Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:MPI: Multiple Perspective Attack Investigation with Semantic Aware
Execution Partitioning
author:Shiqing Ma and
Juan Zhai and
Fei Wang and
Kyu Hyung Lee and
Xiangyu Zhang and
Dongyan Xu
MPI: Multiple Perspective Attack Investigation
with Semantics Aware Execution Partitioning
Shiqing Ma, Purdue University; Juan Zhai, Nanjing University; Fei Wang, Purdue University;
Kyu Hyung Lee, University of Georgia; Xiangyu Zhang and Dongyan Xu, Purdue University
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/ma
This paper is included in the Proceedings of the 26th USENIX Security SymposiumAugust 16–18, 2017 • Vancouver, BC, CanadaISBN 978-1-931971-40-9Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIXMPI: Multiple Perspective Attack Investigation with Semantics Aware
Execution Partitioning
Shiqing Ma
Purdue University
Juan Zhai
Nanjing University
Xiangyu Zhang
Purdue University
Abstract
Traditional auditing techniques generate large and inac-
curate causal graphs. To overcome such limitations, re-
searchers proposed to leverage execution partitioning to
improve analysis granularity and hence precision. How-
ever, these techniques rely on a low level programming
paradigm (i.e., event handling loops) to partition execu-
tion, which often results in low level graphs with a lot of
redundancy. This not only leads to space inefficiency and
noises in causal graphs, but also makes it difficult to un-
derstand attack provenance. Moreover, these techniques
require training to detect low level memory dependencies
across partitions. Achieving correctness and complete-
ness in the training is highly challenging. In this paper,
we propose a semantics aware program annotation and
instrumentation technique to partition execution based
on the application specific high level task structures. It
avoids training, generates execution partitions with rich
semantic information and provides multiple perspectives
of an...


Instruction: 总结这篇安全研究的主要观点

Input:
title:MPI: Multiple Perspective Attack Investigation with Semantic Aware
Execution Partitioning
author:Shiqing Ma and
Juan Zhai and
Fei Wang and
Kyu Hyung Lee and
Xiangyu Zhang and
Dongyan Xu
MPI: Multiple Perspective Attack Investigation
with Semantics Aware Execution Partitioning
Shiqing Ma, Purdue University; Juan Zhai, Nanjing University; Fei Wang, Purdue University;
Kyu Hyung Lee, University of Georgia; Xiangyu Zhang and Dongyan Xu, Purdue University
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/ma
This paper is included in the Proceedings of the 26th USENIX Security SymposiumAugust 16–18, 2017 • Vancouver, BC, CanadaISBN 978-1-931971-40-9Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIXMPI: Multiple Perspective Attack Investigation with Semantics Aware
Execution Partitioning
Shiqing Ma
Purdue University
Juan Zhai
Nanjing University
Xiangyu Zhang
Purdue University
Abstract
Traditional auditing techniques generate large and inac-
curate causal graphs. To overcome such limitations, re-
searchers proposed to leverage execution partitioning to
improve analysis granularity and hence precision. How-
ever, these techniques rely on a low level programming
paradigm (i.e., event handling loops) to partition execu-
tion, which often results in low level graphs with a lot of
redundancy. This not only leads to space inefficiency and
noises in causal graphs, but also makes it difficult to un-
derstand attack provenance. Moreover, these techniques
require training to detect low level memory dependencies
across partitions. Achieving correctness and complete-
ness in the training is highly challenging. In this paper,
we propose a semantics aware program annotation and
instrumentation technique to partition execution based
on the application specific high level task structures. It
avoids training, generates execution partitions with rich
semantic information and provides multiple perspectives
of an...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Before Toasters Rise Up: A View into the Emerging IoT Threat Landscape
author:Pierre-Antoine Vervier and
Yun Shen
Before Toasters Rise Up: A View into the
Emerging IoT Threat Landscape
Pierre-Antoine Vervier1(B) and Yun Shen2
1 Symantec Research Labs, Sophia Antipolis, France
pierre-antoine vervier@symantec.com
2 Symantec Research Labs, Reading, UK
yun shen@symantec.com
Abstract. The insecurity of smart Internet-connected or so-called
“IoT” devices has become more concerning than ever. The existence
of botnets exploiting vulnerable, often poorly secured and conﬁgured
Internet-facing devices has been known for many years. However, the
outbreak of several high-proﬁle DDoS attacks sourced by massive IoT
botnets, such as Mirai, in late 2016 served as an indication of the poten-
tial devastating impact that these vulnerable devices represent. Since
then, the volume and sophistication of attacks targeting IoT devices have
grown steeply and new botnets now emerge every couple of months.
