Instruction: 总结这篇安全研究的主要观点

Input:
title:Taking Routers Off Their Meds: Why Assumptions Of Router Stability
Are Dangerous
author:Max Schuchard and
Christopher Thompson and
Nicholas Hopper and
Yongdae Kim
Taking Routers Off Their Meds:
Why Assumptions Of Router Stability Are Dangerous
Max Schuchard, Christopher Thompson, Nicholas Hopper, Yongdae Kim
University of Minnesota
{schuch, cthomp, hopper, kyd} @ cs.umn.edu
In this work, we examine how an adversary in control
of a BGP speaker in a transit AS can cause a victim router
in an arbitrary location on the Internet to become unstable.
Through experimentation with both hardware and software
routers, we look at the behavior of routers under abnor-
mal conditions and come to four conclusions. First, routers
placed in certain states behave in anything but a stable man-
ner. Second, unexpected but perfectly legal BGP messages
can place routers into those states with disconcerting ease.
Third, an adversary can use these messages to disrupt a vic-
tim router to which he is not directly connected. Fourth,
modern best practices do little to prevent these attacks.
)
(
 0
B
M
Time (s)
y
r
o
m
e
M
CISCO
Quagga
Through
Figure 1.
 500  1000  1500  2000  2500
70.0
60.0
50.0
40.0
30.0
20.0
10.0
0.0
-10.0
experi-
ments on hardware
and software routers,
we
observed what
happens when routers
ﬁnd
themselves
starved for CPU cy-
cles or memory. We
witnessed a variety of
failure modes, ranging
from severe perfor-
mance degradation to the unrecoverable failure of all active
routing sessions. We also observed that a router placed into
one of these states would more than likely cause its peers
to enter one or more of these states as well. An example of
this is a CPU starved router was the exhausting its peer’s
memory. When the rate of incoming BGP updates exceeds
a router’s computational capacity, the receiving router only
buffers a ﬁxed number of incoming BGP messages. When
those limits are reached it is up to the sender to buffer
all future updates until the CPU starved rout...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Polygraph: Automatically Generating Signatures for Polymorphic Worms
author:James Newsome and
Brad Karp and
Dawn Xiaodong Song
Polygraph: Automatically Generating Signatures
for Polymorphic Worms
James Newsome
Carnegie Mellon University
jnewsome@ece.cmu.edu
Brad Karp
Dawn Song
Intel Research Pittsburgh
brad.n.karp@intel.com
Carnegie Mellon University
bkarp+@cs.cmu.edu
Carnegie Mellon University
dawnsong@cmu.edu
Abstract
It is widely believed that content-signature-based intru-
sion detection systems (IDSes) are easily evaded by poly-
morphic worms, which vary their payload on every infec-
tion attempt.
In this paper, we present Polygraph, a sig-
nature generation system that successfully produces signa-
tures that match polymorphic worms. Polygraph gener-
ates signatures that consist of multiple disjoint content sub-
strings. In doing so, Polygraph leverages our insight that
for a real-world exploit to function properly, multiple in-
variant substrings must often be present in all variants of
a payload; these substrings typically correspond to proto-
col framing, return addresses, and in some cases, poorly
obfuscated code. We contribute a deﬁnition of the poly-
morphic signature generation problem; propose classes of
signature suited for matching polymorphic worm payloads;
and present algorithms for automatic generation of signa-
tures in these classes. Our evaluation of these algorithms on
a range of polymorphic worms demonstrates that Polygraph
produces signatures for polymorphic worms that exhibit low
false negatives and false positives.
1. Introduction and Motivation
Enabled by ever-more pervasive Internet connectivity, an
increasing variety of exploitable vulnerabilities in software,
and a lack of diversity in the software running on Internet-
attached hosts, Internet worms increasingly threaten the
availability and integrity of Internet-based services.
Toward defending against Internet worms (and other at-
tacks), the research community has proposed and ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Polygraph: Automatically Generating Signatures for Polymorphic Worms
author:James Newsome and
Brad Karp and
Dawn Xiaodong Song
Polygraph: Automatically Generating Signatures
for Polymorphic Worms
James Newsome
Carnegie Mellon University
jnewsome@ece.cmu.edu
Brad Karp
Dawn Song
Intel Research Pittsburgh
brad.n.karp@intel.com
Carnegie Mellon University
bkarp+@cs.cmu.edu
Carnegie Mellon University
dawnsong@cmu.edu
Abstract
It is widely believed that content-signature-based intru-
sion detection systems (IDSes) are easily evaded by poly-
morphic worms, which vary their payload on every infec-
tion attempt.
In this paper, we present Polygraph, a sig-
nature generation system that successfully produces signa-
tures that match polymorphic worms. Polygraph gener-
ates signatures that consist of multiple disjoint content sub-
strings. In doing so, Polygraph leverages our insight that
for a real-world exploit to function properly, multiple in-
variant substrings must often be present in all variants of
a payload; these substrings typically correspond to proto-
col framing, return addresses, and in some cases, poorly
obfuscated code. We contribute a deﬁnition of the poly-
morphic signature generation problem; propose classes of
signature suited for matching polymorphic worm payloads;
and present algorithms for automatic generation of signa-
tures in these classes. Our evaluation of these algorithms on
a range of polymorphic worms demonstrates that Polygraph
produces signatures for polymorphic worms that exhibit low
false negatives and false positives.
1. Introduction and Motivation
Enabled by ever-more pervasive Internet connectivity, an
increasing variety of exploitable vulnerabilities in software,
and a lack of diversity in the software running on Internet-
attached hosts, Internet worms increasingly threaten the
availability and integrity of Internet-based services.
Toward defending against Internet worms (and other at-
tacks), the research community has proposed and ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Efficient computational oblivious transfer using interactive hashing
author:Kirill Morozov and
George Savvides
Efﬁcient Computational Oblivious Transfer
Using Interactive Hashing
(cid:3)
Kirill Morozov
Faculty of Mathematics, Kyushu University
744 Motooka Nishi-ku Fukuoka 819-0395 Japan
morozov@math.kyushu-u.ac.jp
ABSTRACT
We present two protocols for reducing oblivious transfer
(OT) to the security of trapdoor permutations and to the
hardness of some coding problems, respectively. The (cid:12)rst
protocol is the most e(cid:14)cient known to date, while the sec-
ond one is a theoretical proof-of-concept. Our construc-
tions leverage the power of Interactive Hashing (IH). The
(cid:12)rst protocol can be viewed as a simple modi(cid:12)cation of the
well-known OT construction by Even, Goldreich and Lem-
pel (1985), in which a receiver must send a random domain
element to a sender through IH. Alternatively, our protocol
can be viewed as a simple modi(cid:12)cation of the construction
by Ostrovsky, Venkatesan and Yung (1993), in which the
players substitute the one-way permutation with a trapdoor
permutation. We use a similar approach to derive a second
OT protocol based on coding assumptions related to security
of the McEliece cryptosystem. In our second construction,
the receiver inputs a public key into IH while privately keep-
ing the corresponding secret key. Two di(cid:11)erent versions of
IH are used: the computationally secure one in the (cid:12)rst pro-
tocol, and the information-theoretically secure one in the
second.
Categories and Subject Descriptors
F.m [Theory of Computation]: Miscellaneous|distribu-
ted computation; E.3 [Data]: Data Encryption|public key
cryptosystems; E.4 [Data]: Coding and Information Theo-
ry|error correcting codes
General Terms
Security, Theory
Keywords
Oblivious transfer, interactive hashing, trapdoor permuta-
(cid:3)
This work was done when Kirill Morozov was with Research
Center for Information Security, National Institute of ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Efficient computational oblivious transfer using interactive hashing
author:Kirill Morozov and
George Savvides
Efﬁcient Computational Oblivious Transfer
Using Interactive Hashing
(cid:3)
Kirill Morozov
Faculty of Mathematics, Kyushu University
744 Motooka Nishi-ku Fukuoka 819-0395 Japan
morozov@math.kyushu-u.ac.jp
ABSTRACT
We present two protocols for reducing oblivious transfer
(OT) to the security of trapdoor permutations and to the
hardness of some coding problems, respectively. The (cid:12)rst
protocol is the most e(cid:14)cient known to date, while the sec-
ond one is a theoretical proof-of-concept. Our construc-
tions leverage the power of Interactive Hashing (IH). The
(cid:12)rst protocol can be viewed as a simple modi(cid:12)cation of the
well-known OT construction by Even, Goldreich and Lem-
pel (1985), in which a receiver must send a random domain
element to a sender through IH. Alternatively, our protocol
can be viewed as a simple modi(cid:12)cation of the construction
by Ostrovsky, Venkatesan and Yung (1993), in which the
players substitute the one-way permutation with a trapdoor
permutation. We use a similar approach to derive a second
OT protocol based on coding assumptions related to security
of the McEliece cryptosystem. In our second construction,
the receiver inputs a public key into IH while privately keep-
ing the corresponding secret key. Two di(cid:11)erent versions of
IH are used: the computationally secure one in the (cid:12)rst pro-
tocol, and the information-theoretically secure one in the
second.
Categories and Subject Descriptors
F.m [Theory of Computation]: Miscellaneous|distribu-
ted computation; E.3 [Data]: Data Encryption|public key
cryptosystems; E.4 [Data]: Coding and Information Theo-
ry|error correcting codes
General Terms
Security, Theory
Keywords
Oblivious transfer, interactive hashing, trapdoor permuta-
(cid:3)
This work was done when Kirill Morozov was with Research
Center for Information Security, National Institute of ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Swarm Attacks against Network-Level Emulation/Analysis
author:Simon P. Chung and
Aloysius K. Mok
Swarm Attacks against Network-Level
Emulation/Analysis
Simon P. Chung and Aloysius K. Mok(cid:2)
University of Texas at Austin, Austin TX 78712, USA
Department of Computer Sciences,
{phchung,mok}@cs.utexas.edu
Abstract. It is always assumed that if the attackers can achieve their
goal by exploiting a vulnerability once, they won’t exploit it twice. This
assumption shapes our view of what attacks look like, and aﬀects the
design of many security systems. In this work, we propose the swarm
attack, in which the attacker deliberately exploits the same vulnerability
multiple times, each intended to carry out only a small part of the attack
goal. We have studied eight systems that detect attacks using network-
level emulation/analysis, and ﬁnd them surprisingly vulnerable to attacks
based on this strategy.
Keywords: Decoder detection; network-level emulation; network IDS;
evasion; swarm attacks.
1 Introduction
In its simplest, most common form, a control hijacking attack works as follow: the
attacker sends in one single malicious input with the proper “protocol frame”
to trigger the targeted vulnerability, together with a self contained payload
that will achieve the attacker’s goal once executed. When the malicious input is
processed, certain control data structure will be overwritten, and this results in
an almost instant transfer of control to the attacker’s payload. We believe
many security systems are designed with this simple model of attacks in mind,
and it is usually implicitly assumed that the attacker gains nothing by making
the attack more complicated (or less “eﬃcient”). In other word, if they can get
all their attack code executed with one instance of control hijacking, they will
not divide their code into multiple pieces and execute them through multiple
exploitations of the vulnerability. Similarly, the attacker will overwrite the piece
of control data that...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Swarm Attacks against Network-Level Emulation/Analysis
author:Simon P. Chung and
Aloysius K. Mok
Swarm Attacks against Network-Level
Emulation/Analysis
Simon P. Chung and Aloysius K. Mok(cid:2)
University of Texas at Austin, Austin TX 78712, USA
Department of Computer Sciences,
{phchung,mok}@cs.utexas.edu
Abstract. It is always assumed that if the attackers can achieve their
goal by exploiting a vulnerability once, they won’t exploit it twice. This
assumption shapes our view of what attacks look like, and aﬀects the
design of many security systems. In this work, we propose the swarm
attack, in which the attacker deliberately exploits the same vulnerability
multiple times, each intended to carry out only a small part of the attack
goal. We have studied eight systems that detect attacks using network-
level emulation/analysis, and ﬁnd them surprisingly vulnerable to attacks
based on this strategy.
Keywords: Decoder detection; network-level emulation; network IDS;
evasion; swarm attacks.
1 Introduction
In its simplest, most common form, a control hijacking attack works as follow: the
attacker sends in one single malicious input with the proper “protocol frame”
to trigger the targeted vulnerability, together with a self contained payload
that will achieve the attacker’s goal once executed. When the malicious input is
processed, certain control data structure will be overwritten, and this results in
an almost instant transfer of control to the attacker’s payload. We believe
many security systems are designed with this simple model of attacks in mind,
and it is usually implicitly assumed that the attacker gains nothing by making
the attack more complicated (or less “eﬃcient”). In other word, if they can get
all their attack code executed with one instance of control hijacking, they will
not divide their code into multiple pieces and execute them through multiple
exploitations of the vulnerability. Similarly, the attacker will overwrite the piece
of control data that...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:HyperDex: a distributed, searchable key-value store
author:Robert Escriva and
Bernard Wong and
Emin G"un Sirer
HyperDex: A Distributed, Searchable Key-Value Store
Robert Escriva
Computer Science
Department
Cornell University
escriva@cs.cornell.edu
Bernard Wong
Cheriton School of Computer
Science
University of Waterloo
bernard@uwaterloo.ca
Emin Gün Sirer
Computer Science
Department
Cornell University
egs@systems.cs.cornell.edu
ABSTRACT
Distributed key-value stores are now a standard component
of high-performance web services and cloud computing ap-
plications. While key-value stores oﬀer signiﬁcant perfor-
mance and scalability advantages compared to traditional
databases, they achieve these properties through a restricted
API that limits object retrieval—an object can only be re-
trieved by the (primary and only) key under which it was
inserted. This paper presents HyperDex, a novel distributed
key-value store that provides a unique search primitive that
enables queries on secondary attributes. The key insight
behind HyperDex is the concept of hyperspace hashing in
which objects with multiple attributes are mapped into a
multidimensional hyperspace. This mapping leads to eﬃ-
cient implementations not only for retrieval by primary key,
but also for partially-speciﬁed secondary attribute searches
and range queries. A novel chaining protocol enables the
system to achieve strong consistency, maintain availability
and guarantee fault tolerance. An evaluation of the full sys-
tem shows that HyperDex is 12-13× faster than Cassandra
and MongoDB for ﬁnding partially speciﬁed objects. Ad-
ditionally, HyperDex achieves 2-4× higher throughput for
get/put operations.
Categories and Subject Descriptors
D.4.7 [Operating Systems]: Organization and Design
Keywords
Key-Value Store, NoSQL, Fault-Tolerance, Strong Consis-
tency, Performance
1.
INTRODUCTION
Modern distributed applications are reshaping the land-
scape of storage systems. Recently emerging distributed
key-valu...


