodology, design, execu-
tion, results, and evaluation of an ethical telephone phishing
scam. The study performed 10 telephone phishing experi-
ments on 3,000 university participants without prior aware-
ness over the course of a workweek. Overall, we were able to
identify at least one key factor—spoofed Caller ID—that had
a signiﬁcant effect in tricking the victims into revealing their
Social Security number.
1 Introduction
The rise of telephone spam, scams, fraud, phishing, or vish-
ing, is a signiﬁcant and growing problem. According to FTC
reports for 2018, phone impersonation scams have increased
signiﬁcantly in the recent years. The national Do-Not-Call
Registry received more than 5.78 million unwanted call com-
plaints [1], with fraud and imposer scam in the top spo...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Users Really Do Answer Telephone Scams
author:Huahong Tu and
Adam Doup'e and
Ziming Zhao and
Gail-Joon Ahn
Users Really Do Answer Telephone Scams
Huahong Tu, University of Maryland; Adam Doupé, Arizona State University; Ziming Zhao,
Rochester Institute of Technology; Gail-Joon Ahn, Arizona State University and
Samsung Research
https://www.usenix.org/conference/usenixsecurity19/presentation/tu
This paper is included in the Proceedings of the 28th USENIX Security Symposium.August 14–16, 2019 • Santa Clara, CA, USA978-1-939133-06-9Open access to the Proceedings of the 28th USENIX Security Symposium is sponsored by USENIX.Users Really Do Answer Telephone Scams
Huahong Tu1, Adam Doupé2, Ziming Zhao3, and Gail-Joon Ahn2,4
1University of Maryland, hh2@umd.edu
2Arizona State University, {doupe, gahn}@asu.edu
3Rochester Institute of Technology, zxzics@rit.edu
4Samsung Research
Abstract
As telephone scams become increasingly prevalent, it is cru-
cial to understand what causes recipients to fall victim to
these scams. Armed with this knowledge, effective counter-
measures can be developed to challenge the key foundations
of successful telephone phishing attacks.
In this paper, we present the methodology, design, execu-
tion, results, and evaluation of an ethical telephone phishing
scam. The study performed 10 telephone phishing experi-
ments on 3,000 university participants without prior aware-
ness over the course of a workweek. Overall, we were able to
identify at least one key factor—spoofed Caller ID—that had
a signiﬁcant effect in tricking the victims into revealing their
Social Security number.
1 Introduction
The rise of telephone spam, scams, fraud, phishing, or vish-
ing, is a signiﬁcant and growing problem. According to FTC
reports for 2018, phone impersonation scams have increased
signiﬁcantly in the recent years. The national Do-Not-Call
Registry received more than 5.78 million unwanted call com-
plaints [1], with fraud and imposer scam in the top spo...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Smart in-network deduplication for storage-aware SDN
author:Yu Hua and
Xue Liu and
Dan Feng
Smart In-Network Deduplication for Storage-aware SDN
Yu Hua
WNLO, School of Computer
Huazhong University of
Science and Technology
csyhua@hust.edu.cn
Wuhan, China
Xue Liu
Dan Feng
School of Computer Science
WNLO, School of Computer
McGill University
Montreal, Canada
xueliu@cs.mcgill.ca
Huazhong University of
Science and Technology
dfeng@hust.edu.cn
Wuhan, China
ABSTRACT
In order to efﬁciently handle the rapid growth of data and reduce
the overhead of network transmission, we propose an in-network
deduplication for storage-aware Software Deﬁned Network (SDN),
called SMIND. Unlike conventional source or destination dedupli-
cation schemes, SMIND implements in-network deduplication via
SDN. Moreover, to address the performance bottleneck of access-
ing and indexing SDN controller, we implement an SDN-enabled
Flash Translation Layer (FTL) in a real prototype of Solid State
Disk (SSD). Experimental results demonstrate the efﬁciency and
efﬁcacy of SMIND.
Categories and Subject Descriptors
C.2.1 [COMPUTER-COMMUNICATION NETWORKS]: Net-
work Architecture and Design
Keywords
Software Deﬁned Network, Deduplication, Storage Systems
1.
INTRODUCTION
The amount of information created and replicated has rapidly
increase, in which there exists a large fraction of redundant data.
The heavy redundancy causes non-trivial overheads to the network
performance [1]. One solution is to detect data redundancy and
reduce the amount of duplicate data to be transmitted [2, 3].
Data deduplication can be executed in either source (e.g., clients)
or destination (e.g., servers) end systems. Speciﬁcally, source dedu-
plication is to remove data redundancy before transmission to the
destination.
It works through client software that communicates
with the server to compare arriving data with previously stored
data. If the server contains previously stored data, they will not
be sent. However, the source d...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Smart in-network deduplication for storage-aware SDN
author:Yu Hua and
Xue Liu and
Dan Feng
Smart In-Network Deduplication for Storage-aware SDN
Yu Hua
WNLO, School of Computer
Huazhong University of
Science and Technology
csyhua@hust.edu.cn
Wuhan, China
Xue Liu
Dan Feng
School of Computer Science
WNLO, School of Computer
McGill University
Montreal, Canada
xueliu@cs.mcgill.ca
Huazhong University of
Science and Technology
dfeng@hust.edu.cn
Wuhan, China
ABSTRACT
In order to efﬁciently handle the rapid growth of data and reduce
the overhead of network transmission, we propose an in-network
deduplication for storage-aware Software Deﬁned Network (SDN),
called SMIND. Unlike conventional source or destination dedupli-
cation schemes, SMIND implements in-network deduplication via
SDN. Moreover, to address the performance bottleneck of access-
ing and indexing SDN controller, we implement an SDN-enabled
Flash Translation Layer (FTL) in a real prototype of Solid State
Disk (SSD). Experimental results demonstrate the efﬁciency and
efﬁcacy of SMIND.
Categories and Subject Descriptors
C.2.1 [COMPUTER-COMMUNICATION NETWORKS]: Net-
work Architecture and Design
Keywords
Software Deﬁned Network, Deduplication, Storage Systems
1.