Although a lot of research is being carried out to study new spurs of
attacks and malware, we still lack a comprehensive overview of the cur-
rent state of the IoT thread landscape. In this paper, we present the
insights gained from operating low- and high-interaction IoT honeypots
for a period of six months. Namely, we see that the diversity and sophisti-
cation of IoT botnets are both growing. While Mirai is still a dominating
actor, it now has to coexist with other botnets such as Hajime and IoT
Reaper. Cybercriminals also appear to be packing their botnets with
more and more software vulnerability exploits targeting speciﬁc devices
to increase their infection rate and win the battle against the other com-
peting botnets. Finally, while the IoT malware ecosystem is currently
not as sophisticated as the traditional one, it is rapidly catching up. We
thus believe that the security community has the opportunity to learn
from passed experience and act proactively upon this emerging thr...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Before Toasters Rise Up: A View into the Emerging IoT Threat Landscape
author:Pierre-Antoine Vervier and
Yun Shen
Before Toasters Rise Up: A View into the
Emerging IoT Threat Landscape
Pierre-Antoine Vervier1(B) and Yun Shen2
1 Symantec Research Labs, Sophia Antipolis, France
pierre-antoine vervier@symantec.com
2 Symantec Research Labs, Reading, UK
yun shen@symantec.com
Abstract. The insecurity of smart Internet-connected or so-called
“IoT” devices has become more concerning than ever. The existence
of botnets exploiting vulnerable, often poorly secured and conﬁgured
Internet-facing devices has been known for many years. However, the
outbreak of several high-proﬁle DDoS attacks sourced by massive IoT
botnets, such as Mirai, in late 2016 served as an indication of the poten-
tial devastating impact that these vulnerable devices represent. Since
then, the volume and sophistication of attacks targeting IoT devices have
grown steeply and new botnets now emerge every couple of months.
Although a lot of research is being carried out to study new spurs of
attacks and malware, we still lack a comprehensive overview of the cur-
rent state of the IoT thread landscape. In this paper, we present the
insights gained from operating low- and high-interaction IoT honeypots
for a period of six months. Namely, we see that the diversity and sophisti-
cation of IoT botnets are both growing. While Mirai is still a dominating
actor, it now has to coexist with other botnets such as Hajime and IoT
Reaper. Cybercriminals also appear to be packing their botnets with
more and more software vulnerability exploits targeting speciﬁc devices
to increase their infection rate and win the battle against the other com-
peting botnets. Finally, while the IoT malware ecosystem is currently
not as sophisticated as the traditional one, it is rapidly catching up. We
thus believe that the security community has the opportunity to learn
from passed experience and act proactively upon this emerging thr...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:PBS: Periodic Behavioral Spectrum of P2P Applications
author:Tom Z. J. Fu and
Yan Hu and
Xingang Shi and
Dah-Ming Chiu and
John C. S. Lui
PBS: Periodic Behavioral Spectrum of P2P
Applications
Tom Z.J. Fu1, Yan Hu1, Xingang Shi1, Dah Ming Chiu1, and John C.S. Lui2
{zjfu6,yhu4,sxg007,dmchiu}@ie.cuhk.edu.hk
1 IE Dept., CUHK
2 CSE Dept., CUHK
cslui@cse.cuhk.edu.hk
Abstract. Due to the signiﬁcant increase of peer-to-peer (P2P) traf-
ﬁc in the past few years, more attentions are put on designing eﬀective
methodologies of monitoring and identifying P2P traﬃc. In this paper,
we propose a novel approach to measure and discover the special char-
acteristics of P2P applications, the periodic behaviors, from the packet
traces. We call this the “periodic behavioral spectrum” (PBS) of P2P
applications. This new ﬁnding, learning the characteristics of P2P traﬃc
from a new angle, could enhance our understanding on P2P applica-
tions. To show the eﬀectiveness of our approach, we not only provide
justiﬁcations as to why P2P applications should have some inherent pe-
riodic behaviors, but also conduct hundreds of experiments of applying
the approach on several popular P2P applications.
1 Introduction
There is a signiﬁcant increase in P2P applications running over the Internet and
enterprise IP networks during the past few years. These applications include P2P
content distribution applications like BitTorrent, BitComet and eMule, and P2P
streaming applications like Sopcast, PPLive, PPStream. Since P2P applications
account for a large portion of total Internet traﬃc, it is important to correctly
identify P2P traﬃc for traﬃc monitoring and network operations. However, ex-
isting approaches to classifying P2P traﬃc have well known drawbacks: Port-
based method is ineﬀective since many P2P applications rarely use ﬁxed port
numbers. Payload signature-based method is more reliable, but constraints like
hardware resource limitation, payload encryption and privacy and legal concerns
make...


