Instruction: 总结这篇安全研究的主要观点

Input:
title:A Transparent Highway for inter-Virtual Network Function Communication
with Open vSwitch
author:Mauricio V'asquez Bernal and
Ivano Cerrato and
Fulvio Risso and
David Verbeiren
A Transparent Highway for inter-Virtual Network
Function Communication with Open vSwitch
Mauricio Vásquez Bernal1, Ivano Cerrato1, Fulvio Risso1, David Verbeiren2
1Dept. of Computer and Control Engineering, Politecnico di Torino, Turin, Italy
2Tessares SA, Louvain-la-Neuve, Belgium, formerly at Intel Corporation NV/SA, Belgium
1{mauricio.vasquez, ivano.cerrato, fulvio.risso}@polito.it; 2david.verbeiren@gmail.com
ABSTRACT
This paper presents a software architecture that can
dynamically and transparently establish direct commu-
nication paths between DPDK-based virtual network
functions executed in virtual machines, by recognizing
new point-to-point connections in traﬃc steering rules.
We demonstrate the huge advantages of this architec-
ture in terms of performance and the possibility to im-
plement it with localized modiﬁcations in Open vSwitch
and DPDK, without touching the VNFs.
CCS Concepts
•Networks → Middle boxes / network appliances;
Keywords
NFV; Open vSwitch; DPDK; performance
1.
INTRODUCTION
In Network Functions Virtualization (NFV), complex
services can be delivered by rearranging multiple Vir-
tual Network Functions (VNFs) in arbitrary graphs (Fig-
ure 1(a)), with multiple VNFs often executed on a single
physical server as distinct machines (VMs). This paper
presents a set of interacting software components that
optimize the inter-VNF communications by creating a
direct connection between two VMs, hence bypassing
the vSwitch when two VNFs are logically connected
through a point-to-point (p-2-p) link.
Diﬀerently from other proposals [1], we can acceler-
ate transparently and dynamically the packets exchange
between VMs on a widespread vSwitch. Transparency
refers to the possibility for an application to exploit the
Permission to make digital or hard copies of all or part o...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Signals from the crowd: uncovering social relationships through smartphone
probes
author:Marco Valerio Barbera and
Alessandro Epasto and
Alessandro Mei and
Vasile Claudiu Perta and
Julinda Stefa
Signals from the Crowd: Uncovering Social Relationships
through Smartphone Probes
Marco V. Barbera, Alessandro Epasto, Alessandro Mei, Vasile C. Perta, and Julinda Stefa
Department of Computer Science, Sapienza University of Rome, Italy,
{barbera, epasto, mei, perta, stefa}@di.uniroma1.it.
ABSTRACT
The ever increasing ubiquitousness of WiFi access points, cou-
pled with the diffusion of smartphones, suggest that Internet every
time and everywhere will soon (if not already has) become a re-
ality. Even in presence of 3G connectivity, our devices are built
to switch automatically to WiFi networks so to improve user ex-
perience. Most of the times, this is achieved by recurrently broad-
casting automatic connectivity requests (known as Probe Requests)
to known access points (APs), like, e.g., “Home WiFi”, “Campus
WiFi”, and so on. In a large gathering of people, the number of
these probes can be very high. This scenario rises a natural ques-
tion: “Can signiﬁcant information on the social structure of a large
crowd and on its socioeconomic status be inferred by looking at
smartphone probes?”.
In this work we give a positive answer to this question. We or-
ganized a 3-months long campaign, through which we collected
around 11M probes sent by more than 160K different devices. Dur-
ing the campaign we targeted national and international events that
attracted large crowds as well as other gatherings of people. Then,
we present a simple and automatic methodology to build the un-
derlying social graph of the smartphone users, starting from their
probes. We do so for each of our target events, and ﬁnd that they
all feature social-network properties. In addition, we show that, by
looking at the probes in an event, we can learn important sociolog-
ical aspects of its participants—...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Signals from the crowd: uncovering social relationships through smartphone
probes
author:Marco Valerio Barbera and
Alessandro Epasto and
Alessandro Mei and
Vasile Claudiu Perta and
Julinda Stefa
Signals from the Crowd: Uncovering Social Relationships
through Smartphone Probes
Marco V. Barbera, Alessandro Epasto, Alessandro Mei, Vasile C. Perta, and Julinda Stefa
Department of Computer Science, Sapienza University of Rome, Italy,
{barbera, epasto, mei, perta, stefa}@di.uniroma1.it.
ABSTRACT
The ever increasing ubiquitousness of WiFi access points, cou-
pled with the diffusion of smartphones, suggest that Internet every
time and everywhere will soon (if not already has) become a re-
ality. Even in presence of 3G connectivity, our devices are built
to switch automatically to WiFi networks so to improve user ex-
perience. Most of the times, this is achieved by recurrently broad-
casting automatic connectivity requests (known as Probe Requests)
to known access points (APs), like, e.g., “Home WiFi”, “Campus
WiFi”, and so on. In a large gathering of people, the number of
these probes can be very high. This scenario rises a natural ques-
tion: “Can signiﬁcant information on the social structure of a large
crowd and on its socioeconomic status be inferred by looking at
smartphone probes?”.
In this work we give a positive answer to this question. We or-
ganized a 3-months long campaign, through which we collected
around 11M probes sent by more than 160K different devices. Dur-
ing the campaign we targeted national and international events that
attracted large crowds as well as other gatherings of people. Then,
we present a simple and automatic methodology to build the un-
derlying social graph of the smartphone users, starting from their
probes. We do so for each of our target events, and ﬁnd that they
all feature social-network properties. In addition, we show that, by
looking at the probes in an event, we can learn important sociolog-
ical aspects of its participants—...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Wi Not Calling: Practical Privacy and Availability Attacks in Wi-Fi
Calling
author:Jaejong Baek and
Sukwha Kyung and
Haehyun Cho and
Ziming Zhao and
Yan Shoshitaishvili and
Adam Doup'e and
Gail-Joon Ahn
Wi Not Calling: Practical Privacy and Availability Attacks in
Wi-Fi Calling
Jaejong Baek
Arizona State University
jbaek7@asu.edu
Ziming Zhao
Rochester Institute of Technology
zhao@mail.rit.edu
Haehyun Cho
Arizona State University
haehyun@asu.edu
Adam Doupé
Arizona State University
doupe@asu.edu
Sukwha Kyung
Arizona State University
skyung1@asu.edu
Yan Shoshitaishvili
Arizona State University
yans@asu.edu
Gail-Joon Ahn
Arizona State University
Samsung Research
gahn@asu.edu
gailjoon.ahn@samsung.com
ABSTRACT
Wi-Fi Calling, which is used to make and receive calls over the Wi-
Fi network, has been widely adopted and deployed to extend the
coverage and increase the capacity in weak signal areas by moving
traffic from LTE to Wi-Fi networks. However, the security of Wi-Fi
Calling mechanism has not been fully analyzed, and Wi-Fi Calling
may inherently have greater security risks than conventional LTE
calling. To provide secure connections with confidentiality and
integrity, Wi-Fi Calling leverages the IETF protocols IKEv2 and
IPSec.
In this paper, we analyze the security of Wi-Fi Calling specifica-
tions and discover several vulnerabilities that allow an adversary to
track the location of users and perform DoS attacks. By setting up
a rogue access point in live testbed environment, we observe that
user devices can leak the International Mobile Subscriber Identity
(IMSI), despite it being encrypted. The leaked information can be
further exploited for tracking user locations. We also discuss how
these protocols are vulnerable to several denial of service attacks.
To protect user privacy and services against these attacks, we
propose practical countermeasures. We also present trade-off con-
siderations that pose challenges for us to apply countermeasures
to mitigate t...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Wi Not Calling: Practical Privacy and Availability Attacks in Wi-Fi
Calling
author:Jaejong Baek and
Sukwha Kyung and
Haehyun Cho and
Ziming Zhao and
Yan Shoshitaishvili and
Adam Doup'e and
Gail-Joon Ahn
Wi Not Calling: Practical Privacy and Availability Attacks in
Wi-Fi Calling
Jaejong Baek
Arizona State University
jbaek7@asu.edu
Ziming Zhao
Rochester Institute of Technology
zhao@mail.rit.edu
Haehyun Cho
Arizona State University
haehyun@asu.edu
Adam Doupé
Arizona State University
doupe@asu.edu
Sukwha Kyung
Arizona State University
skyung1@asu.edu
Yan Shoshitaishvili
Arizona State University
yans@asu.edu
Gail-Joon Ahn
Arizona State University
Samsung Research
gahn@asu.edu
gailjoon.ahn@samsung.com
ABSTRACT
Wi-Fi Calling, which is used to make and receive calls over the Wi-
Fi network, has been widely adopted and deployed to extend the
coverage and increase the capacity in weak signal areas by moving
traffic from LTE to Wi-Fi networks. However, the security of Wi-Fi
Calling mechanism has not been fully analyzed, and Wi-Fi Calling
may inherently have greater security risks than conventional LTE
calling. To provide secure connections with confidentiality and
integrity, Wi-Fi Calling leverages the IETF protocols IKEv2 and
IPSec.
In this paper, we analyze the security of Wi-Fi Calling specifica-
tions and discover several vulnerabilities that allow an adversary to
track the location of users and perform DoS attacks. By setting up
a rogue access point in live testbed environment, we observe that
user devices can leak the International Mobile Subscriber Identity
(IMSI), despite it being encrypted. The leaked information can be
further exploited for tracking user locations. We also discuss how
these protocols are vulnerable to several denial of service attacks.
To protect user privacy and services against these attacks, we
propose practical countermeasures. We also present trade-off con-
siderations that pose challenges for us to apply countermeasures
to mitigate t...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Understanding HTTP Traffic and CDN Behavior from the Eyes of a
Mobile ISP
author:Pedro Casas and
Pierdomenico Fiadino and
Arian B"ar
Understanding HTTP Traﬃc and CDN
Behavior from the Eyes of a Mobile ISP(cid:2)
Pedro Casas, Pierdomenico Fiadino, and Arian B¨ar
Telecommunications Research Center Vienna - FTW, Vienna, Austria
surname@ftw.at
Abstract. Today’s Internet is dominated by HTTP services and Con-
tent Delivery Networks (CDNs). Popular web services like Facebook and
YouTube are hosted by highly distributed CDNs like Akamai and Google.
Understanding this new complex Internet scenario is paramount for net-
work operators, to control the traﬃc on their networks and to improve
the quality experienced by their customers, specially when something
goes wrong. This paper studies the most popular HTTP services and
their underlying hosting networks, through the analysis of a full week of
HTTP traﬃc traces collected at an operational mobile network.
Keywords: HTTP Traﬃc, Content Delivery Networks, Mobile Net-
works.
1
Introduction
Today’s Internet is shaped by the success of large services running on top of
HTTP. HTTP is currently the dominating content delivery protocol, accounting
for more than 75% of the residential customers traﬃc [1]. HTTP-based services
such as YouTube and Facebook are forcing the Internet to shift the content as
close as possible to the users. The very last few years have seen an astonishing
development in Content Delivery Networks (CDNs) technology, and nowadays
Internet content is delivered by large CDNs like Akamai or Google.
This paper studies the dynamics of the top Internet services running on HTTP.
Using a full week of HTTP traﬃc traces collected at the mobile broadband net-
work of a major European ISP, we study the associations between services and
the hosting organizations providing the content. The dataset consists of more