INTRODUCTION
The amount of information created and replicated has rapidly
increase, in which there exists a large fraction of redundant data.
The heavy redundancy causes non-trivial overheads to the network
performance [1]. One solution is to detect data redundancy and
reduce the amount of duplicate data to be transmitted [2, 3].
Data deduplication can be executed in either source (e.g., clients)
or destination (e.g., servers) end systems. Speciﬁcally, source dedu-
plication is to remove data redundancy before transmission to the
destination.
It works through client software that communicates
with the server to compare arriving data with previously stored
data. If the server contains previously stored data, they will not
be sent. However, the source d...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Sizing router buffers
author:Guido Appenzeller and
Isaac Keslassy and
Nick McKeown
Sizing Router Buffers
Guido Appenzeller
Stanford University
Isaac Keslassy
Stanford University
Nick McKeown
Stanford University
appenz@cs.stanford.edu
keslassy@yuba.stanford.edu
nickm@stanford.edu
ABSTRACT
All Internet routers contain buﬀers to hold packets during
times of congestion. Today, the size of the buﬀers is deter-
mined by the dynamics of TCP’s congestion control algo-
rithm. In particular, the goal is to make sure that when a
link is congested, it is busy 100% of the time; which is equiv-
alent to making sure its buﬀer never goes empty. A widely
used rule-of-thumb states that each link needs a buﬀer of
size B = RT T × C, where RT T is the average round-trip
time of a ﬂow passing across the link, and C is the data rate
of the link. For example, a 10Gb/s router linecard needs
approximately 250ms × 10Gb/s = 2.5Gbits of buﬀers; and
the amount of buﬀering grows linearly with the line-rate.
Such large buﬀers are challenging for router manufacturers,
who must use large, slow, oﬀ-chip DRAMs. And queueing
delays can be long, have high variance, and may destabilize
the congestion control algorithms. In this paper we argue
that the rule-of-thumb (B = RT T × C) is now outdated and
incorrect for backbone routers. This is because of the large
number of ﬂows (TCP connections) multiplexed together on
a single backbone link. Using theory, simulation and exper-
√
iments on a network of real routers, we show that a link
with n ﬂows requires no more than B = (RT T × C)/
n, for
long-lived or short-lived TCP ﬂows. The consequences on
router design are enormous: A 2.5Gb/s link carrying 10,000
ﬂows could reduce its buﬀers by 99% with negligible dif-
ference in throughput; and a 10Gb/s link carrying 50,000
ﬂows requires only 10Mbits of buﬀering, which can easily be
implemented using fast, on-chip SRAM.
Categories and Subject Descriptors
C.2 [Internetworking]: Routers
∗
The authors are with th...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Sizing router buffers
author:Guido Appenzeller and
Isaac Keslassy and
Nick McKeown
Sizing Router Buffers
Guido Appenzeller
Stanford University
Isaac Keslassy
Stanford University
Nick McKeown
Stanford University
appenz@cs.stanford.edu
keslassy@yuba.stanford.edu
nickm@stanford.edu
ABSTRACT
All Internet routers contain buﬀers to hold packets during
times of congestion. Today, the size of the buﬀers is deter-
mined by the dynamics of TCP’s congestion control algo-
rithm. In particular, the goal is to make sure that when a
link is congested, it is busy 100% of the time; which is equiv-
alent to making sure its buﬀer never goes empty. A widely
used rule-of-thumb states that each link needs a buﬀer of
size B = RT T × C, where RT T is the average round-trip
time of a ﬂow passing across the link, and C is the data rate
of the link. For example, a 10Gb/s router linecard needs
approximately 250ms × 10Gb/s = 2.5Gbits of buﬀers; and
the amount of buﬀering grows linearly with the line-rate.
Such large buﬀers are challenging for router manufacturers,
who must use large, slow, oﬀ-chip DRAMs. And queueing
delays can be long, have high variance, and may destabilize
the congestion control algorithms. In this paper we argue
that the rule-of-thumb (B = RT T × C) is now outdated and
incorrect for backbone routers. This is because of the large
number of ﬂows (TCP connections) multiplexed together on
a single backbone link. Using theory, simulation and exper-
√
iments on a network of real routers, we show that a link
with n ﬂows requires no more than B = (RT T × C)/
n, for
long-lived or short-lived TCP ﬂows. The consequences on
router design are enormous: A 2.5Gb/s link carrying 10,000
ﬂows could reduce its buﬀers by 99% with negligible dif-
ference in throughput; and a 10Gb/s link carrying 50,000
ﬂows requires only 10Mbits of buﬀering, which can easily be
implemented using fast, on-chip SRAM.
Categories and Subject Descriptors
C.2 [Internetworking]: Routers
∗
The authors are with th...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:NtFuzz: Enabling Type-Aware Kernel Fuzzing on Windows with Static
Binary Analysis
author:Jaeseung Choi and
Kangsu Kim and
Daejin Lee and
Sang Kil Cha
2021 IEEE Symposium on Security and Privacy (SP)
NTFUZZ: Enabling Type-Aware Kernel Fuzzing on
Windows with Static Binary Analysis
Jaeseung Choi, Kangsu Kim, Daejin Lee, Sang Kil Cha
{jschoi17, kskim0610, djlee1592, sangkilc}@kaist.ac.kr
KAIST
4
1
1
0
0
.
1
2
0
2
.
1
0
0
0
4
P
S
/
9
0
1
1
.
0
1
:
I
O
D
|
E
E
E
I
1
2
0
2
©
0
0
.
1
3
$
/
1
2
/
5
-
4
3
9
8
-
1
8
2
7
-
1
-
8
7
9
|
)
P
S
(
y
c
a
v
i
r
P
d
n
a
y
t
i
r
u
c
e
S
n
o
m
u
i
s
o
p
m
y
S
E
E
E
I
1
2
0
2
Abstract—Although it is common practice for kernel fuzzers
to leverage type information of system calls, current Windows
kernel fuzzers do not follow the practice as most system calls are
private and largely undocumented. In this paper, we present a
practical static binary analyzer that automatically infers system
call types on Windows at scale. We incorporate our analyzer
to NTFUZZ, a type-aware Windows kernel fuzzing framework.