Instruction: 总结这篇安全研究的主要观点

Input:
title:PBS: Periodic Behavioral Spectrum of P2P Applications
author:Tom Z. J. Fu and
Yan Hu and
Xingang Shi and
Dah-Ming Chiu and
John C. S. Lui
PBS: Periodic Behavioral Spectrum of P2P
Applications
Tom Z.J. Fu1, Yan Hu1, Xingang Shi1, Dah Ming Chiu1, and John C.S. Lui2
{zjfu6,yhu4,sxg007,dmchiu}@ie.cuhk.edu.hk
1 IE Dept., CUHK
2 CSE Dept., CUHK
cslui@cse.cuhk.edu.hk
Abstract. Due to the signiﬁcant increase of peer-to-peer (P2P) traf-
ﬁc in the past few years, more attentions are put on designing eﬀective
methodologies of monitoring and identifying P2P traﬃc. In this paper,
we propose a novel approach to measure and discover the special char-
acteristics of P2P applications, the periodic behaviors, from the packet
traces. We call this the “periodic behavioral spectrum” (PBS) of P2P
applications. This new ﬁnding, learning the characteristics of P2P traﬃc
from a new angle, could enhance our understanding on P2P applica-
tions. To show the eﬀectiveness of our approach, we not only provide
justiﬁcations as to why P2P applications should have some inherent pe-
riodic behaviors, but also conduct hundreds of experiments of applying
the approach on several popular P2P applications.
1 Introduction
There is a signiﬁcant increase in P2P applications running over the Internet and
enterprise IP networks during the past few years. These applications include P2P
content distribution applications like BitTorrent, BitComet and eMule, and P2P
streaming applications like Sopcast, PPLive, PPStream. Since P2P applications
account for a large portion of total Internet traﬃc, it is important to correctly
identify P2P traﬃc for traﬃc monitoring and network operations. However, ex-
isting approaches to classifying P2P traﬃc have well known drawbacks: Port-
based method is ineﬀective since many P2P applications rarely use ﬁxed port
numbers. Payload signature-based method is more reliable, but constraints like
hardware resource limitation, payload encryption and privacy and legal concerns
make...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Bootstrapping evolvability for inter-domain routing with D-BGP
author:Raja R. Sambasivan and
David Tran-Lam and
Aditya Akella and
Peter Steenkiste
Bootstrapping evolvability for inter-domain routing with D-BGP
Raja R. Sambasivan
Boston University
Aditya Akella
University of Wisconsin-Madison
ABSTRACT
The Internet’s inter-domain routing infrastructure, provided today by
BGP, is extremely rigid and does not facilitate the introduction of new
inter-domain routing protocols. This rigidity has made it incredibly
difficult to widely deploy critical fixes to BGP. It has also depressed
ASes’ ability to sell value-added services or replace BGP entirely
with a more sophisticated protocol. Even if operators undertook the
significant effort needed to fix or replace BGP, it is likely the next
protocol will be just as difficult to change or evolve. To help, this
paper identifies two features needed in the routing infrastructure
(i.e., within any inter-domain routing protocol) to facilitate evolution
to new protocols. To understand their utility, it presents D-BGP, a
version of BGP that incorporates them.
CCS CONCEPTS
• Networks → Network design principles; Network protocol de-
sign; Routing protocols; Public Internet;
KEYWORDS
BGP; Control plane; Extensibility; Evolvability; Routing
ACM Reference format:
Raja R. Sambasivan, David Tran-Lam, Aditya Akella, and Peter Steenkiste.
2017. Bootstrapping evolvability for inter-domain routing with D-BGP. In
Proceedings of SIGCOMM ’17, Los Angeles, CA, USA, August 21–25, 2017, 14 pages.
https://doi.org/10.1145/3098822.3098857
INTRODUCTION
1
The Internet’s inter-domain routing infrastructure is a critical com-
ponent of its architecture. The routing paths it computes and dissem-
inates in the control plane allow us to access all of the services and
content that we hold dear. Today, this infrastructure is provided by a
single inter-domain routing protocol—the Border Gateway Protocol
(BGP)—which is plagued with problems. It does not prov...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Bootstrapping evolvability for inter-domain routing with D-BGP
author:Raja R. Sambasivan and
David Tran-Lam and
Aditya Akella and
Peter Steenkiste
Bootstrapping evolvability for inter-domain routing with D-BGP
Raja R. Sambasivan
Boston University
Aditya Akella
University of Wisconsin-Madison
ABSTRACT
The Internet’s inter-domain routing infrastructure, provided today by
BGP, is extremely rigid and does not facilitate the introduction of new
inter-domain routing protocols. This rigidity has made it incredibly
difficult to widely deploy critical fixes to BGP. It has also depressed
ASes’ ability to sell value-added services or replace BGP entirely
with a more sophisticated protocol. Even if operators undertook the
significant effort needed to fix or replace BGP, it is likely the next
protocol will be just as difficult to change or evolve. To help, this
paper identifies two features needed in the routing infrastructure
(i.e., within any inter-domain routing protocol) to facilitate evolution
to new protocols. To understand their utility, it presents D-BGP, a
version of BGP that incorporates them.