than half a billion HTTP ﬂows. For each ﬂow, the dataset contains the con-
tacted URL, the server IP ad...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Understanding HTTP Traffic and CDN Behavior from the Eyes of a
Mobile ISP
author:Pedro Casas and
Pierdomenico Fiadino and
Arian B"ar
Understanding HTTP Traﬃc and CDN
Behavior from the Eyes of a Mobile ISP(cid:2)
Pedro Casas, Pierdomenico Fiadino, and Arian B¨ar
Telecommunications Research Center Vienna - FTW, Vienna, Austria
surname@ftw.at
Abstract. Today’s Internet is dominated by HTTP services and Con-
tent Delivery Networks (CDNs). Popular web services like Facebook and
YouTube are hosted by highly distributed CDNs like Akamai and Google.
Understanding this new complex Internet scenario is paramount for net-
work operators, to control the traﬃc on their networks and to improve
the quality experienced by their customers, specially when something
goes wrong. This paper studies the most popular HTTP services and
their underlying hosting networks, through the analysis of a full week of
HTTP traﬃc traces collected at an operational mobile network.
Keywords: HTTP Traﬃc, Content Delivery Networks, Mobile Net-
works.
1
Introduction
Today’s Internet is shaped by the success of large services running on top of
HTTP. HTTP is currently the dominating content delivery protocol, accounting
for more than 75% of the residential customers traﬃc [1]. HTTP-based services
such as YouTube and Facebook are forcing the Internet to shift the content as
close as possible to the users. The very last few years have seen an astonishing
development in Content Delivery Networks (CDNs) technology, and nowadays
Internet content is delivered by large CDNs like Akamai or Google.
This paper studies the dynamics of the top Internet services running on HTTP.
Using a full week of HTTP traﬃc traces collected at the mobile broadband net-
work of a major European ISP, we study the associations between services and
the hosting organizations providing the content. The dataset consists of more
than half a billion HTTP ﬂows. For each ﬂow, the dataset contains the con-
tacted URL, the server IP ad...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Proteus: Detecting Android Emulators from Instruction-Level Profiles
author:Onur Sahin and
Ayse K. Coskun and
Manuel Egele
Proteus: Detecting Android Emulators
from Instruction-Level Proﬁles
Onur Sahin(B), Ayse K. Coskun, and Manuel Egele
Boston University, Boston, MA 02215, USA
sahin@bu.edu
Abstract. The popularity of Android and the personal information
stored on these devices attract the attention of regular cyber-criminals
as well as nation state adversaries who develop malware that targets this
platform. To identify malicious Android apps at a scale (e.g., Google Play
contains 3.7M Apps), state-of-the-art mobile malware analysis systems
inspect the execution of apps in emulation-based sandboxes. An emerg-
ing class of evasive Android malware, however, can evade detection by
such analysis systems through ceasing malicious activities if an emulation
sandbox is detected. Thus, systematically uncovering potential meth-
ods to detect emulated environments is crucial to stay ahead of adver-
saries. This work uncovers the detection methods based on discrepancies
in instruction-level behavior between software-based emulators and real
ARM CPUs that power the vast majority of Android devices. To sys-
tematically discover such discrepancies at scale, we propose the Proteus
system. Proteus performs large-scale collection of application execution
traces (i.e., registers and memory) as they run on an emulator and on
accurate software models of ARM CPUs. Proteus automatically identi-
ﬁes the instructions that cause divergent behavior between emulated and
real CPUs and, on a set of 500K test programs, identiﬁed 28K divergent
instances. By inspecting these instances, we reveal 3 major classes of root
causes that are responsible for these discrepancies. We show that some of
these root causes can be easily ﬁxed without introducing observable per-
formance degradation in the emulator. Thus, we have submitted patches
to improve resilience of Android emulators against evasive ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Proteus: Detecting Android Emulators from Instruction-Level Profiles
author:Onur Sahin and
Ayse K. Coskun and
Manuel Egele
Proteus: Detecting Android Emulators
from Instruction-Level Proﬁles
Onur Sahin(B), Ayse K. Coskun, and Manuel Egele
Boston University, Boston, MA 02215, USA
sahin@bu.edu
Abstract. The popularity of Android and the personal information
stored on these devices attract the attention of regular cyber-criminals
as well as nation state adversaries who develop malware that targets this
platform. To identify malicious Android apps at a scale (e.g., Google Play
contains 3.7M Apps), state-of-the-art mobile malware analysis systems
inspect the execution of apps in emulation-based sandboxes. An emerg-
ing class of evasive Android malware, however, can evade detection by
such analysis systems through ceasing malicious activities if an emulation
sandbox is detected. Thus, systematically uncovering potential meth-
ods to detect emulated environments is crucial to stay ahead of adver-
saries. This work uncovers the detection methods based on discrepancies
in instruction-level behavior between software-based emulators and real
ARM CPUs that power the vast majority of Android devices. To sys-
tematically discover such discrepancies at scale, we propose the Proteus
system. Proteus performs large-scale collection of application execution
traces (i.e., registers and memory) as they run on an emulator and on
accurate software models of ARM CPUs. Proteus automatically identi-
ﬁes the instructions that cause divergent behavior between emulated and
real CPUs and, on a set of 500K test programs, identiﬁed 28K divergent
instances. By inspecting these instances, we reveal 3 major classes of root
causes that are responsible for these discrepancies. We show that some of
these root causes can be easily ﬁxed without introducing observable per-
formance degradation in the emulator. Thus, we have submitted patches
to improve resilience of Android emulators against evasive ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Statistical guarantees of performance for MIMO designs
author:Jayanand Asok Kumar and
Shobha Vasudevan
2010 IEEE/IFIP
International
Conference
on Dependable
Systems & Networks (DSN)
Statistical
guarantees
of performance
for MIMO designs
J ayanand Asok Kumar
Shobha Vasudevan
Coordinated
Science Laboratory
Coordinated
Science Laboratory
University
of Illinois
j asokku2@illinois.edu
at Urbana-Champaign
University
of Illinois
shobhav@illinois.edu
at Urbana-Champaign
Abstract
Performance
In this paper, we introduce
of Mul
by met
Transfer
metrics
quantified
introduce
is typically
Output (MIMO) systems.
Sources of noise such as quantization,
ran
Level (RTL) designs
domness into Register
tiple Input Multiple
of these MIMO RTL designs
rics averaged over simulations.
a formal approach to compute these metrics
with high con
fidence. We define best, bounded and average case per
formance
logic. We then use probabilistic
these properties
statistical performance.
If a property fails,
acterization
ing is known to encounter
plosion.
sound and efficient
scalability
different non-trivial  components
the problem of state space ex
of interest,
we show
improve the
our approach on
in a probabilistic
temporal
to verify
guarantee
the
we show a char
model check
of error. However, probabilistic
of our approach. We illustrate
for MIMO RTL and thereby
that significantly
to the properties
model checking
as properties
reductions
With respect
of MIMO system designs.
1 Introduction
There is an ever growing demand to design reliable
com
at high data rates. The com
(DSP) systems in
signal processing
to be area and
Bit Error Rate (BER) is a commonly used
links that operate
and digital
layers of these links are required
munication
munication
the physical
power efficient.
performance
measure of the probability
bit is decoded in error. In wireless
tems, BER requirements
systems [29] are designed
BER is ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Statistical guarantees of performance for MIMO designs
author:Jayanand Asok Kumar and
Shobha Vasudevan
2010 IEEE/IFIP
International
Conference
on Dependable
Systems & Networks (DSN)
Statistical
guarantees
of performance
for MIMO designs
J ayanand Asok Kumar
Shobha Vasudevan
Coordinated
Science Laboratory
Coordinated
Science Laboratory
University
of Illinois
j asokku2@illinois.edu
at Urbana-Champaign
University
of Illinois
shobhav@illinois.edu
at Urbana-Champaign
Abstract
Performance
In this paper, we introduce
of Mul
by met
Transfer
metrics
quantified
introduce
is typically
Output (MIMO) systems.
Sources of noise such as quantization,
ran
Level (RTL) designs
domness into Register
tiple Input Multiple
of these MIMO RTL designs
rics averaged over simulations.
a formal approach to compute these metrics
with high con
fidence. We define best, bounded and average case per
formance
logic. We then use probabilistic
these properties
statistical performance.
If a property fails,
acterization
ing is known to encounter
plosion.
sound and efficient
scalability
different non-trivial  components
the problem of state space ex
of interest,
we show
improve the
our approach on
in a probabilistic
temporal
to verify
guarantee
the
we show a char
model check
of error. However, probabilistic
of our approach. We illustrate
for MIMO RTL and thereby
that significantly
to the properties
model checking
as properties
reductions
With respect
of MIMO system designs.
1 Introduction
There is an ever growing demand to design reliable
com
at high data rates. The com
(DSP) systems in
signal processing
to be area and
Bit Error Rate (BER) is a commonly used
links that operate
and digital
layers of these links are required
munication
munication
the physical
power efficient.
performance
measure of the probability
bit is decoded in error. In wireless
tems, BER requirements
systems [29] are designed
BER is ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:On a New Class of Pulsing Denial-of-Service Attacks and the Defense
author:Xiapu Luo and
Rocky K. C. Chang
On a New Class of Pulsing Denial-of-Service Attacks and the Defense
Xiapu Luo and Rocky K. C. Chang
Department of Computing
The Hong Kong Polytechnic University
Kowloon, Hong Kong, SAR, China
{csxluo,csrchang}@comp.polyu.edu.hk
Abstract
In this paper we analyze a new class of pulsing denial-
of-service (PDoS) attacks that could seriously degrade
the throughput of TCP ﬂows. During a PDoS attack,
periodic pulses of attack packets are sent
to a vic-
tim. The magnitude of each pulse should be signiﬁcant
enough to cause packet losses. We describe two spe-
ciﬁc attack models according to the timing of the at-
tack pulses with respect to the TCP’s congestion window
movement: timeout-based and AIMD (additive-increase-
multiplicative-decrease)-based. We show through an
analysis that even a small number of attack pulses can
cause signiﬁcant throughput degradation. The second
part of this paper is a novel two-stage scheme to detect
PDoS attacks on a victim network. The ﬁrst stage is based
on a wavelet transform used to extract the desired fre-
quency components of the data trafﬁc and ACK trafﬁc.
The second stage is to detect change points in the ex-
tracted components. Through both simulation and test-
bed experiments, we verify the feasibility and effectiveness
of the detection scheme.
1
Introduction
Starting from the most well-known denial-of-service
(DoS) attacks in February 2000 against a number of very
popular web sites, such as Yahoo, Amazon, and eTrade,
DoS attacks continue to plague the Internet. The most re-
cent one is the attack against Akami’s DNS servers, which
disrupted their services for hours. Unlike other system-
speciﬁc attacks, DoS attacks are more generic in nature.
Therefore, their impact can be very signiﬁcant in scope
and damage.
Conventional DoS attacks are ﬂooding-based [8]. That
is, an attacker sends out an unusually large number of
packets...