To our knowledge, this is the ﬁrst practical fuzzing system that
utilizes scalable binary analysis on a COTS OS. With NTFUZZ,
we found 11 previously unknown kernel bugs, and earned $25,000
through the bug bounty program offered by Microsoft. All these
results conﬁrm the practicality of our system as a kernel fuzzer.
I. INTRODUCTION
Software vulnerabilities in kernel code cause serious se-
curity breaches. At the very least, malicious attackers can
produce a Blue Screen of Death (BSoD) on a victim machine.
At worst, attackers can gain unprivileged access to the ker-
nel space, which entails information disclosure or privilege
escalation. For these reasons, the two biggest OS makers, i.e.,
Apple and Microsoft, are offering rewards up to $15,000 and
$30,000, respectively, for reporting a critical vulnerability in
their kernels [3], [57].
Therefore,
there has been growing research interest on
kernel fuzzing in both industry and academia [...


Instruction: 总结这篇安全研究的主要观点

Input:
title:NtFuzz: Enabling Type-Aware Kernel Fuzzing on Windows with Static
Binary Analysis
author:Jaeseung Choi and
Kangsu Kim and
Daejin Lee and
Sang Kil Cha
2021 IEEE Symposium on Security and Privacy (SP)
NTFUZZ: Enabling Type-Aware Kernel Fuzzing on
Windows with Static Binary Analysis
Jaeseung Choi, Kangsu Kim, Daejin Lee, Sang Kil Cha
{jschoi17, kskim0610, djlee1592, sangkilc}@kaist.ac.kr
KAIST
4
1
1
0
0
.
1
2
0
2
.
1
0
0
0
4
P
S
/
9
0
1
1
.
0
1
:
I
O
D
|
E
E
E
I
1
2
0
2
©
0
0
.
1
3
$
/
1
2
/
5
-
4
3
9
8
-
1
8
2
7
-
1
-
8
7
9
|
)
P
S
(
y
c
a
v
i
r
P
d
n
a
y
t
i
r
u
c
e
S
n
o
m
u
i
s
o
p
m
y
S
E
E
E
I
1
2
0
2
Abstract—Although it is common practice for kernel fuzzers
to leverage type information of system calls, current Windows
kernel fuzzers do not follow the practice as most system calls are
private and largely undocumented. In this paper, we present a
practical static binary analyzer that automatically infers system
call types on Windows at scale. We incorporate our analyzer
to NTFUZZ, a type-aware Windows kernel fuzzing framework.
To our knowledge, this is the ﬁrst practical fuzzing system that
utilizes scalable binary analysis on a COTS OS. With NTFUZZ,
we found 11 previously unknown kernel bugs, and earned $25,000
through the bug bounty program offered by Microsoft. All these
results conﬁrm the practicality of our system as a kernel fuzzer.
I. INTRODUCTION
Software vulnerabilities in kernel code cause serious se-
curity breaches. At the very least, malicious attackers can
produce a Blue Screen of Death (BSoD) on a victim machine.
At worst, attackers can gain unprivileged access to the ker-
nel space, which entails information disclosure or privilege
escalation. For these reasons, the two biggest OS makers, i.e.,
Apple and Microsoft, are offering rewards up to $15,000 and
$30,000, respectively, for reporting a critical vulnerability in
their kernels [3], [57].
Therefore,
there has been growing research interest on
kernel fuzzing in both industry and academia [...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:TabShots: client-side detection of tabnabbing attacks
author:Philippe De Ryck and
Nick Nikiforakis and
Lieven Desmet and
Wouter Joosen
TabShots: Client-Side Detection of Tabnabbing Attacks
Philippe De Ryck, Nick Nikiforakis, Lieven Desmet, Wouter Joosen
iMinds-Distrinet, KU Leuven, 3001 Leuven, Belgium
Philippe.DeRyck@cs.kuleuven.be
ABSTRACT
As the web grows larger and larger and as the browser be-
comes the vehicle-of-choice for delivering many applications
of daily use, the security and privacy of web users is under
constant attack. Phishing is as prevalent as ever, with anti-
phishing communities reporting thousands of new phishing
campaigns each month.
In 2010, tabnabbing, a variation
of phishing, was introduced.
In a tabnabbing attack, an
innocuous-looking page, opened in a browser tab, disguises
itself as the login page of a popular web application, when
the user’s focus is on a diﬀerent tab. The attack exploits the
trust of users for already opened pages and the user habit
of long-lived browser tabs.
To combat this recent attack, we propose TabShots. Tab-
Shots is a browser extension that helps browsers and users to
remember what each tab looked like, before the user changed
tabs. Our system compares the appearance of each tab and
highlights the parts that were changed, allowing the user to
distinguish between legitimate changes and malicious mas-
querading. Using an experimental evaluation on the most
popular sites of the Internet, we show that TabShots has
no impact on 78% of these sites, and very little on another
19%. Thereby, TabShots eﬀectively protects users against
tabnabbing attacks without aﬀecting their browsing habits
and without breaking legitimate popular sites.
Categories and Subject Descriptors
K.6.5 [Management of Computing and Information
Systems]: Security and Protection; H.3.5 [Information
Storage and Retrieval]: Web-based services
Keywords
Tabnabbing, phishing, client-side protection
Permission to make digital or hard copies of all ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:TabShots: client-side detection of tabnabbing attacks
author:Philippe De Ryck and
Nick Nikiforakis and
Lieven Desmet and
Wouter Joosen
TabShots: Client-Side Detection of Tabnabbing Attacks
Philippe De Ryck, Nick Nikiforakis, Lieven Desmet, Wouter Joosen
iMinds-Distrinet, KU Leuven, 3001 Leuven, Belgium
Philippe.DeRyck@cs.kuleuven.be
ABSTRACT
As the web grows larger and larger and as the browser be-
comes the vehicle-of-choice for delivering many applications
of daily use, the security and privacy of web users is under
constant attack. Phishing is as prevalent as ever, with anti-
phishing communities reporting thousands of new phishing
campaigns each month.
