Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Empowering Low-Power Wide Area Networks in Urban Settings
author:Rashad Eletreby and
Diana Zhang and
Swarun Kumar and
Osman Yagan
Empowering Low-Power Wide Area Networks in Urban Settings
Rashad Eletreby
Carnegie Mellon University
Pittsburgh, PA
reletreby@cmu.edu
Swarun Kumar
Carnegie Mellon University
Pittsburgh, PA
swarun@cmu.edu
Diana Zhang
Carnegie Mellon University
Pittsburgh, PA
dianaz1@andrew.cmu.edu
Osman Yağan
Carnegie Mellon University
Pittsburgh, PA
oyagan@andrew.cmu.edu
ABSTRACT
Low-Power Wide Area Networks (LP-WANs) are an attractive
emerging platform to connect the Internet-of-things. LP-WANs
enable low-cost devices with a 10-year battery to communicate
at few kbps to a base station, kilometers away. But deploying LP-
WANs in large urban environments is challenging, given the sheer
density of nodes that causes interference, coupled with attenuation
from buildings that limits signal range. Yet, state-of-the-art tech-
niques to address these limitations demand inordinate hardware
complexity at the base stations or clients, increasing their size and
cost.
This paper presents Choir, a system that overcomes challenges
pertaining to density and range of urban LP-WANs despite the lim-
ited capabilities of base station and client hardware. First, Choir pro-
poses a novel technique that aims to disentangle and decode large
numbers of interfering transmissions at a simple, single-antenna
LP-WAN base station. It does so, perhaps counter-intuitively, by
taking the hardware imperfections of low-cost LP-WAN clients
to its advantage. Second, Choir exploits the correlation of sensed
data collected by LP-WAN nodes to collaboratively reach a far-
away base station, even if individual clients are beyond its range.
We implement and evaluate Choir on USRP N210 base stations
serving a 10 square kilometer area surrounding Carnegie Mellon
University campus. Our results reveal that Choir improves network
throughput of commodity LP-WAN clients by 6.84 × and expands
commun...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Empowering Low-Power Wide Area Networks in Urban Settings
author:Rashad Eletreby and
Diana Zhang and
Swarun Kumar and
Osman Yagan
Empowering Low-Power Wide Area Networks in Urban Settings
Rashad Eletreby
Carnegie Mellon University
Pittsburgh, PA
reletreby@cmu.edu
Swarun Kumar
Carnegie Mellon University
Pittsburgh, PA
swarun@cmu.edu
Diana Zhang
Carnegie Mellon University
Pittsburgh, PA
dianaz1@andrew.cmu.edu
Osman Yağan
Carnegie Mellon University
Pittsburgh, PA
oyagan@andrew.cmu.edu
ABSTRACT
Low-Power Wide Area Networks (LP-WANs) are an attractive
emerging platform to connect the Internet-of-things. LP-WANs
enable low-cost devices with a 10-year battery to communicate
at few kbps to a base station, kilometers away. But deploying LP-
WANs in large urban environments is challenging, given the sheer
density of nodes that causes interference, coupled with attenuation
from buildings that limits signal range. Yet, state-of-the-art tech-
niques to address these limitations demand inordinate hardware
complexity at the base stations or clients, increasing their size and
cost.
This paper presents Choir, a system that overcomes challenges
pertaining to density and range of urban LP-WANs despite the lim-
ited capabilities of base station and client hardware. First, Choir pro-
poses a novel technique that aims to disentangle and decode large
numbers of interfering transmissions at a simple, single-antenna
LP-WAN base station. It does so, perhaps counter-intuitively, by
taking the hardware imperfections of low-cost LP-WAN clients
to its advantage. Second, Choir exploits the correlation of sensed
data collected by LP-WAN nodes to collaboratively reach a far-
away base station, even if individual clients are beyond its range.
We implement and evaluate Choir on USRP N210 base stations
serving a 10 square kilometer area surrounding Carnegie Mellon
University campus. Our results reveal that Choir improves network
throughput of commodity LP-WAN clients by 6.84 × and expands
commun...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Locally Differentially Private Analysis of Graph Statistics
author:Jacob Imola and
Takao Murakami and
Kamalika Chaudhuri
Locally Differentially Private Analysis of
Graph Statistics
Jacob Imola, UC San Diego; Takao Murakami, AIST;
Kamalika Chaudhuri, UC San Diego
https://www.usenix.org/conference/usenixsecurity21/presentation/imola
This paper is included in the Proceedings of the 30th USENIX Security Symposium.August 11–13, 2021978-1-939133-24-3Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX.Locally Differentially Private Analysis of Graph Statistics
Jacob Imola∗
UC San Diego
Takao Murakami∗
AIST
Kamalika Chaudhuri
UC San Diego
Abstract
Differentially private analysis of graphs is widely used for
releasing statistics from sensitive graphs while still preserv-
ing user privacy. Most existing algorithms however are in a
centralized privacy model, where a trusted data curator holds
the entire graph. As this model raises a number of privacy and
security issues – such as, the trustworthiness of the curator
and the possibility of data breaches, it is desirable to consider
algorithms in a more decentralized local model where no
server holds the entire graph.
In this work, we consider a local model, and present al-
gorithms for counting subgraphs – a fundamental task for
analyzing the connection patterns in a graph – with LDP
(Local Differential Privacy). For triangle counts, we present
algorithms that use one and two rounds of interaction, and
show that an additional round can signiﬁcantly improve the
utility. For k-star counts, we present an algorithm that achieves
an order optimal estimation error in the non-interactive lo-
cal model. We provide new lower-bounds on the estimation
error for general graph statistics including triangle counts
and k-star counts. Finally, we perform extensive experiments
on two real datasets, and show that it is indeed possible to
accurately estimate subgraph counts in the local differential...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Locally Differentially Private Analysis of Graph Statistics
author:Jacob Imola and
Takao Murakami and
Kamalika Chaudhuri
Locally Differentially Private Analysis of
Graph Statistics
Jacob Imola, UC San Diego; Takao Murakami, AIST;
Kamalika Chaudhuri, UC San Diego
https://www.usenix.org/conference/usenixsecurity21/presentation/imola
This paper is included in the Proceedings of the 30th USENIX Security Symposium.August 11–13, 2021978-1-939133-24-3Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX.Locally Differentially Private Analysis of Graph Statistics
Jacob Imola∗
UC San Diego
Takao Murakami∗
AIST
Kamalika Chaudhuri
UC San Diego
Abstract
Differentially private analysis of graphs is widely used for
releasing statistics from sensitive graphs while still preserv-
ing user privacy. Most existing algorithms however are in a
centralized privacy model, where a trusted data curator holds
the entire graph. As this model raises a number of privacy and
security issues – such as, the trustworthiness of the curator
and the possibility of data breaches, it is desirable to consider
algorithms in a more decentralized local model where no
server holds the entire graph.
In this work, we consider a local model, and present al-
gorithms for counting subgraphs – a fundamental task for
analyzing the connection patterns in a graph – with LDP
(Local Differential Privacy). For triangle counts, we present
algorithms that use one and two rounds of interaction, and
show that an additional round can signiﬁcantly improve the
utility. For k-star counts, we present an algorithm that achieves
an order optimal estimation error in the non-interactive lo-
cal model. We provide new lower-bounds on the estimation
error for general graph statistics including triangle counts
and k-star counts. Finally, we perform extensive experiments
on two real datasets, and show that it is indeed possible to
accurately estimate subgraph counts in the local differential...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Compiler-Directed Program-Fault Coverage for Highly Available Java
Internet Services
author:Chen Fu and
Richard P. Martin and
Kiran Nagaraja and
Thu D. Nguyen and
Barbara G. Ryder and
David Wonnacott
Compiler-directed Program-fault Coverage
for Highly Available Java Internet Services∗
Chen Fu, Richard P. Martin, Kiran Nagaraja,
Thu D. Nguyen, Barbara G. Ryder
Department of Computer Science
Rutgers University, Piscataway, NJ 08854
‡
†
David Wonnacott
Department of Computer Science
Haverford College
Haverford, PA 19041
Abstract: We present a new approach that uses compiler-
directed fault-injection for coverage testing of recovery
code in Internet services to evaluate their robustness to op-
erating system and I/O hardware faults. We deﬁne a set
of program-fault coverage metrics that enable quantiﬁca-
tion of Java catch blocks exercised during fault-injection
experiments. We use compiler analyses to instrument appli-
cation code in two ways: to direct fault injection to occur
at appropriate points during execution, and to measure the
resulting coverage. As a proof of concept for these ideas,
we have applied our techniques manually to Mufﬁn, a proxy
server; we obtained a high degree of coverage of catch
blocks, with, on average, 85% of the expected faults per
catch being experienced as caught exceptions.
1
Introduction
Many different approaches to fault injection have been
developed and studied [10, 11, 17, 20, 28], but in a software
engineering context all these efforts suffer from a funda-
mental limitation. Speciﬁcally, they have led to a proba-
bilistic analysis that describes the likelihood that a program
or software component can deliver correct service under
speciﬁc fault and work loads [3], treating the application as
a black box which only can be tested in terms of its observ-
able behavior in response to inputs. While this probabilistic
reasoning is necessary to produce dependable software, it
is not sufﬁcient for software designers and testers to under...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Compiler-Directed Program-Fault Coverage for Highly Available Java
Internet Services
author:Chen Fu and
Richard P. Martin and
Kiran Nagaraja and
Thu D. Nguyen and
Barbara G. Ryder and
David Wonnacott
Compiler-directed Program-fault Coverage
for Highly Available Java Internet Services∗
Chen Fu, Richard P. Martin, Kiran Nagaraja,
Thu D. Nguyen, Barbara G. Ryder
Department of Computer Science
Rutgers University, Piscataway, NJ 08854
‡
†
David Wonnacott
Department of Computer Science
Haverford College
Haverford, PA 19041
Abstract: We present a new approach that uses compiler-
directed fault-injection for coverage testing of recovery
code in Internet services to evaluate their robustness to op-
erating system and I/O hardware faults. We deﬁne a set
of program-fault coverage metrics that enable quantiﬁca-
tion of Java catch blocks exercised during fault-injection
experiments. We use compiler analyses to instrument appli-
cation code in two ways: to direct fault injection to occur
at appropriate points during execution, and to measure the
resulting coverage. As a proof of concept for these ideas,
we have applied our techniques manually to Mufﬁn, a proxy
server; we obtained a high degree of coverage of catch
blocks, with, on average, 85% of the expected faults per
catch being experienced as caught exceptions.