CCS CONCEPTS
• Networks → Network design principles; Network protocol de-
sign; Routing protocols; Public Internet;
KEYWORDS
BGP; Control plane; Extensibility; Evolvability; Routing
ACM Reference format:
Raja R. Sambasivan, David Tran-Lam, Aditya Akella, and Peter Steenkiste.
2017. Bootstrapping evolvability for inter-domain routing with D-BGP. In
Proceedings of SIGCOMM ’17, Los Angeles, CA, USA, August 21–25, 2017, 14 pages.
https://doi.org/10.1145/3098822.3098857
INTRODUCTION
1
The Internet’s inter-domain routing infrastructure is a critical com-
ponent of its architecture. The routing paths it computes and dissem-
inates in the control plane allow us to access all of the services and
content that we hold dear. Today, this infrastructure is provided by a
single inter-domain routing protocol—the Border Gateway Protocol
(BGP)—which is plagued with problems. It does not prov...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Query-Efficient Black-Box Attack Against Sequence-Based Malware Classifiers
author:Ishai Rosenberg and
Asaf Shabtai and
Yuval Elovici and
Lior Rokach
0
2
0
2
t
c
O
3
]
R
C
.
s
c
[
7
v
8
7
7
8
0
.
4
0
8
1
:
v
i
X
r
a
Query-Eﬃcient Black-Box Attack Against Sequence-Based
Malware Classiﬁers
Ishai Rosenberg, Asaf Shabtai, Yuval Elovici and Lior Rokach
Ben-Gurion University of The Negev
October 6, 2020
Abstract
In this paper, we present a generic, query-eﬃcient black-box attack against API call-based
machine learning malware classiﬁers. We generate adversarial examples by modifying the mal-
ware’s API call sequences and non-sequential features (printable strings), and these adversarial
examples will be misclassiﬁed by the target malware classiﬁer without aﬀecting the malware’s
functionality.
In contrast to previous studies, our attack minimizes the number of malware classiﬁer queries
required. In addition, in our attack, the attacker must only know the class predicted by the
malware classiﬁer; attacker knowledge of the malware classiﬁer’s conﬁdence score is optional.
We evaluate the attack eﬀectiveness when attacks are performed against a variety of malware
classiﬁer architectures, including recurrent neural network (RNN) variants, deep neural net-
works, support vector machines, and gradient boosted decision trees. Our attack success rate
is around 98% when the classiﬁer’s conﬁdence score is known and 64% when just the classiﬁer’s
predicted class is known.
We implement four state-of-the-art query-eﬃcient attacks and show that our attack requires
fewer queries and less knowledge about the attacked model’s architecture than other existing
query-eﬃcient attacks, making it practical for attacking cloud-based malware classiﬁers at a
minimal cost.
Introduction
1
Next generation anti-malware products use machine learning and deep learning models instead of
signatures and heuristics, in order to detect previously unseen malware. Windows-based API call
sequence-based class...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Query-Efficient Black-Box Attack Against Sequence-Based Malware Classifiers
author:Ishai Rosenberg and
Asaf Shabtai and
Yuval Elovici and
Lior Rokach
0
2
0
2
t
c
O
3
]
R
C
.
s
c
[
7
v
8
7
7
8
0
.
4
0
8
1
:
v
i
X
r
a
Query-Eﬃcient Black-Box Attack Against Sequence-Based
Malware Classiﬁers
Ishai Rosenberg, Asaf Shabtai, Yuval Elovici and Lior Rokach
Ben-Gurion University of The Negev
October 6, 2020
Abstract
In this paper, we present a generic, query-eﬃcient black-box attack against API call-based
machine learning malware classiﬁers. We generate adversarial examples by modifying the mal-
ware’s API call sequences and non-sequential features (printable strings), and these adversarial
examples will be misclassiﬁed by the target malware classiﬁer without aﬀecting the malware’s
functionality.