In 2010, tabnabbing, a variation
of phishing, was introduced.
In a tabnabbing attack, an
innocuous-looking page, opened in a browser tab, disguises
itself as the login page of a popular web application, when
the user’s focus is on a diﬀerent tab. The attack exploits the
trust of users for already opened pages and the user habit
of long-lived browser tabs.
To combat this recent attack, we propose TabShots. Tab-
Shots is a browser extension that helps browsers and users to
remember what each tab looked like, before the user changed
tabs. Our system compares the appearance of each tab and
highlights the parts that were changed, allowing the user to
distinguish between legitimate changes and malicious mas-
querading. Using an experimental evaluation on the most
popular sites of the Internet, we show that TabShots has
no impact on 78% of these sites, and very little on another
19%. Thereby, TabShots eﬀectively protects users against
tabnabbing attacks without aﬀecting their browsing habits
and without breaking legitimate popular sites.
Categories and Subject Descriptors
K.6.5 [Management of Computing and Information
Systems]: Security and Protection; H.3.5 [Information
Storage and Retrieval]: Web-based services
Keywords
Tabnabbing, phishing, client-side protection
Permission to make digital or hard copies of all ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Delving into internet streaming media delivery: a quality and resource
utilization perspective
author:Lei Guo and
Enhua Tan and
Songqing Chen and
Zhen Xiao and
Oliver Spatscheck and
Xiaodong Zhang
Delving into Internet Streaming Media Delivery: A Quality
and Resource Utilization Perspective
Lei Guo1, Enhua Tan1, Songqing Chen2, Zhen Xiao3, Oliver Spatscheck4, and Xiaodong Zhang1
1Department of Computer Science and Engineering
The Ohio State University
Columbus, OH 43210, USA
{lguo, etan, zhang}@cse.ohio-state.edu
3IBM T. J. Watson Research Center
19 Skyline Drive
Hawthorne, NY 10532, USA
xiaozhen@us.ibm.com
2Department of Computer Science
George Mason University
Fairfax, VA 22030, USA
sqchen@cs.gmu.edu
4AT&T Labs-Research
180 Park Ave.
Florham Park, NJ 07932, USA
spatsch@research.att.com
ABSTRACT
Modern Internet streaming services have utilized various
techniques to improve the quality of streaming media deliv-
ery. Despite the characterization of media access patterns
and user behaviors in many measurement studies, few stud-
ies have focused on the streaming techniques themselves,
particularly on the quality of streaming experiences they of-
fer end users and on the resources of the media systems
that they consume.
In order to gain insights into cur-
rent streaming services and thus provide guidance on de-
signing resource-eﬃcient and high quality streaming media
systems, we have collected a large streaming media work-
load from thousands of broadband home users and business
users hosted by a major ISP, and analyzed the most com-
monly used streaming techniques such as automatic protocol
switch, Fast Streaming, MBR encoding and rate adaptation.
Our measurement and analysis results show that with these
techniques, current streaming systems tend to over-utilize
CPU and bandwidth resources to provide better services to
end users, which may not be a desirable and eﬀective way
to improve the quality of streaming media delivery. Moti-
vated by these results, we pro...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Delving into internet streaming media delivery: a quality and resource
utilization perspective
author:Lei Guo and
Enhua Tan and
Songqing Chen and
Zhen Xiao and
Oliver Spatscheck and
Xiaodong Zhang
Delving into Internet Streaming Media Delivery: A Quality
and Resource Utilization Perspective
Lei Guo1, Enhua Tan1, Songqing Chen2, Zhen Xiao3, Oliver Spatscheck4, and Xiaodong Zhang1
1Department of Computer Science and Engineering
The Ohio State University
Columbus, OH 43210, USA
{lguo, etan, zhang}@cse.ohio-state.edu
3IBM T. J. Watson Research Center
19 Skyline Drive
Hawthorne, NY 10532, USA
xiaozhen@us.ibm.com
2Department of Computer Science
George Mason University
Fairfax, VA 22030, USA
sqchen@cs.gmu.edu
4AT&T Labs-Research
180 Park Ave.
Florham Park, NJ 07932, USA
spatsch@research.att.com
ABSTRACT
Modern Internet streaming services have utilized various
techniques to improve the quality of streaming media deliv-
ery. Despite the characterization of media access patterns
and user behaviors in many measurement studies, few stud-
ies have focused on the streaming techniques themselves,
particularly on the quality of streaming experiences they of-
fer end users and on the resources of the media systems
that they consume.
In order to gain insights into cur-
rent streaming services and thus provide guidance on de-
signing resource-eﬃcient and high quality streaming media
systems, we have collected a large streaming media work-
load from thousands of broadband home users and business
users hosted by a major ISP, and analyzed the most com-
monly used streaming techniques such as automatic protocol
switch, Fast Streaming, MBR encoding and rate adaptation.
Our measurement and analysis results show that with these
techniques, current streaming systems tend to over-utilize
CPU and bandwidth resources to provide better services to
end users, which may not be a desirable and eﬀective way
to improve the quality of streaming media delivery. Moti-
vated by these results, we pro...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Anomaly Detector Performance Evaluation Using a Parameterized Environment
author:Jeffery P. Hansen and
Kymie M. C. Tan and
Roy A. Maxion
Anomaly Detector Performance Evaluation
Using a Parameterized Environment
Jeﬀery P. Hansen, Kymie M.C. Tan, and Roy A. Maxion
Carnegie Mellon University, Pittsburgh, Pennsylvania / USA
Abstract. Over the years, intrusion detection has matured into a ﬁeld
replete with anomaly detectors of various types. These detectors are
tasked with detecting computer-based attacks, insider threats, worms
and more. Their abundance easily prompts the question - is anomaly de-
tection improving in eﬃcacy and reliability? Current evaluation strate-
gies may provide answers; however, they suﬀer from problems. For exam-
ple, they produce results that are only valid within the evaluation data
set and they provide very little by way of diagnostic information to tune
detector performance in a principled manner.