1
Introduction
Many different approaches to fault injection have been
developed and studied [10, 11, 17, 20, 28], but in a software
engineering context all these efforts suffer from a funda-
mental limitation. Speciﬁcally, they have led to a proba-
bilistic analysis that describes the likelihood that a program
or software component can deliver correct service under
speciﬁc fault and work loads [3], treating the application as
a black box which only can be tested in terms of its observ-
able behavior in response to inputs. While this probabilistic
reasoning is necessary to produce dependable software, it
is not sufﬁcient for software designers and testers to under...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Social Networks Meet Distributed Systems: Towards a Robust Sybil Defense
under Churn
author:Nitin Chiluka and
Nazareno Andrade and
Johan A. Pouwelse and
Henk J. Sips
Social Networks Meet Distributed Systems
Towards a Robust Sybil Defense under Churn
Nitin Chiluka
INRIA Rennes
ﬁrst.last@gmail.com
Nazareno Andrade
UFCG
nazareno@lsd.ufcg.edu.br
Johan Pouwelse
Delft University of Technology
j.a.pouwelse@tudelft.nl
Henk Sips
Delft University of Technology
h.j.sips@tudelft.nl
ABSTRACT
This paper examines the impact of heavy churn on the ro-
bustness of decentralized social network-based Sybil defense
(SNSD) schemes. Our analysis reveals that (i) heavy churn
disintegrates the social overlay network that is fundamental
to these schemes into multiple disconnected components, re-
sulting in poor network connectivity, and (ii) a naive solution
that adds links from each node to all its 2-hop neighbors im-
proves network connectivity but comes at a signiﬁcant cost
of poor attack resilience of these schemes.
We propose a new design point in the trade-oﬀ between
network connectivity and attack resilience of SNSD schemes,
where each node adds links to only a selective few of all its 2-
hop neighbors based on a minimum expansion contribution
(MinEC) heuristic. Extensive evaluation through simula-
tions shows that our approach fares as good as the naive
2-hop solution in terms of network connectivity, while mak-
ing little compromise on the attack resilience. Moreover, our
approach preserves the fast-mixing property that is funda-
mental to many SNSD schemes even at high levels of churn.
This result suggests that existing and potential future SNSD
schemes relying on this property can incorporate our ap-
proach into their designs with minimal changes.
Categories and Subject Descriptors
C.2.0 [Computer-Communication Networks]: General—
Security and protection
Keywords
Social overlay network, Churn, Sybil attack
1.
INTRODUCTION
Security and churn are two key challenges in designin...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Social Networks Meet Distributed Systems: Towards a Robust Sybil Defense
under Churn
author:Nitin Chiluka and
Nazareno Andrade and
Johan A. Pouwelse and
Henk J. Sips
Social Networks Meet Distributed Systems
Towards a Robust Sybil Defense under Churn
Nitin Chiluka
INRIA Rennes
ﬁrst.last@gmail.com
Nazareno Andrade
UFCG
nazareno@lsd.ufcg.edu.br
Johan Pouwelse
Delft University of Technology
j.a.pouwelse@tudelft.nl
Henk Sips
Delft University of Technology
h.j.sips@tudelft.nl
ABSTRACT
This paper examines the impact of heavy churn on the ro-
bustness of decentralized social network-based Sybil defense
(SNSD) schemes. Our analysis reveals that (i) heavy churn
disintegrates the social overlay network that is fundamental
to these schemes into multiple disconnected components, re-
sulting in poor network connectivity, and (ii) a naive solution
that adds links from each node to all its 2-hop neighbors im-
proves network connectivity but comes at a signiﬁcant cost
of poor attack resilience of these schemes.
We propose a new design point in the trade-oﬀ between
network connectivity and attack resilience of SNSD schemes,
where each node adds links to only a selective few of all its 2-
hop neighbors based on a minimum expansion contribution
(MinEC) heuristic. Extensive evaluation through simula-
tions shows that our approach fares as good as the naive
2-hop solution in terms of network connectivity, while mak-
ing little compromise on the attack resilience. Moreover, our
approach preserves the fast-mixing property that is funda-
mental to many SNSD schemes even at high levels of churn.
This result suggests that existing and potential future SNSD
schemes relying on this property can incorporate our ap-
proach into their designs with minimal changes.
Categories and Subject Descriptors
C.2.0 [Computer-Communication Networks]: General—
Security and protection
Keywords
Social overlay network, Churn, Sybil attack
1.
INTRODUCTION
Security and churn are two key challenges in designin...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Leaky DNN: Stealing Deep-Learning Model Secret with GPU Context-Switching
Side-Channel
author:Junyi Wei and
Yicheng Zhang and
Zhe Zhou and
Zhou Li and
Mohammad Abdullah Al Faruque
Leaky DNN: Stealing Deep-learning Model Secret
with GPU Context-switching Side-channel
Junyi Wei∗, Yicheng Zhang†, Zhe Zhou∗, Zhou Li† and Mohammad Abdullah Al Faruque†
∗Fudan University, Email: wjygerald@gmail.com, zhouzhe@fudan.edu.cn
†University of California, Irvine, Email: {yichez16, zhou.li, alfaruqu}@uci.edu
Abstract—Machine learning has been attracting strong inter-
ests in recent years. Numerous companies have invested great
efforts and resources to develop customized deep-learning models,
which are their key intellectual properties. In this work, we
investigate to what extent the secret of deep-learning models can
be inferred by attackers.
In particular, we focus on the scenario that a model developer
and an adversary share the same GPU when training a Deep
Neural Network (DNN) model. We exploit the GPU side-channel
based on context-switching penalties. This side-channel allows us
to extract the ﬁne-grained structural secret of a DNN model,
including its layer composition and hyper-parameters.
Leveraging this side-channel, we developed an attack prototype
named MoSConS, which applies LSTM-based inference models to
identify the structural secret. Our evaluation of MoSConS shows
the structural information can be accurately recovered. There-
fore, we believe new defense mechanisms should be developed to
protect training against the GPU side-channel.
Index Terms—Deep-learning; GPU; Side-channel;
I. INTRODUCTION
In recent years, technologies driven by machine-learning,
especially deep learning, have been gaining strong momentum
from the research community and industry. Those technologies
have shown promises and early success in transforming the
application domains, like computer vision [54] and speech
recognition [64]. Driven by this wave, numerous companies
have been devoting h...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Leaky DNN: Stealing Deep-Learning Model Secret with GPU Context-Switching
Side-Channel
author:Junyi Wei and
Yicheng Zhang and
Zhe Zhou and
Zhou Li and
Mohammad Abdullah Al Faruque
Leaky DNN: Stealing Deep-learning Model Secret
with GPU Context-switching Side-channel
Junyi Wei∗, Yicheng Zhang†, Zhe Zhou∗, Zhou Li† and Mohammad Abdullah Al Faruque†
∗Fudan University, Email: wjygerald@gmail.com, zhouzhe@fudan.edu.cn
†University of California, Irvine, Email: {yichez16, zhou.li, alfaruqu}@uci.edu
Abstract—Machine learning has been attracting strong inter-
ests in recent years. Numerous companies have invested great
efforts and resources to develop customized deep-learning models,
which are their key intellectual properties. In this work, we
investigate to what extent the secret of deep-learning models can
be inferred by attackers.
In particular, we focus on the scenario that a model developer
and an adversary share the same GPU when training a Deep
Neural Network (DNN) model. We exploit the GPU side-channel
based on context-switching penalties. This side-channel allows us
to extract the ﬁne-grained structural secret of a DNN model,
including its layer composition and hyper-parameters.
Leveraging this side-channel, we developed an attack prototype
named MoSConS, which applies LSTM-based inference models to
identify the structural secret. Our evaluation of MoSConS shows
the structural information can be accurately recovered. There-
fore, we believe new defense mechanisms should be developed to
protect training against the GPU side-channel.
Index Terms—Deep-learning; GPU; Side-channel;
I. INTRODUCTION
In recent years, technologies driven by machine-learning,
especially deep learning, have been gaining strong momentum
from the research community and industry. Those technologies
have shown promises and early success in transforming the
application domains, like computer vision [54] and speech
recognition [64]. Driven by this wave, numerous companies
have been devoting h...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:SoK: The Evolution of Sybil Defense via Social Networks
author:Lorenzo Alvisi and
Allen Clement and
Alessandro Epasto and
Silvio Lattanzi and
Alessandro Panconesi
2013 IEEE Symposium on Security and Privacy
SoK: The Evolution of Sybil Defense via Social Networks
Lorenzo Alvisi
Allen Clement
UT Austin
MPI−SWS
Alessandro Epasto
Sapienza, U of Rome
Silvio Lattanzi
Google Inc.
Alessandro Panconesi
Sapienza, U of Rome
Abstract—Sybil attacks in which an adversary forges a
potentially unbounded number of identities are a danger to
distributed systems and online social networks. The goal of
sybil defense is to accurately identify sybil identities.
This paper surveys the evolution of sybil defense protocols
that leverage the structural properties of the social graph
underlying a distributed system to identify sybil identities. We
make two main contributions. First, we clarify the deep con-
nection between sybil defense and the theory of random walks.
This leads us to identify a community detection algorithm that,
for the ﬁrst time, offers provable guarantees in the context of
sybil defense. Second, we advocate a new goal for sybil defense
that addresses the more limited, but practically useful, goal of
securely white-listing a local region of the graph.
I. INTRODUCTION
The possibility that malicious users may forge an un−
bounded number of sybil identities, indistinguishable from
honest ones, is a fundamental threat to distributed systems
that rely on voting [11]. This threat is particularly acute
in decentralized systems, where it may be impractical or
impossible to rely on a single authority to certify which users
are legitimate [20]. The goal of sybil defense is to accurately
identify sybil identities1—“ideally, the system should accept
all legitimate identities but no counterfeit entities” [11]—
but simple techniques can be either too brittle (beating a
CAPTCHA [40] costs a fraction of a cent) or too blunt (IP
ﬁltering penalizes all users behind a NAT).
Against thi...


Instruction: 总结这篇安全研究的主要观点

Input:
title:SoK: The Evolution of Sybil Defense via Social Networks
author:Lorenzo Alvisi and
Allen Clement and
Alessandro Epasto and
Silvio Lattanzi and
Alessandro Panconesi
2013 IEEE Symposium on Security and Privacy
SoK: The Evolution of Sybil Defense via Social Networks
Lorenzo Alvisi
Allen Clement
UT Austin
MPI−SWS
Alessandro Epasto
Sapienza, U of Rome
Silvio Lattanzi
Google Inc.
Alessandro Panconesi
Sapienza, U of Rome
Abstract—Sybil attacks in which an adversary forges a
potentially unbounded number of identities are a danger to
distributed systems and online social networks. The goal of
sybil defense is to accurately identify sybil identities.
This paper surveys the evolution of sybil defense protocols
that leverage the structural properties of the social graph
underlying a distributed system to identify sybil identities. We
make two main contributions. First, we clarify the deep con-
nection between sybil defense and the theory of random walks.
This leads us to identify a community detection algorithm that,
for the ﬁrst time, offers provable guarantees in the context of
sybil defense. Second, we advocate a new goal for sybil defense
that addresses the more limited, but practically useful, goal of
securely white-listing a local region of the graph.
I. INTRODUCTION
The possibility that malicious users may forge an un−
bounded number of sybil identities, indistinguishable from
honest ones, is a fundamental threat to distributed systems
that rely on voting [11]. This threat is particularly acute
in decentralized systems, where it may be impractical or
impossible to rely on a single authority to certify which users
are legitimate [20]. The goal of sybil defense is to accurately
identify sybil identities1—“ideally, the system should accept
all legitimate identities but no counterfeit entities” [11]—
but simple techniques can be either too brittle (beating a
CAPTCHA [40] costs a fraction of a cent) or too blunt (IP
ﬁltering penalizes all users behind a NAT).