Instruction: 总结这篇安全研究的主要观点

Input:
title:On a New Class of Pulsing Denial-of-Service Attacks and the Defense
author:Xiapu Luo and
Rocky K. C. Chang
On a New Class of Pulsing Denial-of-Service Attacks and the Defense
Xiapu Luo and Rocky K. C. Chang
Department of Computing
The Hong Kong Polytechnic University
Kowloon, Hong Kong, SAR, China
{csxluo,csrchang}@comp.polyu.edu.hk
Abstract
In this paper we analyze a new class of pulsing denial-
of-service (PDoS) attacks that could seriously degrade
the throughput of TCP ﬂows. During a PDoS attack,
periodic pulses of attack packets are sent
to a vic-
tim. The magnitude of each pulse should be signiﬁcant
enough to cause packet losses. We describe two spe-
ciﬁc attack models according to the timing of the at-
tack pulses with respect to the TCP’s congestion window
movement: timeout-based and AIMD (additive-increase-
multiplicative-decrease)-based. We show through an
analysis that even a small number of attack pulses can
cause signiﬁcant throughput degradation. The second
part of this paper is a novel two-stage scheme to detect
PDoS attacks on a victim network. The ﬁrst stage is based
on a wavelet transform used to extract the desired fre-
quency components of the data trafﬁc and ACK trafﬁc.
The second stage is to detect change points in the ex-
tracted components. Through both simulation and test-
bed experiments, we verify the feasibility and effectiveness
of the detection scheme.
1
Introduction
Starting from the most well-known denial-of-service
(DoS) attacks in February 2000 against a number of very
popular web sites, such as Yahoo, Amazon, and eTrade,
DoS attacks continue to plague the Internet. The most re-
cent one is the attack against Akami’s DNS servers, which
disrupted their services for hours. Unlike other system-
speciﬁc attacks, DoS attacks are more generic in nature.
Therefore, their impact can be very signiﬁcant in scope
and damage.
Conventional DoS attacks are ﬂooding-based [8]. That
is, an attacker sends out an unusually large number of
packets...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A framework for early stage quality-fault tolerance analysis of embedded
control systems
author:Satya Gautam Vadlamudi and
P. P. Chakrabarti and
Dipankar Das and
Purnendu Sinha
A Framework For Early Stage Quality-Fault Tolerance Analysis Of
Embedded Control Systems
S. G. Vadlamudi and P. P. Chakrabarti
Dipankar Das and Purnendu Sinha
Department of Computer Science and Engineering
Electrical and Software Architecture Group
Indian Institute of Technology Kharagpur
Email: {satya,ppchak}@cse.iitkgp.ernet.in
Kharagpur, India
General Motors India Science Lab
Email: {dipankar.das,purnendu.sinha}@gm.com
Bangalore, India
Abstract—This work presents a static-analysis based method
for analyzing the robustness of a given embedded control
system design,
in the presence of quality-faults in sensors,
software components, and inter-connections. The method char-
acterizes the individual components of the system by storing
the relations between the precision of inputs and the precision
of outputs in what we call, lookup tables (LUTs). A network of
LUTs thus formed which represent the given control system is
converted into a satisﬁability modulo theory (SMT) instance,
such that a satisfying assignment corresponds to a potential
counterexample (the set of quality-faults which violate the given
fault-tolerance requirements) or hot-spot in the design. Hot-
spots obtained in this manner are counter-veriﬁed through
simulation to ﬁlter the false-positives. Experimental results
on the fault-tolerant fuel controller from Simulink automotive
library demonstrate the efﬁcacy of the proposed approach.
Keywords-embedded systems; fault injection; fault tolerant
systems; quality faults; robustness;
I. INTRODUCTION
Embedded control systems are widely used in many
domains such as aeronautics, automotive, medical, nuclear,
etc. The applications range from safety-critical features like
computing when and how an airbag of a car must inﬂate,
to value and business enhancing features like controlling
...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A framework for early stage quality-fault tolerance analysis of embedded
control systems
author:Satya Gautam Vadlamudi and
P. P. Chakrabarti and
Dipankar Das and
Purnendu Sinha
A Framework For Early Stage Quality-Fault Tolerance Analysis Of
Embedded Control Systems
S. G. Vadlamudi and P. P. Chakrabarti
Dipankar Das and Purnendu Sinha
Department of Computer Science and Engineering
Electrical and Software Architecture Group
Indian Institute of Technology Kharagpur
Email: {satya,ppchak}@cse.iitkgp.ernet.in
Kharagpur, India
General Motors India Science Lab
Email: {dipankar.das,purnendu.sinha}@gm.com
Bangalore, India
Abstract—This work presents a static-analysis based method
for analyzing the robustness of a given embedded control
system design,
in the presence of quality-faults in sensors,
software components, and inter-connections. The method char-
acterizes the individual components of the system by storing
the relations between the precision of inputs and the precision
of outputs in what we call, lookup tables (LUTs). A network of
LUTs thus formed which represent the given control system is
converted into a satisﬁability modulo theory (SMT) instance,
such that a satisfying assignment corresponds to a potential
counterexample (the set of quality-faults which violate the given
fault-tolerance requirements) or hot-spot in the design. Hot-
spots obtained in this manner are counter-veriﬁed through
simulation to ﬁlter the false-positives. Experimental results
on the fault-tolerant fuel controller from Simulink automotive
library demonstrate the efﬁcacy of the proposed approach.
Keywords-embedded systems; fault injection; fault tolerant
systems; quality faults; robustness;
I. INTRODUCTION
Embedded control systems are widely used in many
domains such as aeronautics, automotive, medical, nuclear,
etc. The applications range from safety-critical features like
computing when and how an airbag of a car must inﬂate,
to value and business enhancing features like controlling
...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Mitigating denial-of-service attacks in MANET by distributed packet
filtering: a game-theoretic approach
author:Xiaoxin Wu and
David K. Y. Yau
Mitigating Denial-of-Service Attacks in MANET by
Distributed Packet Filtering: A Game-theoretic Approach ∗
Intel China Research Center Ltd
Xiaoxin Wu
Beijing, China
xiaoxin.wu@intel.com
ABSTRACT
Defending against denial-of-service (DoS) in a mobile ad
hoc network (MANET) is challenging because the network
topology is dynamic and nodes are selﬁsh. In this paper, we
propose a DoS mitigation technique that uses digital signa-
tures to verify legitimate packets, and drop packets that do
not pass the veriﬁcation. Since nodes are selﬁsh, they may
not perform the veriﬁcation so that they can avoid paying
the overhead. A bad packet that escapes veriﬁcation along
the whole network path will bring a penalty to all its for-
warders. A network game can be formulated in which nodes
along a network path, in optimizing their own beneﬁts, are
encouraged to act collectively to ﬁlter out bad packets. An-
alytical results show that Nash equilibrium can be attained
for players in the proposed game, in which signiﬁcant ben-
eﬁts can be provided to forwarders such that many of the
bad packets will be eliminated by veriﬁcation.
1.
INTRODUCTION
The dependencies between dynamic, mutually untrusted
neighbors in a mobile ad hoc network (MANET) create im-
portant security concerns in such networks. Among the at-
tacks documented in the literature, denial-of-service (DoS)
attacks are particularly damaging since both communica-
tion bandwidth and node resources are scarce in MANETs.
In addition to their ability to take down a network quickly,
DoS attacks directed at bandwidth and end node resources
are easy to launch; e.g., by simply injecting useless traﬃc
into the network.
DoS mitigation techniques designed for wireline networks
will not work well in an ad hoc environment where the routes
and the set of forwarders on a routing path are highly dy-
...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Mitigating denial-of-service attacks in MANET by distributed packet
filtering: a game-theoretic approach
author:Xiaoxin Wu and
David K. Y. Yau
Mitigating Denial-of-Service Attacks in MANET by
Distributed Packet Filtering: A Game-theoretic Approach ∗
Intel China Research Center Ltd
Xiaoxin Wu
Beijing, China
xiaoxin.wu@intel.com
ABSTRACT
Defending against denial-of-service (DoS) in a mobile ad
hoc network (MANET) is challenging because the network
topology is dynamic and nodes are selﬁsh. In this paper, we
propose a DoS mitigation technique that uses digital signa-
tures to verify legitimate packets, and drop packets that do
not pass the veriﬁcation. Since nodes are selﬁsh, they may
not perform the veriﬁcation so that they can avoid paying
the overhead. A bad packet that escapes veriﬁcation along
the whole network path will bring a penalty to all its for-
warders. A network game can be formulated in which nodes
along a network path, in optimizing their own beneﬁts, are
encouraged to act collectively to ﬁlter out bad packets. An-
alytical results show that Nash equilibrium can be attained
for players in the proposed game, in which signiﬁcant ben-
eﬁts can be provided to forwarders such that many of the
bad packets will be eliminated by veriﬁcation.
1.
INTRODUCTION
The dependencies between dynamic, mutually untrusted
neighbors in a mobile ad hoc network (MANET) create im-
portant security concerns in such networks. Among the at-
tacks documented in the literature, denial-of-service (DoS)
attacks are particularly damaging since both communica-
tion bandwidth and node resources are scarce in MANETs.
In addition to their ability to take down a network quickly,
DoS attacks directed at bandwidth and end node resources
are easy to launch; e.g., by simply injecting useless traﬃc
into the network.
DoS mitigation techniques designed for wireline networks
will not work well in an ad hoc environment where the routes
and the set of forwarders on a routing path are highly dy-
...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:POSTER: Towards Highly Interactive Honeypots for Industrial Control
Systems
author:Stephan Lau and
Johannes Klick and
Stephan Arndt and
Volker Roth
POSTER: Towards Highly Interactive Honeypots for
Industrial Control Systems
Stephan Lau
Freie Universität Berlin
stephan.lau@fu-berlin.de
Johannes Klick
Freie Universität Berlin
johannes.klick@fu-
berlin.de
Stephan Arndt
Freie Universität Berlin
stephan.arndt@fu-
berlin.de
Volker Roth
Freie Universität Berlin
volker.roth@fu-berlin.de
ABSTRACT
Honeypots are a common tool to set intrusion alarms and to
study attacks against computer systems. In order to be con-
vincing, honeypots attempt to resemble actual systems that
are in active use. Recently, researchers have begun to develop
honeypots for programmable logic controllers (PLCs). The
tools of which we are aware have limited functionality com-
pared to genuine devices. Particularly, they do not support
running actual PLC programs.
In order to improve upon the interactive capabilities of
PLC honeypots we set out to develop a simulator for Siemens
S7-300 series PLCs. Our current prototype XPOT supports
PLC program compilation and interpretation, the proprietary
S7comm protocol and SNMP. While the supported feature
set is not yet comprehensive, it is possible to program it using
standard IDEs such as Siemens’ TIA portal. Additionally,
we emulate the characteristics of the network stack of our
reference PLC in order to resist OS ﬁngerprinting attempts
using tools such as Nmap.
Initial experiments with students whom we trained in PLC
programming indicate that XPOT may resist cursory in-
spection but still fails against knowledgeable and suspicious
adversaries. We conclude that high-interactive PLC hon-
eypots need to support a fairly complete feature set of the
genuine, simulated PLC.
Keywords
Honeypot; Programmable Logic Controller (PLC); Industrial
Control Systems (ICS); SCADA
1.
INTRODUCTION
Connecting devices to the Internet often increases their
utility – at the pr...


