Instruction: 总结这篇安全研究的主要观点

Input:
title:Managing heterogeneous network environments using an extensible policy
framework
author:Lawrence Teo and
Gail-Joon Ahn
Managing Heterogeneous Network Environments Using an
Extensible Policy Framework
University of North Carolina at Charlotte
College of Computing and Informatics
University of North Carolina at Charlotte
College of Computing and Informatics
Gail-Joon Ahn †
gahn@uncc.edu
Lawrence Teo
lcteo@uncc.edu
ABSTRACT
Security policy management is critical to meet organiza-
tional needs and reduce potential risks because almost ev-
ery organization depends on computer networks and the In-
ternet for their daily operations. It is therefore important
to specify and enforce security policies eﬀectively. How-
ever, as organizations grow, so do their networks increas-
ing the diﬃculty of deploying a security policy, especially
across heterogeneous systems. In this paper, we introduce
a policy framework called Chameleos-x which is designed to
enforce security policies consistently across security-aware
systems with network services–primarily operating systems,
ﬁrewalls, and intrusion detection systems. Throughout this
paper, we focus on the design and architecture of Chameleos-
x and demonstrate how our policy framework helps organi-
zations implement security policies in changing, diversity-
rich environments. We also describe our experimentation of
Chameleos-x to demonstrate the feasibility of the proposed
approach.
1.
INTRODUCTION
Businesses and organizations depend heavily on computer
networks and information systems for their daily operations.
Due to this ever-increasing reliance on computer systems, it
is critical for organizations to implement a carefully-designed
security policy for their networks and information systems.
When organizations grow, so do their computer networks
and information systems. This growth tends to introduce
diversity and heterogeneity into the network, especially as
new operating systems, network devices, and security tech-
nologie...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:DevoFlow: scaling flow management for high-performance networks
author:Andrew R. Curtis and
Jeffrey C. Mogul and
Jean Tourrilhes and
Praveen Yalagandula and
Puneet Sharma and
Sujata Banerjee
DevoFlow: Scaling Flow Management for
High-Performance Networks∗
Andrew R. Curtis
University of Waterloo
Jeffrey C. Mogul, Jean Tourrilhes, Praveen Yalagandula
Puneet Sharma, Sujata Banerjee
HP Labs — Palo Alto
ABSTRACT
OpenFlow is a great concept, but its original design im-
poses excessive overheads. It can simplify network and traf-
ﬁc management in enterprise and data center environments,
because it enables ﬂow-level control over Ethernet switch-
ing and provides global visibility of the ﬂows in the net-
work. However, such ﬁne-grained control and visibility comes
with costs: the switch-implementation costs of involving the
switch’s control-plane too often and the distributed-system
costs of involving the OpenFlow controller too frequently,
both on ﬂow setups and especially for statistics-gathering.
In this paper, we analyze these overheads, and show that
OpenFlow’s current design cannot meet the needs of high-
performance networks. We design and evaluate DevoFlow,
a modiﬁcation of the OpenFlow model which gently breaks
the coupling between control and global visibility, in a way
that maintains a useful amount of visibility without impos-
ing unnecessary costs. We evaluate DevoFlow through simu-
lations, and ﬁnd that it can load-balance data center traﬃc
as well as ﬁne-grained solutions, without as much overhead:
DevoFlow uses 10–53 times fewer ﬂow table entries at an av-
erage switch, and uses 10–42 times fewer control messages.
Categories and Subject Descriptors.
C.2 [Internetworking]: Network Architecture and Design
General Terms. Design, Measurement, Performance
Keywords. Data center, Flow-based networking
1.
INTRODUCTION
Flow-based switches, such as those enabled by the Open-
Flow [35] framework, support ﬁne-grained, ﬂow-level control
of Ethernet switching. Such c...


Instruction: 总结这篇安全研究的主要观点

Input:
title:DevoFlow: scaling flow management for high-performance networks
author:Andrew R. Curtis and
Jeffrey C. Mogul and
Jean Tourrilhes and
Praveen Yalagandula and
Puneet Sharma and
Sujata Banerjee
DevoFlow: Scaling Flow Management for
High-Performance Networks∗
Andrew R. Curtis
University of Waterloo
Jeffrey C. Mogul, Jean Tourrilhes, Praveen Yalagandula
Puneet Sharma, Sujata Banerjee
HP Labs — Palo Alto
ABSTRACT
OpenFlow is a great concept, but its original design im-
poses excessive overheads. It can simplify network and traf-
ﬁc management in enterprise and data center environments,
because it enables ﬂow-level control over Ethernet switch-
ing and provides global visibility of the ﬂows in the net-
work. However, such ﬁne-grained control and visibility comes
with costs: the switch-implementation costs of involving the
switch’s control-plane too often and the distributed-system
costs of involving the OpenFlow controller too frequently,
both on ﬂow setups and especially for statistics-gathering.
In this paper, we analyze these overheads, and show that
OpenFlow’s current design cannot meet the needs of high-
performance networks. We design and evaluate DevoFlow,
a modiﬁcation of the OpenFlow model which gently breaks
the coupling between control and global visibility, in a way
that maintains a useful amount of visibility without impos-
ing unnecessary costs. We evaluate DevoFlow through simu-
lations, and ﬁnd that it can load-balance data center traﬃc
as well as ﬁne-grained solutions, without as much overhead:
DevoFlow uses 10–53 times fewer ﬂow table entries at an av-
erage switch, and uses 10–42 times fewer control messages.
Categories and Subject Descriptors.
C.2 [Internetworking]: Network Architecture and Design
General Terms. Design, Measurement, Performance
Keywords. Data center, Flow-based networking
1.
INTRODUCTION
Flow-based switches, such as those enabled by the Open-
Flow [35] framework, support ﬁne-grained, ﬂow-level control
of Ethernet switching. Such c...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Mobile location tracking in metro areas: malnets and others
author:Nathaniel Husted and
Steven A. Myers
Mobile Location Tracking in Metro Areas: Malnets and
Others
Nathaniel Husted
School of Informatics and Computing
Indiana University, Bloomington
nhusted@indiana.edu
Steven Myers
School of Informatics and Computing
Indiana University, Bloomington
samyers@indiana.edu
ABSTRACT
Digital wireless radios broadcast identiﬁcation numbers that
uniquely identify them. As has been previously observed,
given the ubiquity with which people carry smartphones
with their embedded WiFi radios powered on, comes the
ability to track individuals’ movements. The ability to use
wireless radios for positioning has been previously observed
and developed in to useful products.
In these systems a
user willingly geolocates themselves by providing identiﬁers
to infrastructure hardware. In this paper we consider the
converse question: what rates of monitoring by smartphones
devices in a given metropolitan area are necessary to achieve
diﬀerent levels of involuntary geolocation. While previous
work has looked at countermeasure that attempt to maintain
privacy, no work has attempted to quantify the problem and
risks. Using appropriate simulations we give the ﬁrst quan-
titative support for the number and conditions of tracking
devices necessary to track the locations of non-participant
individuals in urban environments. We provide evidence
that a small, but not insigniﬁcant, number of mobile devices
can be used to track a majority of users during a signiﬁcant
fraction of their travel with current devices. We conclude
that in the immediate future, malnets would require rela-
tively high infection rates to pose a signiﬁcant threat, but
that voluntary networks, with perceived beneﬁt can prob-
ably achieve the usage rates necessary to track individual
movements of non-subscribed users to a high-degree of ac-
curacy. Our results also suggest ubiquitous deployment of
802.11n in smartphones would...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Mobile location tracking in metro areas: malnets and others
author:Nathaniel Husted and
Steven A. Myers
Mobile Location Tracking in Metro Areas: Malnets and
Others
Nathaniel Husted
School of Informatics and Computing
Indiana University, Bloomington
nhusted@indiana.edu
Steven Myers
School of Informatics and Computing
Indiana University, Bloomington
samyers@indiana.edu
ABSTRACT
Digital wireless radios broadcast identiﬁcation numbers that
uniquely identify them. As has been previously observed,
given the ubiquity with which people carry smartphones
with their embedded WiFi radios powered on, comes the
ability to track individuals’ movements. The ability to use
wireless radios for positioning has been previously observed
and developed in to useful products.
In these systems a
user willingly geolocates themselves by providing identiﬁers
to infrastructure hardware. In this paper we consider the
converse question: what rates of monitoring by smartphones
devices in a given metropolitan area are necessary to achieve
diﬀerent levels of involuntary geolocation. While previous
work has looked at countermeasure that attempt to maintain
privacy, no work has attempted to quantify the problem and
risks. Using appropriate simulations we give the ﬁrst quan-
titative support for the number and conditions of tracking
devices necessary to track the locations of non-participant
individuals in urban environments. We provide evidence
that a small, but not insigniﬁcant, number of mobile devices
can be used to track a majority of users during a signiﬁcant
fraction of their travel with current devices. We conclude
that in the immediate future, malnets would require rela-
tively high infection rates to pose a signiﬁcant threat, but
that voluntary networks, with perceived beneﬁt can prob-
ably achieve the usage rates necessary to track individual
movements of non-subscribed users to a high-degree of ac-
curacy. Our results also suggest ubiquitous deployment of
802.11n in smartphones would...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:An investigation of geographic mapping techniques for internet hosts
author:Venkata N. Padmanabhan and
Lakshminarayanan Subramanian
An Investigation of Geographic Mapping Techniques for
Internet Hosts
Venkata N. Padmanabhan
Microsoft Research
Lakshminarayanan Subramaniany
University of California at Berkeley
ABSTRACT
 hi ae we ak whehe i i ibe  b	id a
adde  gegahic cai aig evice f ee
h. S	ch a evice w	d eabe a age ad ieeig
ca f cai	awae aicai. Thi i a chaegig
be beca	e a  adde de  iheey cai
a idicai f cai.
We ee ad eva	ae hee diic echi	e cec
ivey efeed  a 2Ge f deeiig he gegahic
cai f ee h. The (cid:12) echi	e GeTack i
fe cai baed  he DS ae f he age h
he eaby ewk de. The ecd echi	e Ge
ig 	e ewk deay ea	ee f gegahicay
diib	ed cai  ded	ce he cdiae f he a
ge h. The hid echi	e GeC	e cbie aia
ad iby iacc	ae h		cai aig ifa
i ad BG e(cid:12)x ifai  ife he cai f he
age h. Uig exeive ad vaied daa e we eva
ae he eface f hee echi	e ad ideify f	da
ea chaege i ded	cig gegahic cai f he
 adde f a ee h.
1.
INTRODUCTION
 hi ae we ak he 	ei: i i ibe  b	id
a  adde  gegahic cai aig evice f
ee h? Give a  adde he aig evice
w	d e	 he gegahic cai f he h  which
he  adde ha bee aiged. Thi i a chaegig
be beca	e a  adde de  iheey cai
a idicai f gegahic cai.
B	idig a  adde  cai aig evice he
cai aig be f h i a ieeig b
e i i w...