Against thi...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Demystifying Soft Error Assessment Strategies on ARM CPUs: Microarchitectural
Fault Injection vs. Neutron Beam Experiments
author:Athanasios Chatzidimitriou and
Pablo Bodmann and
George Papadimitriou and
Dimitris Gizopoulos and
Paolo Rech
2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
Demystifying Soft Error Assessment Strategies on
ARM CPUs: Microarchitectural Fault Injection vs.
Neutron Beam Experiments
Athanasios Chatzidimitriou†
Pablo Bodmann*
George Papadimitriou† Dimitris Gizopoulos†
Paolo Rech*
†Dept. of Informatics and Telecommunications, University of Athens, Athens, Greece
{achatz | georgepap | dgizop}@di.uoa.gr
*PPGC, Institute of Informatics, Federal University of Rio Grande do Sul, Porto Alegre, Brasil
{prjbodmann | prech}@inf.ufrgs.br
Abstract—Fault injection in early microarchitecture-level sim-
ulation CPU models and beam experiments on the ﬁnal physical
CPU chip are two established methodologies to access the soft
error reliability of a microprocessor at different stages of its
design ﬂow. Beam experiments, on one hand, estimate the
devices expected soft error rate in realistic physical conditions
by exposing it to accelerated particles ﬂuxes. Fault injection in
microarchitectural models of the processor, on the other hand,
provides deep insights on faults propagation through the entire
system stack, including the operating system. Combining beam
experiments and fault injection data can deliver deep insights
about the devices expected reliability when deployed in the ﬁeld.
However, it is yet largely unclear if the fault injection error rates
can be compared to those reported by beam experiments and
how this comparison can lead to informed soft error protection
decisions in early stages of the system design.
In this paper, we present and analyze data gathered with
extensive beam experiments (on physical CPU hardware) and
microarchitectural fault injections (on an equivalent CPU model
on Gem5) perfor...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Demystifying Soft Error Assessment Strategies on ARM CPUs: Microarchitectural
Fault Injection vs. Neutron Beam Experiments
author:Athanasios Chatzidimitriou and
Pablo Bodmann and
George Papadimitriou and
Dimitris Gizopoulos and
Paolo Rech
2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
Demystifying Soft Error Assessment Strategies on
ARM CPUs: Microarchitectural Fault Injection vs.
Neutron Beam Experiments
Athanasios Chatzidimitriou†
Pablo Bodmann*
George Papadimitriou† Dimitris Gizopoulos†
Paolo Rech*
†Dept. of Informatics and Telecommunications, University of Athens, Athens, Greece
{achatz | georgepap | dgizop}@di.uoa.gr
*PPGC, Institute of Informatics, Federal University of Rio Grande do Sul, Porto Alegre, Brasil
{prjbodmann | prech}@inf.ufrgs.br
Abstract—Fault injection in early microarchitecture-level sim-
ulation CPU models and beam experiments on the ﬁnal physical
CPU chip are two established methodologies to access the soft
error reliability of a microprocessor at different stages of its
design ﬂow. Beam experiments, on one hand, estimate the
devices expected soft error rate in realistic physical conditions
by exposing it to accelerated particles ﬂuxes. Fault injection in
microarchitectural models of the processor, on the other hand,
provides deep insights on faults propagation through the entire
system stack, including the operating system. Combining beam
experiments and fault injection data can deliver deep insights
about the devices expected reliability when deployed in the ﬁeld.
However, it is yet largely unclear if the fault injection error rates
can be compared to those reported by beam experiments and
how this comparison can lead to informed soft error protection
decisions in early stages of the system design.
In this paper, we present and analyze data gathered with
extensive beam experiments (on physical CPU hardware) and
microarchitectural fault injections (on an equivalent CPU model
on Gem5) perfor...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:An inquiry into the nature and causes of the wealth of internet miscreants
author:Jason Franklin and
Adrian Perrig and
Vern Paxson and
Stefan Savage
An Inquiry into the Nature and Causes of
the Wealth of Internet Miscreants∗
Jason Franklin
Carnegie Mellon University
jfrankli@cs.cmu.edu
Adrian Perrig
Cylab/CMU
perrig@cmu.edu
Vern Paxson
ICSI
vern@icsi.berkeley.edu
Stefan Savage
UC San Diego
savage@cs.ucsd.edu
ABSTRACT
This paper studies an active underground economy which special-
izes in the commoditization of activities such as credit card fraud,
identity theft, spamming, phishing, online credential theft, and the
sale of compromised hosts. Using a seven month trace of logs col-
lected from an active underground market operating on public In-
ternet chat networks, we measure how the shift from “hacking for
fun” to “hacking for proﬁt” has given birth to a societal substrate
mature enough to steal wealth into the millions of dollars in less
than one year.
Categories and Subject Descriptors
K.4.1 [Public Policy Issues]: ABUSE AND CRIME INVOLVING
COMPUTERS
General Terms
Measurement,Security
Keywords
eCrime, Underground Markets
∗
This research was supported in part by CyLab at Carnegie Mel-
lon under grant DAAD19-02-1-0389 from the Army Research
Ofﬁce, and grants CNS-0537246, CCF-0424422, CNS-0433668,
and NSF-0433702 from the National Science Foundation. Jason
Franklin performed this research while on appointment as a U.S.
Department of Homeland Security (DHS) Fellow under the DHS
Scholarship and Fellowship Program, a program administered by
the Oak Ridge Institute for Science and Education (ORISE) for
DHS through an interagency agreement with the U.S Department
of Energy (DOE). The views and conclusions contained here are
those of the authors and should not be interpreted as necessarily
representing the ofﬁcial policies or endorsements, either express or
implied, of ARO, CMU, NSF, DHS, DOE, ORISE or the U.S. Gov-
ernment or any of its agencies.
Permission to make...


Instruction: 总结这篇安全研究的主要观点

Input:
title:An inquiry into the nature and causes of the wealth of internet miscreants
author:Jason Franklin and
Adrian Perrig and
Vern Paxson and
Stefan Savage
An Inquiry into the Nature and Causes of
the Wealth of Internet Miscreants∗
Jason Franklin
Carnegie Mellon University
jfrankli@cs.cmu.edu
Adrian Perrig
Cylab/CMU
perrig@cmu.edu
Vern Paxson
ICSI
vern@icsi.berkeley.edu
Stefan Savage
UC San Diego
savage@cs.ucsd.edu
ABSTRACT
This paper studies an active underground economy which special-
izes in the commoditization of activities such as credit card fraud,
identity theft, spamming, phishing, online credential theft, and the
sale of compromised hosts. Using a seven month trace of logs col-
lected from an active underground market operating on public In-
ternet chat networks, we measure how the shift from “hacking for
fun” to “hacking for proﬁt” has given birth to a societal substrate
mature enough to steal wealth into the millions of dollars in less
than one year.
Categories and Subject Descriptors
K.4.1 [Public Policy Issues]: ABUSE AND CRIME INVOLVING
COMPUTERS
General Terms
Measurement,Security
Keywords
eCrime, Underground Markets
∗
This research was supported in part by CyLab at Carnegie Mel-
lon under grant DAAD19-02-1-0389 from the Army Research
Ofﬁce, and grants CNS-0537246, CCF-0424422, CNS-0433668,
and NSF-0433702 from the National Science Foundation. Jason
Franklin performed this research while on appointment as a U.S.
Department of Homeland Security (DHS) Fellow under the DHS
Scholarship and Fellowship Program, a program administered by
the Oak Ridge Institute for Science and Education (ORISE) for
DHS through an interagency agreement with the U.S Department
of Energy (DOE). The views and conclusions contained here are
those of the authors and should not be interpreted as necessarily
representing the ofﬁcial policies or endorsements, either express or
implied, of ARO, CMU, NSF, DHS, DOE, ORISE or the U.S. Gov-
ernment or any of its agencies.
Permission to make...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Scaling Up Clustered Network Appliances with ScaleBricks
author:Dong Zhou and
Bin Fan and
Hyeontaek Lim and
David G. Andersen and
Michael Kaminsky and
Michael Mitzenmacher and
Ren Wang and
Ajaypal Singh
Scaling Up Clustered Network Appliances with ScaleBricks
Dong Zhou, Bin Fan, Hyeontaek Lim, David G. Andersen, Michael Kaminsky†,
Michael Mitzenmacher**, Ren Wang†, Ajaypal Singh‡
Carnegie Mellon University, †Intel Labs, **Harvard University, ‡Connectem, Inc.
ABSTRACT
This paper presents ScaleBricks, a new design for building
scalable, clustered network appliances that must “pin” ﬂow
state to a speciﬁc handling node without being able to choose
which node that should be. ScaleBricks applies a new, com-
pact lookup structure to route packets directly to the appro-
priate handling node, without incurring the cost of multiple
hops across the internal interconnect. Its lookup structure
is many times smaller than the alternative approach of fully
replicating a forwarding table onto all nodes. As a result,
ScaleBricks is able to improve throughput and latency while
simultaneously increasing the total number of ﬂows that can
be handled by such a cluster. This architecture is effective in
practice: Used to optimize packet forwarding in an existing
commercial LTE-to-Internet gateway, it increases the through-
put of a four-node cluster by 23%, reduces latency by up to
10%, saves memory, and stores up to 5.7x more entries in the
forwarding table.
CCS Concepts
•Networks → Middle boxes / network appliances;
Keywords
network function virtualization; scalability; hashing algo-
rithms
1.
INTRODUCTION
Many clustered network appliances require deterministic par-
titioning of a ﬂat key space among a cluster of machines.
When a packet enters the cluster, the ingress node will direct
the packet to its handling node. The handling node maintains
state that is used to process the packet, such as the packet’s
Permission to make digital or hard copies of part or all of this work for
pe...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Scaling Up Clustered Network Appliances with ScaleBricks
author:Dong Zhou and
Bin Fan and
Hyeontaek Lim and
David G. Andersen and
Michael Kaminsky and
Michael Mitzenmacher and
Ren Wang and
Ajaypal Singh
Scaling Up Clustered Network Appliances with ScaleBricks
Dong Zhou, Bin Fan, Hyeontaek Lim, David G. Andersen, Michael Kaminsky†,
Michael Mitzenmacher**, Ren Wang†, Ajaypal Singh‡
Carnegie Mellon University, †Intel Labs, **Harvard University, ‡Connectem, Inc.
ABSTRACT
This paper presents ScaleBricks, a new design for building
scalable, clustered network appliances that must “pin” ﬂow
state to a speciﬁc handling node without being able to choose
which node that should be. ScaleBricks applies a new, com-
pact lookup structure to route packets directly to the appro-
priate handling node, without incurring the cost of multiple
hops across the internal interconnect. Its lookup structure
is many times smaller than the alternative approach of fully
replicating a forwarding table onto all nodes. As a result,
ScaleBricks is able to improve throughput and latency while
simultaneously increasing the total number of ﬂows that can
be handled by such a cluster. This architecture is effective in
practice: Used to optimize packet forwarding in an existing
commercial LTE-to-Internet gateway, it increases the through-
put of a four-node cluster by 23%, reduces latency by up to
10%, saves memory, and stores up to 5.7x more entries in the
forwarding table.
CCS Concepts
•Networks → Middle boxes / network appliances;
Keywords
network function virtualization; scalability; hashing algo-
rithms
1.
INTRODUCTION
Many clustered network appliances require deterministic par-
titioning of a ﬂat key space among a cluster of machines.