Instruction: 总结这篇安全研究的主要观点

Input:
title:POSTER: Towards Highly Interactive Honeypots for Industrial Control
Systems
author:Stephan Lau and
Johannes Klick and
Stephan Arndt and
Volker Roth
POSTER: Towards Highly Interactive Honeypots for
Industrial Control Systems
Stephan Lau
Freie Universität Berlin
stephan.lau@fu-berlin.de
Johannes Klick
Freie Universität Berlin
johannes.klick@fu-
berlin.de
Stephan Arndt
Freie Universität Berlin
stephan.arndt@fu-
berlin.de
Volker Roth
Freie Universität Berlin
volker.roth@fu-berlin.de
ABSTRACT
Honeypots are a common tool to set intrusion alarms and to
study attacks against computer systems. In order to be con-
vincing, honeypots attempt to resemble actual systems that
are in active use. Recently, researchers have begun to develop
honeypots for programmable logic controllers (PLCs). The
tools of which we are aware have limited functionality com-
pared to genuine devices. Particularly, they do not support
running actual PLC programs.
In order to improve upon the interactive capabilities of
PLC honeypots we set out to develop a simulator for Siemens
S7-300 series PLCs. Our current prototype XPOT supports
PLC program compilation and interpretation, the proprietary
S7comm protocol and SNMP. While the supported feature
set is not yet comprehensive, it is possible to program it using
standard IDEs such as Siemens’ TIA portal. Additionally,
we emulate the characteristics of the network stack of our
reference PLC in order to resist OS ﬁngerprinting attempts
using tools such as Nmap.
Initial experiments with students whom we trained in PLC
programming indicate that XPOT may resist cursory in-
spection but still fails against knowledgeable and suspicious
adversaries. We conclude that high-interactive PLC hon-
eypots need to support a fairly complete feature set of the
genuine, simulated PLC.
Keywords
Honeypot; Programmable Logic Controller (PLC); Industrial
Control Systems (ICS); SCADA
1.
INTRODUCTION
Connecting devices to the Internet often increases their
utility – at the pr...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Ether: malware analysis via hardware virtualization extensions
author:Artem Dinaburg and
Paul Royal and
Monirul I. Sharif and
Wenke Lee
Ether: Malware Analysis via
Hardware Virtualization Extensions
Artem Dinaburg∗†, Paul Royal†∗, Monirul Sharif∗†, Wenke Lee†∗
{artem, paul, msharif, wenke}@{gtisc.gatech.edu, damballa.com}
∗Georgia Institute of Technology, Atlanta, GA, USA
†Damballa, Inc., Atlanta, GA, USA
ABSTRACT
Malware has become the centerpiece of most security threats
on the Internet. Malware analysis is an essential technology
that extracts the runtime behavior of malware, and supplies
signatures to detection systems and provides evidence for re-
covery and cleanup. The focal point in the malware analysis
battle is how to detect versus how to hide a malware ana-
lyzer from malware during runtime. State-of-the-art analyz-
ers reside in or emulate part of the guest operating system
and its underlying hardware, making them easy to detect
and evade. In this paper, we propose a transparent and ex-
ternal approach to malware analysis, which is motivated by
the intuition that for a malware analyzer to be transparent,
it must not induce any side-eﬀects that are unconditionally
detectable by malware. Our analyzer, Ether, is based on a
novel application of hardware virtualization extensions such
as Intel VT, and resides completely outside of the target OS
environment. Thus, there are no in-guest software compo-
nents vulnerable to detection, and there are no shortcomings
that arise from incomplete or inaccurate system emulation.
Our experiments are based on our study of obfuscation tech-
niques used to create 25,000 recent malware samples. The
results show that Ether remains transparent and defeats the
obfuscation tools that evade existing approaches.
Categories and Subject Descriptors
D.4.6 [Operating Systems]: Security and Protection—In-
vasive software
General Terms
Security
Keywords
Malware Analysis, Dynamic Analysis, Virtualization, Emu-
lation, Unpacking
Per...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Ether: malware analysis via hardware virtualization extensions
author:Artem Dinaburg and
Paul Royal and
Monirul I. Sharif and
Wenke Lee
Ether: Malware Analysis via
Hardware Virtualization Extensions
Artem Dinaburg∗†, Paul Royal†∗, Monirul Sharif∗†, Wenke Lee†∗
{artem, paul, msharif, wenke}@{gtisc.gatech.edu, damballa.com}
∗Georgia Institute of Technology, Atlanta, GA, USA
†Damballa, Inc., Atlanta, GA, USA
ABSTRACT
Malware has become the centerpiece of most security threats
on the Internet. Malware analysis is an essential technology
that extracts the runtime behavior of malware, and supplies
signatures to detection systems and provides evidence for re-
covery and cleanup. The focal point in the malware analysis
battle is how to detect versus how to hide a malware ana-
lyzer from malware during runtime. State-of-the-art analyz-
ers reside in or emulate part of the guest operating system
and its underlying hardware, making them easy to detect
and evade. In this paper, we propose a transparent and ex-
ternal approach to malware analysis, which is motivated by
the intuition that for a malware analyzer to be transparent,
it must not induce any side-eﬀects that are unconditionally
detectable by malware. Our analyzer, Ether, is based on a
novel application of hardware virtualization extensions such
as Intel VT, and resides completely outside of the target OS
environment. Thus, there are no in-guest software compo-
nents vulnerable to detection, and there are no shortcomings
that arise from incomplete or inaccurate system emulation.
Our experiments are based on our study of obfuscation tech-
niques used to create 25,000 recent malware samples. The
results show that Ether remains transparent and defeats the
obfuscation tools that evade existing approaches.
Categories and Subject Descriptors
D.4.6 [Operating Systems]: Security and Protection—In-
vasive software
General Terms
Security
Keywords
Malware Analysis, Dynamic Analysis, Virtualization, Emu-
lation, Unpacking
Per...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Processor-Level Selective Replication
author:Nithin Nakka and
Karthik Pattabiraman and
Ravishankar K. Iyer
Processor-level Selective Replication
Nithin Nakka, Karthik Pattabiraman, Ravishankar Iyer
Center for Reliable and High Performance Computing
Coordinated Science Laboratory
{nakka, pattabir, iyer}@crhc.uiuc.edu
Abstract
that  only
it  can  be  ensured
We  propose  a  processor-level  technique  called
Selective  Replication,  by  which  the  application  can
choose  where  in  its  application  stream  and  to  what
degree  it  requires  replication.  Recent  work  on  static
analysis  and
fault-injection-based  experiments  on
applications  reveals  that  certain  variables  in  the
application  are  critical  to  its  crash-  and  hang-free
execution.  If
the
computation  of  these  variables  is  error-free,  then  a
high  degree  of  crash/hang  coverage  can  be  achieved
at a low performance overhead to the application. The
Selective  Replication  technique  provides  an  ideal
platform  for  validating  this  claim.  The  technique  is
compared against complete duplication as provided in
current architecture-level techniques. The results show
that  with  about  59%
full
duplication,  selective  replication  detects  97%  of  the
data  errors  and  87%  of  the  instruction  errors  that
were  covered  by  full  duplication.  It  also  reduces  the
detection of errors benign to the final outcome of the
application by 17.8% as compared to full duplication.
less  overhead
Keywords:  Application-aware,  Error  Detection,
Redundant Hardware, Critical Variable, Duplication.
1. Introduction
than
The
System-level  replication  has  been  widely  used  to
detect  and  possibly  tolerate  transient  errors  in  both
commercial systems and research prototypes. Recently,
processor-level  replication  has  emerged  as  a  viable
technique [1].
redundancy  and
two  basic  approaches  for  processor-level
replication  ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Processor-Level Selective Replication
author:Nithin Nakka and
Karthik Pattabiraman and
Ravishankar K. Iyer
Processor-level Selective Replication
Nithin Nakka, Karthik Pattabiraman, Ravishankar Iyer
Center for Reliable and High Performance Computing
Coordinated Science Laboratory
{nakka, pattabir, iyer}@crhc.uiuc.edu
Abstract
that  only
it  can  be  ensured
We  propose  a  processor-level  technique  called
Selective  Replication,  by  which  the  application  can
choose  where  in  its  application  stream  and  to  what
degree  it  requires  replication.  Recent  work  on  static
analysis  and
fault-injection-based  experiments  on
applications  reveals  that  certain  variables  in  the
application  are  critical  to  its  crash-  and  hang-free
execution.  If
the
computation  of  these  variables  is  error-free,  then  a
high  degree  of  crash/hang  coverage  can  be  achieved
at a low performance overhead to the application. The
Selective  Replication  technique  provides  an  ideal
platform  for  validating  this  claim.  The  technique  is
compared against complete duplication as provided in
current architecture-level techniques. The results show
that  with  about  59%
full
duplication,  selective  replication  detects  97%  of  the
data  errors  and  87%  of  the  instruction  errors  that
were  covered  by  full  duplication.  It  also  reduces  the
detection of errors benign to the final outcome of the
application by 17.8% as compared to full duplication.
less  overhead
Keywords:  Application-aware,  Error  Detection,
Redundant Hardware, Critical Variable, Duplication.
1. Introduction
than
The
System-level  replication  has  been  widely  used  to
detect  and  possibly  tolerate  transient  errors  in  both
commercial systems and research prototypes. Recently,
processor-level  replication  has  emerged  as  a  viable
technique [1].
redundancy  and
two  basic  approaches  for  processor-level
replication  ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:EnclavePDP: A General Framework to Verify Data Integrity in Cloud
Using Intel SGX
author:Yun He and
Yihua Xu and
Xiaoqi Jia and
Shengzhi Zhang and
Peng Liu and
Shuai Chang
EnclavePDP: A General Framework to Verify Data Integrity in Cloud
Using Intel SGX
Yun He1,2, Yihua Xu3, Xiaoqi Jia1,2∗
, Shengzhi Zhang3, Peng Liu4, and Shuai Chang1,2
1{CAS-KLONAT†, BKLONSPT‡}, Institute of Information Engineering, Chinese Academy of Sciences
2School of Cyber Security, University of Chinese Academy of Sciences
3Metropolitan College, Boston University
4Pennsylvania State University
Abstract
As the cloud storage service becomes pervasive, verifying the
integrity of their outsourced data on cloud remotely turns out
to be challenging for users. Existing Provable Data Posses-
sion (PDP) schemes mostly resort to a Third Party Auditor
(TPA) to verify the integrity on behalf of users, thus reducing
their communication and computation burden. However, such
schemes demand fully trusted TPA, that is, placing TPA in the
Trusted Computing Base (TCB), which is not always a rea-
sonable assumption. In this paper, we propose EnclavePDP, a
secure and general data integrity veriﬁcation framework that
relies on Intel SGX to establish the TCB for PDP schemes,
thus eliminating the TPA from the TCB. EnclavePDP sup-
ports both new and existing PDP schemes by integrating core
functionalities of cryptography libraries into Intel SGX. We
choose 10 existing representative PDP schemes, and port
them into EnclavePDP with reasonable effort. By deploy-
ing EnclavePDP in a real-world cloud storage platform and
running the 10 PDP schemes respectively, we demonstrate
that EnclavePDP can eliminate the dependence on TPA and
introduce reasonable performance overhead.
1 Introduction
Nowadays, many organizations demand to keep their data
records, and then perform deep analysis over the data us-
ing machine learning or other techniques for their business
purposes. For instance, e-health companies offer optimized
...