Instruction: 总结这篇安全研究的主要观点

Input:
title:An investigation of geographic mapping techniques for internet hosts
author:Venkata N. Padmanabhan and
Lakshminarayanan Subramanian
An Investigation of Geographic Mapping Techniques for
Internet Hosts
Venkata N. Padmanabhan
Microsoft Research
Lakshminarayanan Subramaniany
University of California at Berkeley
ABSTRACT
 hi ae we ak whehe i i ibe  b	id a
adde  gegahic cai aig evice f ee
h. S	ch a evice w	d eabe a age ad ieeig
ca f cai	awae aicai. Thi i a chaegig
be beca	e a  adde de  iheey cai
a idicai f cai.
We ee ad eva	ae hee diic echi	e cec
ivey efeed  a 2Ge f deeiig he gegahic
cai f ee h. The (cid:12) echi	e GeTack i
fe cai baed  he DS ae f he age h
he eaby ewk de. The ecd echi	e Ge
ig 	e ewk deay ea	ee f gegahicay
diib	ed cai  ded	ce he cdiae f he a
ge h. The hid echi	e GeC	e cbie aia
ad iby iacc	ae h		cai aig ifa
i ad BG e(cid:12)x ifai  ife he cai f he
age h. Uig exeive ad vaied daa e we eva
ae he eface f hee echi	e ad ideify f	da
ea chaege i ded	cig gegahic cai f he
 adde f a ee h.
1.
INTRODUCTION
 hi ae we ak he 	ei: i i ibe  b	id
a  adde  gegahic cai aig evice f
ee h? Give a  adde he aig evice
w	d e	 he gegahic cai f he h  which
he  adde ha bee aiged. Thi i a chaegig
be beca	e a  adde de  iheey cai
a idicai f gegahic cai.
B	idig a  adde  cai aig evice he
cai aig be f h i a ieeig b
e i i w...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Android ION Hazard: the Curse of Customizable Memory Management
System
author:Hang Zhang and
Dongdong She and
Zhiyun Qian
Android ION Hazard: the Curse of Customizable Memory
Management System
Hang Zhang, Dongdong She, Zhiyun Qian
University of California, Riverside
hang@cs.ucr.edu, dshe002@ucr.edu, zhiyunq@cs.ucr.edu
ABSTRACT
ION is a uniﬁed memory management interface for Android
that is widely used on virtually all ARM based Android de-
vices. ION attempts to achieve several ambitious goals that
have not been simultaneously achieved before (not even on
Linux). Diﬀerent from managing regular memory in the
system, ION is designed to share and manage memory with
special constraints, e.g., physically contiguous memory. De-
spite the great ﬂexibility and performance beneﬁts oﬀered,
such a critical subsystem, as we discover, unfortunately has
ﬂawed security assumptions and designs.
In this paper, we systematically analyze the ION relat-
ed vulnerabilities from the conceptual root causes to the
detailed implementation decisions. Since ION is often cus-
tomized heavily for diﬀerent Android devices, the speciﬁc
vulnerabilities often manifest themselves diﬀerently. By con-
ducting a range of runtime testing as well as static analysis,
we are able to uncover a large number of serious vulnera-
bilities on the latest Android devices (e.g., Nexus 6P run-
ning Android 6.0 and 7.0 preview) such as denial-of-service
and dumping memory from the system and arbitrary appli-
cations (e.g., email content, passwords). Finally, we oﬀer
suggestions on how to redesign the ION subsystem to elim-
inate these ﬂaws. We believe that the lessons learned can
help guide the future design of similar memory management
subsystems.
1.
INTRODUCTION
Android operating system has gained tremendous pop-
ularity in the past few years thanks to the huge vendor
support behind it. Unlike iOS that runs on only Apple-
assembled hardware, Android is open source and encourages
other vendors to build smartph...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Android ION Hazard: the Curse of Customizable Memory Management
System
author:Hang Zhang and
Dongdong She and
Zhiyun Qian
Android ION Hazard: the Curse of Customizable Memory
Management System
Hang Zhang, Dongdong She, Zhiyun Qian
University of California, Riverside
hang@cs.ucr.edu, dshe002@ucr.edu, zhiyunq@cs.ucr.edu
ABSTRACT
ION is a uniﬁed memory management interface for Android
that is widely used on virtually all ARM based Android de-
vices. ION attempts to achieve several ambitious goals that
have not been simultaneously achieved before (not even on
Linux). Diﬀerent from managing regular memory in the
system, ION is designed to share and manage memory with
special constraints, e.g., physically contiguous memory. De-
spite the great ﬂexibility and performance beneﬁts oﬀered,
such a critical subsystem, as we discover, unfortunately has
ﬂawed security assumptions and designs.
In this paper, we systematically analyze the ION relat-
ed vulnerabilities from the conceptual root causes to the
detailed implementation decisions. Since ION is often cus-
tomized heavily for diﬀerent Android devices, the speciﬁc
vulnerabilities often manifest themselves diﬀerently. By con-
ducting a range of runtime testing as well as static analysis,
we are able to uncover a large number of serious vulnera-
bilities on the latest Android devices (e.g., Nexus 6P run-
ning Android 6.0 and 7.0 preview) such as denial-of-service
and dumping memory from the system and arbitrary appli-
cations (e.g., email content, passwords). Finally, we oﬀer
suggestions on how to redesign the ION subsystem to elim-
inate these ﬂaws. We believe that the lessons learned can
help guide the future design of similar memory management
subsystems.
1.
INTRODUCTION
Android operating system has gained tremendous pop-
ularity in the past few years thanks to the huge vendor
support behind it. Unlike iOS that runs on only Apple-
assembled hardware, Android is open source and encourages
other vendors to build smartph...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Will you trust this TLS certificate?: perceptions of people working
in IT
author:Martin Ukrop and
Lydia Kraus and
Vashek Matyas and
Heider Ahmad Mutleq Wahsheh
Will You Trust This TLS Certificate?
Perceptions of People Working in IT
Martin Ukrop
mukrop@mail.muni.cz
CRoCS, Masaryk University
Brno, Czech Republic
Vashek Matyas
matyas@fi.muni.cz
CRoCS, Masaryk University
Brno, Czech Republic
Lydia Kraus
lydia.kraus@fi.muni.cz
CRoCS, Masaryk University
Brno, Czech Republic
Heider Ahmad Mutleq Wahsheh
heider.wahsheh@unive.it
Ca’ Foscari University of Venice
Venice, Italy
ABSTRACT
Flawed TLS certificates are not uncommon on the Internet. While
they signal a potential issue, in most cases they have benign causes
(e.g., misconfiguration or even deliberate deployment). This adds
fuzziness to the decision on whether to trust a connection or not.
Little is known about perceptions of flawed certificates by IT pro-
fessionals, even though their decisions impact high numbers of end
users. Moreover, it is unclear how much does the content of error
messages and documentation influence these perceptions.
To shed light on these issues, we observed 75 attendees of an
industrial IT conference investigating different certificate validation
errors. We also analysed the influence of re-worded error messages
and redesigned documentation. We find that people working in IT
have very nuanced opinions with trust decisions being far from bi-
nary. The self-signed and the name constrained certificates seem to
be over-trusted (the latter also being poorly understood). We show
that even small changes in existing error messages can positively
influence resource use, comprehension, and trust assessment. Our re-
worded error messages and documentation can be directly adopted.
CCS CONCEPTS
• Security and privacy → Usability in security and privacy;
Authentication; • Human-centered computing;
KEYWORDS
warning design, documentation, TLS certificate, usable security
ACM Reference Format:
Martin Ukr...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Will you trust this TLS certificate?: perceptions of people working
in IT
author:Martin Ukrop and
Lydia Kraus and
Vashek Matyas and
Heider Ahmad Mutleq Wahsheh
Will You Trust This TLS Certificate?
Perceptions of People Working in IT
Martin Ukrop
mukrop@mail.muni.cz
CRoCS, Masaryk University
Brno, Czech Republic
Vashek Matyas
matyas@fi.muni.cz
CRoCS, Masaryk University
Brno, Czech Republic
Lydia Kraus
lydia.kraus@fi.muni.cz
CRoCS, Masaryk University
Brno, Czech Republic
Heider Ahmad Mutleq Wahsheh
heider.wahsheh@unive.it
Ca’ Foscari University of Venice
Venice, Italy
ABSTRACT
Flawed TLS certificates are not uncommon on the Internet. While
they signal a potential issue, in most cases they have benign causes
(e.g., misconfiguration or even deliberate deployment). This adds
fuzziness to the decision on whether to trust a connection or not.
Little is known about perceptions of flawed certificates by IT pro-
fessionals, even though their decisions impact high numbers of end
users. Moreover, it is unclear how much does the content of error
messages and documentation influence these perceptions.
To shed light on these issues, we observed 75 attendees of an
industrial IT conference investigating different certificate validation
errors. We also analysed the influence of re-worded error messages
and redesigned documentation. We find that people working in IT
have very nuanced opinions with trust decisions being far from bi-
nary. The self-signed and the name constrained certificates seem to
be over-trusted (the latter also being poorly understood). We show
that even small changes in existing error messages can positively
influence resource use, comprehension, and trust assessment. Our re-
worded error messages and documentation can be directly adopted.
CCS CONCEPTS
• Security and privacy → Usability in security and privacy;
Authentication; • Human-centered computing;
KEYWORDS
warning design, documentation, TLS certificate, usable security
ACM Reference Format:
Martin Ukr...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Understanding Precision in Host Based Intrusion Detection
author:Monirul I. Sharif and
Kapil Singh and
Jonathon T. Giffin and
Wenke Lee
Understanding Precision in Host Based Intrusion
Detection
Formal Analysis and Practical Models
Monirul Sharif, Kapil Singh, Jonathon Gifﬁn, and Wenke Lee