In contrast to previous studies, our attack minimizes the number of malware classiﬁer queries
required. In addition, in our attack, the attacker must only know the class predicted by the
malware classiﬁer; attacker knowledge of the malware classiﬁer’s conﬁdence score is optional.
We evaluate the attack eﬀectiveness when attacks are performed against a variety of malware
classiﬁer architectures, including recurrent neural network (RNN) variants, deep neural net-
works, support vector machines, and gradient boosted decision trees. Our attack success rate
is around 98% when the classiﬁer’s conﬁdence score is known and 64% when just the classiﬁer’s
predicted class is known.
We implement four state-of-the-art query-eﬃcient attacks and show that our attack requires
fewer queries and less knowledge about the attacked model’s architecture than other existing
query-eﬃcient attacks, making it practical for attacking cloud-based malware classiﬁers at a
minimal cost.
Introduction
1
Next generation anti-malware products use machine learning and deep learning models instead of
signatures and heuristics, in order to detect previously unseen malware. Windows-based API call
sequence-based class...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Efficient Implementation of ECDH Key Exchange for MSP430-Based Wireless
Sensor Networks
author:Zhe Liu and
Hwajeong Seo and
Zhi Hu and
Xinyi Huang and
Johann Großsch"adl
Efﬁcient Implementation of ECDH Key Exchange for
MSP430-Based Wireless Sensor Networks
Zhe Liu
University of Luxembourg,
Luxembourg
zhe.liu@uni.lu
Hwajeong Seo
Pusan National University,
Republic of Korea
Zhi Hu
Central South University,
P.R. China
hwajeong84@gmail.com
huzhi@math.pku.edu.cn
Xinyi Huang
Fujian Normal University,
P.R. China
Johann Großschädl
University of Luxembourg,
Luxembourg
xyhuang81@gmail.com
johann.groszschaedl@uni.lu
ABSTRACT
Public-Key Cryptography (PKC) is an indispensable build-
ing block of modern security protocols, and, thus, essential
for secure communication over insecure networks. Despite a
signiﬁcant body of research devoted to making PKC more
“lightweight,” it is still commonly perceived that software
implementations of PKC are computationally too expensive
for practical use in ultra-low power devices such as wireless
sensor nodes. In the present paper we aim to challenge this
perception and present a highly-optimized implementation
of Elliptic Curve Cryptography (ECC) for the TI MSP430
series of 16-bit microcontrollers. Our software is inspired
by MoTE-ECC and supports scalar multiplication on two
families of elliptic curves, namely Montgomery and twisted
Edwards curves. However, in contrast to MoTE-ECC, we
use pseudo-Mersenne prime ﬁelds as underlying algebraic
structure to facilitate inter-operability with existing ECC
implementations. We introduce a novel “zig-zag” technique
for multiple-precision squaring on the MSP430 and assess
its execution time. Similar to MoTE-ECC, we employ the
Montgomery model for variable-base scalar multiplications
and the twisted Edwards model if the base point is ﬁxed
(e.g. to generate an ephemeral key pair). Our experiments
show that the two scalar multiplications needed to perform
an ephemeral ECDH key exchange can be acc...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Efficient Implementation of ECDH Key Exchange for MSP430-Based Wireless
Sensor Networks
author:Zhe Liu and
Hwajeong Seo and
Zhi Hu and
Xinyi Huang and
Johann Großsch"adl
Efﬁcient Implementation of ECDH Key Exchange for
MSP430-Based Wireless Sensor Networks
Zhe Liu
University of Luxembourg,
Luxembourg
zhe.liu@uni.lu
Hwajeong Seo
Pusan National University,
Republic of Korea
Zhi Hu
Central South University,
P.R. China
hwajeong84@gmail.com
huzhi@math.pku.edu.cn
Xinyi Huang
Fujian Normal University,
P.R. China
Johann Großschädl
University of Luxembourg,
Luxembourg
xyhuang81@gmail.com
johann.groszschaedl@uni.lu
ABSTRACT
Public-Key Cryptography (PKC) is an indispensable build-
ing block of modern security protocols, and, thus, essential
for secure communication over insecure networks. Despite a
signiﬁcant body of research devoted to making PKC more
“lightweight,” it is still commonly perceived that software
implementations of PKC are computationally too expensive
for practical use in ultra-low power devices such as wireless
sensor nodes. In the present paper we aim to challenge this
perception and present a highly-optimized implementation
of Elliptic Curve Cryptography (ECC) for the TI MSP430
series of 16-bit microcontrollers. Our software is inspired
by MoTE-ECC and supports scalar multiplication on two
families of elliptic curves, namely Montgomery and twisted
Edwards curves. However, in contrast to MoTE-ECC, we
use pseudo-Mersenne prime ﬁelds as underlying algebraic
structure to facilitate inter-operability with existing ECC
implementations. We introduce a novel “zig-zag” technique
for multiple-precision squaring on the MSP430 and assess
its execution time. Similar to MoTE-ECC, we employ the