Instruction: 总结这篇安全研究的主要观点

Input:
title:EnclavePDP: A General Framework to Verify Data Integrity in Cloud
Using Intel SGX
author:Yun He and
Yihua Xu and
Xiaoqi Jia and
Shengzhi Zhang and
Peng Liu and
Shuai Chang
EnclavePDP: A General Framework to Verify Data Integrity in Cloud
Using Intel SGX
Yun He1,2, Yihua Xu3, Xiaoqi Jia1,2∗
, Shengzhi Zhang3, Peng Liu4, and Shuai Chang1,2
1{CAS-KLONAT†, BKLONSPT‡}, Institute of Information Engineering, Chinese Academy of Sciences
2School of Cyber Security, University of Chinese Academy of Sciences
3Metropolitan College, Boston University
4Pennsylvania State University
Abstract
As the cloud storage service becomes pervasive, verifying the
integrity of their outsourced data on cloud remotely turns out
to be challenging for users. Existing Provable Data Posses-
sion (PDP) schemes mostly resort to a Third Party Auditor
(TPA) to verify the integrity on behalf of users, thus reducing
their communication and computation burden. However, such
schemes demand fully trusted TPA, that is, placing TPA in the
Trusted Computing Base (TCB), which is not always a rea-
sonable assumption. In this paper, we propose EnclavePDP, a
secure and general data integrity veriﬁcation framework that
relies on Intel SGX to establish the TCB for PDP schemes,
thus eliminating the TPA from the TCB. EnclavePDP sup-
ports both new and existing PDP schemes by integrating core
functionalities of cryptography libraries into Intel SGX. We
choose 10 existing representative PDP schemes, and port
them into EnclavePDP with reasonable effort. By deploy-
ing EnclavePDP in a real-world cloud storage platform and
running the 10 PDP schemes respectively, we demonstrate
that EnclavePDP can eliminate the dependence on TPA and
introduce reasonable performance overhead.
1 Introduction
Nowadays, many organizations demand to keep their data
records, and then perform deep analysis over the data us-
ing machine learning or other techniques for their business
purposes. For instance, e-health companies offer optimized
...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:DeTor: Provably Avoiding Geographic Regions in Tor
author:Zhihao Li and
Stephen Herwig and
Dave Levin
DeTor: Provably Avoiding Geographic
Regions in Tor
Zhihao Li, Stephen Herwig, and Dave Levin, University of Maryland
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/li
This paper is included in the Proceedings of the 26th USENIX Security SymposiumAugust 16–18, 2017 • Vancouver, BC, CanadaISBN 978-1-931971-40-9Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIXDeTor: Provably Avoiding Geographic Regions in Tor
Zhihao Li, Stephen Herwig, and Dave Levin
University of Maryland
Abstract
destination [19].
Large, routing-capable adversaries such as nation-
states have the ability to censor and launch powerful
deanonymization attacks against Tor circuits that traverse
their borders. Tor allows users to specify a set of coun-
tries to exclude from circuit selection, but this provides
merely the illusion of control, as it does not preclude
those countries from being on the path between nodes
in a circuit. For instance, we ﬁnd that circuits excluding
US Tor nodes deﬁnitively avoid the US 12% of the time.
This paper presents DeTor, a set of techniques for
proving when a Tor circuit has avoided user-speciﬁed ge-
ographic regions. DeTor extends recent work on using
speed-of-light constraints to prove that a round-trip of
communication physically could not have traversed cer-
tain geographic regions. As such, DeTor does not require
modiﬁcations to the Tor protocol, nor does it require a
map of the Internet’s topology. We show how DeTor can
be used to avoid censors (by never transiting the cen-
sor once) and to avoid timing-based deanonymization
attacks (by never transiting a geographic region twice).
We analyze DeTor’s success at ﬁnding avoidance circuits
through simulation using real latencies from Tor.
1
Introduction
Tor [8] has proven to be an effective tool at providing
anonymous communication ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:DeTor: Provably Avoiding Geographic Regions in Tor
author:Zhihao Li and
Stephen Herwig and
Dave Levin
DeTor: Provably Avoiding Geographic
Regions in Tor
Zhihao Li, Stephen Herwig, and Dave Levin, University of Maryland
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/li
This paper is included in the Proceedings of the 26th USENIX Security SymposiumAugust 16–18, 2017 • Vancouver, BC, CanadaISBN 978-1-931971-40-9Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIXDeTor: Provably Avoiding Geographic Regions in Tor
Zhihao Li, Stephen Herwig, and Dave Levin
University of Maryland
Abstract
destination [19].
Large, routing-capable adversaries such as nation-
states have the ability to censor and launch powerful
deanonymization attacks against Tor circuits that traverse
their borders. Tor allows users to specify a set of coun-
tries to exclude from circuit selection, but this provides
merely the illusion of control, as it does not preclude
those countries from being on the path between nodes
in a circuit. For instance, we ﬁnd that circuits excluding
US Tor nodes deﬁnitively avoid the US 12% of the time.
This paper presents DeTor, a set of techniques for
proving when a Tor circuit has avoided user-speciﬁed ge-
ographic regions. DeTor extends recent work on using
speed-of-light constraints to prove that a round-trip of
communication physically could not have traversed cer-
tain geographic regions. As such, DeTor does not require
modiﬁcations to the Tor protocol, nor does it require a
map of the Internet’s topology. We show how DeTor can
be used to avoid censors (by never transiting the cen-
sor once) and to avoid timing-based deanonymization
attacks (by never transiting a geographic region twice).
We analyze DeTor’s success at ﬁnding avoidance circuits
through simulation using real latencies from Tor.
1
Introduction
Tor [8] has proven to be an effective tool at providing
anonymous communication ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Measuring the state of ECN readiness in servers, clients, and routers
author:Steven J. Bauer and
Robert Beverly and
Arthur W. Berger
Measuring the State of ECN Readiness in Servers, Clients,
and Routers
Steven Bauer
MIT CSAIL
bauer@mit.edu
Robert Beverly
Naval Postgraduate School
rbeverly@nps.edu
Arthur Berger
MIT CSAIL / Akamai
awberger@csail.mit.edu
ABSTRACT
Better exposing congestion can improve traﬃc management
in the wide-area, at peering points, among residential broad-
band connections, and in the data center. TCP’s network
utilization and eﬃciency depends on congestion informa-
tion, while recent research proposes economic and policy
models based on congestion. Such motivations have driven
widespread support of Explicit Congestion Notiﬁcation (ECN)
in modern operating systems. We reappraise the Internet’s
ECN readiness, updating and extending previous measure-
ments. Across large and diverse server populations, we ﬁnd
a three-fold increase in ECN support over prior studies. Us-
ing new methods, we characterize ECN within mobile infras-
tructure and at the client-side, populations previously un-
measured. Via large-scale path measurements, we ﬁnd the
ECN feedback loop failing in the core of the network 40% of
the time, typically at AS boundaries. Finally, we discover
new examples of infrastructure violating ECN Internet stan-
dards, and discuss remaining impediments to running ECN
while suggesting mechanisms to aid adoption.
Categories and Subject Descriptors
C.2.3 [Computer Communication Networks]: Network
Operations—network monitoring; C.2.1 [Computer Com-
munication Networks]: Network Architecture and Design
General Terms
ECN, Measurement, Experimentation
Keywords
Explicit Congestion Notiﬁcation, Router-Assisted Conges-
tion Control
1.
INTRODUCTION
The Internet’s traditional end-to-end approach to conges-
tion control, TCP, attempts to simultaneously optimize ef-
ﬁciency and fairness between traﬃc ﬂows[14]. Cooperating
end host TCPs must infer conges...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Measuring the state of ECN readiness in servers, clients, and routers
author:Steven J. Bauer and
Robert Beverly and
Arthur W. Berger
Measuring the State of ECN Readiness in Servers, Clients,
and Routers
Steven Bauer
MIT CSAIL
bauer@mit.edu
Robert Beverly
Naval Postgraduate School
rbeverly@nps.edu
Arthur Berger
MIT CSAIL / Akamai
awberger@csail.mit.edu
ABSTRACT
Better exposing congestion can improve traﬃc management
in the wide-area, at peering points, among residential broad-
band connections, and in the data center. TCP’s network
utilization and eﬃciency depends on congestion informa-
tion, while recent research proposes economic and policy
models based on congestion. Such motivations have driven
widespread support of Explicit Congestion Notiﬁcation (ECN)
in modern operating systems. We reappraise the Internet’s
ECN readiness, updating and extending previous measure-
ments. Across large and diverse server populations, we ﬁnd
a three-fold increase in ECN support over prior studies. Us-
ing new methods, we characterize ECN within mobile infras-
tructure and at the client-side, populations previously un-
measured. Via large-scale path measurements, we ﬁnd the
ECN feedback loop failing in the core of the network 40% of
the time, typically at AS boundaries. Finally, we discover
new examples of infrastructure violating ECN Internet stan-
dards, and discuss remaining impediments to running ECN
while suggesting mechanisms to aid adoption.
Categories and Subject Descriptors
C.2.3 [Computer Communication Networks]: Network
Operations—network monitoring; C.2.1 [Computer Com-
munication Networks]: Network Architecture and Design
General Terms
ECN, Measurement, Experimentation
Keywords
Explicit Congestion Notiﬁcation, Router-Assisted Conges-
tion Control
1.
INTRODUCTION
The Internet’s traditional end-to-end approach to conges-
tion control, TCP, attempts to simultaneously optimize ef-
ﬁciency and fairness between traﬃc ﬂows[14]. Cooperating
end host TCPs must infer conges...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:CIPHERLEAKS: Breaking Constant-time Cryptography on AMD SEV
via the Ciphertext Side Channel
author:Mengyuan Li and
Yinqian Zhang and
Huibo Wang and
Kang Li and
Yueqiang Cheng
CipherLeaks: Breaking Constant-time Cryptography
on AMD SEV via the Ciphertext Side Channel
Mengyuan Li, The Ohio State University; Yinqian Zhang, Southern University
of Science and Technology; Huibo Wang and Kang Li, Baidu Security;
Yueqiang Cheng, NIO Security Research
https://www.usenix.org/conference/usenixsecurity21/presentation/li-mengyuan
This paper is included in the Proceedings of the 30th USENIX Security Symposium.August 11–13, 2021978-1-939133-24-3Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX.CIPHERLEAKS: Breaking Constant-time Cryptography on AMD SEV
via the Ciphertext Side Channel
Mengyuan Li∗
The Ohio State University
Yinqian Zhang† (cid:66)
Southern University of Science and Technology
Huibo Wang
Baidu Security
Kang Li
Baidu Security
Yueqiang Cheng‡
NIO Security Research
Abstract
AMD’s Secure Encrypted Virtualization (SEV) is a hard-
ware extension available in AMD’s EPYC server processors
to support conﬁdential cloud computing. While various prior
studies have demonstrated attacks against SEV by exploiting
its lack of encryption in the VM control block or the lack of
integrity protection of the encrypted memory and nested page
tables, these issues have been addressed in the subsequent
releases of SEV-Encrypted State (SEV-ES) and SEV-Secure
Nested Paging (SEV-SNP).
In this paper, we study a previously unexplored vulner-
ability of SEV, including both SEV-ES and SEV-SNP. The
vulnerability is dubbed ciphertext side channels, which allows
the privileged adversary to infer the guest VM’s execution
states or recover certain plaintext. To demonstrate the sever-
ity of the vulnerability, we present the CIPHERLEAKS attack,
which exploits the ciphertext side channel to steal private keys
from the constant-time implementation of the R...