School of Computer Science, Georgia Institute of Technology
{msharif,ksingh,giffin,wenke}@cc.gatech.edu
Abstract. Many host-based anomaly detection systems monitor process execu-
tion at the granularity of system calls. Other recently proposed schemes instead
verify the destinations of control-ﬂow transfers to prevent the execution of attack
code. This paper formally analyzes and compares real systems based on these
two anomaly detection philosophies in terms of their attack detection capabilities,
and proves and disproves several intuitions. We prove that for any system-call se-
quence model, under the same (static or dynamic) program analysis technique,
there always exists a more precise control-ﬂow sequence based model. While hy-
brid approaches combining system calls and control ﬂows intuitively seem advan-
tageous, especially when binary analysis constructs incomplete models, we prove
that they have no fundamental advantage over simpler control-ﬂow models. Fi-
nally, we utilize the ideas in our framework to make external monitoring feasible
at the precise control-ﬂow level. Our experiments show that external control-ﬂow
monitoring imposes performance overhead comparable to previous system call
based approaches while detecting synthetic and real world attacks as effectively
as an inlined monitor.
Keywords: Anomaly detection, Formal analysis, Program models.
1 Introduction
Over the years, researchers have developed an abundance of host-based intrusion detec-
tion systems, utilizing a variety of mechanisms. Most systems, e.g. [11,29,9,10,17,16,
12,27], model an application’s normal system call usage and use run-time monitoring to
detect attacks that cause behavior deviating...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Understanding Precision in Host Based Intrusion Detection
author:Monirul I. Sharif and
Kapil Singh and
Jonathon T. Giffin and
Wenke Lee
Understanding Precision in Host Based Intrusion
Detection
Formal Analysis and Practical Models
Monirul Sharif, Kapil Singh, Jonathon Gifﬁn, and Wenke Lee
School of Computer Science, Georgia Institute of Technology
{msharif,ksingh,giffin,wenke}@cc.gatech.edu
Abstract. Many host-based anomaly detection systems monitor process execu-
tion at the granularity of system calls. Other recently proposed schemes instead
verify the destinations of control-ﬂow transfers to prevent the execution of attack
code. This paper formally analyzes and compares real systems based on these
two anomaly detection philosophies in terms of their attack detection capabilities,
and proves and disproves several intuitions. We prove that for any system-call se-
quence model, under the same (static or dynamic) program analysis technique,
there always exists a more precise control-ﬂow sequence based model. While hy-
brid approaches combining system calls and control ﬂows intuitively seem advan-
tageous, especially when binary analysis constructs incomplete models, we prove
that they have no fundamental advantage over simpler control-ﬂow models. Fi-
nally, we utilize the ideas in our framework to make external monitoring feasible
at the precise control-ﬂow level. Our experiments show that external control-ﬂow
monitoring imposes performance overhead comparable to previous system call
based approaches while detecting synthetic and real world attacks as effectively
as an inlined monitor.
Keywords: Anomaly detection, Formal analysis, Program models.
1 Introduction
Over the years, researchers have developed an abundance of host-based intrusion detec-
tion systems, utilizing a variety of mechanisms. Most systems, e.g. [11,29,9,10,17,16,
12,27], model an application’s normal system call usage and use run-time monitoring to
detect attacks that cause behavior deviating...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Privacy and accountability for location-based aggregate statistics
author:Raluca A. Popa and
Andrew J. Blumberg and
Hari Balakrishnan and
Frank H. Li
Privacy and Accountability for Location-based Aggregate
Statistics
Raluca Ada Popa
ralucap@mit.edu
MIT
Andrew J. Blumberg
University of Texas, Austin
blumberg@math.utexas.edu
Frank H. Li
MIT
frankli@mit.edu
Hari Balakrishnan
MIT
hari@mit.edu
ABSTRACT
A signiﬁcant and growing class of location-based mobile applica-
tions aggregate position data from individual devices at a server and
compute aggregate statistics over these position streams. Because
these devices can be linked to the movement of individuals, there
is signiﬁcant danger that the aggregate computation will violate the
location privacy of individuals. This paper develops and evaluates
PrivStats, a system for computing aggregate statistics over location
data that simultaneously achieves two properties: ﬁrst, provable
guarantees on location privacy even in the face of any side informa-
tion about users known to the server, and second, privacy-preserving
accountability (i.e., protection against abusive clients uploading
large amounts of spurious data). PrivStats achieves these properties
using a new protocol for uploading and aggregating data anony-
mously as well as an efﬁcient zero-knowledge proof of knowledge
protocol we developed from scratch for accountability. We imple-
mented our system on Nexus One smartphones and commodity
servers. Our experimental results demonstrate that PrivStats is a
practical system: computing a common aggregate (e.g., count) over
the data of 10, 000 clients takes less than 0.46 s at the server and
the protocol has modest latency (0.6 s) to upload data from a Nexus
phone. We also validated our protocols on real driver traces from
the CarTel project.
Categories and subject descriptors: C.2.0 [Computer Communi-
cation Networks]: General–Security and protection
General terms: Security
1.
INTRODUCTION
The emergence of location-b...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Privacy and accountability for location-based aggregate statistics
author:Raluca A. Popa and
Andrew J. Blumberg and
Hari Balakrishnan and
Frank H. Li
Privacy and Accountability for Location-based Aggregate
Statistics
Raluca Ada Popa
ralucap@mit.edu
MIT
Andrew J. Blumberg
University of Texas, Austin
blumberg@math.utexas.edu
Frank H. Li
MIT
frankli@mit.edu
Hari Balakrishnan
MIT
hari@mit.edu
ABSTRACT
A signiﬁcant and growing class of location-based mobile applica-
tions aggregate position data from individual devices at a server and
compute aggregate statistics over these position streams. Because
these devices can be linked to the movement of individuals, there
is signiﬁcant danger that the aggregate computation will violate the
location privacy of individuals. This paper develops and evaluates
PrivStats, a system for computing aggregate statistics over location
data that simultaneously achieves two properties: ﬁrst, provable
guarantees on location privacy even in the face of any side informa-
tion about users known to the server, and second, privacy-preserving
accountability (i.e., protection against abusive clients uploading
large amounts of spurious data). PrivStats achieves these properties
using a new protocol for uploading and aggregating data anony-
mously as well as an efﬁcient zero-knowledge proof of knowledge
protocol we developed from scratch for accountability. We imple-
mented our system on Nexus One smartphones and commodity
servers. Our experimental results demonstrate that PrivStats is a
practical system: computing a common aggregate (e.g., count) over
the data of 10, 000 clients takes less than 0.46 s at the server and
the protocol has modest latency (0.6 s) to upload data from a Nexus
phone. We also validated our protocols on real driver traces from
the CarTel project.
Categories and subject descriptors: C.2.0 [Computer Communi-
cation Networks]: General–Security and protection
General terms: Security
1.
INTRODUCTION
The emergence of location-b...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:MulVAL: A Logic-based Network Security Analyzer
author:Xinming Ou and
Sudhakar Govindavajhala and
Andrew W. Appel
MulVAL: A Logic-based Network Security Analyzer ∗
Xinming Ou
Sudhakar Govindavajhala Andrew W. Appel
Princeton University
{xou, sudhakar, appel}@cs.princeton.edu
Abstract
To determine the security impact software vulnerabilities
have on a particular network, one must consider interac-
tions among multiple network elements. For a vulnera-
bility analysis tool to be useful in practice, two features
are crucial. First, the model used in the analysis must be
able to automatically integrate formal vulnerability spec-
iﬁcations from the bug-reporting community. Second,
the analysis must be able to scale to networks with thou-
sands of machines.
We show how to achieve these two goals by present-
ing MulVAL, an end-to-end framework and reasoning
system that conducts multihost, multistage vulnerability
analysis on a network. MulVAL adopts Datalog as the
modeling language for the elements in the analysis (bug
speciﬁcation, conﬁguration description, reasoning rules,
operating-system permission and privilege model, etc.).
We easily leverage existing vulnerability-database and
scanning tools by expressing their output in Datalog and
feeding it to our MulVAL reasoning engine. Once the in-
formation is collected, the analysis can be performed in
seconds for networks with thousands of machines.
We implemented our framework on the Red Hat Linux
platform. Our framework can reason about 84% of the
Red Hat bugs reported in OVAL, a formal vulnerability
deﬁnition language. We tested our tool on a real network
with hundreds of users. The tool detected a policy vio-
lation caused by software vulnerabilities and the system
administrators took remediation measures.
1 Introduction
the number of vulnerabilities discovered each year grow-
ing rapidly, it is impossible for system administrators
to keep the software running on their network machines
free of security bugs. One of...