When a packet enters the cluster, the ingress node will direct
the packet to its handling node. The handling node maintains
state that is used to process the packet, such as the packet’s
Permission to make digital or hard copies of part or all of this work for
pe...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Dynamic Verification of Memory Consistency in Cache-Coherent Multithreaded
Computer Architectures
author:Albert Meixner and
Daniel J. Sorin
Dynamic Veriﬁcation of Memory Consistency in Cache-Coherent
Multithreaded Computer Architectures
Albert Meixner
Dept. of Computer Science
Duke University
albert@cs.duke.edu
Abstract
Multithreaded servers with cache-coherent shared mem-
ory are the dominant type of machines used to run criti-
cal network
services and database management
systems. To achieve the high availability required for
these tasks, it is necessary to incorporate mechanisms
for error detection and recovery. Correct operation of
the memory system is deﬁned by the memory consistency
model. Errors can therefore be detected by checking if
the observed memory system behavior deviates from the
speciﬁed consistency model. Based on recent work, we
design a framework for dynamic veriﬁcation of memory
consistency (DVMC). The framework consists of mecha-
nisms to verify three invariants that are proven to guar-
antee that a speciﬁed memory consistency model is
obeyed. We describe an implementation of the frame-
work for the SPARCv9 architecture and experimentally
evaluate its performance using full-system simulation of
commercial workloads.
1.  Introduction
Computer system availability is crucial for the multi-
threaded (including multiprocessor) systems that run
critical
infrastructure. Unless architectural steps are
taken, availability will decrease over time as implemen-
tations use larger numbers of increasingly unreliable
components in search of higher performance. Backward
error recovery (BER) is a cost-effective mechanism [26,
21] to tolerate such errors, but it can only recover from
errors that are detected in a timely fashion. Tradition-
ally, most systems employ localized error detection
mechanisms, such as parity bits on cache lines and
memory buses, to detect errors. While such specialized
mechanisms detect the errors that they target, they do
not comp...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Dynamic Verification of Memory Consistency in Cache-Coherent Multithreaded
Computer Architectures
author:Albert Meixner and
Daniel J. Sorin
Dynamic Veriﬁcation of Memory Consistency in Cache-Coherent
Multithreaded Computer Architectures
Albert Meixner
Dept. of Computer Science
Duke University
albert@cs.duke.edu
Abstract
Multithreaded servers with cache-coherent shared mem-
ory are the dominant type of machines used to run criti-
cal network
services and database management
systems. To achieve the high availability required for
these tasks, it is necessary to incorporate mechanisms
for error detection and recovery. Correct operation of
the memory system is deﬁned by the memory consistency
model. Errors can therefore be detected by checking if
the observed memory system behavior deviates from the
speciﬁed consistency model. Based on recent work, we
design a framework for dynamic veriﬁcation of memory
consistency (DVMC). The framework consists of mecha-
nisms to verify three invariants that are proven to guar-
antee that a speciﬁed memory consistency model is
obeyed. We describe an implementation of the frame-
work for the SPARCv9 architecture and experimentally
evaluate its performance using full-system simulation of
commercial workloads.
1.  Introduction
Computer system availability is crucial for the multi-
threaded (including multiprocessor) systems that run
critical
infrastructure. Unless architectural steps are
taken, availability will decrease over time as implemen-
tations use larger numbers of increasingly unreliable
components in search of higher performance. Backward
error recovery (BER) is a cost-effective mechanism [26,
21] to tolerate such errors, but it can only recover from
errors that are detected in a timely fashion. Tradition-
ally, most systems employ localized error detection
mechanisms, such as parity bits on cache lines and
memory buses, to detect errors. While such specialized
mechanisms detect the errors that they target, they do
not comp...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Toward Topology Dualism: Improving the Accuracy of AS Annotations
for Routers
author:Bradley Huffaker and
Amogh Dhamdhere and
Marina Fomenkov and
kc claffy
Toward Topology Dualism: Improving the Accuracy of
AS Annotations for Routers(cid:2)
Bradley Huffaker, Amogh Dhamdhere, Marina Fomenkov, and kc claffy
CAIDA, University of California, San Diego
{bradley,amogh,marina,kc}@caida.org
Abstract. To describe, analyze, and model the topological and structural charac-
teristics of the Internet, researchers use Internet maps constructed at the router or
autonomous system (AS) level. Although progress has been made on each front
individually, a dual graph representing connectivity of routers with AS labels
remains an elusive goal. We take steps toward merging the router-level and AS-
level views of the Internet. We start from a collection of traces, i.e. sequences
of IP addresses obtained with large-scale traceroute measurements from a dis-
tributed set of vantage points. We use state-of-the-art alias resolution techniques
to identify interfaces belonging to the same router. We develop novel heuristics
to assign routers to ASes, producing an AS-router dual graph. We validate our
router assignment heuristics using data provided by tier-1 and tier-2 ISPs and
ﬁve research networks, and show that we successfully assign 80% of routers with
interfaces from multiple ASes to the correct AS. When we include routers with
interfaces from a single AS, the accuracy drops to 71%, due to the 24% of total
inferred routers for which our measurement or alias resolution fails to ﬁnd an in-
terface belonging to the correct AS. We use our dual graph construct to estimate
economic properties of the AS-router dual graph, such as the number of internal
and border routers owned by different types of ASes. We also demonstrate how
our techniques can improve IP-AS mapping, including resolving up to 62% of
false loops we observed in AS paths derived from traceroutes.
1 Introduction
There is growi...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Toward Topology Dualism: Improving the Accuracy of AS Annotations
for Routers
author:Bradley Huffaker and
Amogh Dhamdhere and
Marina Fomenkov and
kc claffy
Toward Topology Dualism: Improving the Accuracy of
AS Annotations for Routers(cid:2)
Bradley Huffaker, Amogh Dhamdhere, Marina Fomenkov, and kc claffy
CAIDA, University of California, San Diego
{bradley,amogh,marina,kc}@caida.org
Abstract. To describe, analyze, and model the topological and structural charac-
teristics of the Internet, researchers use Internet maps constructed at the router or
autonomous system (AS) level. Although progress has been made on each front
individually, a dual graph representing connectivity of routers with AS labels
remains an elusive goal. We take steps toward merging the router-level and AS-
level views of the Internet. We start from a collection of traces, i.e. sequences
of IP addresses obtained with large-scale traceroute measurements from a dis-
tributed set of vantage points. We use state-of-the-art alias resolution techniques
to identify interfaces belonging to the same router. We develop novel heuristics
to assign routers to ASes, producing an AS-router dual graph. We validate our
router assignment heuristics using data provided by tier-1 and tier-2 ISPs and
ﬁve research networks, and show that we successfully assign 80% of routers with
interfaces from multiple ASes to the correct AS. When we include routers with
interfaces from a single AS, the accuracy drops to 71%, due to the 24% of total
inferred routers for which our measurement or alias resolution fails to ﬁnd an in-
terface belonging to the correct AS. We use our dual graph construct to estimate
economic properties of the AS-router dual graph, such as the number of internal
and border routers owned by different types of ASes. We also demonstrate how
our techniques can improve IP-AS mapping, including resolving up to 62% of
false loops we observed in AS paths derived from traceroutes.
1 Introduction
There is growi...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:PASAN: Detecting Peripheral Access Concurrency Bugs within Bare-Metal
Embedded Applications
author:Taegyu Kim and
Vireshwar Kumar and
Junghwan Rhee and
Jizhou Chen and
Kyungtae Kim and
Chung Hwan Kim and
Dongyan Xu and
Dave (Jing) Tian
PASAn: Detecting Peripheral Access Concurrency
Bugs within Bare-Metal Embedded Applications
Taegyu Kim, Purdue University; Vireshwar Kumar, Indian Institute of Technology,
Delhi; Junghwan Rhee, University of Central Oklahoma; Jizhou Chen and Kyungtae
Kim, Purdue University; Chung Hwan Kim, University of Texas at Dallas; Dongyan
Xu and Dave (Jing) Tian, Purdue University
https://www.usenix.org/conference/usenixsecurity21/presentation/kim
This paper is included in the Proceedings of the 30th USENIX Security Symposium.August 11–13, 2021978-1-939133-24-3Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX.PASAN: Detecting Peripheral Access Concurrency Bugs
within Bare-Metal Embedded Applications
Taegyu Kim†, Vireshwar Kumar∗, Junghwan Rhee§, Jizhou Chen†
Kyungtae Kim†, Chung Hwan Kim¶, Dongyan Xu†, Dave (Jing) Tian†
†Purdue University, {tgkim, chen2731, kim1798, dxu, daveti}@purdue.edu
∗Indian Institute of Technology, Delhi, viresh@cse.iitd.ac.in
§University of Central Oklahoma, jhrhee@gmail.com
¶University of Texas at Dallas, chungkim@utdallas.edu
Abstract
Concurrency bugs might be one of the most challenging soft-
ware defects to detect and debug due to their non-deterministic
triggers caused by task scheduling and interrupt handling.
While different tools have been proposed to address concur-
rency issues, protecting peripherals in embedded systems
from concurrent accesses impose unique challenges. A naïve
lock protection on a certain memory-mapped I/O (MMIO)
address still allows concurrent accesses to other MMIO ad-
dresses of a peripheral. Meanwhile, embedded peripherals
such as sensors often employ some internal state machines to
achieve certain functionalities. As a result, improper...


Instruction: 总结这篇安全研究的主要观点

Input:
title:PASAN: Detecting Peripheral Access Concurrency Bugs within Bare-Metal
Embedded Applications
author:Taegyu Kim and
Vireshwar Kumar and
Junghwan Rhee and
Jizhou Chen and
Kyungtae Kim and
Chung Hwan Kim and
Dongyan Xu and
Dave (Jing) Tian
PASAn: Detecting Peripheral Access Concurrency
Bugs within Bare-Metal Embedded Applications
Taegyu Kim, Purdue University; Vireshwar Kumar, Indian Institute of Technology,
Delhi; Junghwan Rhee, University of Central Oklahoma; Jizhou Chen and Kyungtae
Kim, Purdue University; Chung Hwan Kim, University of Texas at Dallas; Dongyan
Xu and Dave (Jing) Tian, Purdue University
https://www.usenix.org/conference/usenixsecurity21/presentation/kim
This paper is included in the Proceedings of the 30th USENIX Security Symposium.August 11–13, 2021978-1-939133-24-3Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX.PASAN: Detecting Peripheral Access Concurrency Bugs
within Bare-Metal Embedded Applications
Taegyu Kim†, Vireshwar Kumar∗, Junghwan Rhee§, Jizhou Chen†
Kyungtae Kim†, Chung Hwan Kim¶, Dongyan Xu†, Dave (Jing) Tian†
†Purdue University, {tgkim, chen2731, kim1798, dxu, daveti}@purdue.edu
∗Indian Institute of Technology, Delhi, viresh@cse.iitd.ac.in
§University of Central Oklahoma, jhrhee@gmail.com
¶University of Texas at Dallas, chungkim@utdallas.edu
Abstract
Concurrency bugs might be one of the most challenging soft-
ware defects to detect and debug due to their non-deterministic
triggers caused by task scheduling and interrupt handling.