Instruction: 总结这篇安全研究的主要观点

Input:
title:HyperDex: a distributed, searchable key-value store
author:Robert Escriva and
Bernard Wong and
Emin G"un Sirer
HyperDex: A Distributed, Searchable Key-Value Store
Robert Escriva
Computer Science
Department
Cornell University
escriva@cs.cornell.edu
Bernard Wong
Cheriton School of Computer
Science
University of Waterloo
bernard@uwaterloo.ca
Emin Gün Sirer
Computer Science
Department
Cornell University
egs@systems.cs.cornell.edu
ABSTRACT
Distributed key-value stores are now a standard component
of high-performance web services and cloud computing ap-
plications. While key-value stores oﬀer signiﬁcant perfor-
mance and scalability advantages compared to traditional
databases, they achieve these properties through a restricted
API that limits object retrieval—an object can only be re-
trieved by the (primary and only) key under which it was
inserted. This paper presents HyperDex, a novel distributed
key-value store that provides a unique search primitive that
enables queries on secondary attributes. The key insight
behind HyperDex is the concept of hyperspace hashing in
which objects with multiple attributes are mapped into a
multidimensional hyperspace. This mapping leads to eﬃ-
cient implementations not only for retrieval by primary key,
but also for partially-speciﬁed secondary attribute searches
and range queries. A novel chaining protocol enables the
system to achieve strong consistency, maintain availability
and guarantee fault tolerance. An evaluation of the full sys-
tem shows that HyperDex is 12-13× faster than Cassandra
and MongoDB for ﬁnding partially speciﬁed objects. Ad-
ditionally, HyperDex achieves 2-4× higher throughput for
get/put operations.
Categories and Subject Descriptors
D.4.7 [Operating Systems]: Organization and Design
Keywords
Key-Value Store, NoSQL, Fault-Tolerance, Strong Consis-
tency, Performance
1.
INTRODUCTION
Modern distributed applications are reshaping the land-
scape of storage systems. Recently emerging distributed
key-valu...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:CoSMeDis: A Distributed Social Media Platform with Formally Verified
Confidentiality Guarantees
author:Thomas Bauereiß and
Armando Pesenti Gritti and
Andrei Popescu and
Franco Raimondi
2017 IEEE Symposium on Security and Privacy
CoSMeDis: A Distributed Social Media Platform
with Formally Veriﬁed Conﬁdentiality Guarantees
Thomas Bauereiß∗, Armando Pesenti Gritti†, Andrei Popescu‡§, Franco Raimondi‡
∗German Research Center for Artiﬁcial Intelligence (DFKI) Bremen, Germany
†Global NoticeBoard, UK
‡Department of Computer Science, Middlesex University London, UK
§Institute of Mathematics Simion Stoilow of the Romanian Academy
Abstract— We present the design, implementation and in-
formation ﬂow veriﬁcation of CoSMeDis, a distributed social
media platform. The system consists of an arbitrary number
of communicating nodes, deployable at different locations over
the Internet. Its registered users can post content and establish
intra-node and inter-node friendships, used to regulate access
control over the posts. The system’s kernel has been veriﬁed
in the proof assistant Isabelle/HOL and automatically extracted
as Scala code. We formalized a framework for composing a
class of information ﬂow security guarantees in a distributed
system, applicable to input/output automata. We instantiated this
framework to conﬁdentiality properties for CoSMeDis’s sources
of information: posts, friendship requests, and friendship status.
I.
INTRODUCTION
Recent years have seen an explosion of web-based systems
aimed at sharing information between multiple users in a con-
venient, but controlled fashion. Examples include enterprise
systems, social networks, e-commerce sites and cloud services.
These systems often deal with conﬁdential information, such
as credit card details, medical data, location information and
sensitive documents. Unfortunately, most of these systems
offer no guarantees concerning the prevention of unintended
ﬂow of information. Programming errors or ambiguous policy
...