Montgomery model for variable-base scalar multiplications
and the twisted Edwards model if the base point is ﬁxed
(e.g. to generate an ephemeral key pair). Our experiments
show that the two scalar multiplications needed to perform
an ephemeral ECDH key exchange can be acc...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:CS2P: Improving Video Bitrate Selection and Adaptation with Data-Driven
Throughput Prediction
author:Yi Sun and
Xiaoqi Yin and
Junchen Jiang and
Vyas Sekar and
Fuyuan Lin and
Nanshu Wang and
Tao Liu and
Bruno Sinopoli
CS2P: Improving Video Bitrate Selection and
Adaptation with Data-Driven Throughput Prediction
Yi Sun⊗, Xiaoqi Yin†, Junchen Jiang†, Vyas Sekar†
Fuyuan Lin⊗, Nanshu Wang⊗, Tao Liu(cid:5), Bruno Sinopoli†
⊗ ICT/CAS, † CMU, (cid:5) iQIYI
{sunyi, linfuyuan, wangnanshu}@ict.ac.cn, yinxiaoqi522@gmail.com,
junchenj@cs.cmu.edu, vsekar@andrew.cmu.edu, liutao@qiyi.com,
brunos@ece.cmu.edu
ABSTRACT
Bitrate adaptation is critical
to ensure good quality-of-
experience (QoE) for Internet video. Several efforts have
argued that accurate throughput prediction can dramatically
improve the efﬁciency of (1) initial bitrate selection to lower
startup delay and offer high initial resolution and (2) mid-
stream bitrate adaptation for high QoE. However, prior ef-
forts did not systematically quantify real-world throughput
predictability or develop good prediction algorithms. To
bridge this gap, this paper makes three contributions. First,
we analyze the throughput characteristics in a dataset with
20M+ sessions. We ﬁnd: (a) Sessions sharing similar key
features (e.g., ISP, region) present similar initial throughput
values and dynamic patterns; (b) There is a natural “state-
ful” behavior in throughput variability within a given ses-
sion. Second, building on these insights, we develop CS2P,
a throughput prediction system which uses a data-driven ap-
proach to learn (a) clusters of similar sessions, (b) an ini-
tial throughput predictor, and (c) a Hidden-Markov-Model
based midstream predictor modeling the stateful evolution of
throughput. Third, we develop a prototype system and show
using trace-driven simulation and real-world experiments
that: (1) CS2P outperforms existing prediction approaches
by 40% and 50% in terms of the median prediction error
for initial and mids...


Instruction: 总结这篇安全研究的主要观点

Input:
title:CS2P: Improving Video Bitrate Selection and Adaptation with Data-Driven
Throughput Prediction
author:Yi Sun and
Xiaoqi Yin and
Junchen Jiang and
Vyas Sekar and
Fuyuan Lin and
Nanshu Wang and
Tao Liu and
Bruno Sinopoli
CS2P: Improving Video Bitrate Selection and
Adaptation with Data-Driven Throughput Prediction
Yi Sun⊗, Xiaoqi Yin†, Junchen Jiang†, Vyas Sekar†
Fuyuan Lin⊗, Nanshu Wang⊗, Tao Liu(cid:5), Bruno Sinopoli†
⊗ ICT/CAS, † CMU, (cid:5) iQIYI
{sunyi, linfuyuan, wangnanshu}@ict.ac.cn, yinxiaoqi522@gmail.com,
junchenj@cs.cmu.edu, vsekar@andrew.cmu.edu, liutao@qiyi.com,
brunos@ece.cmu.edu
ABSTRACT
Bitrate adaptation is critical
to ensure good quality-of-
experience (QoE) for Internet video. Several efforts have
argued that accurate throughput prediction can dramatically
improve the efﬁciency of (1) initial bitrate selection to lower
startup delay and offer high initial resolution and (2) mid-
stream bitrate adaptation for high QoE. However, prior ef-
forts did not systematically quantify real-world throughput
predictability or develop good prediction algorithms. To
bridge this gap, this paper makes three contributions. First,
we analyze the throughput characteristics in a dataset with
20M+ sessions. We ﬁnd: (a) Sessions sharing similar key
features (e.g., ISP, region) present similar initial throughput
values and dynamic patterns; (b) There is a natural “state-
ful” behavior in throughput variability within a given ses-
sion. Second, building on these insights, we develop CS2P,
a throughput prediction system which uses a data-driven ap-
proach to learn (a) clusters of similar sessions, (b) an ini-
tial throughput predictor, and (c) a Hidden-Markov-Model
based midstream predictor modeling the stateful evolution of
throughput. Third, we develop a prototype system and show
using trace-driven simulation and real-world experiments
that: (1) CS2P outperforms existing prediction approaches
by 40% and 50% in terms of the median prediction error
for initial and mids...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Pseudo-Randomness and the Crystal Ball
author:Cynthia Dwork
Pseudo-Randomness and the Crystal Ball
Cynthia Dwork
Harvard University
Department of Computer Science
Cambridge, MA, USA
ABSTRACT
The last decade has witnessed the emergence of algorithmic fairness
as a new frontier in the application of theoretical computer science
to problems of societal concern. The delay between academic in-
vestigation and industrial rhetoric acknowledging the concern has
been surprisingly brief. This alacrity has positive and negative con-
sequences, to wit, opportunity for quick adoption of technology
and pressure for quick fixes.