This paper studies the problem of acquiring reliable performance re-
sults for an anomaly detector. Aspects of a data environment that will
aﬀect detector performance, such as the frequency distribution of data
elements, are identiﬁed, characterized and used to construct a synthetic
data environment to assess a frequency-based anomaly detector. In a
series of experiments that systematically maps out the detector’s per-
formance, areas of detection weaknesses are exposed, and strengths are
identiﬁed. Finally, the extensibility of the lessons learned in the synthetic
environment are observed using real-world data.
Keywords: anomaly detection, performance modeling, IDS evaluation,
tuning.
1 Introduction
The results of a search on the web under anomaly detection will attest to the
prevalence of anomaly detectors and their application toward the detection of
worms, insider threats, and computer attacks. What is interesting, however, is
not the large number of hits but rather the increasing awareness by the main-
stream community regarding the shor...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Anomaly Detector Performance Evaluation Using a Parameterized Environment
author:Jeffery P. Hansen and
Kymie M. C. Tan and
Roy A. Maxion
Anomaly Detector Performance Evaluation
Using a Parameterized Environment
Jeﬀery P. Hansen, Kymie M.C. Tan, and Roy A. Maxion
Carnegie Mellon University, Pittsburgh, Pennsylvania / USA
Abstract. Over the years, intrusion detection has matured into a ﬁeld
replete with anomaly detectors of various types. These detectors are
tasked with detecting computer-based attacks, insider threats, worms
and more. Their abundance easily prompts the question - is anomaly de-
tection improving in eﬃcacy and reliability? Current evaluation strate-
gies may provide answers; however, they suﬀer from problems. For exam-
ple, they produce results that are only valid within the evaluation data
set and they provide very little by way of diagnostic information to tune
detector performance in a principled manner.
This paper studies the problem of acquiring reliable performance re-
sults for an anomaly detector. Aspects of a data environment that will
aﬀect detector performance, such as the frequency distribution of data
elements, are identiﬁed, characterized and used to construct a synthetic
data environment to assess a frequency-based anomaly detector. In a
series of experiments that systematically maps out the detector’s per-
formance, areas of detection weaknesses are exposed, and strengths are
identiﬁed. Finally, the extensibility of the lessons learned in the synthetic
environment are observed using real-world data.
Keywords: anomaly detection, performance modeling, IDS evaluation,
tuning.
1 Introduction
The results of a search on the web under anomaly detection will attest to the
prevalence of anomaly detectors and their application toward the detection of
worms, insider threats, and computer attacks. What is interesting, however, is
not the large number of hits but rather the increasing awareness by the main-
stream community regarding the shor...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Walkie-Talkie: An Efficient Defense Against Passive Website Fingerprinting
Attacks
author:Tao Wang and
Ian Goldberg
Walkie-Talkie: An Efficient Defense Against Passive
Website Fingerprinting Attacks
Tao Wang, Hong Kong University of Science and Technology;
Ian Goldberg, University of Waterloo
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/wang-tao
This paper is included in the Proceedings of the 26th USENIX Security SymposiumAugust 16–18, 2017 • Vancouver, BC, CanadaISBN 978-1-931971-40-9Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIXWalkie-Talkie: An Efﬁcient Defense Against
Passive Website Fingerprinting Attacks
Tao Wang
Department of Computer Science and Engineering
Hong Kong University of Science and Technology
taow@cse.ust.hk
Ian Goldberg
Cheriton School of Computer Science
University of Waterloo
iang@cs.uwaterloo.ca
Abstract
Website ﬁngerprinting (WF) is a trafﬁc analysis attack
that allows an eavesdropper to determine the web activ-
ity of a client, even if the client is using privacy tech-
nologies such as proxies, VPNs, or Tor. Recent work
has highlighted the threat of website ﬁngerprinting to
privacy-sensitive web users. Many previously designed
defenses against website ﬁngerprinting have been broken
by newer attacks that use better classiﬁers. The remain-
ing effective defenses are inefﬁcient: they hamper user
experience and burden the server with large overheads.
In this work we propose Walkie-Talkie, an effective
and efﬁcient WF defense. Walkie-Talkie modiﬁes the
browser to communicate in half-duplex mode rather than
the usual full-duplex mode; half-duplex mode produces
easily moldable burst sequences to leak less information
to the adversary, at little additional overhead. Designed
for the open-world scenario, Walkie-Talkie molds burst
sequences so that sensitive and non-sensitive pages look
the same. Experimentally, we show that Walkie-Talkie
can defeat all known...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Walkie-Talkie: An Efficient Defense Against Passive Website Fingerprinting
Attacks
author:Tao Wang and
Ian Goldberg
Walkie-Talkie: An Efficient Defense Against Passive
Website Fingerprinting Attacks
Tao Wang, Hong Kong University of Science and Technology;
Ian Goldberg, University of Waterloo
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/wang-tao
This paper is included in the Proceedings of the 26th USENIX Security SymposiumAugust 16–18, 2017 • Vancouver, BC, CanadaISBN 978-1-931971-40-9Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIXWalkie-Talkie: An Efﬁcient Defense Against
Passive Website Fingerprinting Attacks
Tao Wang
Department of Computer Science and Engineering
Hong Kong University of Science and Technology
taow@cse.ust.hk
Ian Goldberg
Cheriton School of Computer Science
University of Waterloo
iang@cs.uwaterloo.ca
Abstract
Website ﬁngerprinting (WF) is a trafﬁc analysis attack
that allows an eavesdropper to determine the web activ-
ity of a client, even if the client is using privacy tech-
nologies such as proxies, VPNs, or Tor. Recent work
has highlighted the threat of website ﬁngerprinting to
privacy-sensitive web users. Many previously designed
defenses against website ﬁngerprinting have been broken
by newer attacks that use better classiﬁers. The remain-
ing effective defenses are inefﬁcient: they hamper user
experience and burden the server with large overheads.