Instruction: 总结这篇安全研究的主要观点

Input:
title:CoSMeDis: A Distributed Social Media Platform with Formally Verified
Confidentiality Guarantees
author:Thomas Bauereiß and
Armando Pesenti Gritti and
Andrei Popescu and
Franco Raimondi
2017 IEEE Symposium on Security and Privacy
CoSMeDis: A Distributed Social Media Platform
with Formally Veriﬁed Conﬁdentiality Guarantees
Thomas Bauereiß∗, Armando Pesenti Gritti†, Andrei Popescu‡§, Franco Raimondi‡
∗German Research Center for Artiﬁcial Intelligence (DFKI) Bremen, Germany
†Global NoticeBoard, UK
‡Department of Computer Science, Middlesex University London, UK
§Institute of Mathematics Simion Stoilow of the Romanian Academy
Abstract— We present the design, implementation and in-
formation ﬂow veriﬁcation of CoSMeDis, a distributed social
media platform. The system consists of an arbitrary number
of communicating nodes, deployable at different locations over
the Internet. Its registered users can post content and establish
intra-node and inter-node friendships, used to regulate access
control over the posts. The system’s kernel has been veriﬁed
in the proof assistant Isabelle/HOL and automatically extracted
as Scala code. We formalized a framework for composing a
class of information ﬂow security guarantees in a distributed
system, applicable to input/output automata. We instantiated this
framework to conﬁdentiality properties for CoSMeDis’s sources
of information: posts, friendship requests, and friendship status.
I.
INTRODUCTION
Recent years have seen an explosion of web-based systems
aimed at sharing information between multiple users in a con-
venient, but controlled fashion. Examples include enterprise
systems, social networks, e-commerce sites and cloud services.
These systems often deal with conﬁdential information, such
as credit card details, medical data, location information and
sensitive documents. Unfortunately, most of these systems
offer no guarantees concerning the prevention of unintended
ﬂow of information. Programming errors or ambiguous policy
...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Raising the Bar: Evaluating Origin-wide Security Manifests
author:Steven Van Acker and
Daniel Hausknecht and
Andrei Sabelfeld
Raising the Bar: Evaluating Origin-wide Security Manifests
Chalmers University of Technology
Chalmers University of Technology
Steven Van Acker
Gothenburg, Sweden
Daniel Hausknecht
Gothenburg, Sweden
Andrei Sabelfeld
Chalmers University of Technology
Gothenburg, Sweden
ABSTRACT
Defending a web application from attackers requires the correct
conguration of several web security mechanisms for each and
every web page in that web application. This conguration process
can be dicult and result in gaps in the defense against web attack-
ers because some web pages may be overlooked. In this work we
provide a rst evaluation of the standard draft for an origin-wide
security conguration mechanism called the “origin manifest”. The
mechanism raises the security level of an entire web origin at once
while still allowing the specication of web security policies at
the web page level. We create prototype implementations of the
origin manifest mechanism for both the client-side and server-side,
and provide security ocers with an automated origin manifest
learner and generator to aid them with the conguration of their
web origins. To resolve potential collisions of policies dened by
the web origin with policies dened by web pages we formalize the
comparison and combination of web security policies and integrate
it into our prototype implementation. We evaluate the feasibility
of the origin manifest mechanism with a longitudinal study of pop-
ular websites to determine whether origin manifest les are stable
enough to not require frequent reconguration, and perform per-
formance measurements on the Alexa top 10,000 to determine the
network trac overhead. Our results show that the origin manifest
mechanism can eectively raise the security level of a web origin
while slightly improving network performance.
ACM Reference Format:
Steven Van Acker...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Raising the Bar: Evaluating Origin-wide Security Manifests
author:Steven Van Acker and
Daniel Hausknecht and
Andrei Sabelfeld
Raising the Bar: Evaluating Origin-wide Security Manifests
Chalmers University of Technology
Chalmers University of Technology
Steven Van Acker
Gothenburg, Sweden
Daniel Hausknecht
Gothenburg, Sweden
Andrei Sabelfeld
Chalmers University of Technology
Gothenburg, Sweden
ABSTRACT
Defending a web application from attackers requires the correct
conguration of several web security mechanisms for each and
every web page in that web application. This conguration process
can be dicult and result in gaps in the defense against web attack-
ers because some web pages may be overlooked. In this work we
provide a rst evaluation of the standard draft for an origin-wide
security conguration mechanism called the “origin manifest”. The
mechanism raises the security level of an entire web origin at once
while still allowing the specication of web security policies at
the web page level. We create prototype implementations of the
origin manifest mechanism for both the client-side and server-side,
and provide security ocers with an automated origin manifest
learner and generator to aid them with the conguration of their
web origins. To resolve potential collisions of policies dened by
the web origin with policies dened by web pages we formalize the
comparison and combination of web security policies and integrate
it into our prototype implementation. We evaluate the feasibility
of the origin manifest mechanism with a longitudinal study of pop-
ular websites to determine whether origin manifest les are stable
enough to not require frequent reconguration, and perform per-
formance measurements on the Alexa top 10,000 to determine the
network trac overhead. Our results show that the origin manifest
mechanism can eectively raise the security level of a web origin
while slightly improving network performance.
ACM Reference Format:
Steven Van Acker...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:CodeAlchemist: Semantics-Aware Code Generation to Find Vulnerabilities
in JavaScript Engines
author:HyungSeok Han and
DongHyeon Oh and
Sang Kil Cha
CodeAlchemist: Semantics-Aware Code Generation
to Find Vulnerabilities in JavaScript Engines
HyungSeok Han
KAIST
DongHyeon Oh
KAIST
hyungseok.han@kaist.ac.kr
donghyeon.oh@kaist.ac.kr
Sang Kil Cha
KAIST
sangkilc@kaist.ac.kr
Abstract—JavaScript engines are an attractive target
for
attackers due to their popularity and ﬂexibility in building
exploits. Current state-of-the-art fuzzers for ﬁnding JavaScript
engine vulnerabilities focus mainly on generating syntactically
correct test cases based on either a predeﬁned context-free
grammar or a trained probabilistic language model. Unfor-
tunately, syntactically correct JavaScript sentences are often
semantically invalid at runtime. Furthermore, statically analyzing
the semantics of JavaScript code is challenging due to its
dynamic nature: JavaScript code is generated at runtime, and
JavaScript expressions are dynamically-typed. To address this
challenge, we propose a novel test case generation algorithm
that we call semantics-aware assembly, and implement it in a
fuzz testing tool termed CodeAlchemist. Our tool can generate
arbitrary JavaScript code snippets that are both semantically and
syntactically correct, and it effectively yields test cases that can
crash JavaScript engines. We found numerous vulnerabilities of
the latest JavaScript engines with CodeAlchemist and reported
them to the vendors.
I.
INTRODUCTION
JavaScript (JS) engines have become a core component of
modern web browsers as they enable dynamic and interactive
features on web pages. As of July of 2018, approximately
94.9% of all the websites use JS [34], and almost all smart-
phones are equipped with a JS-enabled browser today.
The growing popularity of JS also means that JS engines
are an appealing target for attackers. As developers attempt to
improve performance and functionality of modern JS engines,...


Instruction: 总结这篇安全研究的主要观点

Input:
title:CodeAlchemist: Semantics-Aware Code Generation to Find Vulnerabilities
in JavaScript Engines
author:HyungSeok Han and
DongHyeon Oh and
Sang Kil Cha
CodeAlchemist: Semantics-Aware Code Generation
to Find Vulnerabilities in JavaScript Engines
HyungSeok Han
KAIST
DongHyeon Oh
KAIST
hyungseok.han@kaist.ac.kr
donghyeon.oh@kaist.ac.kr
Sang Kil Cha
KAIST
sangkilc@kaist.ac.kr
Abstract—JavaScript engines are an attractive target
for
attackers due to their popularity and ﬂexibility in building
exploits. Current state-of-the-art fuzzers for ﬁnding JavaScript
engine vulnerabilities focus mainly on generating syntactically
correct test cases based on either a predeﬁned context-free
grammar or a trained probabilistic language model. Unfor-
tunately, syntactically correct JavaScript sentences are often
semantically invalid at runtime. Furthermore, statically analyzing
the semantics of JavaScript code is challenging due to its
dynamic nature: JavaScript code is generated at runtime, and
JavaScript expressions are dynamically-typed. To address this
challenge, we propose a novel test case generation algorithm
that we call semantics-aware assembly, and implement it in a
fuzz testing tool termed CodeAlchemist. Our tool can generate
arbitrary JavaScript code snippets that are both semantically and
syntactically correct, and it effectively yields test cases that can
crash JavaScript engines. We found numerous vulnerabilities of
the latest JavaScript engines with CodeAlchemist and reported
them to the vendors.
I.
INTRODUCTION
JavaScript (JS) engines have become a core component of
modern web browsers as they enable dynamic and interactive
features on web pages. As of July of 2018, approximately
94.9% of all the websites use JS [34], and almost all smart-
phones are equipped with a JS-enabled browser today.
The growing popularity of JS also means that JS engines
are an appealing target for attackers. As developers attempt to
improve performance and functionality of modern JS engines,...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Geometric Exploration of the Landmark Selection Problem
author:Liying Tang and
Mark Crovella
Geometric Exploration of the Landmark Selection
Problem
Liying Tang and Mark Crovella
Department of Computer Science, Boston University, Boston, MA 02215
{litang,crovella}@cs.bu.edu
Abstract. Internet coordinate systems appear promising as a method for esti-
mating network distance without direct measurement, allowing scalable conﬁgu-
ration of emerging applications such as content delivery networks, peer to peer
systems, and overlay networks. However all such systems rely on landmarks, and
the choice of landmarks has a dramatic impact on their accuracy. Landmark sel-
ection is challenging because of the size of the Internet (leading to an immense
space of candidate sets) and because insight into the properties of good landmark
sets is lacking. In this paper we explore fast algorithms for landmark selection.
Whereas the traditional approach to analyzing similar network-based conﬁgurka-
tion problems employs the graph structure of the Internet, we leverage work in
coordinate systems to treat the problem geometrically, providing an opening for
applying new algorithms. Our results suggest that when employing small numbers
of landmarks (5-10), such geometric algorithms provide good landmarks, while
for larger numbers of landmarks (20-30) even faster methods based on random
selection are equally effective.
1 Introduction
Internet coordinate schemes assign coordinate vectors to hosts in the Internet, and at-
tempt to do so in a manner such that the Euclidean distance between hosts approximates
their network distance, usually taken to be minimum RTT [7]. The power of such co-
ordinate systems is that they allow network distance to be estimated in the absence of
measurement. As a result, applications for which network distance matters (such as con-
tent delivery networks, peer to peer applications, end-system multicast, and others) can
be rapidly conﬁgured in a network-sensiti...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Geometric Exploration of the Landmark Selection Problem
author:Liying Tang and
Mark Crovella
Geometric Exploration of the Landmark Selection
Problem
Liying Tang and Mark Crovella
Department of Computer Science, Boston University, Boston, MA 02215
{litang,crovella}@cs.bu.edu
Abstract. Internet coordinate systems appear promising as a method for esti-
mating network distance without direct measurement, allowing scalable conﬁgu-
ration of emerging applications such as content delivery networks, peer to peer
systems, and overlay networks. However all such systems rely on landmarks, and
the choice of landmarks has a dramatic impact on their accuracy. Landmark sel-
ection is challenging because of the size of the Internet (leading to an immense
space of candidate sets) and because insight into the properties of good landmark
sets is lacking. In this paper we explore fast algorithms for landmark selection.
Whereas the traditional approach to analyzing similar network-based conﬁgurka-
tion problems employs the graph structure of the Internet, we leverage work in
coordinate systems to treat the problem geometrically, providing an opening for
applying new algorithms. Our results suggest that when employing small numbers
of landmarks (5-10), such geometric algorithms provide good landmarks, while
for larger numbers of landmarks (20-30) even faster methods based on random
selection are equally effective.
1 Introduction
Internet coordinate schemes assign coordinate vectors to hosts in the Internet, and at-
tempt to do so in a manner such that the Euclidean distance between hosts approximates
their network distance, usually taken to be minimum RTT [7]. The power of such co-
ordinate systems is that they allow network distance to be estimated in the absence of
measurement. As a result, applications for which network distance matters (such as con-
tent delivery networks, peer to peer applications, end-system multicast, and others) can
be rapidly conﬁgured in a network-sensiti...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Unexpected Data Dependency Creation and Chaining: A New Attack to
SDN
author:Feng Xiao and
Jinquan Zhang and
Jianwei Huang and
Guofei Gu and
Dinghao Wu and
Peng Liu
2020 IEEE Symposium on Security and Privacy
Unexpected Data Dependency Creation and
Chaining: A New Attack to SDN
Feng Xiao, Jinquan Zhang, Jianwei Huang†, Guofei Gu†, Dinghao Wu, Peng Liu
The Pennsylvania State University
† SUCCESS Lab, Texas A&M University
Abstract—Software-Deﬁned Networking (SDN) is an emerging
network architecture that provides programmable networking
through a logically centralized controller. As SDN becomes more
prominent, its security vulnerabilities become more evident than
ever. Serving as the “brain” of a software-deﬁned network, how
the control plane (of the network) is exposed to external inputs
(i.e., data plane messages) is directly correlated with how secure
the network is. Fortunately, due to some unique SDN design
choices (e.g., control plane and data plane separation), attackers
often struggle to ﬁnd a reachable path to those vulnerable logic
hidden deeply within the control plane.
it
In this paper, we demonstrate that
is possible for a
weak adversary who only controls a commodity network device
(host or switch) to attack previously unreachable control plane
components by maliciously increasing reachability in the con-
trol plane. We introduce D2C2 (data dependency creation and
chaining) attack, which leverages some widely-used SDN protocol
features (e.g., custom ﬁelds) to create and chain unexpected data
dependencies in order to achieve greater reachability. We have
developed a novel tool, SVHunter, which can effectively identify
D2C2 vulnerabilities. Till now we have evaluated SVHunter
on three mainstream open-source SDN controllers (i.e., ONOS,
Floodlight, and Opendaylight) as well as one security-enhanced
controller (i.e., SE-Floodlight). SVHunter detects 18 previously
unknown vulnerabilities, all of which can be exploited remotely
to launch serious attacks su...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Unexpected Data Dependency Creation and Chaining: A New Attack to
SDN
author:Feng Xiao and
Jinquan Zhang and
Jianwei Huang and
Guofei Gu and
Dinghao Wu and
Peng Liu
2020 IEEE Symposium on Security and Privacy
Unexpected Data Dependency Creation and
Chaining: A New Attack to SDN
Feng Xiao, Jinquan Zhang, Jianwei Huang†, Guofei Gu†, Dinghao Wu, Peng Liu
The Pennsylvania State University
† SUCCESS Lab, Texas A&M University
Abstract—Software-Deﬁned Networking (SDN) is an emerging
network architecture that provides programmable networking
through a logically centralized controller. As SDN becomes more
prominent, its security vulnerabilities become more evident than
ever. Serving as the “brain” of a software-deﬁned network, how
the control plane (of the network) is exposed to external inputs
(i.e., data plane messages) is directly correlated with how secure
the network is. Fortunately, due to some unique SDN design
choices (e.g., control plane and data plane separation), attackers
often struggle to ﬁnd a reachable path to those vulnerable logic
hidden deeply within the control plane.
it
In this paper, we demonstrate that
is possible for a
weak adversary who only controls a commodity network device
(host or switch) to attack previously unreachable control plane
components by maliciously increasing reachability in the con-
trol plane. We introduce D2C2 (data dependency creation and
chaining) attack, which leverages some widely-used SDN protocol
features (e.g., custom ﬁelds) to create and chain unexpected data
dependencies in order to achieve greater reachability. We have
developed a novel tool, SVHunter, which can effectively identify
D2C2 vulnerabilities. Till now we have evaluated SVHunter
on three mainstream open-source SDN controllers (i.e., ONOS,
Floodlight, and Opendaylight) as well as one security-enhanced
controller (i.e., SE-Floodlight). SVHunter detects 18 previously
unknown vulnerabilities, all of which can be exploited remotely
to launch serious attacks su...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:eXpert-BSM: A Host-Based Intrusion Detection Solution for Sun Solaris
author:Ulf Lindqvist and
Phillip A. Porras
eXpert-BSM: A Host-based Intrusion Detection Solution
for Sun Solaris
Ulf Lindqvist and Phillip A. Porras
System Design Laboratory
SRI International
333 Ravenswood Avenue
Menlo Park, CA 94025-3493
(cid:1)ulf, porras(cid:2)@sdl.sri.com
Abstract
eXpert-BSM is a real time forward-reasoning expert sys-
tem that analyzes Sun Solaris audit trails. Based on many
years of intrusion detection research, eXpert-BSM’s knowl-
edge base detects a wide range of speciﬁc and general forms
of misuse, provides detailed reports and recommendations
to the system operator, and has a low false-alarm rate.
Host-based intrusion detection offers the ability to detect
misuse and subversion through the direct monitoring of pro-
cesses inside the host, providing an important complement
to network-based surveillance. Suites of eXpert-BSMs may
be deployed throughout a network, and their alarms man-
aged, correlated, and acted on by remote or local subscrib-
ing security services, thus helping to address issues of de-
centralized management. Inside the host, eXpert-BSM is
intended to operate as a true security daemon for host sys-
tems, consuming few CPU cycles and very little memory
and secondary storage. eXpert-BSM has been available
for download on the Internet since April 2000, and has been
successfully deployed in several production environments.
1. Introduction
When research on intrusion detection was initiated in the
early 1980s, the problem was often referred to as automated
audit-trail analysis. In theory, auditing is an important se-
The work presented in this paper was funded by the Defense Advanced
Research Projects Agency (DARPA), under contract number F30602-98-
C-0059. SRI International, EMERALD, and eXpert-BSM are trademarks
of SRI International. Sun, Sun Microsystems, Solaris, SunOS, Sun En-
terprise and SunSHIELD are trademarks or registered trademarks of Sun
M...