An early dichotomy in the literature differentiates between group
notions of fairness — based on comparing prediction/classification
statistics for (typically disjoint) demographic groups — and individ-
ual fairness, i.e., requiring that similar individuals be treated simi-
larly [2]. Both face challenges. Group fairness criteria are appealing
but can be meaningless [2, 8] or mutually incompatible [1, 7]; indi-
vidual fairness requires a task-specific metric specifying the degree
to which pairs of individuals are (dis)similar for the purposes of the
task at hand. Considerable progress toward learning such a metric
from an expert was made only recently [6]; see also [4].
Focus on similarity metrics has thrown into relief foundational
questions about randomness and uncertainty. Some questions are
specific to the philosophy of fairness, for example, questions about
the value of an ex ante guarantee of fairness offered by a roll of
the dice. Others involve the choice of metric, exposing the role of
context. For example, should the likelihood that a job candidate will
succeed in the advertised position be evaluated in the context of
the work culture of the specific company that listed the position, or
in an ideal, or even just a more egalitarian company with stronger
culture of inclusivity?
A third set of questions revolves around the meaning of a “prob-
...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Pseudo-Randomness and the Crystal Ball
author:Cynthia Dwork
Pseudo-Randomness and the Crystal Ball
Cynthia Dwork
Harvard University
Department of Computer Science
Cambridge, MA, USA
ABSTRACT
The last decade has witnessed the emergence of algorithmic fairness
as a new frontier in the application of theoretical computer science
to problems of societal concern. The delay between academic in-
vestigation and industrial rhetoric acknowledging the concern has
been surprisingly brief. This alacrity has positive and negative con-
sequences, to wit, opportunity for quick adoption of technology
and pressure for quick fixes.
An early dichotomy in the literature differentiates between group
notions of fairness — based on comparing prediction/classification
statistics for (typically disjoint) demographic groups — and individ-
ual fairness, i.e., requiring that similar individuals be treated simi-
larly [2]. Both face challenges. Group fairness criteria are appealing
but can be meaningless [2, 8] or mutually incompatible [1, 7]; indi-
vidual fairness requires a task-specific metric specifying the degree
to which pairs of individuals are (dis)similar for the purposes of the
task at hand. Considerable progress toward learning such a metric
from an expert was made only recently [6]; see also [4].
Focus on similarity metrics has thrown into relief foundational
questions about randomness and uncertainty. Some questions are
specific to the philosophy of fairness, for example, questions about
the value of an ex ante guarantee of fairness offered by a roll of
the dice. Others involve the choice of metric, exposing the role of
context. For example, should the likelihood that a job candidate will
succeed in the advertised position be evaluated in the context of
the work culture of the specific company that listed the position, or
in an ideal, or even just a more egalitarian company with stronger
culture of inclusivity?