In this work we propose Walkie-Talkie, an effective
and efﬁcient WF defense. Walkie-Talkie modiﬁes the
browser to communicate in half-duplex mode rather than
the usual full-duplex mode; half-duplex mode produces
easily moldable burst sequences to leak less information
to the adversary, at little additional overhead. Designed
for the open-world scenario, Walkie-Talkie molds burst
sequences so that sensitive and non-sensitive pages look
the same. Experimentally, we show that Walkie-Talkie
can defeat all known...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:POSTER: Mining Elephant Applications in Unknown Traffic by Service
Clustering
author:Hongliang Yu and
Yong Zhao and
Gang Xiong and
Li Guo and
Zhen Li and
Yong Wang
POSTER: Mining Elephant Applications in Unknown Traffic
by Service Clustering
Hongliang Yu
School of Computer Science, Beijing
University of Posts and
Telecommunications, China
yuhongliang@bupt.edu.cn
Yong Zhao, Gang Xiong,
Li Guo, Zhen Li
Institute of Information Engineering,
Chinese Academy of Sciences,
China
familyname.firstname@iie.ac.cn
Yong Wang
The National Computer Network
Emergency Response Technical
Team/Coordination Center of China
wangyong@cert.org.cn
ABSTRACT
Network  traffic  classification  is  of  great  importance  for  fine-
grained  network  management  and  network  security.  However,
with the rapid development of new network applications in recent
years, traffic that cannot be identified by classifiers accounts for
an  increasing  ratio,  which  brings  a  great  challenge  for  network
operators.  Most  of  the  unknown  traffic  is  usually  generated  by
only a few or some certain kinds of applications. We call this kind
of  traffic  as  the  elephant  traffic.  It  is  generally  recognized  that
traffic sharing the same server IP and server port is generated by
the same application. In this paper, we say that they are belonging
to  the  same  service.  Therefore,  we  propose  a  novel  method,  in
which  service-based  statistical  features  are  used  for  cluster
analysis,  to classify these elephant traffic. Preliminary results on
a  real  network  traffic  dataset  show  that  our  method  is  able  to
automatically identify similar unknown applications. We believe
that  classifying  unknown  traffic  in  service  perspective  is  a
promising direction.
Categories and Subject Descriptors
C.2.3 [Computer Communication Networks]: Network
monitoring; Network management
Keywords
Service, Unknown Traffic, Traffic Classification, Ele...


Instruction: 总结这篇安全研究的主要观点

Input:
title:POSTER: Mining Elephant Applications in Unknown Traffic by Service
Clustering
author:Hongliang Yu and
Yong Zhao and
Gang Xiong and
Li Guo and
Zhen Li and
Yong Wang
POSTER: Mining Elephant Applications in Unknown Traffic
by Service Clustering
Hongliang Yu
School of Computer Science, Beijing
University of Posts and
Telecommunications, China
yuhongliang@bupt.edu.cn
Yong Zhao, Gang Xiong,
Li Guo, Zhen Li
Institute of Information Engineering,
Chinese Academy of Sciences,
China
familyname.firstname@iie.ac.cn
Yong Wang
The National Computer Network
Emergency Response Technical
Team/Coordination Center of China
wangyong@cert.org.cn
ABSTRACT
Network  traffic  classification  is  of  great  importance  for  fine-
grained  network  management  and  network  security.  However,
with the rapid development of new network applications in recent
years, traffic that cannot be identified by classifiers accounts for
an  increasing  ratio,  which  brings  a  great  challenge  for  network
operators.  Most  of  the  unknown  traffic  is  usually  generated  by
only a few or some certain kinds of applications. We call this kind
of  traffic  as  the  elephant  traffic.  It  is  generally  recognized  that
traffic sharing the same server IP and server port is generated by
the same application. In this paper, we say that they are belonging
to  the  same  service.  Therefore,  we  propose  a  novel  method,  in
which  service-based  statistical  features  are  used  for  cluster
analysis,  to classify these elephant traffic. Preliminary results on
a  real  network  traffic  dataset  show  that  our  method  is  able  to
automatically identify similar unknown applications. We believe
that  classifying  unknown  traffic  in  service  perspective  is  a
promising direction.
Categories and Subject Descriptors
C.2.3 [Computer Communication Networks]: Network
monitoring; Network management
Keywords
Service, Unknown Traffic, Traffic Classification, Ele...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:SWIFT: Super-fast and Robust Privacy-Preserving Machine Learning
author:Nishat Koti and
Mahak Pancholi and
Arpita Patra and
Ajith Suresh
SWIFT: Super-fast and Robust Privacy-Preserving
Machine Learning
Nishat Koti, Mahak Pancholi, Arpita Patra, and Ajith Suresh,
Indian Institute of Science, Bangalore
https://www.usenix.org/conference/usenixsecurity21/presentation/koti
This paper is included in the Proceedings of the 30th USENIX Security Symposium.August 11–13, 2021978-1-939133-24-3Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX.SWIFT: Super-fast and Robust Privacy-Preserving Machine Learning
Nishat Koti
Indian Institute of Science
Mahak Pancholi
Indian Institute of Science
Ajith Suresh
Indian Institute of Science
Arpita Patra
Indian Institute of Science
Abstract
Performing machine learning (ML) computation on private
data while maintaining data privacy, aka Privacy-preserving
Machine Learning (PPML), is an emergent ﬁeld of research.
Recently, PPML has seen a visible shift towards the adoption
of the Secure Outsourced Computation (SOC) paradigm due
to the heavy computation that it entails. In the SOC paradigm,
computation is outsourced to a set of powerful and specially
equipped servers that provide service on a pay-per-use basis.
In this work, we propose SWIFT, a robust PPML framework
for a range of ML algorithms in SOC setting, that guarantees
output delivery to the users irrespective of any adversarial
behaviour. Robustness, a highly desirable feature, evokes user
participation without the fear of denial of service.
At the heart of our framework lies a highly-efﬁcient,
maliciously-secure, three-party computation (3PC) over rings
that provides guaranteed output delivery (GOD) in the honest-
majority setting. To the best of our knowledge, SWIFT is the
ﬁrst robust and efﬁcient PPML framework in the 3PC set-
ting. SWIFT is as fast as (and is strictly better in some cases
than) the best-known 3PC framework BLAZE (Pat...