Instruction: 总结这篇安全研究的主要观点

Input:
title:eXpert-BSM: A Host-Based Intrusion Detection Solution for Sun Solaris
author:Ulf Lindqvist and
Phillip A. Porras
eXpert-BSM: A Host-based Intrusion Detection Solution
for Sun Solaris
Ulf Lindqvist and Phillip A. Porras
System Design Laboratory
SRI International
333 Ravenswood Avenue
Menlo Park, CA 94025-3493
(cid:1)ulf, porras(cid:2)@sdl.sri.com
Abstract
eXpert-BSM is a real time forward-reasoning expert sys-
tem that analyzes Sun Solaris audit trails. Based on many
years of intrusion detection research, eXpert-BSM’s knowl-
edge base detects a wide range of speciﬁc and general forms
of misuse, provides detailed reports and recommendations
to the system operator, and has a low false-alarm rate.
Host-based intrusion detection offers the ability to detect
misuse and subversion through the direct monitoring of pro-
cesses inside the host, providing an important complement
to network-based surveillance. Suites of eXpert-BSMs may
be deployed throughout a network, and their alarms man-
aged, correlated, and acted on by remote or local subscrib-
ing security services, thus helping to address issues of de-
centralized management. Inside the host, eXpert-BSM is
intended to operate as a true security daemon for host sys-
tems, consuming few CPU cycles and very little memory
and secondary storage. eXpert-BSM has been available
for download on the Internet since April 2000, and has been
successfully deployed in several production environments.
1. Introduction
When research on intrusion detection was initiated in the
early 1980s, the problem was often referred to as automated
audit-trail analysis. In theory, auditing is an important se-
The work presented in this paper was funded by the Defense Advanced
Research Projects Agency (DARPA), under contract number F30602-98-
C-0059. SRI International, EMERALD, and eXpert-BSM are trademarks
of SRI International. Sun, Sun Microsystems, Solaris, SunOS, Sun En-
terprise and SunSHIELD are trademarks or registered trademarks of Sun
M...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Poster: Understanding User's Decision to Interact with Potential Phishing
Posts on Facebook using a Vignette Study
author:Sovantharith Seng and
Huzeyfe Kocabas and
Mahdi Nasrullah Al-Ameen and
Matthew Wright
Poster: Understanding User’s Decision to Interact with Potential
Phishing Posts on Facebook using a Vignette Study
Sovantharith Seng
sovantharith.seng@mail.rit.edu
Rochester Institute of Technology
Rochester, New York
Huzeyfe Kocabas
huzeyfe.kocabas@aggiemail.usu.edu
Utah State University
Logan, Utah
Mahdi Nasrullah Al-Ameen
mahdi.al-ameen@usu.edu
Utah State University
Logan, Utah
Matthew Wright
matthew.wright@rit.edu
Rochester Institute of Technology
Rochester, New York
Abstract
Facebook remains the largest social media platform on the Internet
with over one billion active monthly users. A variety of personal
and sensitive data is shared on the platform, which makes it a prime
target for attackers. Increasingly, we see phishing attacks that take
advantage of users’ lack of security knowledge, deceiving victims
by using fake or compromised accounts to share malicious posts.
These attacks may slip undetected by the Facebook defense sys-
tem, exposing users to potentially be phished or have their devices
infected with drive-by downloads and malware. Only a few stud-
ies have been conducted to date to understand how users interact
with attacks like this in Facebook. In our prior work, we conducted
a study to address this challenge using a simulated interface and
think-aloud protocol. In this study, we aim to make further progress
in understanding the impact of different factors on users’ clicking
decision in social media through a vignette study that encourages
participants to think about realistic scenarios that they might face.
CCS Concepts
• Security and privacy → Social network security and pri-
vacy; Social aspects of security and privacy.
Keywords
social media; facebook; phishing; vignette study
ACM Reference Format:
Sovantharith Seng, Huzeyfe Kocabas, ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Poster: Understanding User's Decision to Interact with Potential Phishing
Posts on Facebook using a Vignette Study
author:Sovantharith Seng and
Huzeyfe Kocabas and
Mahdi Nasrullah Al-Ameen and
Matthew Wright
Poster: Understanding User’s Decision to Interact with Potential
Phishing Posts on Facebook using a Vignette Study
Sovantharith Seng
sovantharith.seng@mail.rit.edu
Rochester Institute of Technology
Rochester, New York
Huzeyfe Kocabas
huzeyfe.kocabas@aggiemail.usu.edu
Utah State University
Logan, Utah
Mahdi Nasrullah Al-Ameen
mahdi.al-ameen@usu.edu
Utah State University
Logan, Utah
Matthew Wright
matthew.wright@rit.edu
Rochester Institute of Technology
Rochester, New York
Abstract
Facebook remains the largest social media platform on the Internet
with over one billion active monthly users. A variety of personal
and sensitive data is shared on the platform, which makes it a prime
target for attackers. Increasingly, we see phishing attacks that take
advantage of users’ lack of security knowledge, deceiving victims
by using fake or compromised accounts to share malicious posts.
These attacks may slip undetected by the Facebook defense sys-
tem, exposing users to potentially be phished or have their devices
infected with drive-by downloads and malware. Only a few stud-
ies have been conducted to date to understand how users interact
with attacks like this in Facebook. In our prior work, we conducted
a study to address this challenge using a simulated interface and
think-aloud protocol. In this study, we aim to make further progress
in understanding the impact of different factors on users’ clicking
decision in social media through a vignette study that encourages
participants to think about realistic scenarios that they might face.
CCS Concepts
• Security and privacy → Social network security and pri-
vacy; Social aspects of security and privacy.
Keywords
social media; facebook; phishing; vignette study
ACM Reference Format:
Sovantharith Seng, Huzeyfe Kocabas, ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Dissecting Round Trip Time on the Slow Path with a Single Packet
author:Pietro Marchetta and
Alessio Botta and
Ethan Katz-Bassett and
Antonio Pescapè
Dissecting Round Trip Time on the Slow Path
with a Single Packet
Pietro Marchetta1, Alessio Botta1, Ethan Katz-Bassett2, and Antonio Pescap´e1
1 University of Napoli Federico II, Napoli, Italy
2 University of Southern California, Los Angeles, USA
Abstract. Researchers and operators often measure Round Trip Time
when monitoring, troubleshooting, or otherwise assessing network paths.
However, because it combines all hops traversed along both the forward
and reverse path, it can be diﬃcult to interpret or to attribute delay to
particular path segments.
In this work, we present an approach using a single packet to dissect
the RTT in chunks mapped to speciﬁc portions of the path. Using the IP
Prespeciﬁed Timestamp option directed at intermediate routers, it pro-
vides RTT estimations along portions of the slow path. Using multiple
vantage points (116 PlanetLab nodes), we show that the proposed ap-
proach can be applied on more than 77% of the considered paths. Finally,
we present preliminary results for two use cases (home network contri-
bution to the RTT and per-Autonomous System RTT contribution) to
demonstrate its potential in practical scenarios.
1
Introduction and Motivation
A common metric used to estimate the delay over a network path is the Round
Trip Time (RTT) [1], deﬁned as the length of time it takes to send a data packet
toward a destination and receive its response. Monitoring RTT provides useful
information about the network status when managing testbeds and operational
networks [28]. However, an RTT sample comprises all the delays experienced
by the data packet and its response along the forward and reverse path respec-
tively, and it also includes the time the destination takes to inspect the incoming
packet and generate the proper response. As a consequence, it can be diﬃcult
to interpret RTT values...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Dissecting Round Trip Time on the Slow Path with a Single Packet
author:Pietro Marchetta and
Alessio Botta and
Ethan Katz-Bassett and
Antonio Pescapè
Dissecting Round Trip Time on the Slow Path
with a Single Packet
Pietro Marchetta1, Alessio Botta1, Ethan Katz-Bassett2, and Antonio Pescap´e1
1 University of Napoli Federico II, Napoli, Italy
2 University of Southern California, Los Angeles, USA
Abstract. Researchers and operators often measure Round Trip Time
when monitoring, troubleshooting, or otherwise assessing network paths.
However, because it combines all hops traversed along both the forward
and reverse path, it can be diﬃcult to interpret or to attribute delay to
particular path segments.
In this work, we present an approach using a single packet to dissect
the RTT in chunks mapped to speciﬁc portions of the path. Using the IP
Prespeciﬁed Timestamp option directed at intermediate routers, it pro-
vides RTT estimations along portions of the slow path. Using multiple
vantage points (116 PlanetLab nodes), we show that the proposed ap-
proach can be applied on more than 77% of the considered paths. Finally,
we present preliminary results for two use cases (home network contri-
bution to the RTT and per-Autonomous System RTT contribution) to
demonstrate its potential in practical scenarios.
1
Introduction and Motivation
A common metric used to estimate the delay over a network path is the Round
Trip Time (RTT) [1], deﬁned as the length of time it takes to send a data packet
toward a destination and receive its response. Monitoring RTT provides useful
information about the network status when managing testbeds and operational
networks [28]. However, an RTT sample comprises all the delays experienced
by the data packet and its response along the forward and reverse path respec-
tively, and it also includes the time the destination takes to inspect the incoming
packet and generate the proper response. As a consequence, it can be diﬃcult
to interpret RTT values...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:On the responsiveness of DNS-based network control
author:Jeffrey Pang and
Aditya Akella and
Anees Shaikh and
Balachander Krishnamurthy and
Srinivasan Seshan
On the Responsiveness of DNS-based Network Control
Jeffrey Pang(cid:3), Aditya Akella(cid:3), Anees Shaikhy, Balachander Krishnamurthyz, Srinivasan Seshan(cid:3)
(cid:3)Computer Science Department
Carnegie Mellon University
Pittsburgh, PA 15213-3891
fjeffpang,aditya,srini+g@cs.cmu.edu
yNetwork Software and Services
IBM T.J. Watson Research Center Florham Park, NJ 07932-0971
zAT&T Labs – Research
bala@research.att.com
Hawthorne, NY 10532-2134
aashaikh@watson.ibm.com
ABSTRACT