Instruction: 总结这篇安全研究的主要观点

Input:
title:MulVAL: A Logic-based Network Security Analyzer
author:Xinming Ou and
Sudhakar Govindavajhala and
Andrew W. Appel
MulVAL: A Logic-based Network Security Analyzer ∗
Xinming Ou
Sudhakar Govindavajhala Andrew W. Appel
Princeton University
{xou, sudhakar, appel}@cs.princeton.edu
Abstract
To determine the security impact software vulnerabilities
have on a particular network, one must consider interac-
tions among multiple network elements. For a vulnera-
bility analysis tool to be useful in practice, two features
are crucial. First, the model used in the analysis must be
able to automatically integrate formal vulnerability spec-
iﬁcations from the bug-reporting community. Second,
the analysis must be able to scale to networks with thou-
sands of machines.
We show how to achieve these two goals by present-
ing MulVAL, an end-to-end framework and reasoning
system that conducts multihost, multistage vulnerability
analysis on a network. MulVAL adopts Datalog as the
modeling language for the elements in the analysis (bug
speciﬁcation, conﬁguration description, reasoning rules,
operating-system permission and privilege model, etc.).
We easily leverage existing vulnerability-database and
scanning tools by expressing their output in Datalog and
feeding it to our MulVAL reasoning engine. Once the in-
formation is collected, the analysis can be performed in
seconds for networks with thousands of machines.
We implemented our framework on the Red Hat Linux
platform. Our framework can reason about 84% of the
Red Hat bugs reported in OVAL, a formal vulnerability
deﬁnition language. We tested our tool on a real network
with hundreds of users. The tool detected a policy vio-
lation caused by software vulnerabilities and the system
administrators took remediation measures.
1 Introduction
the number of vulnerabilities discovered each year grow-
ing rapidly, it is impossible for system administrators
to keep the software running on their network machines
free of security bugs. One of...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Analyzing the MAC-level behavior of wireless networks in the wild
author:Ratul Mahajan and
Maya Rodrig and
David Wetherall and
John Zahorjan
Analyzing the MAC-level Behavior of Wireless Networks
in the Wild
Ratul Mahajan
Microsoft Research
Maya Rodrig
University of Washington
David Wetherall
University of Washington
John Zahorjan
University of Washington
ABSTRACT
We present Wit, a non-intrusive tool that builds on passive moni-
toring to analyze the detailed MAC-level behavior of operational
wireless networks. Wit uses three processing steps to construct an
enhanced trace of system activity. First, a robust merging proce-
dure combines the necessarily incomplete views from multiple, in-
dependent monitors into a single, more complete trace of wireless
activity. Next, a novel inference engine based on formal language
methods reconstructs packets that were not captured by any moni-
tor and determines whether each packet was received by its destina-
tion. Finally, Wit derives network performance measures from this
enhanced trace; we show how to estimate the number of stations
competing for the medium. We assess Wit with a mix of real traces
and simulation tests. We ﬁnd that merging and inference both sig-
niﬁcantly enhance the originally captured trace. We apply Wit to
multi-monitor traces from a live network to show how it facilitates
802.11 MAC analyses that would otherwise be difﬁcult or rely on
less accurate heuristics.
Categories and Subject Descriptors
C.4 [Performance of systems]: Measurement techniques
General Terms
Measurement, performance
Keywords
Passive monitoring, measurement tool, 802.11 MAC
1.
INTRODUCTION
Measurement-driven analysis of live networks is critical to un-
derstanding and improving their operation (e.g., [3, 28, 13, 18, 22,
24]). In the case of wireless, however, very little detailed informa-
tion is currently available on the performance of real deployments,
even though wireless protocols are a subject of intense research and
standard...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Analyzing the MAC-level behavior of wireless networks in the wild
author:Ratul Mahajan and
Maya Rodrig and
David Wetherall and
John Zahorjan
Analyzing the MAC-level Behavior of Wireless Networks
in the Wild
Ratul Mahajan
Microsoft Research
Maya Rodrig
University of Washington
David Wetherall
University of Washington
John Zahorjan
University of Washington
ABSTRACT
We present Wit, a non-intrusive tool that builds on passive moni-
toring to analyze the detailed MAC-level behavior of operational
wireless networks. Wit uses three processing steps to construct an
enhanced trace of system activity. First, a robust merging proce-
dure combines the necessarily incomplete views from multiple, in-
dependent monitors into a single, more complete trace of wireless
activity. Next, a novel inference engine based on formal language
methods reconstructs packets that were not captured by any moni-
tor and determines whether each packet was received by its destina-
tion. Finally, Wit derives network performance measures from this
enhanced trace; we show how to estimate the number of stations
competing for the medium. We assess Wit with a mix of real traces
and simulation tests. We ﬁnd that merging and inference both sig-
niﬁcantly enhance the originally captured trace. We apply Wit to
multi-monitor traces from a live network to show how it facilitates
802.11 MAC analyses that would otherwise be difﬁcult or rely on
less accurate heuristics.
Categories and Subject Descriptors
C.4 [Performance of systems]: Measurement techniques
General Terms
Measurement, performance
Keywords
Passive monitoring, measurement tool, 802.11 MAC
1.
INTRODUCTION
Measurement-driven analysis of live networks is critical to un-
derstanding and improving their operation (e.g., [3, 28, 13, 18, 22,
24]). In the case of wireless, however, very little detailed informa-
tion is currently available on the performance of real deployments,
even though wireless protocols are a subject of intense research and
standard...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Who Touched My Browser Fingerprint?: A Large-scale Measurement Study
and Classification of Fingerprint Dynamics
author:Song Li and
Yinzhi Cao
Who Touched My Browser Fingerprint?
A Large-scale Measurement Study and Classification of
Fingerprint Dynamics
Song Li
Johns Hopkins University
lsong18@jhu.edu
Yinzhi Cao
Johns Hopkins University
yinzhi.cao@jhu.edu
ABSTRACT
Browser fingerprints are dynamic, evolving with feature values
changed over time. Previous fingerprinting datasets are either small-
scale with only thousands of browser instances or without con-
sidering fingerprint dynamics. Thus, it remains unclear how an
evolution-aware fingerprinting tool behaves in a real-world setting,
e.g., on a website with millions of browser instances, let alone how
fingerprint dynamics implicate privacy and security.
In this paper, we perform the first, large-scale study of millions of
fingerprints to analyze fingerprint dynamics in a real-world website.
Our measurement study answers the question of how and why
fingerprints change over time by classifying fingerprint dynamics
into three categories based on their causes. We also observed several
insights from our measurement, e.g., we show that state-of-the-
art fingerprinting tool performs poorly in terms of F1-Score and
matching speed in this real-world setting.
ACM Reference Format:
Song Li and Yinzhi Cao. 2020. Who Touched My Browser Fingerprint? A
Large-scale Measurement Study and Classification of Fingerprint Dynamics.
In ACM Internet Measurement Conference (IMC ’20), October 27–November
29, 2020, Virtual Event, USA. ACM, New York, NY, USA, 16 pages. https:
//doi.org/10.1145/3419394.3423614
1 INTRODUCTION
Browser fingerprinting, an alternative to browser cookies when
being disabled or cleared, is that a website extracts a list of browser
features at the client side and then constructs an identifier, called
a fingerprint, based on these extracted features to identify or au-
thenticate the browser. Browser fingerprintin...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Who Touched My Browser Fingerprint?: A Large-scale Measurement Study
and Classification of Fingerprint Dynamics
author:Song Li and
Yinzhi Cao
Who Touched My Browser Fingerprint?
A Large-scale Measurement Study and Classification of
Fingerprint Dynamics
Song Li
Johns Hopkins University
lsong18@jhu.edu
Yinzhi Cao
Johns Hopkins University
yinzhi.cao@jhu.edu
ABSTRACT
Browser fingerprints are dynamic, evolving with feature values
changed over time. Previous fingerprinting datasets are either small-
scale with only thousands of browser instances or without con-
sidering fingerprint dynamics. Thus, it remains unclear how an
evolution-aware fingerprinting tool behaves in a real-world setting,
e.g., on a website with millions of browser instances, let alone how
fingerprint dynamics implicate privacy and security.
In this paper, we perform the first, large-scale study of millions of
fingerprints to analyze fingerprint dynamics in a real-world website.
Our measurement study answers the question of how and why
fingerprints change over time by classifying fingerprint dynamics
into three categories based on their causes. We also observed several
insights from our measurement, e.g., we show that state-of-the-
art fingerprinting tool performs poorly in terms of F1-Score and
matching speed in this real-world setting.
ACM Reference Format:
Song Li and Yinzhi Cao. 2020. Who Touched My Browser Fingerprint? A
Large-scale Measurement Study and Classification of Fingerprint Dynamics.
In ACM Internet Measurement Conference (IMC ’20), October 27–November
29, 2020, Virtual Event, USA. ACM, New York, NY, USA, 16 pages. https:
//doi.org/10.1145/3419394.3423614
1 INTRODUCTION
Browser fingerprinting, an alternative to browser cookies when
being disabled or cleared, is that a website extracts a list of browser
features at the client side and then constructs an identifier, called
a fingerprint, based on these extracted features to identify or au-
thenticate the browser. Browser fingerprintin...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:SecLaaS: secure logging-as-a-service for cloud forensics
author:Shams Zawoad and
Amit Kumar Dutta and
Ragib Hasan
SecLaaS: Secure Logging-as-a-Service for Cloud
Forensics
Shams Zawoad
University of Alabama at
Birmingham
Birmingham, Alabama
35294-1170
zawoad@cis.uab.edu
Amit Kumar Dutta
University of Alabama at
Birmingham
Birmingham, Alabama
adutta@cis.uab.edu
35294-1170
Ragib Hasan
University of Alabama at
Birmingham
Birmingham, Alabama
ragib@cis.uab.edu
35294-1170
ABSTRACT
Cloud computing has emerged as a popular computing paradigm
in recent years. However, today’s cloud computing architectures
often lack support for computer forensic investigations. Analyzing
various logs (e.g., process logs, network logs) plays a vital role in
computer forensics. Unfortunately, collecting logs from a cloud is
very hard given the black-box nature of clouds and the multi-tenant
cloud models, where many users share the same processing and
network resources. Researchers have proposed using log API or
cloud management console to mitigate the challenges of collecting
logs from cloud infrastructure. However, there has been no concrete
work, which shows how to provide cloud logs to investigator while
preserving users’ privacy and integrity of the logs. In this paper,
we introduce Secure-Logging-as-a-Service (SecLaaS), which stores
virtual machines’ logs and provides access to forensic investigators
ensuring the conﬁdentiality of the cloud users. Additionally, SeclaaS
preserves proofs of past log and thus protects the integrity of the
logs from dishonest investigators or cloud providers. Finally, we
evaluate the feasibility of the scheme by implementing SecLaaS for
network access logs in OpenStack – a popular open source cloud
platform.
Categories and Subject Descriptors
C.2.4 [Computer Communication Networks]: Distributed Sys-
tems—Cloud Computing; K.6.m [Management of Computing
and Information Systems]: Miscellaneous
General Terms
Security
Keywords
Cloud Forensics, Forensic Invest...