While different tools have been proposed to address concur-
rency issues, protecting peripherals in embedded systems
from concurrent accesses impose unique challenges. A naïve
lock protection on a certain memory-mapped I/O (MMIO)
address still allows concurrent accesses to other MMIO ad-
dresses of a peripheral. Meanwhile, embedded peripherals
such as sensors often employ some internal state machines to
achieve certain functionalities. As a result, improper...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:You Get Where You're Looking for: The Impact of Information Sources
on Code Security
author:Yasemin Acar and
Michael Backes and
Sascha Fahl and
Doowon Kim and
Michelle L. Mazurek and
Christian Stransky
2016 IEEE Symposium on Security and Privacy
2016 IEEE Symposium on Security and Privacy
You Get Where You’re Looking For
The Impact of Information Sources on Code Security
Yasemin Acar, Michael Backes, Sascha Fahl, Doowon Kim†, Michelle L. Mazurek†, Christian Stransky
CISPA, Saarland University; †University of Maryland, College Park
Abstract—Vulnerabilities in Android code – including but not
limited to insecure data storage, unprotected inter-component
communication, broken TLS implementations, and violations
of least privilege – have enabled real-world privacy leaks and
motivated research cataloguing their prevalence and impact.
Researchers have speculated that appiﬁcation promotes secu-
rity problems, as it increasingly allows inexperienced laymen
to develop complex and sensitive apps. Anecdotally, Internet
resources such as Stack Overﬂow are blamed for promoting
insecure solutions that are naively copy-pasted by inexperienced
developers.
In this paper, we for the ﬁrst time systematically analyzed
how the use of information resources impacts code security.
We ﬁrst surveyed 295 app developers who have published in
the Google Play market concerning how they use resources to
solve security-related problems. Based on the survey results, we
conducted a lab study with 54 Android developers (students and
professionals), in which participants wrote security- and privacy-
relevant code under time constraints. The participants were
assigned to one of four conditions: free choice of resources, Stack
Overﬂow only, ofﬁcial Android documentation only, or books
only. Those participants who were allowed to use only Stack
Overﬂow produced signiﬁcantly less secure code than those using,
the ofﬁcial Android documentation or books, while participants
using the ofﬁcial Android do...


Instruction: 总结这篇安全研究的主要观点

Input:
title:You Get Where You're Looking for: The Impact of Information Sources
on Code Security
author:Yasemin Acar and
Michael Backes and
Sascha Fahl and
Doowon Kim and
Michelle L. Mazurek and
Christian Stransky
2016 IEEE Symposium on Security and Privacy
2016 IEEE Symposium on Security and Privacy
You Get Where You’re Looking For
The Impact of Information Sources on Code Security
Yasemin Acar, Michael Backes, Sascha Fahl, Doowon Kim†, Michelle L. Mazurek†, Christian Stransky
CISPA, Saarland University; †University of Maryland, College Park
Abstract—Vulnerabilities in Android code – including but not
limited to insecure data storage, unprotected inter-component
communication, broken TLS implementations, and violations
of least privilege – have enabled real-world privacy leaks and
motivated research cataloguing their prevalence and impact.
Researchers have speculated that appiﬁcation promotes secu-
rity problems, as it increasingly allows inexperienced laymen
to develop complex and sensitive apps. Anecdotally, Internet
resources such as Stack Overﬂow are blamed for promoting
insecure solutions that are naively copy-pasted by inexperienced
developers.
In this paper, we for the ﬁrst time systematically analyzed
how the use of information resources impacts code security.
We ﬁrst surveyed 295 app developers who have published in
the Google Play market concerning how they use resources to
solve security-related problems. Based on the survey results, we
conducted a lab study with 54 Android developers (students and
professionals), in which participants wrote security- and privacy-
relevant code under time constraints. The participants were
assigned to one of four conditions: free choice of resources, Stack
Overﬂow only, ofﬁcial Android documentation only, or books
only. Those participants who were allowed to use only Stack
Overﬂow produced signiﬁcantly less secure code than those using,
the ofﬁcial Android documentation or books, while participants
using the ofﬁcial Android do...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Why eve and mallory (also) love webmasters: a study on the root causes
of SSL misconfigurations
author:Sascha Fahl and
Yasemin Acar and
Henning Perl and
Matthew Smith
Why Eve and Mallory (Also) Love Webmasters
A Study on the Root Causes of SSL Misconﬁgurations
Sascha Fahl, Yasemin Acar, Henning Perl, Matthew Smith
{sascha.fahl,yasemin.acar,henning.perl,matthew.smith}@fkie.fraunhofer.de
FKIE, Fraunhofer
Bonn, Germany
ABSTRACT
Previous research showed that the SSL infrastructure is a
fragile system: X.509 certiﬁcate validation fails for a non-
trivial number of HTTPS-enabled websites resulting in SSL
warning messages presented to users. Studies revealed that
warning messages do not provide easy-to-understand infor-
mation or are ignored by webbrowser users. SSL warning
messages are a critical component in the HTTPS infras-
tructure and many attempts have been made to improve
these warning messages. However, an important question
has not received suﬃcient attention yet: Why do webmasters
(deliberately) deploy non-validating, security-critical X.509
certiﬁcates on publicly available websites? In this paper,
we conduct the ﬁrst study with webmasters operating non-
validating X.509 certiﬁcates to understand their motives
behind deploying those certiﬁcates. We extracted the non-
validating certiﬁcates from Google’s webcrawler body of
X.509 certiﬁcates, informed webmasters about the problem
with the X.509 certiﬁcate conﬁguration on their website and
invited a random sample of the respective webmasters to
participate in our study. 755 webmasters participated, al-
lowing us insight into their motives. While one third of them
admitted to having misconﬁgured their webserver acciden-
tally, two thirds of them gave reasons for deliberately using
a non-validating X.509 certiﬁcate.
Categories and Subject Descriptors
H.4 [Information Systems Applications]: Miscellaneous
General Terms
SSL, Webmasters, Usable Security, User Study
1.
INTRODUCTION
For the authentication of a serve...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Why eve and mallory (also) love webmasters: a study on the root causes
of SSL misconfigurations
author:Sascha Fahl and
Yasemin Acar and
Henning Perl and
Matthew Smith
Why Eve and Mallory (Also) Love Webmasters
A Study on the Root Causes of SSL Misconﬁgurations
Sascha Fahl, Yasemin Acar, Henning Perl, Matthew Smith
{sascha.fahl,yasemin.acar,henning.perl,matthew.smith}@fkie.fraunhofer.de
FKIE, Fraunhofer
Bonn, Germany
ABSTRACT
Previous research showed that the SSL infrastructure is a
fragile system: X.509 certiﬁcate validation fails for a non-
trivial number of HTTPS-enabled websites resulting in SSL
warning messages presented to users. Studies revealed that
warning messages do not provide easy-to-understand infor-
mation or are ignored by webbrowser users. SSL warning
messages are a critical component in the HTTPS infras-
tructure and many attempts have been made to improve
these warning messages. However, an important question
has not received suﬃcient attention yet: Why do webmasters
(deliberately) deploy non-validating, security-critical X.509
certiﬁcates on publicly available websites? In this paper,
we conduct the ﬁrst study with webmasters operating non-
validating X.509 certiﬁcates to understand their motives
behind deploying those certiﬁcates. We extracted the non-
validating certiﬁcates from Google’s webcrawler body of
X.509 certiﬁcates, informed webmasters about the problem
with the X.509 certiﬁcate conﬁguration on their website and
invited a random sample of the respective webmasters to
participate in our study. 755 webmasters participated, al-
lowing us insight into their motives. While one third of them
admitted to having misconﬁgured their webserver acciden-
tally, two thirds of them gave reasons for deliberately using
a non-validating X.509 certiﬁcate.
Categories and Subject Descriptors
H.4 [Information Systems Applications]: Miscellaneous
General Terms
SSL, Webmasters, Usable Security, User Study
1.
INTRODUCTION
For the authentication of a serve...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Ciphertext policy attribute-based encryption from lattices
author:Jiang Zhang and
Zhenfeng Zhang and
Aijun Ge
International Journal of Network Security, Vol.16, No.6, PP.444-451, Nov. 2014
444
Lattice Ciphertext Policy Attribute-based
Encryption in the Standard Model
Yongtao Wang
China Information Technology Security Evaluation Center, Beijing 100085, P.R.China
(E-mail: wyt.itsec@gmail.com)
(Received Feb. 6, 2013; revised and accepted June 19, 2013)
Abstract
A lattice ciphertext policy attribute based encryption
(CP-ABE) scheme is presented, in which the ciphertext
policy achieved is the AND-gates on multi-valued at-
tributes. The previous construction with AND-gates on
multi-valued attributes as ciphertext policy is based on bi-
linear paring technology. In this paper, inspired by the re-
cent progress of lattice identity based encryption scheme,
we achieve this access structure from lattice technology.
There are two constructions given, and both of them can
be viewed as an extension and generalization of the lattice
identity based encryption schemes proposed by Agrawal et
al., respectively. In addition, our constructions are shown
to be secure under the learning with errors assumption in
the standard model.
Keywords: Access structure, attribute-based encryption,
lattice, learning with errors, standard model
1 Introduction
The notion of attribute based encryption was ﬁrst intro-
duced by Sahai and Waters [18] at EUROCRYPT’05. In
their scheme, a sender can generate a ciphertext according
to an attribute set ω and a user described by an attribute
set γ can get a private key from the authority. When at
least d (threshold parameter) attributes overlapped be-
tween ω and γ, the user is allowed to decrypt this cipher-
text. The above scheme achieves threshold access struc-
ture. At present, some access structures of more com-
plexity are achieved. Attribute based encryption scheme
can be viewed as a generalization of identity based en-
cryption (IBE) [8, 19, 21]. S...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Ciphertext policy attribute-based encryption from lattices
author:Jiang Zhang and
Zhenfeng Zhang and
Aijun Ge
International Journal of Network Security, Vol.16, No.6, PP.444-451, Nov. 2014
444
Lattice Ciphertext Policy Attribute-based
Encryption in the Standard Model
Yongtao Wang
China Information Technology Security Evaluation Center, Beijing 100085, P.R.China
(E-mail: wyt.itsec@gmail.com)
(Received Feb. 6, 2013; revised and accepted June 19, 2013)
Abstract
A lattice ciphertext policy attribute based encryption
(CP-ABE) scheme is presented, in which the ciphertext
policy achieved is the AND-gates on multi-valued at-
tributes. The previous construction with AND-gates on
multi-valued attributes as ciphertext policy is based on bi-
linear paring technology. In this paper, inspired by the re-
cent progress of lattice identity based encryption scheme,
we achieve this access structure from lattice technology.
There are two constructions given, and both of them can
be viewed as an extension and generalization of the lattice
identity based encryption schemes proposed by Agrawal et
al., respectively. In addition, our constructions are shown
to be secure under the learning with errors assumption in
the standard model.