For the last few years, large Web content providers interested in im-
proving their scalability and availability have increasingly turned
to three techniques: mirroring, content distribution, and ISP multi-
homing. The Domain Name System (DNS) has gained a prominent
role in the way each of these techniques directs client requests to
achieve the goals of scalability and availability. The DNS is thought
to offer the transparent and agile control necessary to react quickly
to ISP link failures or phenomenon such as ﬂash crowds.
In this paper, we investigate this assumption with the objective
of quantifying the degree of responsiveness that can be expected
from DNS. We use a combination of Web and DNS access mea-
surements from several busy Web sites, as well as a large content
distribution network, to characterize the behavior of end-systems
and local DNS servers in terms of their adherence to DNS-based
controls. Our results suggest that DNS is at best a coarse-grained
mechanism, and poorly suited for applications, such as route con-
trol, which require quick response to link failures or performance
degradations. We then propose several proactive techniques that,
when deployed in cooperation between large content providers and
important clients, have the potential to improve the responsiveness
of DNS-based control.
Categories and Subject ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:On the responsiveness of DNS-based network control
author:Jeffrey Pang and
Aditya Akella and
Anees Shaikh and
Balachander Krishnamurthy and
Srinivasan Seshan
On the Responsiveness of DNS-based Network Control
Jeffrey Pang(cid:3), Aditya Akella(cid:3), Anees Shaikhy, Balachander Krishnamurthyz, Srinivasan Seshan(cid:3)
(cid:3)Computer Science Department
Carnegie Mellon University
Pittsburgh, PA 15213-3891
fjeffpang,aditya,srini+g@cs.cmu.edu
yNetwork Software and Services
IBM T.J. Watson Research Center Florham Park, NJ 07932-0971
zAT&T Labs – Research
bala@research.att.com
Hawthorne, NY 10532-2134
aashaikh@watson.ibm.com
ABSTRACT
For the last few years, large Web content providers interested in im-
proving their scalability and availability have increasingly turned
to three techniques: mirroring, content distribution, and ISP multi-
homing. The Domain Name System (DNS) has gained a prominent
role in the way each of these techniques directs client requests to
achieve the goals of scalability and availability. The DNS is thought
to offer the transparent and agile control necessary to react quickly
to ISP link failures or phenomenon such as ﬂash crowds.
In this paper, we investigate this assumption with the objective
of quantifying the degree of responsiveness that can be expected
from DNS. We use a combination of Web and DNS access mea-
surements from several busy Web sites, as well as a large content
distribution network, to characterize the behavior of end-systems
and local DNS servers in terms of their adherence to DNS-based
controls. Our results suggest that DNS is at best a coarse-grained
mechanism, and poorly suited for applications, such as route con-
trol, which require quick response to link failures or performance
degradations. We then propose several proactive techniques that,
when deployed in cooperation between large content providers and
important clients, have the potential to improve the responsiveness
of DNS-based control.
Categories and Subject ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Efficient and extensible security enforcement using dynamic data flow
analysis
author:Walter Chang and
Brandon Streiff and
Calvin Lin
Efﬁcient and Extensible Security Enforcement Using
Dynamic Data Flow Analysis
Walter Chang
walter@cs.utexas.edu
Brandon Streiff
bstreiff@mail.utexas.edu
Calvin Lin
lin@cs.utexas.edu
Department of Computer Sciences
The University of Texas at Austin
Austin, TX 78712
ABSTRACT
Current taint tracking systems suffer from high overhead and a lack
of generality. In this paper, we solve both of these issues with an
extensible system that is an order of magnitude more efﬁcient than
previous software taint tracking systems and is fully general to dy-
namic data ﬂow tracking problems. Our system uses a compiler
to transform untrusted programs into policy-enforcing programs,
and our system can be easily reconﬁgured to support new analyses
and policies without modifying the compiler or runtime system.
Our system uses a sound and sophisticated static analysis that can
dramatically reduce the amount of data that must be dynamically
tracked.
For server programs, our system’s average overhead is 0.65%
for taint tracking, which is comparable to the best hardware-based
solutions. For a set of compute-bound benchmarks, our system pro-
duces no runtime overhead because our compiler can prove the ab-
sence of vulnerabilities, eliminating the need to dynamically track
taint. After modifying these benchmarks to contain format string
vulnerabilities, our system’s overhead is less than 13%, which is
over 6× lower than the previous best solutions. We demonstrate
the ﬂexibility and power of our system by applying it to ﬁle dis-
closure vulnerabilities, a problem that taint tracking cannot handle.
To prevent such vulnerabilities, our system introduces an average
runtime overhead of 0.25% for three open source server programs.
Categories and Subject Descriptors
D.4.6 [Operating Systems]: Security and Protection—Informa-
tion Flow Controls
General Terms
Reliab...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Efficient and extensible security enforcement using dynamic data flow
analysis
author:Walter Chang and
Brandon Streiff and
Calvin Lin
Efﬁcient and Extensible Security Enforcement Using
Dynamic Data Flow Analysis
Walter Chang
walter@cs.utexas.edu
Brandon Streiff
bstreiff@mail.utexas.edu
Calvin Lin
lin@cs.utexas.edu
Department of Computer Sciences
The University of Texas at Austin
Austin, TX 78712
ABSTRACT
Current taint tracking systems suffer from high overhead and a lack
of generality. In this paper, we solve both of these issues with an
extensible system that is an order of magnitude more efﬁcient than
previous software taint tracking systems and is fully general to dy-
namic data ﬂow tracking problems. Our system uses a compiler
to transform untrusted programs into policy-enforcing programs,
and our system can be easily reconﬁgured to support new analyses
and policies without modifying the compiler or runtime system.
Our system uses a sound and sophisticated static analysis that can
dramatically reduce the amount of data that must be dynamically
tracked.
For server programs, our system’s average overhead is 0.65%
for taint tracking, which is comparable to the best hardware-based
solutions. For a set of compute-bound benchmarks, our system pro-
duces no runtime overhead because our compiler can prove the ab-
sence of vulnerabilities, eliminating the need to dynamically track
taint. After modifying these benchmarks to contain format string
vulnerabilities, our system’s overhead is less than 13%, which is
over 6× lower than the previous best solutions. We demonstrate
the ﬂexibility and power of our system by applying it to ﬁle dis-
closure vulnerabilities, a problem that taint tracking cannot handle.
To prevent such vulnerabilities, our system introduces an average
runtime overhead of 0.25% for three open source server programs.
Categories and Subject Descriptors
D.4.6 [Operating Systems]: Security and Protection—Informa-
tion Flow Controls
General Terms
Reliab...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A Better Method to Analyze Blockchain Consistency
author:Lucianna Kiffer and
Rajmohan Rajaraman and
Abhi Shelat
A Better Method to Analyze Blockchain Consistency
Lucianna Kiffer, Rajmohan Rajaraman and abhi shelat
Northeastern University
{lkiffer,rraj}@ccs.neu.edu,a.shelat@northeastern.edu
ABSTRACT
The celebrated Nakamoto consensus protocol [16] ushered in sev-
eral new consensus applications including cryptocurrencies. A
few recent works [7, 17] have analyzed important properties of
blockchains, including most significantly, consistency, which is a
guarantee that all honest parties output the same sequence of blocks
throughout the execution of the protocol.
To establish consistency, the prior analysis of Pass, Seeman and
Shelat [17] required a careful counting of certain combinatorial
events that was difficult to apply to variations of Nakamoto. The
work of Garay, Kiayas, and Leonardas [7] provides another method
of analyzing the blockchain under the simplifying assumption that
the network was synchronous.
The contribution of this paper is the development of a simple
Markov-chain based method for analyzing consistency properties of
blockchain protocols. The method includes a formal way of stating
strong concentration bounds as well as easy ways to concretely
compute the bounds. We use our new method to answer a number
of basic questions about consistency of blockchains:
and extend them to other protocols;
• Our new analysis provides a tighter guarantee on the con-
sistency property of Nakamoto’s protocol, including for pa-
rameter regimes which [17] could not consider;
• We analyze a family of delaying attacks first presented in [17],
• We analyze how long a participant should wait before con-
• We analyze the consistency of CliqueChain, a variation of
• We provide the first rigorous consistency analysis of GHOST
sidering a high-value transaction “confirmed”;
the Chainweb [14] system;
[20] and also analyze a folklore “balancing"-attack.
In each case, we use o...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A Better Method to Analyze Blockchain Consistency
author:Lucianna Kiffer and
Rajmohan Rajaraman and
Abhi Shelat
A Better Method to Analyze Blockchain Consistency
Lucianna Kiffer, Rajmohan Rajaraman and abhi shelat
Northeastern University
{lkiffer,rraj}@ccs.neu.edu,a.shelat@northeastern.edu
ABSTRACT
The celebrated Nakamoto consensus protocol [16] ushered in sev-
eral new consensus applications including cryptocurrencies. A
few recent works [7, 17] have analyzed important properties of
blockchains, including most significantly, consistency, which is a
guarantee that all honest parties output the same sequence of blocks
throughout the execution of the protocol.
To establish consistency, the prior analysis of Pass, Seeman and
Shelat [17] required a careful counting of certain combinatorial
events that was difficult to apply to variations of Nakamoto. The
work of Garay, Kiayas, and Leonardas [7] provides another method
of analyzing the blockchain under the simplifying assumption that
the network was synchronous.
The contribution of this paper is the development of a simple
Markov-chain based method for analyzing consistency properties of
blockchain protocols. The method includes a formal way of stating
strong concentration bounds as well as easy ways to concretely