Instruction: 总结这篇安全研究的主要观点

Input:
title:SecLaaS: secure logging-as-a-service for cloud forensics
author:Shams Zawoad and
Amit Kumar Dutta and
Ragib Hasan
SecLaaS: Secure Logging-as-a-Service for Cloud
Forensics
Shams Zawoad
University of Alabama at
Birmingham
Birmingham, Alabama
35294-1170
zawoad@cis.uab.edu
Amit Kumar Dutta
University of Alabama at
Birmingham
Birmingham, Alabama
adutta@cis.uab.edu
35294-1170
Ragib Hasan
University of Alabama at
Birmingham
Birmingham, Alabama
ragib@cis.uab.edu
35294-1170
ABSTRACT
Cloud computing has emerged as a popular computing paradigm
in recent years. However, today’s cloud computing architectures
often lack support for computer forensic investigations. Analyzing
various logs (e.g., process logs, network logs) plays a vital role in
computer forensics. Unfortunately, collecting logs from a cloud is
very hard given the black-box nature of clouds and the multi-tenant
cloud models, where many users share the same processing and
network resources. Researchers have proposed using log API or
cloud management console to mitigate the challenges of collecting
logs from cloud infrastructure. However, there has been no concrete
work, which shows how to provide cloud logs to investigator while
preserving users’ privacy and integrity of the logs. In this paper,
we introduce Secure-Logging-as-a-Service (SecLaaS), which stores
virtual machines’ logs and provides access to forensic investigators
ensuring the conﬁdentiality of the cloud users. Additionally, SeclaaS
preserves proofs of past log and thus protects the integrity of the
logs from dishonest investigators or cloud providers. Finally, we
evaluate the feasibility of the scheme by implementing SecLaaS for
network access logs in OpenStack – a popular open source cloud
platform.
Categories and Subject Descriptors
C.2.4 [Computer Communication Networks]: Distributed Sys-
tems—Cloud Computing; K.6.m [Management of Computing
and Information Systems]: Miscellaneous
General Terms
Security
Keywords
Cloud Forensics, Forensic Invest...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Automatic placement of authorization hooks in the linux security modules
framework
author:Vinod Ganapathy and
Trent Jaeger and
Somesh Jha
Automatic Placement of Authorization Hooks
in the Linux Security Modules Framework
Vinod Ganapathy
University of Wisconsin
vg@cs.wisc.edu
Trent Jaeger
Pennsylvania State University
tjaeger@cse.psu.edu
Somesh Jha
University of Wisconsin
jha@cs.wisc.edu
ABSTRACT
We present a technique for automatic placement of authorization
hooks, and apply it to the Linux security modules (LSM) frame-
work. LSM is a generic framework which allows diverse autho-
rization policies to be enforced by the Linux kernel. It consists of
a kernel module which encapsulates an authorization policy, and
hooks into the kernel module placed at appropriate locations in the
Linux kernel. The kernel enforces the authorization policy using
hook calls. In current practice, hooks are placed manually in the
kernel. This approach is tedious, and as prior work has shown, is
prone to security holes.
Our technique uses static analysis of the Linux kernel and the
kernel module to automate hook placement. Given a non-hook-
placed version of the Linux kernel, and a kernel module that imple-
ments an authorization policy, our technique infers the set of opera-
tions authorized by each hook, and the set of operations performed
by each function in the kernel. It uses this information to infer the
set of hooks that must guard each kernel function. We describe the
design and implementation of a prototype tool called TAHOE (Tool
for Authorization Hook Placement) that uses this technique. We
demonstrate the effectiveness of TAHOE by using it with the LSM
implementation of security-enhanced Linux (SELinux). While our
exposition in this paper focuses on hook placement for LSM, our
technique can be used to place hooks in other LSM-like architec-
tures as well.
Categories and Subject Descriptors: D.4.6 [Operating Systems]:
Security and Protection—Access Controls
General Terms: Al...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Automatic placement of authorization hooks in the linux security modules
framework
author:Vinod Ganapathy and
Trent Jaeger and
Somesh Jha
Automatic Placement of Authorization Hooks
in the Linux Security Modules Framework
Vinod Ganapathy
University of Wisconsin
vg@cs.wisc.edu
Trent Jaeger
Pennsylvania State University
tjaeger@cse.psu.edu
Somesh Jha
University of Wisconsin
jha@cs.wisc.edu
ABSTRACT
We present a technique for automatic placement of authorization
hooks, and apply it to the Linux security modules (LSM) frame-
work. LSM is a generic framework which allows diverse autho-
rization policies to be enforced by the Linux kernel. It consists of
a kernel module which encapsulates an authorization policy, and
hooks into the kernel module placed at appropriate locations in the
Linux kernel. The kernel enforces the authorization policy using
hook calls. In current practice, hooks are placed manually in the
kernel. This approach is tedious, and as prior work has shown, is
prone to security holes.
Our technique uses static analysis of the Linux kernel and the
kernel module to automate hook placement. Given a non-hook-
placed version of the Linux kernel, and a kernel module that imple-
ments an authorization policy, our technique infers the set of opera-
tions authorized by each hook, and the set of operations performed
by each function in the kernel. It uses this information to infer the
set of hooks that must guard each kernel function. We describe the
design and implementation of a prototype tool called TAHOE (Tool
for Authorization Hook Placement) that uses this technique. We
demonstrate the effectiveness of TAHOE by using it with the LSM
implementation of security-enhanced Linux (SELinux). While our
exposition in this paper focuses on hook placement for LSM, our
technique can be used to place hooks in other LSM-like architec-
tures as well.
Categories and Subject Descriptors: D.4.6 [Operating Systems]:
Security and Protection—Access Controls
General Terms: Al...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:New time-memory-data trade-off attack on the estream finalists and
modes of operation of block ciphers
author:Khoongming Khoo and
Chik How Tan
New Time-Memory-Data Trade-Off Attack on the Estream
Finalists and Modes of Operation of Block Ciphers
[Extended Abstract]
Khoongming Khoo
DSO National Laboratories
20 Science Park Drive
S118230, Singapore.
kkhoongm@dso.org.sg
Chik How Tan
NUS Temasek Laboratories
Singapore
tsltch@nus.edu.sg
cannot both be faster than exhaustive search if and only if
the IV length is at least as long as the key length.
For the sake of comparison, we prove the following propo-
sition. From here, we see that our attack, which allows
for faster pre-processing, is more eﬀective than the
HS-TMD and DK-TMD attacks. It also imposes a
more stringent constraint on the length of the IV
for adequate security.
Proposition 1.
1. In the BS-TMD attack [1] on a
stream cipher, if the state size is at least 3/2 times
the key length, then the pre-processing and online at-
tack complexity cannot both be faster than exhaustive
search.
2. In the HS-TMD attack [8] on a stream cipher, if the IV
length v is at least half the key length k, then the pre-
processing and online attack complexity cannot both be
faster than exhaustive search.
3. In the DK-TMD attack [5] on a stream cipher, the pre-
processing complexity is at least the exhaustive search
complexity irrespective of the IV length.
Remark 1. Although the authors of [8] recommended the
IV to be at least as long as the key, that is because they allow
the precomputation time to be worse than exhaustive search
in their estimation.
2. APPLICATIONS OF OUR ATTACK
2.1 Attack on Grain v1
68
76
online attack complexity.
We apply our attack to the Estream ﬁnalist Grain-v1 [6]
pre-processing and
with 80-bit key and break it with 2
In comparison, the current
2
known attacks on Grain-v1 cannot break it with both pre-
processing and online attack complexity faster than exhaus-
tive search. For example, the conditional ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:New time-memory-data trade-off attack on the estream finalists and
modes of operation of block ciphers
author:Khoongming Khoo and
Chik How Tan
New Time-Memory-Data Trade-Off Attack on the Estream
Finalists and Modes of Operation of Block Ciphers
[Extended Abstract]
Khoongming Khoo
DSO National Laboratories
20 Science Park Drive
S118230, Singapore.
kkhoongm@dso.org.sg
Chik How Tan
NUS Temasek Laboratories
Singapore
tsltch@nus.edu.sg
cannot both be faster than exhaustive search if and only if
the IV length is at least as long as the key length.
For the sake of comparison, we prove the following propo-
sition. From here, we see that our attack, which allows
for faster pre-processing, is more eﬀective than the
HS-TMD and DK-TMD attacks. It also imposes a
more stringent constraint on the length of the IV
for adequate security.
Proposition 1.
1. In the BS-TMD attack [1] on a
stream cipher, if the state size is at least 3/2 times
the key length, then the pre-processing and online at-
tack complexity cannot both be faster than exhaustive
search.
2. In the HS-TMD attack [8] on a stream cipher, if the IV
length v is at least half the key length k, then the pre-
processing and online attack complexity cannot both be
faster than exhaustive search.
3. In the DK-TMD attack [5] on a stream cipher, the pre-
processing complexity is at least the exhaustive search
complexity irrespective of the IV length.
Remark 1. Although the authors of [8] recommended the
IV to be at least as long as the key, that is because they allow
the precomputation time to be worse than exhaustive search
in their estimation.
2. APPLICATIONS OF OUR ATTACK
2.1 Attack on Grain v1
68
76
online attack complexity.
We apply our attack to the Estream ﬁnalist Grain-v1 [6]
pre-processing and
with 80-bit key and break it with 2
In comparison, the current
2
known attacks on Grain-v1 cannot break it with both pre-
processing and online attack complexity faster than exhaus-
tive search. For example, the conditional ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:The Limits of Composable Crypto with Transferable Setup Devices
author:Ioana Boureanu and
Miyako Ohkubo and
Serge Vaudenay
Composable Security in the Tamper Proof Hardware Model
under Minimal Complexity
Carmit Hazay(cid:3)
Antigoni Polychroniadouy
Muthuramakrishnan Venkitasubramaniamz
Abstract
We put forth a new formulation of tamper-proof hardware in the Global Universal Composable
(GUC) framework introduced by Canetti et al.
in TCC 2007. Almost all of the previous works rely
on the formulation by Katz in Eurocrypt 2007 and this formulation does not fully capture tokens in a
concurrent setting. We address these shortcomings by relying on the GUC framework where we make
the following contributions:
1. We construct secure Two-Party Computation (2PC) protocols for general functionalities with opti-
mal round complexity and computational assumptions using stateless tokens. More precisely, we
show how to realize arbitrary functionalities with GUC security in two rounds under the minimal
assumption of One-Way Functions (OWFs). Moreover, our construction relies on the underlying
function in a black-box way. As a corollary, we obtain feasibility of Multi-Party Computation
(MPC) with GUC-security under the minimal assumption of OWFs. As an independent contri-
bution, we identify an issue with a claim in a previous work by Goyal, Ishai, Sahai, Venkatesan
and Wadia in TCC 2010 regarding the feasibility of UC-secure computation with stateless tokens
assuming collision-resistant hash-functions (and the extension based only on one-way functions).
2. We then construct a 3-round MPC protocol to securely realize arbitrary functionalities with GUC-
security starting from any semi-honest secure MPC protocol. For this construction, we require
the so-called one-many commit-and-prove primitive introduced in the original work of Canetti,
Lindell, Ostrovsky and Sahai in STOC 2002 that is round-efﬁcient and black-box in the underlying
commitment. Using specially designed “input-delay...