Keywords: Access structure, attribute-based encryption,
lattice, learning with errors, standard model
1 Introduction
The notion of attribute based encryption was ﬁrst intro-
duced by Sahai and Waters [18] at EUROCRYPT’05. In
their scheme, a sender can generate a ciphertext according
to an attribute set ω and a user described by an attribute
set γ can get a private key from the authority. When at
least d (threshold parameter) attributes overlapped be-
tween ω and γ, the user is allowed to decrypt this cipher-
text. The above scheme achieves threshold access struc-
ture. At present, some access structures of more com-
plexity are achieved. Attribute based encryption scheme
can be viewed as a generalization of identity based en-
cryption (IBE) [8, 19, 21]. S...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:SPECS: smart partial enciphering service for accessing encrypted
files with efficient and transparent
author:Tae-Kyou Park and
Ilkyeun Ra
Machine Learning Classiﬁcation over Encrypted Data
Shaﬁ Goldwasser‡
Raphaël Bost∗
Raluca Ada Popa†‡
Stephen Tu‡
Abstract
Machine learning classiﬁcation is used in numerous settings nowadays, such as medical or genomics predictions,
spam detection, face recognition, and ﬁnancial predictions. Due to privacy concerns, in some of these applications, it is
important that the data and the classiﬁer remain conﬁdential.
In this work, we construct three major classiﬁcation protocols that satisfy this privacy constraint: hyperplane
decision, Naïve Bayes, and decision trees. We also enable these protocols to be combined with AdaBoost. At the basis
of these constructions is a new library of building blocks for constructing classiﬁers securely; we demonstrate that this
library can be used to construct other classiﬁers as well, such as a multiplexer and a face detection classiﬁer.
We implemented and evaluated our library and classiﬁers. Our protocols are efﬁcient, taking milliseconds to a few
seconds to perform a classiﬁcation when running on real medical datasets.
1 Introduction
Classiﬁers are an invaluable tool for many tasks today, such as medical or genomics predictions, spam detection, face
recognition, and ﬁnance. Many of these applications handle sensitive data [WGH12, SG11, SG13], so it is important
that the data and the classiﬁer remain private.
Consider the typical setup of supervised learning, depicted in Figure 1. Supervised learning algorithms consist of
two phases: (i) the training phase during which the algorithm learns a model w from a data set of labeled examples,
and (ii) the classiﬁcation phase that runs a classiﬁer C over a previously unseen feature vector x, using the model w to
output a prediction C(x, w).
In applications that handle sensitive data, it is important that the feature vector x and the model w remain sec...


Instruction: 总结这篇安全研究的主要观点

Input:
title:SPECS: smart partial enciphering service for accessing encrypted
files with efficient and transparent
author:Tae-Kyou Park and
Ilkyeun Ra
Machine Learning Classiﬁcation over Encrypted Data
Shaﬁ Goldwasser‡
Raphaël Bost∗
Raluca Ada Popa†‡
Stephen Tu‡
Abstract
Machine learning classiﬁcation is used in numerous settings nowadays, such as medical or genomics predictions,
spam detection, face recognition, and ﬁnancial predictions. Due to privacy concerns, in some of these applications, it is
important that the data and the classiﬁer remain conﬁdential.
In this work, we construct three major classiﬁcation protocols that satisfy this privacy constraint: hyperplane
decision, Naïve Bayes, and decision trees. We also enable these protocols to be combined with AdaBoost. At the basis
of these constructions is a new library of building blocks for constructing classiﬁers securely; we demonstrate that this
library can be used to construct other classiﬁers as well, such as a multiplexer and a face detection classiﬁer.
We implemented and evaluated our library and classiﬁers. Our protocols are efﬁcient, taking milliseconds to a few
seconds to perform a classiﬁcation when running on real medical datasets.
1 Introduction
Classiﬁers are an invaluable tool for many tasks today, such as medical or genomics predictions, spam detection, face
recognition, and ﬁnance. Many of these applications handle sensitive data [WGH12, SG11, SG13], so it is important
that the data and the classiﬁer remain private.
Consider the typical setup of supervised learning, depicted in Figure 1. Supervised learning algorithms consist of
two phases: (i) the training phase during which the algorithm learns a model w from a data set of labeled examples,
and (ii) the classiﬁcation phase that runs a classiﬁer C over a previously unseen feature vector x, using the model w to
output a prediction C(x, w).
In applications that handle sensitive data, it is important that the feature vector x and the model w remain sec...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Software-Implemented Fault Injection Methodology for Design and Validation
of System Fault Tolerance
author:Raphael R. Some and
Won S. Kim and
Garen Khanoyan and
Leslie Callum and
Anil Agrawal and
John J. Beahan
A Software-Implemented Fault Injection Methodology for
Design and Validation of System Fault Tolerance
Raphael R. Some*, Won S. Kim, Garen Khanoyan, Leslie Callum, Ani1 Agrawal, and John J. Beahan
Jet Propulsion Laboratory,  California Institute of Technology, 4800 Oak Grove Drive, Pasadena, CA 91109
Raphael.R.Some@pl.nasa.gov
Abstract
In this paper, we present our experience  in developing
a methodology  and  tool at  the Jet Propulsion  Laboratoly
(JPL) for Software-Implemented  Fault Injection  (SWIFI)
into a parallel processing supercomputer,  which  is being
designed  for  use  in  next  generation  space  exploration
missions.  The fault injector uses software-based  strategies
to  emulate  the  effects  of  radiation-induced
transients
occurring  in the system  hardware  components. The JPL’s
SWlFI  tool  set  called  JIFI
(JPL’s Implementation  of  a
Fault  Injector)  is  being  used,  in  conjunction  with  an
appropriate  system  fault  model,  to  evaluate  candidate
hardware  and  software  fault  tolerance  urchitectures,
determine  the  sensitivity  of  applications  to faults  and
measure the effectiveness  of fault detection,  isolation, and
recovery  strategies.  JIFI  has  been  validated  to  inject
faults  into  user-speciJied  CPU  registers  and  memory
regions  with  a  uniform  random  distribution  in  location
and  time.  Together  with  verifiers,  classifiers,  and  run
scripts,  JIFI  enables  massive fault  injection  campaigns
and statistical data analysis.
1. Introduction
is
to
for
(REE)
Project
The  objective  of
the  Remote  Exploration  and
Experimentation
bring
supercomputing technology into space [I],  [2]. It has twin
goals  of  1)  demonstrating  a  process
rapidly
transfer...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Software-Implemented Fault Injection Methodology for Design and Validation
of System Fault Tolerance
author:Raphael R. Some and
Won S. Kim and
Garen Khanoyan and
Leslie Callum and
Anil Agrawal and
John J. Beahan
A Software-Implemented Fault Injection Methodology for
Design and Validation of System Fault Tolerance
Raphael R. Some*, Won S. Kim, Garen Khanoyan, Leslie Callum, Ani1 Agrawal, and John J. Beahan
Jet Propulsion Laboratory,  California Institute of Technology, 4800 Oak Grove Drive, Pasadena, CA 91109
Raphael.R.Some@pl.nasa.gov
Abstract
In this paper, we present our experience  in developing
a methodology  and  tool at  the Jet Propulsion  Laboratoly
(JPL) for Software-Implemented  Fault Injection  (SWIFI)
into a parallel processing supercomputer,  which  is being
designed  for  use  in  next  generation  space  exploration
missions.  The fault injector uses software-based  strategies
to  emulate  the  effects  of  radiation-induced
transients
occurring  in the system  hardware  components. The JPL’s
SWlFI  tool  set  called  JIFI
(JPL’s Implementation  of  a
Fault  Injector)  is  being  used,  in  conjunction  with  an
appropriate  system  fault  model,  to  evaluate  candidate
hardware  and  software  fault  tolerance  urchitectures,
determine  the  sensitivity  of  applications  to faults  and
measure the effectiveness  of fault detection,  isolation, and
recovery  strategies.  JIFI  has  been  validated  to  inject
faults  into  user-speciJied  CPU  registers  and  memory
regions  with  a  uniform  random  distribution  in  location
and  time.  Together  with  verifiers,  classifiers,  and  run
scripts,  JIFI  enables  massive fault  injection  campaigns
and statistical data analysis.
1. Introduction
is
to
for
(REE)
Project
The  objective  of
the  Remote  Exploration  and
Experimentation
bring
supercomputing technology into space [I],  [2]. It has twin
goals  of  1)  demonstrating  a  process
rapidly
transfer...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:NativeX: Native Executioner Freezes Android
author:Qinsheng Hou and
Yao Cheng and
Lingyun Ying
NativeX: Native Executioner Freezes Android
Qinsheng Hou
QI-ANXIN Technology Research
Legendsec Information Technology
Institute
(Beijing) Inc.
Beijing, China
houqinsheng@qianxin.com
Yao Cheng
Huawei International
Singapore, Singapore
chengyao101@huawei.com
Lingyun Ying∗
QI-ANXIN Technology Research
University of Chinese Academy of
Institute
Sciences
Beijing, China
yinglingyun@qianxin.com
ABSTRACT
Android is a Linux-based multi-thread open-source operating
system that dominates 85% of the worldwide smartphone market
share. Though Android has its established management for its
framework layer processes, we discovered for the first time that the
weak management of native processes is posing tangible threats
to Android systems from version 4.2 to 9.0. As a consequence,
any third-party application without any permission can freeze
the system or force the system to go through a reboot by
starving or significantly delaying the critical system services using
Android commands in its native processes. We design NativeX to
systematically analyze the Android source code to identify the
risky Android commands. For each identified risky command,
NativeX can automatically generate the PoC (Proof-of-Concept)
application, and verify the effectiveness of the generated PoC.
We conduct manual vulnerability analysis to reveal two root
causes beyond the superficial attack consequences. We further
carry out quantitative experiments to demonstrate the attack
consequences, including the device temperature surge, the battery
degeneration, and the computing performance decrease, based on
which, three representative PoC attacks are engineered. Finally, we
discuss possible defense approaches to improve the management
of Android native processes.
CCS CONCEPTS
• Security and privacy → Mobile platform security; Denial-
of-service attacks.
KEYWORDS
Android security, mobile system security, denial-o...


Instruction: 总结这篇安全研究的主要观点

Input:
title:NativeX: Native Executioner Freezes Android
author:Qinsheng Hou and
Yao Cheng and
Lingyun Ying
NativeX: Native Executioner Freezes Android
Qinsheng Hou
QI-ANXIN Technology Research
Legendsec Information Technology
Institute
(Beijing) Inc.
Beijing, China
houqinsheng@qianxin.com
Yao Cheng
Huawei International
Singapore, Singapore
chengyao101@huawei.com
Lingyun Ying∗
QI-ANXIN Technology Research
University of Chinese Academy of
Institute
Sciences
Beijing, China
yinglingyun@qianxin.com
ABSTRACT
Android is a Linux-based multi-thread open-source operating
system that dominates 85% of the worldwide smartphone market
share. Though Android has its established management for its
framework layer processes, we discovered for the first time that the
weak management of native processes is posing tangible threats
to Android systems from version 4.2 to 9.0. As a consequence,
any third-party application without any permission can freeze
the system or force the system to go through a reboot by
starving or significantly delaying the critical system services using
Android commands in its native processes. We design NativeX to
systematically analyze the Android source code to identify the
risky Android commands. For each identified risky command,
NativeX can automatically generate the PoC (Proof-of-Concept)
application, and verify the effectiveness of the generated PoC.
We conduct manual vulnerability analysis to reveal two root
causes beyond the superficial attack consequences. We further
carry out quantitative experiments to demonstrate the attack
consequences, including the device temperature surge, the battery
degeneration, and the computing performance decrease, based on
which, three representative PoC attacks are engineered. Finally, we
discuss possible defense approaches to improve the management
of Android native processes.