compute the bounds. We use our new method to answer a number
of basic questions about consistency of blockchains:
and extend them to other protocols;
• Our new analysis provides a tighter guarantee on the con-
sistency property of Nakamoto’s protocol, including for pa-
rameter regimes which [17] could not consider;
• We analyze a family of delaying attacks first presented in [17],
• We analyze how long a participant should wait before con-
• We analyze the consistency of CliqueChain, a variation of
• We provide the first rigorous consistency analysis of GHOST
sidering a high-value transaction “confirmed”;
the Chainweb [14] system;
[20] and also analyze a folklore “balancing"-attack.
In each case, we use o...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Automatic metadata generation for active measurement
author:Joel Sommers and
Ramakrishnan Durairajan and
Paul Barford
Automatic Metadata Generation for Active Measurement
Joel Sommers
Colgate University
jsommers@colgate.edu
Ramakrishnan Durairajan
University of Oregon
ram@cs.uoregon.edu
University of Wisconsin-Madison
Paul Barford
comScore, Inc.
pb@cs.wisc.edu
ABSTRACT
Empirical research in the Internet is fraught with challenges. Among
these is the possibility that local environmental conditions (e.g.,
CPU load or network load) introduce unexpected bias or artifacts
in measurements that lead to erroneous conclusions. In this paper,
we describe a framework for local environment monitoring that is
designed to be used during Internet measurement experiments. The
goals of our work are to provide a critical, expanded perspective
on measurement results and to improve the opportunity for repro-
ducibility of results. We instantiate our framework in a tool we
call SoMeta, which monitors the local environment during active
probe-based measurement experiments. We evaluate the runtime
costs of SoMeta and conduct a series of experiments in which we
intentionally perturb different aspects of the local environment
during active probe-based measurements. Our experiments show
how simple local monitoring can readily expose conditions that
bias active probe-based measurement results. We conclude with
a discussion of how our framework can be expanded to provide
metadata for a broad range of Internet measurement experiments.
CCS CONCEPTS
• Networks → Network experimentation; Network measure-
ment;
KEYWORDS
network measurement, metadata
ACM Reference Format:
Joel Sommers, Ramakrishnan Durairajan, and Paul Barford. 2017. Automatic
Metadata Generation for Active Measurement. In Proceedings of IMC ’17,
London, United Kingdom, November 1–3, 2017, 7 pages.
https://doi.org/10.1145/3131365.3131400
1 INTRODUCTION
Active probe-based measurements have been widely used to eluci-
date Intern...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Automatic metadata generation for active measurement
author:Joel Sommers and
Ramakrishnan Durairajan and
Paul Barford
Automatic Metadata Generation for Active Measurement
Joel Sommers
Colgate University
jsommers@colgate.edu
Ramakrishnan Durairajan
University of Oregon
ram@cs.uoregon.edu
University of Wisconsin-Madison
Paul Barford
comScore, Inc.
pb@cs.wisc.edu
ABSTRACT
Empirical research in the Internet is fraught with challenges. Among
these is the possibility that local environmental conditions (e.g.,
CPU load or network load) introduce unexpected bias or artifacts
in measurements that lead to erroneous conclusions. In this paper,
we describe a framework for local environment monitoring that is
designed to be used during Internet measurement experiments. The
goals of our work are to provide a critical, expanded perspective
on measurement results and to improve the opportunity for repro-
ducibility of results. We instantiate our framework in a tool we
call SoMeta, which monitors the local environment during active
probe-based measurement experiments. We evaluate the runtime
costs of SoMeta and conduct a series of experiments in which we
intentionally perturb different aspects of the local environment
during active probe-based measurements. Our experiments show
how simple local monitoring can readily expose conditions that
bias active probe-based measurement results. We conclude with
a discussion of how our framework can be expanded to provide
metadata for a broad range of Internet measurement experiments.
CCS CONCEPTS
• Networks → Network experimentation; Network measure-
ment;
KEYWORDS
network measurement, metadata
ACM Reference Format:
Joel Sommers, Ramakrishnan Durairajan, and Paul Barford. 2017. Automatic
Metadata Generation for Active Measurement. In Proceedings of IMC ’17,
London, United Kingdom, November 1–3, 2017, 7 pages.
https://doi.org/10.1145/3131365.3131400
1 INTRODUCTION
Active probe-based measurements have been widely used to eluci-
date Intern...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A resource-minimalist flow size histogram estimator
author:Bruno F. Ribeiro and
Tao Ye and
Donald F. Towsley
A Resource-minimalist Flow Size Histogram Estimator
Bruno Ribeiro
Computer Science
Department
University of Massachusetts
Amherst, MA, 01003
ribeiro@cs.umass.edu
Tao Ye
Sprint
Burlingame, CA, 94010
Tao.Ye@sprint.com
Don Towsley
Computer Science
Department
University of Massachusetts
Amherst, MA, 01003
towsley@cs.umass.edu
ABSTRACT
The histogram of network ﬂow sizes is an important yet
diﬃcult metric to estimate in network monitoring. It is im-
portant because it characterizes traﬃc compositions and is
a crucial component of anomaly detection methods.
It is
diﬃcult to estimate because of its high memory and com-
putational requirements. Existing algorithms compute ﬁne
grained estimates for each ﬂow size, i.e. 1, 2,. . . up to the
maximum number observed over a ﬁnite time interval. Our
approach instead relies on the insight that, while many ap-
plications require ﬁne grained estimates of small ﬂow sizes,
i.e. {1, 2, . . . , k} with a small k, network operators are of-
ten only interested in coarse grained estimates of larger ﬂow
sizes. Thus, we propose an estimator that outputs a binned
histogram of size distributions. Our estimator computes
this histogram in O(k3 + log W ) operations, where W is the
largest ﬂow size of interest to the network operator, while
requiring only a few bits of memory per measured ﬂow. This
translates into more than 4 fold memory savings and an ex-
ponential speedup in the estimator as compared to previous
works, greatly increasing the possibility of performing on-
line estimation inside a router.
Categories and Subject Descriptors
C.2.3 [Network Operations]: Network monitoring; G.3
[Probability and Statistics]: Nonparametric statistics
General Terms
Design, Measurement
Keywords
Monitoring Systems, Sampling Methods, Data Stream Al-
gorithms, Flow Size Histogram
1.
INTRODUCTION
Measuring the histogram of network ﬂow sizes has bee...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A resource-minimalist flow size histogram estimator
author:Bruno F. Ribeiro and
Tao Ye and
Donald F. Towsley
A Resource-minimalist Flow Size Histogram Estimator
Bruno Ribeiro
Computer Science
Department
University of Massachusetts
Amherst, MA, 01003
ribeiro@cs.umass.edu
Tao Ye
Sprint
Burlingame, CA, 94010
Tao.Ye@sprint.com
Don Towsley
Computer Science
Department
University of Massachusetts
Amherst, MA, 01003
towsley@cs.umass.edu
ABSTRACT
The histogram of network ﬂow sizes is an important yet
diﬃcult metric to estimate in network monitoring. It is im-
portant because it characterizes traﬃc compositions and is
a crucial component of anomaly detection methods.
It is
diﬃcult to estimate because of its high memory and com-
putational requirements. Existing algorithms compute ﬁne
grained estimates for each ﬂow size, i.e. 1, 2,. . . up to the
maximum number observed over a ﬁnite time interval. Our
approach instead relies on the insight that, while many ap-
plications require ﬁne grained estimates of small ﬂow sizes,
i.e. {1, 2, . . . , k} with a small k, network operators are of-
ten only interested in coarse grained estimates of larger ﬂow
sizes. Thus, we propose an estimator that outputs a binned
histogram of size distributions. Our estimator computes
this histogram in O(k3 + log W ) operations, where W is the
largest ﬂow size of interest to the network operator, while
requiring only a few bits of memory per measured ﬂow. This
translates into more than 4 fold memory savings and an ex-
ponential speedup in the estimator as compared to previous
works, greatly increasing the possibility of performing on-
line estimation inside a router.
Categories and Subject Descriptors
C.2.3 [Network Operations]: Network monitoring; G.3
[Probability and Statistics]: Nonparametric statistics
General Terms
Design, Measurement
Keywords
Monitoring Systems, Sampling Methods, Data Stream Al-
gorithms, Flow Size Histogram
1.
INTRODUCTION
Measuring the histogram of network ﬂow sizes has bee...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:ATTAIN: An Attack Injection Framework for Software-Defined Networking
author:Benjamin E. Ujcich and
Uttam Thakore and
William H. Sanders
2017 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks
ATTAIN: An Attack Injection Framework for
Software-Deﬁned Networking
Benjamin E. Ujcich∗†, Uttam Thakore∗‡, and William H. Sanders∗†
∗Information Trust Institute, †Department of Electrical and Computer Engineering, ‡Department of Computer Science
University of Illinois at Urbana–Champaign
Email: {ujcich2, thakore1, whs}@illinois.edu
Urbana, Illinois USA
Abstract—Software-deﬁned networking (SDN) has recently
attracted interest as a way to provide cyber resiliency because
of its programmable and logically centralized nature. However,
the security of the SDN architecture itself against malicious
attacks is not well understood and must be ensured in order
to provide cyber resiliency to systems that use SDNs. In this
paper, we present ATTAIN, an attack injection framework for
OpenFlow-based SDN architectures. First, we deﬁne an attack
model that relates system components to an attacker’s capability
to inﬂuence control plane behavior. Second, we deﬁne an attack
language for writing control plane attacks that can be used to
evaluate SDN implementations. Third, we describe an attack
injector architecture that actuates attacks in networks. Finally,
we evaluate our framework with an enterprise network case study
by writing and running attacks with popular SDN controllers.
I. INTRODUCTION
Software-deﬁned networking (SDN) has seen widespread
use in settings such as research networks, enterprise networks
and data center and cloud networks, among others [1]. SDN
decouples control protocol messages that represent how the
end host trafﬁc should be forwarded (i.e., the control plane)
from the end host trafﬁc itself (i.e., the data plane), and it
centralizes forwarding decisions through programmable con-
trollers for network service and application integrati...