Instruction: 总结这篇安全研究的主要观点

Input:
title:The Limits of Composable Crypto with Transferable Setup Devices
author:Ioana Boureanu and
Miyako Ohkubo and
Serge Vaudenay
Composable Security in the Tamper Proof Hardware Model
under Minimal Complexity
Carmit Hazay(cid:3)
Antigoni Polychroniadouy
Muthuramakrishnan Venkitasubramaniamz
Abstract
We put forth a new formulation of tamper-proof hardware in the Global Universal Composable
(GUC) framework introduced by Canetti et al.
in TCC 2007. Almost all of the previous works rely
on the formulation by Katz in Eurocrypt 2007 and this formulation does not fully capture tokens in a
concurrent setting. We address these shortcomings by relying on the GUC framework where we make
the following contributions:
1. We construct secure Two-Party Computation (2PC) protocols for general functionalities with opti-
mal round complexity and computational assumptions using stateless tokens. More precisely, we
show how to realize arbitrary functionalities with GUC security in two rounds under the minimal
assumption of One-Way Functions (OWFs). Moreover, our construction relies on the underlying
function in a black-box way. As a corollary, we obtain feasibility of Multi-Party Computation
(MPC) with GUC-security under the minimal assumption of OWFs. As an independent contri-
bution, we identify an issue with a claim in a previous work by Goyal, Ishai, Sahai, Venkatesan
and Wadia in TCC 2010 regarding the feasibility of UC-secure computation with stateless tokens
assuming collision-resistant hash-functions (and the extension based only on one-way functions).
2. We then construct a 3-round MPC protocol to securely realize arbitrary functionalities with GUC-
security starting from any semi-honest secure MPC protocol. For this construction, we require
the so-called one-many commit-and-prove primitive introduced in the original work of Canetti,
Lindell, Ostrovsky and Sahai in STOC 2002 that is round-efﬁcient and black-box in the underlying
commitment. Using specially designed “input-delay...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Recent Advances in Intrusion Detection, 8th International Symposium,
RAID 2005, Seattle, WA, USA, September 7-9, 2005, Revised Papers
author:
Lecture Notes in Computer Science
Commenced Publication in 1973
Founding and Former Series Editors:
Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen
3858
Editorial Board
David Hutchison
Lancaster University, UK
Takeo Kanade
Carnegie Mellon University, Pittsburgh, PA, USA
Josef Kittler
University of Surrey, Guildford, UK
Jon M. Kleinberg
Cornell University, Ithaca, NY, USA
Friedemann Mattern
ETH Zurich, Switzerland
John C. Mitchell
Stanford University, CA, USA
Moni Naor
Weizmann Institute of Science, Rehovot, Israel
Oscar Nierstrasz
University of Bern, Switzerland
C. Pandu Rangan
Indian Institute of Technology, Madras, India
Bernhard Steffen
University of Dortmund, Germany
Madhu Sudan
Massachusetts Institute of Technology, MA, USA
Demetri Terzopoulos
New York University, NY, USA
Doug Tygar
University of California, Berkeley, CA, USA
Moshe Y. Vardi
Rice University, Houston, TX, USA
Gerhard Weikum
Max-Planck Institute of Computer Science, Saarbruecken, Germany
Alfonso Valdes Diego Zamboni (Eds.)
Recent Advances in
Intrusion Detection
8th International Symposium, RAID 2005
Seattle, WA, USA, September 7-9, 2005
Revised Papers
1 3
Volume Editors
Alfonso Valdes
SRI International
333 Ravenswood Ave., Menlo Park, CA 94025, USA
E-mail: alfonso.valdes@sri.com
Diego Zamboni
IBM Research GmbH
Zurich Research Laboratory
Säumerstr. 4, Postfach, 8803 Rüschlikon, Switzerland
E-mail: dza@zurich.ibm.com
Library of Congress Control Number: 2005939042
CR Subject Classiﬁcation (1998): K.6.5, K.4, E.3, C.2, D.4.6
LNCS Sublibrary: SL 4 – Security and Cryptology
ISSN
ISBN-10
ISBN-13
0302-9743
3-540-31778-3 Springer Berlin Heidelberg New York
978-3-540-31778-4 Springer Berlin Heidelberg New York
This work is subject to copyright. All rights are reserved, whether the whole or part of the material is
concerned, speciﬁcally the rights of transl...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Recent Advances in Intrusion Detection, 8th International Symposium,
RAID 2005, Seattle, WA, USA, September 7-9, 2005, Revised Papers
author:
Lecture Notes in Computer Science
Commenced Publication in 1973
Founding and Former Series Editors:
Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen
3858
Editorial Board
David Hutchison
Lancaster University, UK
Takeo Kanade
Carnegie Mellon University, Pittsburgh, PA, USA
Josef Kittler
University of Surrey, Guildford, UK
Jon M. Kleinberg
Cornell University, Ithaca, NY, USA
Friedemann Mattern
ETH Zurich, Switzerland
John C. Mitchell
Stanford University, CA, USA
Moni Naor
Weizmann Institute of Science, Rehovot, Israel
Oscar Nierstrasz
University of Bern, Switzerland
C. Pandu Rangan
Indian Institute of Technology, Madras, India
Bernhard Steffen
University of Dortmund, Germany
Madhu Sudan
Massachusetts Institute of Technology, MA, USA
Demetri Terzopoulos
New York University, NY, USA
Doug Tygar
University of California, Berkeley, CA, USA
Moshe Y. Vardi
Rice University, Houston, TX, USA
Gerhard Weikum
Max-Planck Institute of Computer Science, Saarbruecken, Germany
Alfonso Valdes Diego Zamboni (Eds.)
Recent Advances in
Intrusion Detection
8th International Symposium, RAID 2005
Seattle, WA, USA, September 7-9, 2005
Revised Papers
1 3
Volume Editors
Alfonso Valdes
SRI International
333 Ravenswood Ave., Menlo Park, CA 94025, USA
E-mail: alfonso.valdes@sri.com
Diego Zamboni
IBM Research GmbH
Zurich Research Laboratory
Säumerstr. 4, Postfach, 8803 Rüschlikon, Switzerland
E-mail: dza@zurich.ibm.com
Library of Congress Control Number: 2005939042
CR Subject Classiﬁcation (1998): K.6.5, K.4, E.3, C.2, D.4.6
LNCS Sublibrary: SL 4 – Security and Cryptology
ISSN
ISBN-10
ISBN-13
0302-9743
3-540-31778-3 Springer Berlin Heidelberg New York
978-3-540-31778-4 Springer Berlin Heidelberg New York
This work is subject to copyright. All rights are reserved, whether the whole or part of the material is
concerned, speciﬁcally the rights of transl...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Tracing Cross Border Web Tracking
author:Costas Iordanou and
Georgios Smaragdakis and
Ingmar Poese and
Nikolaos Laoutaris
Tracing Cross Border Web Tracking
Costas Iordanou
TU Berlin / UC3M
costas@ima.tu-berlin.de
Ingmar Poese
BENOCS
ipoese@benocs.com
Georgios Smaragdakis
TU Berlin
georgios@ima.tu-berlin.de
Nikolaos Laoutaris
Data Transparency Lab / Eurecat
nikos@datatransparencylab.org
ABSTRACT
A tracking flow is a flow between an end user and a Web track-
ing service. We develop an extensive measurement methodology
for quantifying at scale the amount of tracking flows that cross
data protection borders, be it national or international, such as the
EU28 border within which the General Data Protection Regulation
(GDPR) applies. Our methodology uses a browser extension to fully
render advertising and tracking code, various lists and heuristics to
extract well known trackers, passive DNS replication to get all the
IP ranges of trackers, and state-of-the art geolocation. We employ
our methodology on a dataset from 350 real users of the browser
extension over a period of more than four months, and then gener-
alize our results by analyzing billions of web tracking flows from
more than 60 million broadband and mobile users from 4 large
European ISPs. We show that the majority of tracking flows cross
national borders in Europe but, unlike popular belief, are pretty
well confined within the larger GDPR jurisdiction. Simple DNS
redirection and PoP mirroring can increase national confinement
while sealing almost all tracking flows within Europe. Last, we
show that cross boarder tracking is prevalent even in sensitive and
hence protected data categories and groups including health, sexual
orientation, minors, and others.
CCS CONCEPTS
• Information systems → Online advertising; • Security and
privacy → Privacy protections; • Networks → Network mea-
surement; Location based services; • Applied computing → Law;
ACM Reference Format:
Costas Iordanou, Georgios Smaragdakis, In...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Tracing Cross Border Web Tracking
author:Costas Iordanou and
Georgios Smaragdakis and
Ingmar Poese and
Nikolaos Laoutaris
Tracing Cross Border Web Tracking
Costas Iordanou
TU Berlin / UC3M
costas@ima.tu-berlin.de
Ingmar Poese
BENOCS
ipoese@benocs.com
Georgios Smaragdakis
TU Berlin
georgios@ima.tu-berlin.de
Nikolaos Laoutaris
Data Transparency Lab / Eurecat
nikos@datatransparencylab.org
ABSTRACT
A tracking flow is a flow between an end user and a Web track-
ing service. We develop an extensive measurement methodology
for quantifying at scale the amount of tracking flows that cross
data protection borders, be it national or international, such as the
EU28 border within which the General Data Protection Regulation
(GDPR) applies. Our methodology uses a browser extension to fully
render advertising and tracking code, various lists and heuristics to
extract well known trackers, passive DNS replication to get all the
IP ranges of trackers, and state-of-the art geolocation. We employ
our methodology on a dataset from 350 real users of the browser
extension over a period of more than four months, and then gener-
alize our results by analyzing billions of web tracking flows from
more than 60 million broadband and mobile users from 4 large
European ISPs. We show that the majority of tracking flows cross
national borders in Europe but, unlike popular belief, are pretty
well confined within the larger GDPR jurisdiction. Simple DNS
redirection and PoP mirroring can increase national confinement
while sealing almost all tracking flows within Europe. Last, we
show that cross boarder tracking is prevalent even in sensitive and
hence protected data categories and groups including health, sexual
orientation, minors, and others.
CCS CONCEPTS
• Information systems → Online advertising; • Security and
privacy → Privacy protections; • Networks → Network mea-
surement; Location based services; • Applied computing → Law;
ACM Reference Format:
Costas Iordanou, Georgios Smaragdakis, In...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:On Design Inference from Binaries Compiled using Modern C++ Defenses
author:Rukayat Ayomide Erinfolami and
Anh Quach and
Aravind Prakash
On Design Inference from Binaries Compiled using Modern C++ Defenses
Rukayat Ayomide Erinfolami
Binghamton University
Anh Quach
Binghamton University
Aravind Prakash
Binghamton University
{rerinfo1,aquach1,aprakash}@binghamton.edu
Abstract
Due to the use of code pointers, polymorphism in C++ has
been targeted by attackers and defenders alike. Vulnerable pro-
grams that violate the runtime object type integrity have been
successfully exploited. Particularly, virtual dispatch mecha-
nism and type confusion during casting have been targeted.
As a consequence, multiple defenses have been proposed
in recent years to defend against attacks that target poly-
morphism. Particularly, compiler-based defenses incorpo-
rate design information—speciﬁcally class-hierarchy-related
information—into the binary, and enforce runtime security
policies to assert type integrity.
In this paper, we perform a systematic evaluation of the
side-effects and unintended consequences of compiler-based
security. Speciﬁcally, we show that application of modern
defenses makes reverse engineering and semantic recovery
easy. In particular, we show that modern defenses “leak" class
hierarchy information, i.e., design information, thereby deter
adoption in closed-source software. We consider a compre-
hensive set of 10 modern C++ defenses and show that 9 out
of the 10 at least partially reveal design information as an
unintended consequence of the defense. We argue a necessity
for design-leakage-sensitive defenses that are preferable for
closed-source use.
1
Introduction
The beneﬁts of C++ as an object-oriented language have
prompted its wide use in commercial software. As a con-
sequence, the under-the-hood mechanisms of the language
implementation (e.g., virtual dispatch) have come under strict
scrutiny from both the attackers and defenders. Particularly,
pract...