CCS CONCEPTS
• Security and privacy → Mobile platform security; Denial-
of-service attacks.
KEYWORDS
Android security, mobile system security, denial-o...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Predicting Impending Exposure to Malicious Content from User Behavior
author:Mahmood Sharif and
Jumpei Urakawa and
Nicolas Christin and
Ayumu Kubota and
Akira Yamada
Predicting Impending Exposure to Malicious Content
from User Behavior
Mahmood Sharif
Carnegie Mellon University
mahmoods@cmu.edu
Jumpei Urakawa
KDDI Research, Inc.
ju-urakawa@kddi-research.jp
Nicolas Christin
Carnegie Mellon University
nicolasc@cmu.edu
Ayumu Kubota
KDDI Research, Inc.
kubota@kddi-research.jp
Akira Yamada
KDDI Research, Inc.
ai-yamada@kddi-research.jp
ABSTRACT
Many computer-security defenses are reactive—they operate only
when security incidents take place, or immediately thereafter. Re-
cent efforts have attempted to predict security incidents before
they occur, to enable defenders to proactively protect their devices
and networks. These efforts have primarily focused on long-term
predictions. We propose a system that enables proactive defenses at
the level of a single browsing session. By observing user behavior,
it can predict whether they will be exposed to malicious content on
the web seconds before the moment of exposure, thus opening a
window of opportunity for proactive defenses. We evaluate our sys-
tem using three months’ worth of HTTP traffic generated by 20,645
users of a large cellular provider in 2017 and show that it can be
helpful, even when only very low false positive rates are acceptable,
and despite the difficulty of making “on-the-fly” predictions. We
also engage directly with the users through surveys asking them
demographic and security-related questions, to evaluate the utility
of self-reported data for predicting exposure to malicious content.
We find that self-reported data can help forecast exposure risk over
long periods of time. However, even on the long-term, self-reported
data is not as crucial as behavioral measurements to accurately
predict exposure.
CCS CONCEPTS
• Security and privacy → Network security; Human and societal
aspects of security and p...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Predicting Impending Exposure to Malicious Content from User Behavior
author:Mahmood Sharif and
Jumpei Urakawa and
Nicolas Christin and
Ayumu Kubota and
Akira Yamada
Predicting Impending Exposure to Malicious Content
from User Behavior
Mahmood Sharif
Carnegie Mellon University
mahmoods@cmu.edu
Jumpei Urakawa
KDDI Research, Inc.
ju-urakawa@kddi-research.jp
Nicolas Christin
Carnegie Mellon University
nicolasc@cmu.edu
Ayumu Kubota
KDDI Research, Inc.
kubota@kddi-research.jp
Akira Yamada
KDDI Research, Inc.
ai-yamada@kddi-research.jp
ABSTRACT
Many computer-security defenses are reactive—they operate only
when security incidents take place, or immediately thereafter. Re-
cent efforts have attempted to predict security incidents before
they occur, to enable defenders to proactively protect their devices
and networks. These efforts have primarily focused on long-term
predictions. We propose a system that enables proactive defenses at
the level of a single browsing session. By observing user behavior,
it can predict whether they will be exposed to malicious content on
the web seconds before the moment of exposure, thus opening a
window of opportunity for proactive defenses. We evaluate our sys-
tem using three months’ worth of HTTP traffic generated by 20,645
users of a large cellular provider in 2017 and show that it can be
helpful, even when only very low false positive rates are acceptable,
and despite the difficulty of making “on-the-fly” predictions. We
also engage directly with the users through surveys asking them
demographic and security-related questions, to evaluate the utility
of self-reported data for predicting exposure to malicious content.
We find that self-reported data can help forecast exposure risk over
long periods of time. However, even on the long-term, self-reported
data is not as crucial as behavioral measurements to accurately
predict exposure.
CCS CONCEPTS
• Security and privacy → Network security; Human and societal
aspects of security and p...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Advanced Windows Methods on Malware Detection and Classification
author:Dima Rabadi and
Sin G. Teo
Advanced Windows Methods on Malware Detection and
Classification
Dima Rabadi
Institute for Infocomm Research, Singapore
dimadsr@i2r.a-star.edu.sg
Sin G. Teo
Institute for Infocomm Research, Singapore
teosg@i2r.a-star.edu.sg
ABSTRACT
Application Programming Interfaces (APIs) are still considered the
standard accessible data source and core wok of the most widely
adopted malware detection and classification techniques. API-based
malware detectors highly rely on measuring API’s statistical fea-
tures, such as calculating the frequency counter of calling specific
API calls or finding their malicious sequence pattern (i.e., signature-
based detectors). Using simple hooking tools, malware authors
would help in failing such detectors by interrupting the sequence
and shuffling the API calls or deleting/inserting irrelevant calls
(i.e., changing the frequency counter). Moreover, relying on API
calls (e.g., function names) alone without taking into account their
function parameters is insufficient to understand the purpose of
the program. For example, the same API call (e.g., writing on a
file) would act in two ways if two different arguments are passed
(e.g., writing on a system versus user file). However, because of the
heterogeneous nature of API arguments, most of the available API-
based malicious behavior detectors would consider only the API
calls without taking into account their argument information (e.g.,
function parameters). Alternatively, other detectors try considering
the API arguments in their techniques, but they acquire having pro-
ficient knowledge about the API arguments or powerful processors
to extract them. Such requirements demand a prohibitive cost and
complex operations to deal with the arguments. To overcome the
above limitations, with the help of machine learning and without
any expert knowledge of the arguments, we propose a light-weight
API-ba...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Advanced Windows Methods on Malware Detection and Classification
author:Dima Rabadi and
Sin G. Teo
Advanced Windows Methods on Malware Detection and
Classification
Dima Rabadi
Institute for Infocomm Research, Singapore
dimadsr@i2r.a-star.edu.sg
Sin G. Teo
Institute for Infocomm Research, Singapore
teosg@i2r.a-star.edu.sg
ABSTRACT
Application Programming Interfaces (APIs) are still considered the
standard accessible data source and core wok of the most widely
adopted malware detection and classification techniques. API-based
malware detectors highly rely on measuring API’s statistical fea-
tures, such as calculating the frequency counter of calling specific
API calls or finding their malicious sequence pattern (i.e., signature-
based detectors). Using simple hooking tools, malware authors
would help in failing such detectors by interrupting the sequence
and shuffling the API calls or deleting/inserting irrelevant calls
(i.e., changing the frequency counter). Moreover, relying on API
calls (e.g., function names) alone without taking into account their
function parameters is insufficient to understand the purpose of
the program. For example, the same API call (e.g., writing on a
file) would act in two ways if two different arguments are passed
(e.g., writing on a system versus user file). However, because of the
heterogeneous nature of API arguments, most of the available API-
based malicious behavior detectors would consider only the API
calls without taking into account their argument information (e.g.,
function parameters). Alternatively, other detectors try considering
the API arguments in their techniques, but they acquire having pro-
ficient knowledge about the API arguments or powerful processors
to extract them. Such requirements demand a prohibitive cost and
complex operations to deal with the arguments. To overcome the
above limitations, with the help of machine learning and without
any expert knowledge of the arguments, we propose a light-weight
API-ba...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:COMPA: Detecting Compromised Accounts on Social Networks
author:Manuel Egele and
Gianluca Stringhini and
Christopher Kr"ugel and
Giovanni Vigna
COMPA: Detecting Compromised Accounts on Social Networks
Manuel Egele∗ †, Gianluca Stringhini∗, Christopher Kruegel∗, and Giovanni Vigna∗
∗ University of California, Santa Barbara, Santa Barbara, CA
{maeg,gianluca,chris,vigna}@cs.ucsb.edu
† Carnegie Mellon University, Pittsburgh, PA
megele@cmu.edu
Abstract
1
Introduction
As social networking sites have risen in popularity,
cyber-criminals started to exploit these sites to spread mal-
ware and to carry out scams. Previous work has extensively
studied the use of fake (Sybil) accounts that attackers set
up to distribute spam messages (mostly messages that con-
tain links to scam pages or drive-by download sites). Fake
accounts typically exhibit highly anomalous behavior, and
hence, are relatively easy to detect. As a response, attackers
have started to compromise and abuse legitimate accounts.
Compromising legitimate accounts is very effective, as at-
tackers can leverage the trust relationships that the account
owners have established in the past. Moreover, compro-
mised accounts are more difﬁcult to clean up because a so-
cial network provider cannot simply delete the correspond-
ing proﬁles.
In this paper, we present a novel approach to detect
compromised user accounts in social networks, and we ap-
ply it to two popular social networking sites, Twitter and
Facebook. Our approach uses a composition of statistical
modeling and anomaly detection to identify accounts that
experience a sudden change in behavior. Since behavior
changes can also be due to benign reasons (e.g., a user
could switch her preferred client application or post up-
dates at an unusual time), it is necessary to derive a way to
distinguish between malicious and legitimate changes. To
this end, we look for groups of accounts that all experience
similar changes within a short period of time, assumi...


Instruction: 总结这篇安全研究的主要观点

Input:
title:COMPA: Detecting Compromised Accounts on Social Networks
author:Manuel Egele and
Gianluca Stringhini and
Christopher Kr"ugel and
Giovanni Vigna
COMPA: Detecting Compromised Accounts on Social Networks
Manuel Egele∗ †, Gianluca Stringhini∗, Christopher Kruegel∗, and Giovanni Vigna∗
∗ University of California, Santa Barbara, Santa Barbara, CA
{maeg,gianluca,chris,vigna}@cs.ucsb.edu
† Carnegie Mellon University, Pittsburgh, PA
megele@cmu.edu
Abstract
1
Introduction
As social networking sites have risen in popularity,
cyber-criminals started to exploit these sites to spread mal-
ware and to carry out scams. Previous work has extensively
studied the use of fake (Sybil) accounts that attackers set
up to distribute spam messages (mostly messages that con-
tain links to scam pages or drive-by download sites). Fake
accounts typically exhibit highly anomalous behavior, and
hence, are relatively easy to detect. As a response, attackers
have started to compromise and abuse legitimate accounts.
Compromising legitimate accounts is very effective, as at-
tackers can leverage the trust relationships that the account
owners have established in the past. Moreover, compro-
mised accounts are more difﬁcult to clean up because a so-
cial network provider cannot simply delete the correspond-
ing proﬁles.