Instruction: 总结这篇安全研究的主要观点

Input:
title:ATTAIN: An Attack Injection Framework for Software-Defined Networking
author:Benjamin E. Ujcich and
Uttam Thakore and
William H. Sanders
2017 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks
ATTAIN: An Attack Injection Framework for
Software-Deﬁned Networking
Benjamin E. Ujcich∗†, Uttam Thakore∗‡, and William H. Sanders∗†
∗Information Trust Institute, †Department of Electrical and Computer Engineering, ‡Department of Computer Science
University of Illinois at Urbana–Champaign
Email: {ujcich2, thakore1, whs}@illinois.edu
Urbana, Illinois USA
Abstract—Software-deﬁned networking (SDN) has recently
attracted interest as a way to provide cyber resiliency because
of its programmable and logically centralized nature. However,
the security of the SDN architecture itself against malicious
attacks is not well understood and must be ensured in order
to provide cyber resiliency to systems that use SDNs. In this
paper, we present ATTAIN, an attack injection framework for
OpenFlow-based SDN architectures. First, we deﬁne an attack
model that relates system components to an attacker’s capability
to inﬂuence control plane behavior. Second, we deﬁne an attack
language for writing control plane attacks that can be used to
evaluate SDN implementations. Third, we describe an attack
injector architecture that actuates attacks in networks. Finally,
we evaluate our framework with an enterprise network case study
by writing and running attacks with popular SDN controllers.
I. INTRODUCTION
Software-deﬁned networking (SDN) has seen widespread
use in settings such as research networks, enterprise networks
and data center and cloud networks, among others [1]. SDN
decouples control protocol messages that represent how the
end host trafﬁc should be forwarded (i.e., the control plane)
from the end host trafﬁc itself (i.e., the data plane), and it
centralizes forwarding decisions through programmable con-
trollers for network service and application integrati...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Towards Understanding and Detecting Cyberbullying in Real-world Images
author:Nishant Vishwamitra and
Hongxin Hu and
Feng Luo and
Long Cheng
Towards Understanding and Detecting Cyberbullying
in Real-world Images
Nishant Vishwamitra∗, Hongxin Hu∗, Feng Luo† and Long Cheng†
∗Computer Science and Engineering, University at Buffalo
Email: ∗{nvishwam, hongxinh}@buffalo.edu, †{luofeng, lcheng2}@clemson.edu
†School of Computing, Clemson University
Abstract—Cyberbullying has become widely recognized as
a critical social problem plaguing today’s Internet users. This
problem involves perpetrators using Internet-based technologies
to bully their victims by sharing cyberbullying-related content.
To combat this problem, researchers have studied the factors
associated with such content and proposed automatic detection
techniques based on those factors. However, most of these studies
have mainly focused on understanding the factors of textual
content, such as comments and text messages, while largely over-
looking the misuse of visual content in perpetrating cyberbullying.
Recent technological advancements in the way users access the
Internet have led to a new cyberbullying paradigm. Perpetrators
can use visual media to bully their victims through sending and
distributing images with cyberbullying content. As a ﬁrst step to
understand the threat of cyberbullying in images, we report in
this paper a comprehensive study on the nature of images used in
cyberbullying. We ﬁrst collect a real-world cyberbullying images
dataset with 19,300 valid images. We then analyze the images
in our dataset and identify the factors related to cyberbullying
images that can be used to build systems to detect cyberbullying
in images. Our analysis of factors in cyberbullying images reveals
that unlike traditional offensive image content (e.g., violence and
nudity), the factors in cyberbullying images tend to be highly
contextual. We further demonstrate the effectiveness of the factors
by measuring ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Towards Understanding and Detecting Cyberbullying in Real-world Images
author:Nishant Vishwamitra and
Hongxin Hu and
Feng Luo and
Long Cheng
Towards Understanding and Detecting Cyberbullying
in Real-world Images
Nishant Vishwamitra∗, Hongxin Hu∗, Feng Luo† and Long Cheng†
∗Computer Science and Engineering, University at Buffalo
Email: ∗{nvishwam, hongxinh}@buffalo.edu, †{luofeng, lcheng2}@clemson.edu
†School of Computing, Clemson University
Abstract—Cyberbullying has become widely recognized as
a critical social problem plaguing today’s Internet users. This
problem involves perpetrators using Internet-based technologies
to bully their victims by sharing cyberbullying-related content.
To combat this problem, researchers have studied the factors
associated with such content and proposed automatic detection
techniques based on those factors. However, most of these studies
have mainly focused on understanding the factors of textual
content, such as comments and text messages, while largely over-
looking the misuse of visual content in perpetrating cyberbullying.
Recent technological advancements in the way users access the
Internet have led to a new cyberbullying paradigm. Perpetrators
can use visual media to bully their victims through sending and
distributing images with cyberbullying content. As a ﬁrst step to
understand the threat of cyberbullying in images, we report in
this paper a comprehensive study on the nature of images used in
cyberbullying. We ﬁrst collect a real-world cyberbullying images
dataset with 19,300 valid images. We then analyze the images
in our dataset and identify the factors related to cyberbullying
images that can be used to build systems to detect cyberbullying
in images. Our analysis of factors in cyberbullying images reveals
that unlike traditional offensive image content (e.g., violence and
nudity), the factors in cyberbullying images tend to be highly
contextual. We further demonstrate the effectiveness of the factors
by measuring ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Improving Tor using a TCP-over-DTLS Tunnel
author:Joel Reardon and
Ian Goldberg
Improving Tor using a TCP-over-DTLS Tunnel
Joel Reardon∗
Google Switzerland GmbH
Brandschenkestrasse 110
Z¨urich, Switzerland
Ian Goldberg
University of Waterloo
200 University Ave W.
Waterloo, ON, Canada
reardon@google.com
iang@cs.uwaterloo.ca
Abstract
The Tor network gives anonymity to Internet users by re-
laying their trafﬁc through the world over a variety of
routers. All trafﬁc between any pair of routers, even
if they represent circuits for different clients, are mul-
tiplexed over a single TCP connection. This results in
interference across circuits during congestion control,
packet dropping and packet reordering. This interference
greatly contributes to Tor’s notorious latency problems.
Our solution is to use a TCP-over-DTLS (Datagram
Transport Layer Security) transport between routers. We
give each stream of data its own TCP connection, and
protect the TCP headers—which would otherwise give
stream identiﬁcation information to an attacker—with
DTLS. We perform experiments on our implemented
version to illustrate that our proposal has indeed resolved
the cross-circuit interference.
1 Introduction
Tor [2] is a tool to enable Internet privacy that has seen
widespread use and popularity throughout the world.
Tor consists of a network of thousands of nodes—
known as Onion Routers (ORs)—whose operators have
volunteered to relay Internet trafﬁc around the world.
Clients—known as Onion Proxies (OPs)—build circuits
through ORs in the network to dispatch their trafﬁc. Tor’s
goal is to frustrate an attacker who aims to match up
the identities of the clients with the actions they are per-
forming. Despite its popularity, Tor has a problem that
dissuades its ubiquitous application—it imposes greater
latency on its users than they would experience without
Tor.
While some increased latency is inevitable due to the
increased network path length, our experiments show
that this effect is no...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Improving Tor using a TCP-over-DTLS Tunnel
author:Joel Reardon and
Ian Goldberg
Improving Tor using a TCP-over-DTLS Tunnel
Joel Reardon∗
Google Switzerland GmbH
Brandschenkestrasse 110
Z¨urich, Switzerland
Ian Goldberg
University of Waterloo
200 University Ave W.
Waterloo, ON, Canada
reardon@google.com
iang@cs.uwaterloo.ca
Abstract
The Tor network gives anonymity to Internet users by re-
laying their trafﬁc through the world over a variety of
routers. All trafﬁc between any pair of routers, even
if they represent circuits for different clients, are mul-
tiplexed over a single TCP connection. This results in
interference across circuits during congestion control,
packet dropping and packet reordering. This interference
greatly contributes to Tor’s notorious latency problems.
Our solution is to use a TCP-over-DTLS (Datagram
Transport Layer Security) transport between routers. We
give each stream of data its own TCP connection, and
protect the TCP headers—which would otherwise give
stream identiﬁcation information to an attacker—with
DTLS. We perform experiments on our implemented
version to illustrate that our proposal has indeed resolved
the cross-circuit interference.
1 Introduction
Tor [2] is a tool to enable Internet privacy that has seen
widespread use and popularity throughout the world.
Tor consists of a network of thousands of nodes—
known as Onion Routers (ORs)—whose operators have
volunteered to relay Internet trafﬁc around the world.
Clients—known as Onion Proxies (OPs)—build circuits
through ORs in the network to dispatch their trafﬁc. Tor’s
goal is to frustrate an attacker who aims to match up
the identities of the clients with the actions they are per-
forming. Despite its popularity, Tor has a problem that
dissuades its ubiquitous application—it imposes greater
latency on its users than they would experience without
Tor.
While some increased latency is inevitable due to the
increased network path length, our experiments show
that this effect is no...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:An Adaptive Decomposition Approach for the Analysis of Stochastic
Petri Nets
author:Peter Buchholz
An Adaptive Decomposition Approach for the Analysis of Stochastic Petri Nets
Institute for Applied Computer Science, Dresden University of Technology, D-01062 Dresden, Germany
p.buchholz@inf.tu-dresden.de
Peter Buchholz
Abstract
We present a new approximate solution technique for the
numerical analysis of superposed generalized stochastic
Petri nets (SGSPNs) and related models. The approach
combines numerical iterative solution techniques and ﬁxed
point computations using the complete knowledge of state
space and generator matrix. In contrast to other approxi-
mation methods, the proposed method is adaptive by con-
sidering states with a high probability in detail and aggre-
gating states with small probabilities. Probabilities are ap-
proximated by the results derived during the iterative solu-
tion. Thus, a maximum number of states can be predeﬁned
and the presented method automatically aggregates states
such that the solution is computed using a vector of a size
smaller or equal to the maximum. By means of a non-trivial
example it is shown that the approach computes good ap-
proximations with a low effort for many models.
1. Introduction
Stochastic Petri nets (SPNs) and their variants like GSPNs
[1] are important model types to describe discrete event sys-
tems and to analyze them according to their performance,
dependability or performability. Often the long run behav-
ior of a system is analyzed which results in the computa-
tion of the stationary distribution of the continuous time
Markov chain (CTMC) underlying a (G)SPN. Three differ-
ent classes of solution approaches exist to analyze (G)SPNs
or the underlying CTMCs. First, the (G)SPN can be used as
a speciﬁcation of a simulation model and discrete event sim-
ulation can be applied to obtain estimates for the required
results [18]. The advantage of this approach is the general
applicability and ﬂexibility...