Instruction: 总结这篇安全研究的主要观点

Input:
title:SWIFT: Super-fast and Robust Privacy-Preserving Machine Learning
author:Nishat Koti and
Mahak Pancholi and
Arpita Patra and
Ajith Suresh
SWIFT: Super-fast and Robust Privacy-Preserving
Machine Learning
Nishat Koti, Mahak Pancholi, Arpita Patra, and Ajith Suresh,
Indian Institute of Science, Bangalore
https://www.usenix.org/conference/usenixsecurity21/presentation/koti
This paper is included in the Proceedings of the 30th USENIX Security Symposium.August 11–13, 2021978-1-939133-24-3Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX.SWIFT: Super-fast and Robust Privacy-Preserving Machine Learning
Nishat Koti
Indian Institute of Science
Mahak Pancholi
Indian Institute of Science
Ajith Suresh
Indian Institute of Science
Arpita Patra
Indian Institute of Science
Abstract
Performing machine learning (ML) computation on private
data while maintaining data privacy, aka Privacy-preserving
Machine Learning (PPML), is an emergent ﬁeld of research.
Recently, PPML has seen a visible shift towards the adoption
of the Secure Outsourced Computation (SOC) paradigm due
to the heavy computation that it entails. In the SOC paradigm,
computation is outsourced to a set of powerful and specially
equipped servers that provide service on a pay-per-use basis.
In this work, we propose SWIFT, a robust PPML framework
for a range of ML algorithms in SOC setting, that guarantees
output delivery to the users irrespective of any adversarial
behaviour. Robustness, a highly desirable feature, evokes user
participation without the fear of denial of service.
At the heart of our framework lies a highly-efﬁcient,
maliciously-secure, three-party computation (3PC) over rings
that provides guaranteed output delivery (GOD) in the honest-
majority setting. To the best of our knowledge, SWIFT is the
ﬁrst robust and efﬁcient PPML framework in the 3PC set-
ting. SWIFT is as fast as (and is strictly better in some cases
than) the best-known 3PC framework BLAZE (Pat...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A Large-Scale Empirical Analysis of Chinese Web Passwords
author:Zhigong Li and
Weili Han and
Wenyuan Xu
SAVE THE DATE
23rd USENIX Security Symposium
AUGUST 20–22, 2014 • SAN DIEGO, CA
The USENIX Security Symposium brings together researchers, practitioners, system admin istrators,  system programmers,
and others interested in the latest advances in the security of computer  systems and networks. The Symposium will
include a 3-day technical program with refereed papers, invited talks, posters, panel discussions, and Birds-of-a-Feather
sessions. Featured speakers/sessions include:
Keynote Address by Phil Lapsley, author of Exploding the
Phone: The Untold Story of the Teenagers and Outlaws Who
Hacked Ma Bell
Panel: “The Future of Crypto: Getting from Here to
Guarantees” with Daniel J. Bernstein, Matt Blaze, and
Tanja Lange
Invited Talk: “Battling Human Trafficking with Big Data”
by Rolando R. Lopez, Orphan Secure
Invited Talk: “Insight into the NSA’s Weakening
of Crypto Standards” by Joseph Menn, Reuters
The following co-located events will precede the Symposium on August 18–19, 2014:
EVT/WOTE ’14: 2014 Electronic Voting Technology
Workshop/Workshop on Trustworthy Elections
USENIX Journal of Election Technology
and Systems (JETS)
Published in conjunction with EVT/WOTE
www.usenix.org/jets
CSET ’14: 7th Workshop on Cyber Security
Experimentation and Test
NEW! 3GSE ’14: 2014 USENIX Summit on Gaming,
Games, and Gamification in Security Education
FOCI ’14: 4th USENIX Workshop on Free and Open
Communications on the Internet
HotSec ’14: 2014 USENIX Summit on Hot Topics
in Security
HealthTech ’14: 2014 USENIX Summit on Health
Information Technologies
Safety, Security, Privacy, and Interoperability
of Health Information Technologies
WOOT ’14: 8th USENIX Workshop on Offensive
Technologies
www.usenix.org/sec14
Stay Connected...
twitter.com/USENIXSecurity
www.usenix.org/facebook
www.usenix.org/youtube
www.usenix.org/linkedin
www.usenix.org/gplus...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A Large-Scale Empirical Analysis of Chinese Web Passwords
author:Zhigong Li and
Weili Han and
Wenyuan Xu
SAVE THE DATE
23rd USENIX Security Symposium
AUGUST 20–22, 2014 • SAN DIEGO, CA
The USENIX Security Symposium brings together researchers, practitioners, system admin istrators,  system programmers,
and others interested in the latest advances in the security of computer  systems and networks. The Symposium will
include a 3-day technical program with refereed papers, invited talks, posters, panel discussions, and Birds-of-a-Feather
sessions. Featured speakers/sessions include:
Keynote Address by Phil Lapsley, author of Exploding the
Phone: The Untold Story of the Teenagers and Outlaws Who
Hacked Ma Bell
Panel: “The Future of Crypto: Getting from Here to
Guarantees” with Daniel J. Bernstein, Matt Blaze, and
Tanja Lange
Invited Talk: “Battling Human Trafficking with Big Data”
by Rolando R. Lopez, Orphan Secure
Invited Talk: “Insight into the NSA’s Weakening
of Crypto Standards” by Joseph Menn, Reuters
The following co-located events will precede the Symposium on August 18–19, 2014:
EVT/WOTE ’14: 2014 Electronic Voting Technology
Workshop/Workshop on Trustworthy Elections
USENIX Journal of Election Technology
and Systems (JETS)
Published in conjunction with EVT/WOTE
www.usenix.org/jets
CSET ’14: 7th Workshop on Cyber Security
Experimentation and Test
NEW! 3GSE ’14: 2014 USENIX Summit on Gaming,
Games, and Gamification in Security Education
FOCI ’14: 4th USENIX Workshop on Free and Open
Communications on the Internet
HotSec ’14: 2014 USENIX Summit on Hot Topics
in Security
HealthTech ’14: 2014 USENIX Summit on Health
Information Technologies
Safety, Security, Privacy, and Interoperability
of Health Information Technologies
WOOT ’14: 8th USENIX Workshop on Offensive
Technologies
www.usenix.org/sec14
Stay Connected...