Instruction: 总结这篇安全研究的主要观点

Input:
title:CIPHERLEAKS: Breaking Constant-time Cryptography on AMD SEV
via the Ciphertext Side Channel
author:Mengyuan Li and
Yinqian Zhang and
Huibo Wang and
Kang Li and
Yueqiang Cheng
CipherLeaks: Breaking Constant-time Cryptography
on AMD SEV via the Ciphertext Side Channel
Mengyuan Li, The Ohio State University; Yinqian Zhang, Southern University
of Science and Technology; Huibo Wang and Kang Li, Baidu Security;
Yueqiang Cheng, NIO Security Research
https://www.usenix.org/conference/usenixsecurity21/presentation/li-mengyuan
This paper is included in the Proceedings of the 30th USENIX Security Symposium.August 11–13, 2021978-1-939133-24-3Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX.CIPHERLEAKS: Breaking Constant-time Cryptography on AMD SEV
via the Ciphertext Side Channel
Mengyuan Li∗
The Ohio State University
Yinqian Zhang† (cid:66)
Southern University of Science and Technology
Huibo Wang
Baidu Security
Kang Li
Baidu Security
Yueqiang Cheng‡
NIO Security Research
Abstract
AMD’s Secure Encrypted Virtualization (SEV) is a hard-
ware extension available in AMD’s EPYC server processors
to support conﬁdential cloud computing. While various prior
studies have demonstrated attacks against SEV by exploiting
its lack of encryption in the VM control block or the lack of
integrity protection of the encrypted memory and nested page
tables, these issues have been addressed in the subsequent
releases of SEV-Encrypted State (SEV-ES) and SEV-Secure
Nested Paging (SEV-SNP).
In this paper, we study a previously unexplored vulner-
ability of SEV, including both SEV-ES and SEV-SNP. The
vulnerability is dubbed ciphertext side channels, which allows
the privileged adversary to infer the guest VM’s execution
states or recover certain plaintext. To demonstrate the sever-
ity of the vulnerability, we present the CIPHERLEAKS attack,
which exploits the ciphertext side channel to steal private keys
from the constant-time implementation of the R...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Comprehensive shellcode detection using runtime heuristics
author:Michalis Polychronakis and
Kostas G. Anagnostakis and
Evangelos P. Markatos
Comprehensive Shellcode Detection using Runtime
Heuristics
Michalis Polychronakis
Columbia University, USA
mikepo@cs.columbia.edu
Kostas G. Anagnostakis
Niometrics, Singapore
kostas@niometrics.com
Evangelos P. Markatos
FORTH-ICS, Greece
markatos@ics.forth.gr
ABSTRACT
A promising method for the detection of previously unknown code
injection attacks is the identiﬁcation of the shellcode that is part of
the attack vector using payload execution. Existing systems based
on this approach rely on the self-decrypting behavior of polymor-
phic code and can identify only that particular class of shellcode.
Plain, and more importantly, metamorphic shellcode do not carry
a decryption routine nor exhibit any self-modiﬁcations and thus
both evade existing detection systems.
In this paper, we present
a comprehensive shellcode detection technique that uses a set of
runtime heuristics to identify the presence of shellcode in arbitrary
data streams. We have identiﬁed fundamental machine-level oper-
ations that are inescapably performed by different shellcode types,
based on which we have designed heuristics that enable the detec-
tion of plain and metamorphic shellcode regardless of the use of
self-decryption. We have implemented our technique in Gene, a
code injection attack detection system based on passive network
monitoring. Our experimental evaluation and real-world deploy-
ment show that Gene can effectively detect a large and diverse set
of shellcode samples that are currently missed by existing detec-
tors, while so far it has not generated any false positives.
Categories and Subject Descriptors
K.6.5 [Security and Protection]: Invasive software
General Terms
Security
Keywords
Shellcode Detection, Payload Execution, Code Emulation
1.
INTRODUCTION
Code injection attacks have become one of the primary meth-
ods of malware spreading....


Instruction: 总结这篇安全研究的主要观点

Input:
title:Comprehensive shellcode detection using runtime heuristics
author:Michalis Polychronakis and
Kostas G. Anagnostakis and
Evangelos P. Markatos
Comprehensive Shellcode Detection using Runtime
Heuristics
Michalis Polychronakis
Columbia University, USA
mikepo@cs.columbia.edu
Kostas G. Anagnostakis
Niometrics, Singapore
kostas@niometrics.com
Evangelos P. Markatos
FORTH-ICS, Greece
markatos@ics.forth.gr
ABSTRACT
A promising method for the detection of previously unknown code
injection attacks is the identiﬁcation of the shellcode that is part of
the attack vector using payload execution. Existing systems based
on this approach rely on the self-decrypting behavior of polymor-
phic code and can identify only that particular class of shellcode.
Plain, and more importantly, metamorphic shellcode do not carry
a decryption routine nor exhibit any self-modiﬁcations and thus
both evade existing detection systems.
In this paper, we present
a comprehensive shellcode detection technique that uses a set of
runtime heuristics to identify the presence of shellcode in arbitrary
data streams. We have identiﬁed fundamental machine-level oper-
ations that are inescapably performed by different shellcode types,
based on which we have designed heuristics that enable the detec-
tion of plain and metamorphic shellcode regardless of the use of
self-decryption. We have implemented our technique in Gene, a
code injection attack detection system based on passive network
monitoring. Our experimental evaluation and real-world deploy-
ment show that Gene can effectively detect a large and diverse set
of shellcode samples that are currently missed by existing detec-
tors, while so far it has not generated any false positives.
Categories and Subject Descriptors
K.6.5 [Security and Protection]: Invasive software
General Terms
Security
Keywords
Shellcode Detection, Payload Execution, Code Emulation
1.
INTRODUCTION
Code injection attacks have become one of the primary meth-
ods of malware spreading....

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:SRFuzzer: an automatic fuzzing framework for physical SOHO router
devices to discover multi-type vulnerabilities
author:Yu Zhang and
Wei Huo and
Kunpeng Jian and
Ji Shi and
Haoliang Lu and
Longquan Liu and
Chen Wang and
Dandan Sun and
Chao Zhang and
Baoxu Liu
SRFuzzer: An Automatic Fuzzing Framework for
Physical SOHO Router Devices to Discover Multi-
Type Vulnerabilities
{Yu Zhang, Wei Huo, Kunpeng Jian, Ji Shi, Haoliang Lu, Longquan Liu, Chen Wang,
Dandan Sun} 1,2, Chao Zhang3, Baoxu Liu1,2
Institute of Information Engineering, Chinese Academy of Sciences1
School of Cyber Security, University of Chinese Academy of Sciences2
Institute for Network Science and Cyberspace, Tsinghua University3
1
ØSecurity of the SOHO Router is
ØHow to Find the Vulnerability
ØChallenge of Fuzzing the SOHO
Router
Outline
Introduction
Important
Example—— NTP configuration
SRFuzzer——Our Solution
ØSeed Generation
ØSeed Mutation
ØExceptional Behavior Triggering
and Monitoring
ØPower Control
Evaluation
ØExperiment Overview
ØAnalysis of Issues
ØPerformance of Monitors
ØComparison with Popular
Fuzzers
Discussion
Summary
Q&A
2
Security of the SOHO Router is Important
SOHO routers are in prominent position
in nowadays life.
SOHO routers are one of the essential
exploiting targets by adversaries.
ØVPNFilter infected at least 500,000 devices in
at least 54 countries [1]
ØSmart phone, personal computer, camera,
printer, etc
3
Find Vulnerabilities in Routers
Fuzzing is popular in discovering vulnerabilities of IoT devices
Technique
Technique
Emulation
Multi-Type
Vulnerability
Zero-Day
Detection
Coverage-guide
Andrei Costin et al.
Static and Dynamic
Analysis
YES
YES
YES
NO
FIRMADYNE
PoC
YES
NO
NO
NO
IoTFuzzer
Blackbox Fuzzing Blackbox Fuzzing Greybox Fuzzing
Muench et al.
FIRM-AFL
NO
NO
YES
NO
YES
NO
NO
NO
YES
NO
YES
YES
4
Challenge of Fuzzing the SOHO Router
Generator
Initial Seeds
2. How to fuzz dedicated systems?
•  obtain code coverage without emulation is diffcult
•  while emulation...


Instruction: 总结这篇安全研究的主要观点

Input:
title:SRFuzzer: an automatic fuzzing framework for physical SOHO router
devices to discover multi-type vulnerabilities
author:Yu Zhang and
Wei Huo and
Kunpeng Jian and
Ji Shi and
Haoliang Lu and
Longquan Liu and
Chen Wang and
Dandan Sun and
Chao Zhang and
Baoxu Liu
SRFuzzer: An Automatic Fuzzing Framework for
Physical SOHO Router Devices to Discover Multi-
Type Vulnerabilities
{Yu Zhang, Wei Huo, Kunpeng Jian, Ji Shi, Haoliang Lu, Longquan Liu, Chen Wang,
Dandan Sun} 1,2, Chao Zhang3, Baoxu Liu1,2
Institute of Information Engineering, Chinese Academy of Sciences1
School of Cyber Security, University of Chinese Academy of Sciences2
Institute for Network Science and Cyberspace, Tsinghua University3
1
ØSecurity of the SOHO Router is
ØHow to Find the Vulnerability
ØChallenge of Fuzzing the SOHO
Router
Outline
Introduction
Important
Example—— NTP configuration
SRFuzzer——Our Solution
ØSeed Generation
ØSeed Mutation
ØExceptional Behavior Triggering
and Monitoring
ØPower Control
Evaluation
ØExperiment Overview
ØAnalysis of Issues
ØPerformance of Monitors
ØComparison with Popular
Fuzzers
Discussion
Summary
Q&A
2
Security of the SOHO Router is Important
SOHO routers are in prominent position
in nowadays life.
SOHO routers are one of the essential
exploiting targets by adversaries.
ØVPNFilter infected at least 500,000 devices in
at least 54 countries [1]
ØSmart phone, personal computer, camera,
printer, etc
3
Find Vulnerabilities in Routers
Fuzzing is popular in discovering vulnerabilities of IoT devices
Technique
Technique
Emulation
Multi-Type
Vulnerability
Zero-Day
Detection
Coverage-guide
Andrei Costin et al.
Static and Dynamic
Analysis
YES
YES
YES
NO
FIRMADYNE
PoC
YES
NO
NO
NO
IoTFuzzer
Blackbox Fuzzing Blackbox Fuzzing Greybox Fuzzing
Muench et al.
FIRM-AFL
NO
NO
YES
NO
YES
NO
NO
NO
YES
NO
YES
YES
4
Challenge of Fuzzing the SOHO Router
Generator
Initial Seeds
2. How to fuzz dedicated systems?
•  obtain code coverage without emulation is diffcult
•  while emulation...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:SIRAJ: A Unified Framework for Aggregation of Malicious Entity
Detectors
author:Saravanan Thirumuruganathan and
Mohamed Nabeel and
Euijin Choo and
Issa Khalil and
Ting Yu
5
2
7
3
3
8
9
.
2
2
0
2
.
4
1
2
6
4
P
S
/
9
0
1
1
.
0
1
:
I
O
D
|
E
E
E
I
2
2
0
2
©
0
0
.
1
3
$
/
2
2
/
9
-
6
1
3
1
-
4
5
6
6
-
1
-
8
7
9
|
)
P
S
(
y
c
a
v
i
r
P
d
n
a
y
t
i
r
u
c
e
S
n
o
m
u
i
s
o
p
m
y
S
E
E
E
I
2
2
0
2
2022 IEEE Symposium on Security and Privacy (SP)
SIRAJ: A Uniﬁed Framework for Aggregation of
Malicious Entity Detectors
Saravanan Thirumuruganathan, Mohamed Nabeel, Euijin Choo, Issa Khalil, Ting Yu
Qatar Computing Research Institute
{sthirumuruganathan,mnabeel,echoo,ikhalil,tyu}@hbku.edu.qa
Abstract—High-quality intelligence of Internet threat (e.g.,
malware ﬁles, malicious domains, phishing URLs and malicious
IPs) are important
for both security practitioners and the
research community. Given the agility of attackers, the scale
of the Internet, and the fast-evolving landscape of threats, one
could not rely solely on a single source (such as an anti-malware
engine or an IP blacklist) for obtaining accurate, up-to-date,
and comprehensive threat analysis. Instead, we need to aggregate
the analysis from multiple sources. However, it is non-trivial to
do such aggregation effectively. A common practice is to label
an indicator (malware, domains, URLs, etc.) as malicious if it
is marked by a number of sources above an ad-hoc certain
threshold. Often, this results in sub-optimal performance as
it assumes that all sources are of similar quality/expertise,
independent, and temporally stable, which unfortunately are
often not true in practice. A natural alternative is to train
a supervised machine learning model. However, this approach
needs a sufﬁciently large amount of manually labeled ground
truth, which is time-consuming to collect and has to be updated
frequently, resulting in substantial recurring costs.
In this paper, we propose SIRAJ, a novel framework for
aggregating the de...