Instruction: 总结这篇安全研究的主要观点

Input:
title:On Design Inference from Binaries Compiled using Modern C++ Defenses
author:Rukayat Ayomide Erinfolami and
Anh Quach and
Aravind Prakash
On Design Inference from Binaries Compiled using Modern C++ Defenses
Rukayat Ayomide Erinfolami
Binghamton University
Anh Quach
Binghamton University
Aravind Prakash
Binghamton University
{rerinfo1,aquach1,aprakash}@binghamton.edu
Abstract
Due to the use of code pointers, polymorphism in C++ has
been targeted by attackers and defenders alike. Vulnerable pro-
grams that violate the runtime object type integrity have been
successfully exploited. Particularly, virtual dispatch mecha-
nism and type confusion during casting have been targeted.
As a consequence, multiple defenses have been proposed
in recent years to defend against attacks that target poly-
morphism. Particularly, compiler-based defenses incorpo-
rate design information—speciﬁcally class-hierarchy-related
information—into the binary, and enforce runtime security
policies to assert type integrity.
In this paper, we perform a systematic evaluation of the
side-effects and unintended consequences of compiler-based
security. Speciﬁcally, we show that application of modern
defenses makes reverse engineering and semantic recovery
easy. In particular, we show that modern defenses “leak" class
hierarchy information, i.e., design information, thereby deter
adoption in closed-source software. We consider a compre-
hensive set of 10 modern C++ defenses and show that 9 out
of the 10 at least partially reveal design information as an
unintended consequence of the defense. We argue a necessity
for design-leakage-sensitive defenses that are preferable for
closed-source use.
1
Introduction
The beneﬁts of C++ as an object-oriented language have
prompted its wide use in commercial software. As a con-
sequence, the under-the-hood mechanisms of the language
implementation (e.g., virtual dispatch) have come under strict
scrutiny from both the attackers and defenders. Particularly,
pract...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Security Analysis of PHP Bytecode Protection Mechanisms
author:Dario Weißer and
Johannes Dahse and
Thorsten Holz
Security Analysis
of PHP Bytecode Protection Mechanisms
Dario Weißer, Johannes Dahse(B), and Thorsten Holz
Horst G¨ortz Institute for IT-Security (HGI), Ruhr-University Bochum,
{dario.weisser,johannes.dahse,thorsten.holz}@rub.de
Bochum, Germany
Abstract. PHP is the most popular scripting language for web appli-
cations. Because no native solution to compile or protect PHP scripts
exists, PHP applications are usually shipped as plain source code which
is easily understood or copied by an adversary. In order to prevent such
attacks, commercial products such as ionCube, Zend Guard, and Source
Guardian promise a source code protection.
In this paper, we analyze the inner working and security of these
tools and propose a method to recover the source code by leveraging sta-
tic and dynamic analysis techniques. We introduce a generic approach
for decompilation of obfuscated bytecode and show that it is possible to
automatically recover the original source code of protected software. As a
result, we discovered previously unknown vulnerabilities and backdoors
in 1 million lines of recovered source code of 10 protected applications.
Keywords: Security · Reverse engineering · Obfuscation · PHP ·
Bytecode
1 Introduction
Protecting intellectual property (IP) in software systems, such as algorithms,
cryptographic keys, serial numbers, or copyright banners, is a challenging prob-
lem: an adversary can study the program with static or dynamic analysis meth-
ods [7,13,19] and attempt to deduce the sensitive information. To impede such
an analysis, many diﬀerent types of obfuscation techniques for binary executa-
bles were developed (e.g., [3,11,15,21]). Although the semantics of the pro-
gram can be reconstructed with diﬀerent (automated) reverse engineering meth-
ods [4,16,20,29], obfuscation provides at least some protection of the source code
and hampers an adver...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Security Analysis of PHP Bytecode Protection Mechanisms
author:Dario Weißer and
Johannes Dahse and
Thorsten Holz
Security Analysis
of PHP Bytecode Protection Mechanisms
Dario Weißer, Johannes Dahse(B), and Thorsten Holz
Horst G¨ortz Institute for IT-Security (HGI), Ruhr-University Bochum,
{dario.weisser,johannes.dahse,thorsten.holz}@rub.de
Bochum, Germany
Abstract. PHP is the most popular scripting language for web appli-
cations. Because no native solution to compile or protect PHP scripts
exists, PHP applications are usually shipped as plain source code which
is easily understood or copied by an adversary. In order to prevent such
attacks, commercial products such as ionCube, Zend Guard, and Source
Guardian promise a source code protection.
In this paper, we analyze the inner working and security of these
tools and propose a method to recover the source code by leveraging sta-
tic and dynamic analysis techniques. We introduce a generic approach
for decompilation of obfuscated bytecode and show that it is possible to
automatically recover the original source code of protected software. As a
result, we discovered previously unknown vulnerabilities and backdoors
in 1 million lines of recovered source code of 10 protected applications.
Keywords: Security · Reverse engineering · Obfuscation · PHP ·
Bytecode
1 Introduction
Protecting intellectual property (IP) in software systems, such as algorithms,
cryptographic keys, serial numbers, or copyright banners, is a challenging prob-
lem: an adversary can study the program with static or dynamic analysis meth-
ods [7,13,19] and attempt to deduce the sensitive information. To impede such
an analysis, many diﬀerent types of obfuscation techniques for binary executa-
bles were developed (e.g., [3,11,15,21]). Although the semantics of the pro-
gram can be reconstructed with diﬀerent (automated) reverse engineering meth-
ods [4,16,20,29], obfuscation provides at least some protection of the source code
and hampers an adver...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Uncovering network tarpits with degreaser
author:Lance Alt and
Robert Beverly and
Alberto Dainotti
Uncovering Network Tarpits with Degreaser
Lance Alt
Naval Postgraduate School
laalt@cmand.org
Robert Beverly
Naval Postgraduate School
rbeverly@nps.edu
Alberto Dainotti
CAIDA, UC San Diego
alberto@caida.org
ABSTRACT
Network tarpits, whereby a single host or appliance can mas-
querade as many fake hosts on a network and slow network
scanners, are a form of defensive cyber-deception.
In this
work, we develop degreaser , an ecient ﬁngerprinting tool
to remotely detect tarpits. In addition to validating our tool
in a controlled environment, we use degreaser to perform an
Internet-wide scan. We discover tarpits of non-trivial size in
the wild (preﬁxes as large as /16), and characterize their dis-
tribution and behavior. We then show how tarpits pollute
existing network measurement surveys that are tarpit-na¨ıve,
e.g. Internet census data, and how degreaser can improve the
accuracy of such surveys. Lastly, our ﬁndings suggest sev-
eral ways in which to advance the realism of current network
tarpits, thereby raising the bar on tarpits as an operational
security mechanism.
Categories and Subject Descriptors
C.2.0 [Computer-Communication Networks]: General—
Security and protection; C.4 [Performance of Systems]:
Measurement techniques
Keywords
Tarpits; Internet Census; Sticky Honeypot; Deception
1.
INTRODUCTION
Networks face a continual barrage of abusive and mali-
cious attacks. Among available network security defenses
is the class of deceptive network strategies. The high-level
idea is simple: provide to adversaries the illusion of vulnera-
ble targets, or promote an appearance of greater complexity
than actually exists. For example, network honeypots [31]
have long been used to attract abusive trac and attacks.
Trac that arrives at the honeypot can then be analyzed
in order to build databases of e.g. IP reputation [19, 34],
malware signatures [6, 37], and to provide...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Uncovering network tarpits with degreaser
author:Lance Alt and
Robert Beverly and
Alberto Dainotti
Uncovering Network Tarpits with Degreaser
Lance Alt
Naval Postgraduate School
laalt@cmand.org
Robert Beverly
Naval Postgraduate School
rbeverly@nps.edu
Alberto Dainotti
CAIDA, UC San Diego
alberto@caida.org
ABSTRACT
Network tarpits, whereby a single host or appliance can mas-
querade as many fake hosts on a network and slow network
scanners, are a form of defensive cyber-deception.
In this
work, we develop degreaser , an ecient ﬁngerprinting tool
to remotely detect tarpits. In addition to validating our tool
in a controlled environment, we use degreaser to perform an
Internet-wide scan. We discover tarpits of non-trivial size in
the wild (preﬁxes as large as /16), and characterize their dis-
tribution and behavior. We then show how tarpits pollute
existing network measurement surveys that are tarpit-na¨ıve,
e.g. Internet census data, and how degreaser can improve the
accuracy of such surveys. Lastly, our ﬁndings suggest sev-
eral ways in which to advance the realism of current network
tarpits, thereby raising the bar on tarpits as an operational
security mechanism.
Categories and Subject Descriptors
C.2.0 [Computer-Communication Networks]: General—
Security and protection; C.4 [Performance of Systems]:
Measurement techniques
Keywords
Tarpits; Internet Census; Sticky Honeypot; Deception
1.
INTRODUCTION
Networks face a continual barrage of abusive and mali-
cious attacks. Among available network security defenses
is the class of deceptive network strategies. The high-level
idea is simple: provide to adversaries the illusion of vulnera-
ble targets, or promote an appearance of greater complexity
than actually exists. For example, network honeypots [31]
have long been used to attract abusive trac and attacks.
Trac that arrives at the honeypot can then be analyzed
in order to build databases of e.g. IP reputation [19, 34],
malware signatures [6, 37], and to provide...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Accurately Measuring Global Risk of Amplification Attacks using AmpMap
author:Soo-Jin Moon and
Yucheng Yin and
Rahul Anand Sharma and
Yifei Yuan and
Jonathan M. Spring and
Vyas Sekar
Accurately Measuring Global Risk of
Ampliﬁcation Attacks using AmpMap
Soo-Jin Moon†, Yucheng Yin†, Rahul Anand Sharma†, Yifei Yuan§∗, Jonathan M. Spring⋄, Vyas Sekar†
†Carnegie Mellon University, §Alibaba Group, ⋄CERT/CC®, SEI, Carnegie Mellon University
Abstract
Many recent DDoS attacks rely on ampliﬁcation, where an
attacker induces public servers to generate a large volume
of network trafﬁc to a victim. In this paper, we argue for
a low-footprint Internet health monitoring service that can
systematically and continuously quantify this risk to inform
mitigation efforts. Unfortunately, the problem is challenging
because ampliﬁcation is a complex function of query (header)
values and server instances. As such, existing techniques that
enumerate the total number of servers or focus on a speciﬁc
ampliﬁcation-inducing query are fundamentally imprecise. In
designing AmpMap, we leverage key structural insights to
develop an efﬁcient approach that searches across the space
of protocol headers and servers. Using AmpMap, we scanned
thousands of servers for 6 UDP-based protocols. We ﬁnd
that relying on prior recommendations to block or rate-limit
speciﬁc queries still leaves open substantial residual risk as
they miss many other ampliﬁcation-inducing query patterns.
We also observe signiﬁcant variability across servers and
protocols, and thus prior approaches that rely on server census
can substantially misestimate ampliﬁcation risk.
1 Introduction
Many recent high-proﬁle Distributed Denial-of-Service
(DDoS) attacks rely on ampliﬁcation [54, 57]. In an ampliﬁca-
tion attack, an attacker spoofs the victim’s source IP address
and sends queries to a public server (e.g., DNS, NTP, Mem-
cached), which in turn sends large responses to the victim. If
a source IP address can be spoofed, any statel...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Accurately Measuring Global Risk of Amplification Attacks using AmpMap
author:Soo-Jin Moon and
Yucheng Yin and
Rahul Anand Sharma and
Yifei Yuan and
Jonathan M. Spring and
Vyas Sekar
Accurately Measuring Global Risk of
Ampliﬁcation Attacks using AmpMap
Soo-Jin Moon†, Yucheng Yin†, Rahul Anand Sharma†, Yifei Yuan§∗, Jonathan M. Spring⋄, Vyas Sekar†
†Carnegie Mellon University, §Alibaba Group, ⋄CERT/CC®, SEI, Carnegie Mellon University
Abstract
Many recent DDoS attacks rely on ampliﬁcation, where an
attacker induces public servers to generate a large volume
of network trafﬁc to a victim. In this paper, we argue for
a low-footprint Internet health monitoring service that can
systematically and continuously quantify this risk to inform
mitigation efforts. Unfortunately, the problem is challenging
because ampliﬁcation is a complex function of query (header)
values and server instances. As such, existing techniques that
enumerate the total number of servers or focus on a speciﬁc
ampliﬁcation-inducing query are fundamentally imprecise. In
designing AmpMap, we leverage key structural insights to
develop an efﬁcient approach that searches across the space
of protocol headers and servers. Using AmpMap, we scanned
thousands of servers for 6 UDP-based protocols. We ﬁnd
that relying on prior recommendations to block or rate-limit
speciﬁc queries still leaves open substantial residual risk as
they miss many other ampliﬁcation-inducing query patterns.
We also observe signiﬁcant variability across servers and
protocols, and thus prior approaches that rely on server census
can substantially misestimate ampliﬁcation risk.
1 Introduction
Many recent high-proﬁle Distributed Denial-of-Service
(DDoS) attacks rely on ampliﬁcation [54, 57]. In an ampliﬁca-
tion attack, an attacker spoofs the victim’s source IP address
and sends queries to a public server (e.g., DNS, NTP, Mem-
cached), which in turn sends large responses to the victim. If
a source IP address can be spoofed, any statel...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 总结这篇安全研究的主要观点

Input:
title:Measuring and Analyzing Search-Redirection Attacks in the Illicit
Online Prescription Drug Trade
author:Nektarios Leontiadis and
Tyler Moore and
Nicolas Christin
Measuring and Analyzing Search-Redirection Attacks
in the Illicit Online Prescription Drug Trade
Nektarios Leontiadis
Carnegie Mellon University
Tyler Moore
Harvard University
Nicolas Christin
Carnegie Mellon University
Abstract
We investigate the manipulation of web search re-
sults to promote the unauthorized sale of prescription
drugs. We focus on search-redirection attacks, where
miscreants compromise high-ranking websites and dy-
namically redirect trafﬁc to different pharmacies based
upon the particular search terms issued by the consumer.
We constructed a representative list of 218 drug-related
queries and automatically gathered the search results
on a daily basis over nine months in 2010-2011. We
ﬁnd that about one third of all search results are one
of over 7 000 infected hosts triggered to redirect to a
few hundred pharmacy websites. Legitimate pharmacies
and health resources have been largely crowded out by
search-redirection attacks and blog spam. Infections per-
sist longest on websites with high PageRank and from
.edu domains. 96% of infected domains are connected
through trafﬁc redirection chains, and network analysis
reveals that a few concentrated communities link many
otherwise disparate pharmacies together. We calculate
that the conversion rate of web searches into sales lies
between 0.3% and 3%, and that more illegal drugs sales
are facilitated by search-redirection attacks than by email
spam. Finally, we observe that concentration in both the
source infections and redirectors presents an opportunity
for defenders to disrupt online pharmacy sales.
1
Prescription drugs sold illicitly on the Internet arguably
constitute the most dangerous online criminal activity.
While resale of counterfeit luxury goods or software are
obvious frauds, counterfeit medicines actually endanger
public s...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:ReCFA: Resilient Control-Flow Attestation
author:Yumei Zhang and
Xinzhi Liu and
Cong Sun and
Dongrui Zeng and
Gang Tan and
Xiao Kan and
Siqi Ma
ReCFA: Resilient Control-Flow Attestation
Yumei Zhang∗
Xinzhi Liu∗
zhangyumei319@163.com
1144518670@qq.com
Xidian University
Xi’an, China
Gang Tan
gtan@psu.edu
Pennsylvania State University
University Park, PA, USA
Cong Sun†
suncong@xidian.edu.cn
Xidian University
Xi’an, China
Dongrui Zeng
dxz16@psu.edu
Pennsylvania State University
University Park, PA, USA
Xiao Kan
814091656@qq.com
Xidian University
Xi’an, China
Siqi Ma
slivia.ma@uq.edu.au
The University of Queensland
Brisbane, Australia
ABSTRACT
Recent IoT applications gradually adapt more complicated end sys-
tems with commodity software. Ensuring the runtime integrity of
these software is a challenging task for the remote controller or
cloud services. Popular enforcement is the runtime remote attesta-
tion which requires the end system (prover) to generate evidence
for its runtime behavior and a remote trusted verifier to attest the
evidence. Control-flow attestation is a kind of runtime attestation
that provides diagnoses towards the remote control-flow hijacking
at the prover. Most of these attestation approaches focus on small
or embedded software. The recent advance to attesting complicated
software depends on the source code and CFG traversing to measure
the checkpoint-separated subpaths, which may be unavailable for
commodity software and cause possible context missing between
consecutive subpaths in the measurements.
In this work, we propose a resilient control-flow attestation
(ReCFA), which does not need the offline measurement of all le-
gitimate control-flow paths, thus scalable to be used on compli-
cated commodity software. Our main contribution is a multi-phase
approach to condensing the runtime control-flow events; as a re-
sult, the vast amount of control-flow events are abstracted into
a deliverable size. The condensing approach consists of filteri...