twitter.com/USENIXSecurity
www.usenix.org/facebook
www.usenix.org/youtube
www.usenix.org/linkedin
www.usenix.org/gplus...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:The power of procrastination: detection and mitigation of execution-stalling
malicious code
author:Clemens Kolbitsch and
Engin Kirda and
Christopher Kruegel
The Power of Procrastination: Detection and
Mitigation of Execution-Stalling Malicious Code
Clemens Kolbitsch
Vienna University of
Technology
Vienna, Austria
ck@iseclab.org
Engin Kirda
Northeastern University
Boston, MA, USA
ek@ccs.neu.edu
Christopher Kruegel
UC Santa Barbara
Santa Barbara, CA, USA
chris@cs.ucsb.edu
Abstract
Malware continues to remain one of the most important security
problems on the Internet today. Whenever an anti-malware solu-
tion becomes popular, malware authors typically react promptly
and modify their programs to evade defense mechanisms. For ex-
ample, recently, malware authors have increasingly started to create
malicious code that can evade dynamic analysis.
One recent form of evasion against dynamic analysis systems is
stalling code. Stalling code is typically executed before any mali-
cious behavior. The attacker’s aim is to delay the execution of the
malicious activity long enough so that an automated dynamic anal-
ysis system fails to extract the interesting malicious behavior. This
paper presents the ﬁrst approach to detect and mitigate malicious
stalling code, and to ensure forward progress within the amount of
time allocated for the analysis of a sample. Experimental results
show that our system, called HASTEN, works well in practice, and
that it is able to detect additional malicious behavior in real-world
malware samples.
Categories and Subject Descriptors
D.4.6 [Operating Systems]: Security and Protection
General Terms
Security
Keywords
Malware Analysis, Evasion, Emulation
1.
INTRODUCTION
Malicious software (malware) is the driving force behind many
security problems on the web. For example, a large fraction of the
world’s email spam is sent by botnets [16], Trojan programs steal
account credentials for online banking sites [27], and malware pro-
grams participate in ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:The power of procrastination: detection and mitigation of execution-stalling
malicious code
author:Clemens Kolbitsch and
Engin Kirda and
Christopher Kruegel
The Power of Procrastination: Detection and
Mitigation of Execution-Stalling Malicious Code
Clemens Kolbitsch
Vienna University of
Technology
Vienna, Austria
ck@iseclab.org
Engin Kirda
Northeastern University
Boston, MA, USA
ek@ccs.neu.edu
Christopher Kruegel
UC Santa Barbara
Santa Barbara, CA, USA
chris@cs.ucsb.edu
Abstract
Malware continues to remain one of the most important security
problems on the Internet today. Whenever an anti-malware solu-
tion becomes popular, malware authors typically react promptly
and modify their programs to evade defense mechanisms. For ex-
ample, recently, malware authors have increasingly started to create
malicious code that can evade dynamic analysis.
One recent form of evasion against dynamic analysis systems is
stalling code. Stalling code is typically executed before any mali-
cious behavior. The attacker’s aim is to delay the execution of the
malicious activity long enough so that an automated dynamic anal-
ysis system fails to extract the interesting malicious behavior. This
paper presents the ﬁrst approach to detect and mitigate malicious
stalling code, and to ensure forward progress within the amount of
time allocated for the analysis of a sample. Experimental results
show that our system, called HASTEN, works well in practice, and
that it is able to detect additional malicious behavior in real-world
malware samples.
Categories and Subject Descriptors
D.4.6 [Operating Systems]: Security and Protection
General Terms
Security
Keywords
Malware Analysis, Evasion, Emulation
1.
INTRODUCTION
Malicious software (malware) is the driving force behind many
security problems on the web. For example, a large fraction of the
world’s email spam is sent by botnets [16], Trojan programs steal
account credentials for online banking sites [27], and malware pro-
grams participate in ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Robotron: Top-down Network Management at Facebook Scale
author:Yu-Wei Eric Sung and
Xiaozheng Tie and
Starsky H. Y. Wong and
Hongyi Zeng
Robotron: Top-down Network Management at
Facebook Scale
Yu-Wei Eric Sung, Xiaozheng Tie, Starsky H.Y. Wong, and Hongyi Zeng
Facebook, Inc.
robotron@fb.com
ABSTRACT
Network management facilitates a healthy and sustain-
able network. However, its practice is not well under-
stood outside the network engineering community. In
this paper, we present Robotron, a system for manag-
ing a massive production network in a top-down fash-
ion. The system’s goal is to reduce eﬀort and errors on
management tasks by minimizing direct human inter-
action with network devices. Engineers use Robotron
to express high-level design intent, which is translated
into low-level device conﬁgurations and deployed safely.
Robotron also monitors devices’ operational state to en-
sure it does not deviate from the desired state. Since
2008, Robotron has been used to manage tens of thou-
sands of network devices connecting hundreds of thou-
sands of servers globally at Facebook.
CCS Concepts
•Networks → Network management;
Keywords
Robotron, Network Management, Facebook
1.
INTRODUCTION
“Lots of folks confuse bad management
with destiny.” — Kin Hubbard
Managing a large, dynamic, and heavily utilized net-
work is challenging. Everyday, network engineers per-
form numerous diverse tasks such as circuit turn-up and
Permission to make digital or hard copies of all or part of this work for personal
or classroom use is granted without fee provided that copies are not made or
distributed for proﬁt or commercial advantage and that copies bear this notice
and the full citation on the ﬁrst page. Copyrights for components of this work
owned by others than the author(s) must be honored. Abstracting with credit is
permitted. To copy otherwise, or republish, to post on servers or to redistribute to
lists, requires prior speciﬁc permission and/or a fee. Request permissions...