Instruction: 总结这篇安全研究的主要观点

Input:
title:SIRAJ: A Unified Framework for Aggregation of Malicious Entity
Detectors
author:Saravanan Thirumuruganathan and
Mohamed Nabeel and
Euijin Choo and
Issa Khalil and
Ting Yu
5
2
7
3
3
8
9
.
2
2
0
2
.
4
1
2
6
4
P
S
/
9
0
1
1
.
0
1
:
I
O
D
|
E
E
E
I
2
2
0
2
©
0
0
.
1
3
$
/
2
2
/
9
-
6
1
3
1
-
4
5
6
6
-
1
-
8
7
9
|
)
P
S
(
y
c
a
v
i
r
P
d
n
a
y
t
i
r
u
c
e
S
n
o
m
u
i
s
o
p
m
y
S
E
E
E
I
2
2
0
2
2022 IEEE Symposium on Security and Privacy (SP)
SIRAJ: A Uniﬁed Framework for Aggregation of
Malicious Entity Detectors
Saravanan Thirumuruganathan, Mohamed Nabeel, Euijin Choo, Issa Khalil, Ting Yu
Qatar Computing Research Institute
{sthirumuruganathan,mnabeel,echoo,ikhalil,tyu}@hbku.edu.qa
Abstract—High-quality intelligence of Internet threat (e.g.,
malware ﬁles, malicious domains, phishing URLs and malicious
IPs) are important
for both security practitioners and the
research community. Given the agility of attackers, the scale
of the Internet, and the fast-evolving landscape of threats, one
could not rely solely on a single source (such as an anti-malware
engine or an IP blacklist) for obtaining accurate, up-to-date,
and comprehensive threat analysis. Instead, we need to aggregate
the analysis from multiple sources. However, it is non-trivial to
do such aggregation effectively. A common practice is to label
an indicator (malware, domains, URLs, etc.) as malicious if it
is marked by a number of sources above an ad-hoc certain
threshold. Often, this results in sub-optimal performance as
it assumes that all sources are of similar quality/expertise,
independent, and temporally stable, which unfortunately are
often not true in practice. A natural alternative is to train
a supervised machine learning model. However, this approach
needs a sufﬁciently large amount of manually labeled ground
truth, which is time-consuming to collect and has to be updated
frequently, resulting in substantial recurring costs.
In this paper, we propose SIRAJ, a novel framework for
aggregating the de...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:The most dangerous code in the world: validating SSL certificates
in non-browser software
author:Martin Georgiev and
Subodh Iyengar and
Suman Jana and
Rishita Anubhai and
Dan Boneh and
Vitaly Shmatikov
The Most Dangerous Code in the World:
Validating SSL Certiﬁcates in Non-Browser Software
Martin Georgiev
The University of Texas
at Austin
Rishita Anubhai
Stanford University
Subodh Iyengar
Stanford University
Dan Boneh
Stanford University
Suman Jana
The University of Texas
at Austin
Vitaly Shmatikov
The University of Texas
at Austin
ABSTRACT
SSL (Secure Sockets Layer) is the de facto standard for secure In-
ternet communications. Security of SSL connections against an
active network attacker depends on correctly validating public-key
certiﬁcates presented when the connection is established.
We demonstrate that SSL certiﬁcate validation is completely bro-
ken in many security-critical applications and libraries. Vulnerable
software includes Amazon’s EC2 Java library and all cloud clients
based on it; Amazon’s and PayPal’s merchant SDKs responsible
for transmitting payment details from e-commerce sites to payment
gateways; integrated shopping carts such as osCommerce, ZenCart,
Ubercart, and PrestaShop; AdMob code used by mobile websites;
Chase mobile banking and several other Android apps and libraries;
Java Web-services middleware—including Apache Axis, Axis 2,
Codehaus XFire, and Pusher library for Android—and all applica-
tions employing this middleware. Any SSL connection from any of
these programs is insecure against a man-in-the-middle attack.
The root causes of these vulnerabilities are badly designed APIs
of SSL implementations (such as JSSE, OpenSSL, and GnuTLS)
and data-transport libraries (such as cURL) which present devel-
opers with a confusing array of settings and options. We analyze
perils and pitfalls of SSL certiﬁcate validation in software based on
these APIs and present our recommendations.
Categories and Subject Descriptors
C.2.0 [Computer-Co...