In this paper, we present a novel approach to detect
compromised user accounts in social networks, and we ap-
ply it to two popular social networking sites, Twitter and
Facebook. Our approach uses a composition of statistical
modeling and anomaly detection to identify accounts that
experience a sudden change in behavior. Since behavior
changes can also be due to benign reasons (e.g., a user
could switch her preferred client application or post up-
dates at an unusual time), it is necessary to derive a way to
distinguish between malicious and legitimate changes. To
this end, we look for groups of accounts that all experience
similar changes within a short period of time, assumi...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Understanding the Dark Side of Domain Parking
author:Sumayah A. Alrwais and
Kan Yuan and
Eihal Alowaisheq and
Zhou Li and
XiaoFeng Wang
Understanding the Dark Side of Domain Parking
Sumayah Alrwais, Indiana University Bloomington and King Saud University; Kan Yuan,
Indiana University Bloomington; Eihal Alowaisheq, Indiana University Bloomington and
King Saud University; Zhou Li, Indiana University Bloomington and RSA Laboratories;
XiaoFeng Wang, Indiana University Bloomington
https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/alrwais
This paper is included in the Proceedings of the 23rd USENIX Security Symposium.August 20–22, 2014 • San Diego, CAISBN 978-1-931971-15-7Open access to the Proceedings of  the 23rd USENIX Security Symposium is sponsored by USENIXUnderstanding the Dark Side of Domain Parking
Sumayah Alrwais1,2, Kan Yuan1, Eihal Alowaisheq1,2, Zhou Li1,3 and XiaoFeng Wang1
1Indiana University, Bloomington
{salrwais, kanyuan, ealowais, xw7}@indiana.edu
2King Saud University, Riyadh, Saudi Arabia
3RSA Laboratories
zhou.li@rsa.com
Abstract
Domain parking is a booming business with millions of
dollars in revenues. However, it is also among the least
regulated: parked domains have been routinely found to
connect to illicit online activities even though the roles
they play there have never been clariﬁed. In this paper,
we report the ﬁrst systematic study on this “dark side” of
domain parking based upon a novel inﬁltration analysis
on domains hosted by major parking services. The idea
here is to control the trafﬁc sources (crawlers) of the do-
main parking ecosystem, some of its start nodes (parked
domains) and its end nodes (advertisers and trafﬁc buy-
ers) and then “connect the dots”, delivering our own traf-
ﬁc to our end nodes across our own start nodes with other
monetization entities (parking services, ad networks, etc)
in-between. This provided us a unique observation of the
whole monetization process and over one...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Understanding the Dark Side of Domain Parking
author:Sumayah A. Alrwais and
Kan Yuan and
Eihal Alowaisheq and
Zhou Li and
XiaoFeng Wang
Understanding the Dark Side of Domain Parking
Sumayah Alrwais, Indiana University Bloomington and King Saud University; Kan Yuan,
Indiana University Bloomington; Eihal Alowaisheq, Indiana University Bloomington and
King Saud University; Zhou Li, Indiana University Bloomington and RSA Laboratories;
XiaoFeng Wang, Indiana University Bloomington
https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/alrwais
This paper is included in the Proceedings of the 23rd USENIX Security Symposium.August 20–22, 2014 • San Diego, CAISBN 978-1-931971-15-7Open access to the Proceedings of  the 23rd USENIX Security Symposium is sponsored by USENIXUnderstanding the Dark Side of Domain Parking
Sumayah Alrwais1,2, Kan Yuan1, Eihal Alowaisheq1,2, Zhou Li1,3 and XiaoFeng Wang1
1Indiana University, Bloomington
{salrwais, kanyuan, ealowais, xw7}@indiana.edu
2King Saud University, Riyadh, Saudi Arabia
3RSA Laboratories
zhou.li@rsa.com
Abstract
Domain parking is a booming business with millions of
dollars in revenues. However, it is also among the least
regulated: parked domains have been routinely found to
connect to illicit online activities even though the roles
they play there have never been clariﬁed. In this paper,
we report the ﬁrst systematic study on this “dark side” of
domain parking based upon a novel inﬁltration analysis
on domains hosted by major parking services. The idea
here is to control the trafﬁc sources (crawlers) of the do-
main parking ecosystem, some of its start nodes (parked
domains) and its end nodes (advertisers and trafﬁc buy-
ers) and then “connect the dots”, delivering our own traf-
ﬁc to our end nodes across our own start nodes with other
monetization entities (parking services, ad networks, etc)
in-between. This provided us a unique observation of the
whole monetization process and over one...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Digging into Browser-based Crypto Mining
author:Jan R"uth and
Torsten Zimmermann and
Konrad Wolsing and
Oliver Hohlfeld
Digging into Browser-based Crypto Mining
Jan Rüth, Torsten Zimmermann, Konrad Wolsing, Oliver Hohlfeld
Communication and Distributed Systems, RWTH Aachen University, Germany
{lastname}@comsys.rwth-aachen.de
8
1
0
2
p
e
S
1
2
]
R
C
.
s
c
[
2
v
1
1
8
0
0
.
8
0
8
1
:
v
i
X
r
a
ABSTRACT
Mining is the foundation of blockchain-based cryptocurrencies
such as Bitcoin rewarding the miner for finding blocks for new
transactions. The Monero currency enables mining with standard
hardware in contrast to special hardware (ASICs) as often used in
Bitcoin, paving the way for in-browser mining as a new revenue
model for website operators. In this work, we study the prevalence
of this new phenomenon. We identify and classify mining websites
in 138M domains and present a new fingerprinting method which
finds up to a factor of 5.7 more miners than publicly available
block lists. Our work identifies and dissects Coinhive as the major
browser-mining stakeholder. Further, we present a new method to
associate mined blocks in the Monero blockchain to mining pools
and uncover that Coinhive currently contributes 1.18% of mined
blocks having turned over 1293 Moneros in June 2018.
CCS CONCEPTS
• Security and privacy → Malware and its mitigation; • Net-
works → Network measurement;
KEYWORDS
Mining, Cryptocurrency, Monero, Blockchain, Webassembly, Wasm,
Malware, Cryptojacking
ACM Reference Format:
Jan Rüth, Torsten Zimmermann, Konrad Wolsing, and Oliver Hohlfeld. 2018.
Digging into Browser-based Crypto Mining. In IMC ’18: Internet Measure-
ment Conference, October 31–November 2, 2018, Boston, MA, USA. ACM, New
York, NY, USA, 7 pages. https://doi.org/10.1145/3278532.3278539
1 INTRODUCTION
The web economy has traditionally used advertisements as means
to monetize services that are offered free of charge. This business
model relies on the implicit agreement between conte...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Digging into Browser-based Crypto Mining
author:Jan R"uth and
Torsten Zimmermann and
Konrad Wolsing and
Oliver Hohlfeld
Digging into Browser-based Crypto Mining
Jan Rüth, Torsten Zimmermann, Konrad Wolsing, Oliver Hohlfeld
Communication and Distributed Systems, RWTH Aachen University, Germany
{lastname}@comsys.rwth-aachen.de
8
1
0
2
p
e
S
1
2
]
R
C
.
s
c
[
2
v
1
1
8
0
0
.
8
0
8
1
:
v
i
X
r
a
ABSTRACT
Mining is the foundation of blockchain-based cryptocurrencies
such as Bitcoin rewarding the miner for finding blocks for new
transactions. The Monero currency enables mining with standard
hardware in contrast to special hardware (ASICs) as often used in
Bitcoin, paving the way for in-browser mining as a new revenue
model for website operators. In this work, we study the prevalence
of this new phenomenon. We identify and classify mining websites
in 138M domains and present a new fingerprinting method which
finds up to a factor of 5.7 more miners than publicly available
block lists. Our work identifies and dissects Coinhive as the major
browser-mining stakeholder. Further, we present a new method to
associate mined blocks in the Monero blockchain to mining pools
and uncover that Coinhive currently contributes 1.18% of mined
blocks having turned over 1293 Moneros in June 2018.
CCS CONCEPTS
• Security and privacy → Malware and its mitigation; • Net-
works → Network measurement;
KEYWORDS
Mining, Cryptocurrency, Monero, Blockchain, Webassembly, Wasm,
Malware, Cryptojacking
ACM Reference Format:
Jan Rüth, Torsten Zimmermann, Konrad Wolsing, and Oliver Hohlfeld. 2018.
Digging into Browser-based Crypto Mining. In IMC ’18: Internet Measure-
ment Conference, October 31–November 2, 2018, Boston, MA, USA. ACM, New
York, NY, USA, 7 pages. https://doi.org/10.1145/3278532.3278539
1 INTRODUCTION
The web economy has traditionally used advertisements as means
to monetize services that are offered free of charge. This business
model relies on the implicit agreement between conte...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A Study of Access Control Requirements for Healthcare Systems Based
on Audit Trails from Access Logs
author:Lillian Røstad and
Ole Edsberg
A Study of Access Control Requirements for Healthcare Systems Based on Audit
Trails from Access Logs
Lillian Røstad and Ole Edsberg
Norwegian University of Science and Technology (NTNU)
Department of Computer and Information Science
Trondheim, Norway
{lilliaro,edsberg}@idi.ntnu.no
Abstract
In healthcare, role-based access control systems are of-
ten extended with exception mechanisms to ensure access to
needed information even when the needs don’t follow the ex-
pected patterns. Exception mechanisms increase the threats
to patient privacy, and therefore their use should be limited
and subject to auditing. We have studied access logs from a
hospital EPR system with extensive use of exception-based
access control. We found that the uses of the exception
mechanisms were too frequent and widespread to be consid-
ered exceptions. The huge size of the log and the use of pre-
deﬁned or uninformative reasons for access make it infeasi-
ble to audit the log for misuse. The informative reasons that
were given provided starting points for requirements on how
the usage needs should be accomplished without exception-
based access. With more structured and ﬁne-grained log-
ging, analysis of access logs could be a very useful tool for
learning how to reduce the need for exception-based access.
1
Introduction
Security is a key concern for healthcare systems that con-
tain sensitive data, like the Electronic Patient Record (EPR).
Access control is at the heart of this concern. While health-
care personnel need access to the right information at the
right time to provide the best possible care, it is also impor-
tant to ensure patient privacy.
Over the last few years, we have seen a development in
access control research towards more dynamic, workﬂow-
based and user-centered models [1]. However, the state
of the art in existing healthcare sy...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A Study of Access Control Requirements for Healthcare Systems Based
on Audit Trails from Access Logs
author:Lillian Røstad and
Ole Edsberg
A Study of Access Control Requirements for Healthcare Systems Based on Audit
Trails from Access Logs
Lillian Røstad and Ole Edsberg
Norwegian University of Science and Technology (NTNU)
Department of Computer and Information Science
Trondheim, Norway
{lilliaro,edsberg}@idi.ntnu.no
Abstract
In healthcare, role-based access control systems are of-
ten extended with exception mechanisms to ensure access to
needed information even when the needs don’t follow the ex-
pected patterns. Exception mechanisms increase the threats
to patient privacy, and therefore their use should be limited
and subject to auditing. We have studied access logs from a
hospital EPR system with extensive use of exception-based
access control. We found that the uses of the exception
mechanisms were too frequent and widespread to be consid-
ered exceptions. The huge size of the log and the use of pre-
deﬁned or uninformative reasons for access make it infeasi-
ble to audit the log for misuse. The informative reasons that
were given provided starting points for requirements on how
the usage needs should be accomplished without exception-
based access. With more structured and ﬁne-grained log-
ging, analysis of access logs could be a very useful tool for
learning how to reduce the need for exception-based access.
1
Introduction
Security is a key concern for healthcare systems that con-
tain sensitive data, like the Electronic Patient Record (EPR).
Access control is at the heart of this concern. While health-
care personnel need access to the right information at the
right time to provide the best possible care, it is also impor-
tant to ensure patient privacy.
Over the last few years, we have seen a development in
access control research towards more dynamic, workﬂow-
based and user-centered models [1]. However, the state
of the art in existing healthcare sy...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。