Instruction: 总结这篇安全研究的主要观点

Input:
title:ReCFA: Resilient Control-Flow Attestation
author:Yumei Zhang and
Xinzhi Liu and
Cong Sun and
Dongrui Zeng and
Gang Tan and
Xiao Kan and
Siqi Ma
ReCFA: Resilient Control-Flow Attestation
Yumei Zhang∗
Xinzhi Liu∗
zhangyumei319@163.com
1144518670@qq.com
Xidian University
Xi’an, China
Gang Tan
gtan@psu.edu
Pennsylvania State University
University Park, PA, USA
Cong Sun†
suncong@xidian.edu.cn
Xidian University
Xi’an, China
Dongrui Zeng
dxz16@psu.edu
Pennsylvania State University
University Park, PA, USA
Xiao Kan
814091656@qq.com
Xidian University
Xi’an, China
Siqi Ma
slivia.ma@uq.edu.au
The University of Queensland
Brisbane, Australia
ABSTRACT
Recent IoT applications gradually adapt more complicated end sys-
tems with commodity software. Ensuring the runtime integrity of
these software is a challenging task for the remote controller or
cloud services. Popular enforcement is the runtime remote attesta-
tion which requires the end system (prover) to generate evidence
for its runtime behavior and a remote trusted verifier to attest the
evidence. Control-flow attestation is a kind of runtime attestation
that provides diagnoses towards the remote control-flow hijacking
at the prover. Most of these attestation approaches focus on small
or embedded software. The recent advance to attesting complicated
software depends on the source code and CFG traversing to measure
the checkpoint-separated subpaths, which may be unavailable for
commodity software and cause possible context missing between
consecutive subpaths in the measurements.
In this work, we propose a resilient control-flow attestation
(ReCFA), which does not need the offline measurement of all le-
gitimate control-flow paths, thus scalable to be used on compli-
cated commodity software. Our main contribution is a multi-phase
approach to condensing the runtime control-flow events; as a re-
sult, the vast amount of control-flow events are abstracted into
a deliverable size. The condensing approach consists of filteri...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:High-resolution measurement of data center microbursts
author:Qiao Zhang and
Vincent Liu and
Hongyi Zeng and
Arvind Krishnamurthy
High-Resolution Measurement of Data Center Microbursts∗
Qiao Zhang
University of Washington
qiao@cs.washington.edu
Vincent Liu
University of Pennsylvania
liuv@cis.upenn.edu
Hongyi Zeng
Facebook, Inc.
zeng@fb.com
Arvind
Krishnamurthy
University of Washington
arvind@cs.washington.edu
ABSTRACT
Data centers house some of the largest, fastest networks in the
world. In contrast to and as a result of their speed, these networks
operate on very small timescales—a 100 Gbps port processes a sin-
gle packet in at most 500 ns with end-to-end network latencies
of under a millisecond. In this study, we explore the fine-grained
behaviors of a large production data center using extremely high-
resolution measurements (10s to 100s of microsecond) of rack-level
traffic. Our results show that characterizing network events like
congestion and synchronized behavior in data centers does indeed
require the use of such measurements. In fact, we observe that more
than 70% of bursts on the racks we measured are sustained for at
most tens of microseconds: a range that is orders of magnitude
higher-resolution than most deployed measurement frameworks.
Congestion events observed by less granular measurements are
likely collections of smaller µbursts. Thus, we find that traffic at
the edge is significantly less balanced than other metrics might
suggest. Beyond the implications for measurement granularity, we
hope these results will inform future data center load balancing
and congestion control protocols.
CCS CONCEPTS
• Networks → Network measurement; Data center networks;
Network performance analysis; Network monitoring; Social media
networks;
KEYWORDS
Data center traffic, microbursts
ACM Reference Format:
Qiao Zhang, Vincent Liu, Hongyi Zeng, and Arvind Krishnamurthy. 2017.
High-Resolution Measurement of Data Center Microbursts. In Proceedings
of IMC ’17, Lond...


Instruction: 总结这篇安全研究的主要观点

Input:
title:High-resolution measurement of data center microbursts
author:Qiao Zhang and
Vincent Liu and
Hongyi Zeng and
Arvind Krishnamurthy
High-Resolution Measurement of Data Center Microbursts∗
Qiao Zhang
University of Washington
qiao@cs.washington.edu
Vincent Liu
University of Pennsylvania
liuv@cis.upenn.edu
Hongyi Zeng
Facebook, Inc.
zeng@fb.com
Arvind
Krishnamurthy
University of Washington
arvind@cs.washington.edu
ABSTRACT
Data centers house some of the largest, fastest networks in the
world. In contrast to and as a result of their speed, these networks
operate on very small timescales—a 100 Gbps port processes a sin-
gle packet in at most 500 ns with end-to-end network latencies
of under a millisecond. In this study, we explore the fine-grained
behaviors of a large production data center using extremely high-
resolution measurements (10s to 100s of microsecond) of rack-level
traffic. Our results show that characterizing network events like
congestion and synchronized behavior in data centers does indeed
require the use of such measurements. In fact, we observe that more
than 70% of bursts on the racks we measured are sustained for at
most tens of microseconds: a range that is orders of magnitude
higher-resolution than most deployed measurement frameworks.
Congestion events observed by less granular measurements are
likely collections of smaller µbursts. Thus, we find that traffic at
the edge is significantly less balanced than other metrics might
suggest. Beyond the implications for measurement granularity, we
hope these results will inform future data center load balancing
and congestion control protocols.
CCS CONCEPTS
• Networks → Network measurement; Data center networks;
Network performance analysis; Network monitoring; Social media
networks;
KEYWORDS
Data center traffic, microbursts
ACM Reference Format:
Qiao Zhang, Vincent Liu, Hongyi Zeng, and Arvind Krishnamurthy. 2017.
High-Resolution Measurement of Data Center Microbursts. In Proceedings
of IMC ’17, Lond...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Unicorn: Runtime Provenance-Based Detector for Advanced Persistent
Threats
author:Xueyuan Han and
Thomas F. J.-M. Pasquier and
Adam Bates and
James Mickens and
Margo I. Seltzer
UNICORN: Runtime Provenance-Based Detector for
Advanced Persistent Threats
Xueyuan Han∗, Thomas Pasquier†, Adam Bates‡, James Mickens∗ and Margo Seltzer§
{hanx,mickens}@g.harvard.edu
∗Harvard University
†University of Bristol
thomas.pasquier@bristol.ac.uk
‡University of Illinois at Urbana-Champaign
batesa@illinois.edu
§University of British Columbia
mseltzer@cs.ubc.ca
Abstract—Advanced Persistent Threats (APTs) are difﬁcult to
detect due to their “low-and-slow” attack patterns and frequent
use of zero-day exploits. We present UNICORN, an anomaly-
based APT detector that effectively leverages data provenance
analysis. From modeling to detection, UNICORN tailors its design
speciﬁcally for the unique characteristics of APTs. Through
extensive yet time-efﬁcient graph analysis, UNICORN explores
provenance graphs that provide rich contextual and historical
information to identify stealthy anomalous activities without pre-
deﬁned attack signatures. Using a graph sketching technique, it
summarizes long-running system execution with space efﬁciency
to combat slow-acting attacks that take place over a long time
span. UNICORN further improves its detection capability using a
novel modeling approach to understand long-term behavior as the
system evolves. Our evaluation shows that UNICORN outperforms
an existing state-of-the-art APT detection system and detects real-
life APT scenarios with high accuracy.
I.
INTRODUCTION
Advanced Persistent Threats (APT) are becoming increas-
ingly common [9]. The long timescale over which such attacks
take place makes them fundamentally different from more
conventional attacks. In an APT, the adversary’s goal is to gain
control of a speciﬁc (network of) system(s) while remaining
undetected for an extended period of time [116]. The adversary
often relies on zero-day...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Unicorn: Runtime Provenance-Based Detector for Advanced Persistent
Threats
author:Xueyuan Han and
Thomas F. J.-M. Pasquier and
Adam Bates and
James Mickens and
Margo I. Seltzer
UNICORN: Runtime Provenance-Based Detector for
Advanced Persistent Threats
Xueyuan Han∗, Thomas Pasquier†, Adam Bates‡, James Mickens∗ and Margo Seltzer§
{hanx,mickens}@g.harvard.edu
∗Harvard University
†University of Bristol
thomas.pasquier@bristol.ac.uk
‡University of Illinois at Urbana-Champaign
batesa@illinois.edu
§University of British Columbia
mseltzer@cs.ubc.ca
Abstract—Advanced Persistent Threats (APTs) are difﬁcult to
detect due to their “low-and-slow” attack patterns and frequent
use of zero-day exploits. We present UNICORN, an anomaly-
based APT detector that effectively leverages data provenance
analysis. From modeling to detection, UNICORN tailors its design
speciﬁcally for the unique characteristics of APTs. Through
extensive yet time-efﬁcient graph analysis, UNICORN explores
provenance graphs that provide rich contextual and historical
information to identify stealthy anomalous activities without pre-
deﬁned attack signatures. Using a graph sketching technique, it
summarizes long-running system execution with space efﬁciency
to combat slow-acting attacks that take place over a long time
span. UNICORN further improves its detection capability using a
novel modeling approach to understand long-term behavior as the
system evolves. Our evaluation shows that UNICORN outperforms
an existing state-of-the-art APT detection system and detects real-
life APT scenarios with high accuracy.
I.
INTRODUCTION
Advanced Persistent Threats (APT) are becoming increas-
ingly common [9]. The long timescale over which such attacks
take place makes them fundamentally different from more
conventional attacks. In an APT, the adversary’s goal is to gain
control of a speciﬁc (network of) system(s) while remaining
undetected for an extended period of time [116]. The adversary
often relies on zero-day...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:SoK: Using Dynamic Binary Instrumentation for Security (And How You
May Get Caught Red Handed)
author:Daniele Cono D'Elia and
Emilio Coppa and
Simone Nicchi and
Federico Palmaro and
Lorenzo Cavallaro
SoK: Using Dynamic Binary Instrumentation for Security
(And How You May Get Caught Red Handed)
Daniele Cono D’Elia
Sapienza University of Rome
delia@diag.uniroma1.it
Emilio Coppa
Sapienza University of Rome
coppa@diag.uniroma1.it
Simone Nicchi
Sapienza University of Rome
nicchi@diag.uniroma1.it
Federico Palmaro
Prisma
f.palmaro@prismaprogetti.it
ABSTRACT
Dynamic binary instrumentation (DBI) techniques allow for moni-
toring and possibly altering the execution of a running program up
to the instruction level granularity. The ease of use and flexibility of
DBI primitives has made them popular in a large body of research in
different domains, including software security. Lately, the suitabil-
ity of DBI for security has been questioned in light of transparency
concerns from artifacts that popular frameworks introduce in the
execution: while they do not perturb benign programs, a dedicated
adversary may detect their presence and defeat the analysis.
The contributions we provide are two-fold. We first present the
abstraction and inner workings of DBI frameworks, how DBI as-
sisted prominent security research works, and alternative solutions.
We then dive into the DBI evasion and escape problems, discussing
attack surfaces, transparency concerns, and possible mitigations.
We make available to the community a library of detection pat-
terns and stopgap measures that could be of interest to DBI users.
CCS CONCEPTS
• Security and privacy → Systems security; Intrusion/anomaly
detection and malware mitigation; Software reverse engineering; Soft-
ware security engineering.
KEYWORDS
Dynamic binary instrumentation, dynamic binary translation, in-
terposition, transparent monitoring, evasion, escape
ACM Reference Format:
Daniele Cono D’Elia, Emilio Coppa, Simone Nicchi, Federico...