Instruction: 总结这篇安全研究的主要观点

Input:
title:An Adaptive Decomposition Approach for the Analysis of Stochastic
Petri Nets
author:Peter Buchholz
An Adaptive Decomposition Approach for the Analysis of Stochastic Petri Nets
Institute for Applied Computer Science, Dresden University of Technology, D-01062 Dresden, Germany
p.buchholz@inf.tu-dresden.de
Peter Buchholz
Abstract
We present a new approximate solution technique for the
numerical analysis of superposed generalized stochastic
Petri nets (SGSPNs) and related models. The approach
combines numerical iterative solution techniques and ﬁxed
point computations using the complete knowledge of state
space and generator matrix. In contrast to other approxi-
mation methods, the proposed method is adaptive by con-
sidering states with a high probability in detail and aggre-
gating states with small probabilities. Probabilities are ap-
proximated by the results derived during the iterative solu-
tion. Thus, a maximum number of states can be predeﬁned
and the presented method automatically aggregates states
such that the solution is computed using a vector of a size
smaller or equal to the maximum. By means of a non-trivial
example it is shown that the approach computes good ap-
proximations with a low effort for many models.
1. Introduction
Stochastic Petri nets (SPNs) and their variants like GSPNs
[1] are important model types to describe discrete event sys-
tems and to analyze them according to their performance,
dependability or performability. Often the long run behav-
ior of a system is analyzed which results in the computa-
tion of the stationary distribution of the continuous time
Markov chain (CTMC) underlying a (G)SPN. Three differ-
ent classes of solution approaches exist to analyze (G)SPNs
or the underlying CTMCs. First, the (G)SPN can be used as
a speciﬁcation of a simulation model and discrete event sim-
ulation can be applied to obtain estimates for the required
results [18]. The advantage of this approach is the general
applicability and ﬂexibility...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:PriMa: an effective privacy protection mechanism for social networks
author:Anna Cinzia Squicciarini and
Federica Paci and
Smitha Sundareswaran
PriMa: An Effective Privacy Protection Mechanism for
Social Networks
Anna Squicciarini
College of Information
Sciences and Technology
The Pennsylvania State
University, USA
acs20@psu.edu
Federica Paci
Department of Information
Engineering and Computer
Science
University of Trento,
Trento,Italy
paci@disi.unitn.it
Smitha Sundareswaran
College of Information
Sciences and Technology
The Pennsylvania State
University, USA
sus263@psu.edu
ABSTRACT
In this paper, we propose PriMa (Privacy Manager), a privacy pro-
tection mechanism which supports semi-automated generation of
access rules for users’ proﬁle information. PriMa access rules are
tailored by the users’ privacy preferences for their proﬁle data, the
sensitivity of the data itself, and the objective risk of disclosing this
data to other users. The resulting rules are simple, yet powerful
speciﬁcations indicating the adequate level of protection for each
user, and are dynamically adapted to the ever changing setting of
the users’ preferences and SN conﬁguration.
1.
INTRODUCTION
Web 2.0 revolutionizes how people store and share personal data,
allowing for pervasive sharing of personal information on the web.
This change has multi-faceted implications, especially on privacy.
End users, are often unaware of the size or nature of the audience
that could potentially access their data. These issues are partic-
ularly pronounced in Social Network sites (SNs from now on),
where the false sense of intimacy amongst digital friends often
leads to potentially risky disclosures of private data.
Privacy in SNs can be compromised in several ways, by steal-
ing proﬁles’ data, observing the SN graph and by cross-correlating
distributed proﬁles that belongs to multiple sites [19, 7]. One of
the main threats to the users’ privacy stems from accidental disclo-
sures of data. For example, d...


Instruction: 总结这篇安全研究的主要观点

Input:
title:PriMa: an effective privacy protection mechanism for social networks
author:Anna Cinzia Squicciarini and
Federica Paci and
Smitha Sundareswaran
PriMa: An Effective Privacy Protection Mechanism for
Social Networks
Anna Squicciarini
College of Information
Sciences and Technology
The Pennsylvania State
University, USA
acs20@psu.edu
Federica Paci
Department of Information
Engineering and Computer
Science
University of Trento,
Trento,Italy
paci@disi.unitn.it
Smitha Sundareswaran
College of Information
Sciences and Technology
The Pennsylvania State
University, USA
sus263@psu.edu
ABSTRACT
In this paper, we propose PriMa (Privacy Manager), a privacy pro-
tection mechanism which supports semi-automated generation of
access rules for users’ proﬁle information. PriMa access rules are
tailored by the users’ privacy preferences for their proﬁle data, the
sensitivity of the data itself, and the objective risk of disclosing this
data to other users. The resulting rules are simple, yet powerful
speciﬁcations indicating the adequate level of protection for each
user, and are dynamically adapted to the ever changing setting of
the users’ preferences and SN conﬁguration.
1.
INTRODUCTION
Web 2.0 revolutionizes how people store and share personal data,
allowing for pervasive sharing of personal information on the web.
This change has multi-faceted implications, especially on privacy.
End users, are often unaware of the size or nature of the audience
that could potentially access their data. These issues are partic-
ularly pronounced in Social Network sites (SNs from now on),
where the false sense of intimacy amongst digital friends often
leads to potentially risky disclosures of private data.
Privacy in SNs can be compromised in several ways, by steal-
ing proﬁles’ data, observing the SN graph and by cross-correlating
distributed proﬁles that belongs to multiple sites [19, 7]. One of
the main threats to the users’ privacy stems from accidental disclo-
sures of data. For example, d...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:OpenBox: A Software-Defined Framework for Developing, Deploying,
and Managing Network Functions
author:Anat Bremler-Barr and
Yotam Harchol and
David Hay
OpenBox: A Software-Deﬁned Framework for
Developing, Deploying, and Managing
Network Functions
Anat Bremler-Barr ∗
bremler@idc.ac.il
dhay@cs.huji.ac.il
∗ School of Computer Science, The Interdisciplinary Center, Herzliya, Israel
yotamhc@cs.huji.ac.il
† School of Computer Science and Engineering, The Hebrew University, Jerusalem, Israel
Yotam Harchol †
David Hay†
ABSTRACT
We present OpenBox — a software-deﬁned framework
for network-wide development, deployment, and man-
agement of network functions (NFs). OpenBox eﬀec-
tively decouples the control plane of NFs from their data
plane, similarly to SDN solutions that only address the
network’s forwarding plane.
OpenBox consists of three logic components. First,
user-deﬁned OpenBox applications provide NF speciﬁ-
cations through the OpenBox north-bound API. Sec-
ond, a logically-centralized OpenBox controller is able
to merge logic of multiple NFs, possibly from multiple
tenants, and to use a network-wide view to eﬃciently
deploy and scale NFs across the network data plane.
Finally, OpenBox instances constitute OpenBox’s data
plane and are implemented either purely in software or
contain speciﬁc hardware accelerators (e.g., a TCAM).
In practice, diﬀerent NFs carry out similar process-
ing steps on the same packet, and our experiments in-
deed show a signiﬁcant improvement of the network per-
formance when using OpenBox. Moreover, OpenBox
readily supports smart NF placement, NF scaling, and
multi-tenancy through its controller.
CCS Concepts
•Networks → Middle boxes / network appliances;
Programming interfaces; Network control algorithms;
Permission to make digital or hard copies of all or part of this work for personal
or classroom use is granted without fee provided that copies are not made or
distributed for proﬁt or commercial advantage and that copies bear this ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:OpenBox: A Software-Defined Framework for Developing, Deploying,
and Managing Network Functions
author:Anat Bremler-Barr and
Yotam Harchol and
David Hay
OpenBox: A Software-Deﬁned Framework for
Developing, Deploying, and Managing
Network Functions
Anat Bremler-Barr ∗
bremler@idc.ac.il
dhay@cs.huji.ac.il
∗ School of Computer Science, The Interdisciplinary Center, Herzliya, Israel
yotamhc@cs.huji.ac.il
† School of Computer Science and Engineering, The Hebrew University, Jerusalem, Israel
Yotam Harchol †
David Hay†
ABSTRACT
We present OpenBox — a software-deﬁned framework
for network-wide development, deployment, and man-
agement of network functions (NFs). OpenBox eﬀec-
tively decouples the control plane of NFs from their data
plane, similarly to SDN solutions that only address the
network’s forwarding plane.
OpenBox consists of three logic components. First,
user-deﬁned OpenBox applications provide NF speciﬁ-
cations through the OpenBox north-bound API. Sec-
ond, a logically-centralized OpenBox controller is able
to merge logic of multiple NFs, possibly from multiple
tenants, and to use a network-wide view to eﬃciently
deploy and scale NFs across the network data plane.
Finally, OpenBox instances constitute OpenBox’s data
plane and are implemented either purely in software or
contain speciﬁc hardware accelerators (e.g., a TCAM).
In practice, diﬀerent NFs carry out similar process-
ing steps on the same packet, and our experiments in-
deed show a signiﬁcant improvement of the network per-
formance when using OpenBox. Moreover, OpenBox
readily supports smart NF placement, NF scaling, and
multi-tenancy through its controller.
CCS Concepts
•Networks → Middle boxes / network appliances;
Programming interfaces; Network control algorithms;
Permission to make digital or hard copies of all or part of this work for personal
or classroom use is granted without fee provided that copies are not made or
distributed for proﬁt or commercial advantage and that copies bear this ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Analyzing the process of installing rogue software
author:Robin Berthier and
Jorge Arjona and
Michel Cukier
978-1-4244-4421-2/09/$25.00 c(cid:13)2009 IEEE
560
Authorized licensed use limited to: Tsinghua University. Downloaded on March 20,2021 at 05:37:13 UTC from IEEE Xplore.  Restrictions apply.
Analyzing the Process of Installing Rogue SoftwareRobin Berthier*, Jorge Arjona‡*, and Michel Cukier**Center for Risk and ReliabilityDepartment of Mechanical EngineeringUniversity of Maryland, College Park, MD, USA{robinb, jorarar, mcukier}@umd.edu‡Escuela Técnica Superior de Ingenieros deTelecomunicaciónUniversidad Politecnica of Valencia, Spainjorarar@teleco.upv.esAbstractThis practical experience report presents the resultsof an experiment aimed at understanding the sequenceof malicious actions following a remote compromise.The type of rogue software installed during attacks wasused to classify and understand sequences of maliciousactions. For this experiment, we used four Linux targetcomputers running SSH with simple passwords. Duringthe eight-month data collection period, we recorded atotal of 1,171 attack sessions. In these sessions,attackers typed a total of 20,335 commands that wecategorized into 24 specific actions. These actions wereanalyzed based on the type of rogue software installedby attackers.1. IntroductionMost security analysis experiments focus on methodsfor keeping attackers out of target systems, but do littleto address their behavior after a remote compromise. Inthis experiment, we focused exclusively on post-compromise attacker behavior. More specifically, wefocused on the attackers’ actions that led to theinstallation of rogue software. We used four Linux target computers running SSHwith simple passwords. During the eight-month datacollection period, we recorded 1,171 attack sessions. Inthese sessions, attackers typed 20,335 commands thatwe categorized in 24 specific actions. These actionswere analyzed to determine attackers’ patterns andunde...