Instruction: 总结这篇安全研究的主要观点

Input:
title:The most dangerous code in the world: validating SSL certificates
in non-browser software
author:Martin Georgiev and
Subodh Iyengar and
Suman Jana and
Rishita Anubhai and
Dan Boneh and
Vitaly Shmatikov
The Most Dangerous Code in the World:
Validating SSL Certiﬁcates in Non-Browser Software
Martin Georgiev
The University of Texas
at Austin
Rishita Anubhai
Stanford University
Subodh Iyengar
Stanford University
Dan Boneh
Stanford University
Suman Jana
The University of Texas
at Austin
Vitaly Shmatikov
The University of Texas
at Austin
ABSTRACT
SSL (Secure Sockets Layer) is the de facto standard for secure In-
ternet communications. Security of SSL connections against an
active network attacker depends on correctly validating public-key
certiﬁcates presented when the connection is established.
We demonstrate that SSL certiﬁcate validation is completely bro-
ken in many security-critical applications and libraries. Vulnerable
software includes Amazon’s EC2 Java library and all cloud clients
based on it; Amazon’s and PayPal’s merchant SDKs responsible
for transmitting payment details from e-commerce sites to payment
gateways; integrated shopping carts such as osCommerce, ZenCart,
Ubercart, and PrestaShop; AdMob code used by mobile websites;
Chase mobile banking and several other Android apps and libraries;
Java Web-services middleware—including Apache Axis, Axis 2,
Codehaus XFire, and Pusher library for Android—and all applica-
tions employing this middleware. Any SSL connection from any of
these programs is insecure against a man-in-the-middle attack.
The root causes of these vulnerabilities are badly designed APIs
of SSL implementations (such as JSSE, OpenSSL, and GnuTLS)
and data-transport libraries (such as cURL) which present devel-
opers with a confusing array of settings and options. We analyze
perils and pitfalls of SSL certiﬁcate validation in software based on
these APIs and present our recommendations.
Categories and Subject Descriptors
C.2.0 [Computer-Co...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Greystar: Fast and Accurate Detection of SMS Spam Numbers in Large
Cellular Networks Using Gray Phone Space
author:Nan Jiang and
Yu Jin and
Ann Skudlark and
Zhi-Li Zhang
Greystar: Fast and Accurate Detection of
SMS Spam Numbers in Large Cellular Networks
using Grey Phone Space
Nan Jiang, University of Minnesota; Yu Jin and Ann Skudlark, AT&T Labs;
Zhi-Li Zhang, University of Minnesota
Open access to the Proceedings of the 22nd USENIX Security Symposium is sponsored by USENIXThis paper is included in the Proceedings of the 22nd USENIX Security Symposium.August 14–16, 2013 • Washington, D.C., USAISBN 978-1-931971-03-4Greystar: Fast and Accurate Detection of SMS Spam Numbers in Large
Cellular Networks using Grey Phone Space
Nan Jiang
University of Minnesota
Yu Jin
AT&T Labs
Ann Skudlark
AT&T Labs
Zhi-Li Zhang
University of Minnesota
Abstract
In this paper, we present the design of Greystar, an inno-
vative defense system for combating the growing SMS
spam trafﬁc in cellular networks. By exploiting the fact
that most SMS spammers select targets randomly from
the ﬁnite phone number space, Greystar monitors phone
numbers from the grey phone space (which are associ-
ated with data only devices like laptop data cards and
machine-to-machine communication devices like elec-
tricity meters) and employs a novel statistical model to
detect spam numbers based on their footprints on the
grey phone space. Evaluation using ﬁve month SMS
call detail records from a large US cellular carrier shows
that Greystar can detect thousands of spam numbers each
month with very few false alarms and 15% of the de-
tected spam numbers have never been reported by spam
recipients. Moreover, Greystar is much faster in detect-
ing SMS spam than existing victim spam reports, reduc-
ing spam trafﬁc by 75% during peak hours.
1 Introduction
The explosion of mobile devices in the past decade has
brought with it an onslaught of unwanted SMS (Short
Message Service) spam [1].
It has been reported t...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Greystar: Fast and Accurate Detection of SMS Spam Numbers in Large
Cellular Networks Using Gray Phone Space
author:Nan Jiang and
Yu Jin and
Ann Skudlark and
Zhi-Li Zhang
Greystar: Fast and Accurate Detection of
SMS Spam Numbers in Large Cellular Networks
using Grey Phone Space
Nan Jiang, University of Minnesota; Yu Jin and Ann Skudlark, AT&T Labs;
Zhi-Li Zhang, University of Minnesota
Open access to the Proceedings of the 22nd USENIX Security Symposium is sponsored by USENIXThis paper is included in the Proceedings of the 22nd USENIX Security Symposium.August 14–16, 2013 • Washington, D.C., USAISBN 978-1-931971-03-4Greystar: Fast and Accurate Detection of SMS Spam Numbers in Large
Cellular Networks using Grey Phone Space
Nan Jiang
University of Minnesota
Yu Jin
AT&T Labs
Ann Skudlark
AT&T Labs
Zhi-Li Zhang
University of Minnesota
Abstract
In this paper, we present the design of Greystar, an inno-
vative defense system for combating the growing SMS
spam trafﬁc in cellular networks. By exploiting the fact
that most SMS spammers select targets randomly from
the ﬁnite phone number space, Greystar monitors phone
numbers from the grey phone space (which are associ-
ated with data only devices like laptop data cards and
machine-to-machine communication devices like elec-
tricity meters) and employs a novel statistical model to
detect spam numbers based on their footprints on the
grey phone space. Evaluation using ﬁve month SMS
call detail records from a large US cellular carrier shows
that Greystar can detect thousands of spam numbers each
month with very few false alarms and 15% of the de-
tected spam numbers have never been reported by spam
recipients. Moreover, Greystar is much faster in detect-
ing SMS spam than existing victim spam reports, reduc-
ing spam trafﬁc by 75% during peak hours.
1 Introduction
The explosion of mobile devices in the past decade has
brought with it an onslaught of unwanted SMS (Short
Message Service) spam [1].
It has been reported t...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:WebWitness: Investigating, Categorizing, and Mitigating Malware Download
Paths
author:Terry Nelms and
Roberto Perdisci and
Manos Antonakakis and
Mustaque Ahamad
WebWitness: Investigating, Categorizing, and
Mitigating Malware Download Paths
Terry Nelms, Damballa, Inc. and Georgia Institute of Technology; Roberto Perdisci,
University of Georgia and Georgia Institute of Technology; Manos Antonakakis,
Georgia Institute of Technology; Mustaque Ahamad, Georgia Institute of Technology
and New York University Abu Dhabi
https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/nelms
This paper is included in the Proceedings of the
24th USENIX Security Symposium
August 12–14, 2015 • Washington, D.C.
ISBN  978-1-939133-11-3
Open access to the Proceedings of  the 24th USENIX Security Symposium is sponsored by USENIXWebWitness: Investigating, Categorizing, and Mitigating
Malware Download Paths
Terry Nelms1,2, Roberto Perdisci3,2, Manos Antonakakis2, and Mustaque Ahamad2,4
1Damballa, Inc.
4New York University Abu Dhabi
2Georgia Institute of Technology
3University of Georgia
tnelms@damballa.com, perdisci@cs.uga.edu, manos@gatech.edu, mustaq@cc.gatech.edu
Abstract
Most modern malware download attacks occur via the
browser, typically due to social engineering and drive-
by downloads.
In this paper, we study the “origin” of
malware download attacks experienced by real network
users, with the objective of improving malware down-
load defenses. Speciﬁcally, we study the web paths fol-
lowed by users who eventually fall victim to different
types of malware downloads. To this end, we propose a
novel incident investigation system, named WebWitness.
Our system targets two main goals: 1) automatically
trace back and label the sequence of events (e.g., visited
web pages) preceding malware downloads, to highlight
how users reach attack pages on the web; and 2) leverage
these automatically labeled in-the-wild malware down-
load paths to better understand ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:WebWitness: Investigating, Categorizing, and Mitigating Malware Download
Paths
author:Terry Nelms and
Roberto Perdisci and
Manos Antonakakis and
Mustaque Ahamad
WebWitness: Investigating, Categorizing, and
Mitigating Malware Download Paths
Terry Nelms, Damballa, Inc. and Georgia Institute of Technology; Roberto Perdisci,
University of Georgia and Georgia Institute of Technology; Manos Antonakakis,
Georgia Institute of Technology; Mustaque Ahamad, Georgia Institute of Technology
and New York University Abu Dhabi
https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/nelms
This paper is included in the Proceedings of the
24th USENIX Security Symposium
August 12–14, 2015 • Washington, D.C.
ISBN  978-1-939133-11-3
Open access to the Proceedings of  the 24th USENIX Security Symposium is sponsored by USENIXWebWitness: Investigating, Categorizing, and Mitigating
Malware Download Paths
Terry Nelms1,2, Roberto Perdisci3,2, Manos Antonakakis2, and Mustaque Ahamad2,4
1Damballa, Inc.
4New York University Abu Dhabi
2Georgia Institute of Technology
3University of Georgia
tnelms@damballa.com, perdisci@cs.uga.edu, manos@gatech.edu, mustaq@cc.gatech.edu
Abstract
Most modern malware download attacks occur via the
browser, typically due to social engineering and drive-
by downloads.
In this paper, we study the “origin” of
malware download attacks experienced by real network
users, with the objective of improving malware down-
load defenses. Speciﬁcally, we study the web paths fol-
lowed by users who eventually fall victim to different
types of malware downloads. To this end, we propose a
novel incident investigation system, named WebWitness.
Our system targets two main goals: 1) automatically
trace back and label the sequence of events (e.g., visited
web pages) preceding malware downloads, to highlight
how users reach attack pages on the web; and 2) leverage
these automatically labeled in-the-wild malware down-
load paths to better understand ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Characterizing the query behavior in peer-to-peer file sharing systems
author:Alexander Klemm and
Christoph Lindemann and
Mary K. Vernon and
Oliver P. Waldhorst
Characterizing the Query Behavior in
Peer-to-Peer File Sharing Systems*
Alexander Klemma     Christoph Lindemanna     Mary K. Vernonb     Oliver P. Waldhorsta
aUniversity of Dortmund
Department of Computer Science
August-Schmidt-Strasse 12
44227 Dortmund, Germany
http://mobicom.cs.uni-dortmund.de/
bUniversity of Wisconsin - Madison
Department of Computer Sciences
1210 West Dayton Street
Madison, WI 53706, USA
http://www.cs.wisc.edu/~vernon
ABSTRACT
This paper characterizes the query behavior of peers in a peer-to-
peer (P2P) file sharing system. In contrast to previous work, which
provides various aggregate workload statistics, we characterize peer
behavior in a form that can be used for constructing representative
synthetic  workloads  for  evaluating  new  P2P  system  designs.  In
particular, the analysis exposes heterogeneous behavior that occurs
on  different  days,  in  different  geographical  regions  (i.e.,  Asia,
Europe, and North America) or during different periods of the day.
The workload measures include the fraction of connected sessions
that  are  passive  (i.e.,  issue  no  queries),  the  duration  of  such
sessions, and for each active session, the number of queries issued,
time until first query, query interarrival time, time after last query,
and distribution of query popularity. Moreover, the key correlations
in these workload measures are captured in the form of conditional
distributions,  such
the  correlations  can  be  accurately
reproduced in a synthetic workload. The characterization is based
on trace data gathered in the Gnutella P2P system over a period of
40  days.  To  characterize  system-independent  user  behavior,  we
eliminate queries that are specific to the Gnutella system software,
such  as  re-queries  that  are  automatically ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Characterizing the query behavior in peer-to-peer file sharing systems
author:Alexander Klemm and
Christoph Lindemann and
Mary K. Vernon and
Oliver P. Waldhorst
Characterizing the Query Behavior in
Peer-to-Peer File Sharing Systems*
Alexander Klemma     Christoph Lindemanna     Mary K. Vernonb     Oliver P. Waldhorsta
aUniversity of Dortmund
Department of Computer Science
August-Schmidt-Strasse 12
44227 Dortmund, Germany
http://mobicom.cs.uni-dortmund.de/
bUniversity of Wisconsin - Madison
Department of Computer Sciences
1210 West Dayton Street
Madison, WI 53706, USA
http://www.cs.wisc.edu/~vernon
ABSTRACT
This paper characterizes the query behavior of peers in a peer-to-
peer (P2P) file sharing system. In contrast to previous work, which
provides various aggregate workload statistics, we characterize peer
behavior in a form that can be used for constructing representative
synthetic  workloads  for  evaluating  new  P2P  system  designs.  In
particular, the analysis exposes heterogeneous behavior that occurs
on  different  days,  in  different  geographical  regions  (i.e.,  Asia,
Europe, and North America) or during different periods of the day.
The workload measures include the fraction of connected sessions
that  are  passive  (i.e.,  issue  no  queries),  the  duration  of  such
sessions, and for each active session, the number of queries issued,
time until first query, query interarrival time, time after last query,
and distribution of query popularity. Moreover, the key correlations
in these workload measures are captured in the form of conditional
distributions,  such
the  correlations  can  be  accurately
reproduced in a synthetic workload. The characterization is based
on trace data gathered in the Gnutella P2P system over a period of
40  days.  To  characterize  system-independent  user  behavior,  we
eliminate queries that are specific to the Gnutella system software,
such  as  re-queries  that  are  automatically ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Users get routed: traffic correlation on tor by realistic adversaries
author:Aaron Johnson and
Chris Wacek and
Rob Jansen and
Micah Sherr and
Paul F. Syverson
Trafﬁc Correlation on Tor by Realistic Adversaries
Users Get Routed:
Aaron Johnson1
Chris Wacek2
Rob Jansen1 Micah Sherr2
Paul Syverson1
1U.S. Naval Research Laboratory, Washington DC
{aaron.m.johnson, rob.g.jansen, paul.syverson}@nrl.navy.mil
2Georgetown University, Washington DC
{cwacek, msherr}@cs.georgetown.edu
ABSTRACT
We present the ﬁrst analysis of the popular Tor anonymity network
that indicates the security of typical users against reasonably realis-
tic adversaries in the Tor network or in the underlying Internet. Our
results show that Tor users are far more susceptible to compromise
than indicated by prior work. Speciﬁc contributions of the paper
include (1) a model of various typical kinds of users, (2) an adver-
sary model that includes Tor network relays, autonomous systems
(ASes), Internet exchange points (IXPs), and groups of IXPs drawn
from empirical study, (3) metrics that indicate how secure users are
over a period of time, (4) the most accurate topological model to
date of ASes and IXPs as they relate to Tor usage and network con-
ﬁguration, (5) a novel realistic Tor path simulator (TorPS), and (6)
analyses of security making use of all the above. To show that our
approach is useful to explore alternatives and not just Tor as cur-
rently deployed, we also analyze a published alternative path se-
lection algorithm, Congestion-Aware Tor. We create an empirical
model of Tor congestion, identify novel attack vectors, and show
that it too is more vulnerable than previously indicated.
Categories and Subject Descriptors
C.2.0 [Computer-Communication Networks]: General—Secu-
rity and protection
Keywords
Anonymity; metrics; onion routing
1.
INTRODUCTION
Tor is a volunteer-operated anonymity network that is estimated
to protect the privacy of hundreds of thousands of daily users [13,
22]. Howev...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Users get routed: traffic correlation on tor by realistic adversaries
author:Aaron Johnson and
Chris Wacek and
Rob Jansen and
Micah Sherr and
Paul F. Syverson
Trafﬁc Correlation on Tor by Realistic Adversaries
Users Get Routed:
Aaron Johnson1
Chris Wacek2
Rob Jansen1 Micah Sherr2
Paul Syverson1
1U.S. Naval Research Laboratory, Washington DC
{aaron.m.johnson, rob.g.jansen, paul.syverson}@nrl.navy.mil
2Georgetown University, Washington DC
{cwacek, msherr}@cs.georgetown.edu
ABSTRACT
We present the ﬁrst analysis of the popular Tor anonymity network
that indicates the security of typical users against reasonably realis-
tic adversaries in the Tor network or in the underlying Internet. Our
results show that Tor users are far more susceptible to compromise
than indicated by prior work. Speciﬁc contributions of the paper
include (1) a model of various typical kinds of users, (2) an adver-
sary model that includes Tor network relays, autonomous systems
(ASes), Internet exchange points (IXPs), and groups of IXPs drawn
from empirical study, (3) metrics that indicate how secure users are
over a period of time, (4) the most accurate topological model to
date of ASes and IXPs as they relate to Tor usage and network con-
ﬁguration, (5) a novel realistic Tor path simulator (TorPS), and (6)
analyses of security making use of all the above. To show that our
approach is useful to explore alternatives and not just Tor as cur-
rently deployed, we also analyze a published alternative path se-
lection algorithm, Congestion-Aware Tor. We create an empirical
model of Tor congestion, identify novel attack vectors, and show
that it too is more vulnerable than previously indicated.
Categories and Subject Descriptors
C.2.0 [Computer-Communication Networks]: General—Secu-
rity and protection
Keywords
Anonymity; metrics; onion routing
1.
INTRODUCTION
Tor is a volunteer-operated anonymity network that is estimated
to protect the privacy of hundreds of thousands of daily users [13,
22]. Howev...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Hummingbird: Privacy at the Time of Twitter
author:Emiliano De Cristofaro and
Claudio Soriente and
Gene Tsudik and
Andrew Williams
2012 IEEE Symposium on Security and Privacy
Hummingbird: Privacy at the time of Twitter
Emiliano De Cristofaro∗
PARC
edc@parc.com
Claudio Soriente†
ETH Zurich
Gene Tsudik
UC Irvine
Andrew Williams‡
UC Irvine
claudio.soriente@inf.ethz.ch
gene.tsudik@uci.edu
andrewmw@uci.edu
Abstract—In the last several years, micro-blogging Online
Social Networks (OSNs), such as Twitter, have taken the world
by storm, now boasting over 100 million subscribers. As an
unparalleled stage for an enormous audience, they offer fast
and reliable centralized diffusion of pithy tweets to great mul-
titudes of information-hungry and always-connected followers.
At the same time, this information gathering and dissemination
paradigm prompts some important privacy concerns about
relationships between tweeters, followers and interests of the
latter. In this paper, we assess privacy in today’s Twitter-like
OSNs and describe an architecture and a trial implementation
of a privacy-preserving service called Hummingbird. It is
essentially a variant of Twitter that protects tweet contents,
hashtags and follower interests from the (potentially) prying
eyes of the centralized server. We argue that, although in-
herently limited by Twitter’s mission of scalable information-
sharing, this degree of privacy is valuable. We demonstrate, via
a working prototype, that Hummingbird’s additional costs are
tolerably low. We also sketch out some viable enhancements
that might offer better privacy in the long term.
I. INTRODUCTION
Online Social Networks (OSNs) offer multitudes of peo-
ple a means to communicate, share interests, and update
others about their current activities. Social networking ser-
vices are progressively replacing more “traditional” one-
to-one communication systems, such as email and instant
messaging. Alas, as their proliferation increases, so do
privacy concer...