A third set of questions revolves around the meaning of a “prob-
...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:SecDATAVIEW: a secure big data workflow management system for heterogeneous
computing environments
author:Saeid Mofrad and
Ishtiaq Ahmed and
Shiyong Lu and
Ping Yang and
Heming Cui and
Fengwei Zhang
SecDATAVIEW: A Secure Big Data Workflow
Management System for Heterogeneous
Computing Environments
Department of Computer Science
Department of Computer Science
Department of Computer Science
Saeid Mofrad
Wayne State University
saeid.mofrad@wayne.edu
Ishtiaq Ahmed
Wayne State University
ishtiaq@wayne.edu
Shiyong Lu
Wayne State University
shiyong@wayne.edu
Fengwei Zhang∗
Department of Computer Science
Wayne State University
fengwei@wayne.edu
Ping Yang
Department of Computer Science
State University of New York at
Binghamton
pyang@binghamton.edu
Heming Cui
Department of Computer Science
The University of Hong Kong
heming@hcu.hk
ABSTRACT
Big data workflow management systems (BDWFMSs) have recently
emerged as popular platforms to perform large-scale data analytics
in the cloud. However, the protection of data confidentiality and
secure execution of workflow applications remains an important
and challenging problem. Although a few data analytics systems
were developed to address this problem, they are limited to specific
structures such as Map-Reduce-style workflows and SQL queries.
This paper proposes SecDATAVIEW, a BDWFMS that leverages In-
tel Software Guard eXtensions (SGX) and AMD Secure Encrypted
Virtualization (SEV) to develop a heterogeneous trusted execution
environment for workflows. SecDATAVIEW aims to (1) provide the
confidentiality and integrity of code and data for workflows running
on public untrusted clouds, (2) minimize the TCB size for a BD-
WFMS, (3) enable the trade-off between security and performance
for workflows, and (4) support the execution of Java-based workflow
tasks in SGX. Our experimental results show that SecDATAVIEW
imposes 1.69x to 2.62x overhead on workflow execution time on
SGX worker nodes, 1.04x to 1.29x overhead on SEV worker nodes...


Instruction: 总结这篇安全研究的主要观点

Input:
title:SecDATAVIEW: a secure big data workflow management system for heterogeneous
computing environments
author:Saeid Mofrad and
Ishtiaq Ahmed and
Shiyong Lu and
Ping Yang and
Heming Cui and
Fengwei Zhang
SecDATAVIEW: A Secure Big Data Workflow
Management System for Heterogeneous
Computing Environments
Department of Computer Science
Department of Computer Science
Department of Computer Science
Saeid Mofrad
Wayne State University
saeid.mofrad@wayne.edu
Ishtiaq Ahmed
Wayne State University
ishtiaq@wayne.edu
Shiyong Lu
Wayne State University
shiyong@wayne.edu
Fengwei Zhang∗
Department of Computer Science
Wayne State University
fengwei@wayne.edu
Ping Yang
Department of Computer Science
State University of New York at
Binghamton
pyang@binghamton.edu
Heming Cui
Department of Computer Science
The University of Hong Kong
heming@hcu.hk
ABSTRACT
Big data workflow management systems (BDWFMSs) have recently
emerged as popular platforms to perform large-scale data analytics
in the cloud. However, the protection of data confidentiality and
secure execution of workflow applications remains an important
and challenging problem. Although a few data analytics systems
were developed to address this problem, they are limited to specific
structures such as Map-Reduce-style workflows and SQL queries.
This paper proposes SecDATAVIEW, a BDWFMS that leverages In-
tel Software Guard eXtensions (SGX) and AMD Secure Encrypted
Virtualization (SEV) to develop a heterogeneous trusted execution
environment for workflows. SecDATAVIEW aims to (1) provide the
confidentiality and integrity of code and data for workflows running
on public untrusted clouds, (2) minimize the TCB size for a BD-
WFMS, (3) enable the trade-off between security and performance
for workflows, and (4) support the execution of Java-based workflow
tasks in SGX. Our experimental results show that SecDATAVIEW
imposes 1.69x to 2.62x overhead on workflow execution time on
SGX worker nodes, 1.04x to 1.29x overhead on SEV worker nodes...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Screen after Previous Screens: Spatial-Temporal Recreation of Android
App Displays from Memory Images
author:Brendan Saltaformaggio and
Rohit Bhatia and
Xiangyu Zhang and
Dongyan Xu and
Golden G. Richard III
Screen after Previous Screens:
Spatial-Temporal Recreation of Android App
Displays from Memory Images
Brendan Saltaformaggio, Rohit Bhatia, Xiangyu Zhang, and Dongyan Xu, Purdue University;
Golden G. Richard III, University of New Orleans
 https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/saltaformaggio
This paper is included in the Proceedings of the 25th USENIX Security SymposiumAugust 10–12, 2016 • Austin, TXISBN 978-1-931971-32-4Open access to the Proceedings of the 25th USENIX Security Symposium is sponsored by USENIX Screen After Previous Screens: Spatial-Temporal Recreation of Android
App Displays from Memory Images
Brendan Saltaformaggio1, Rohit Bhatia1, Xiangyu Zhang1, Dongyan Xu1, Golden G. Richard III2
1Department of Computer Science and CERIAS, Purdue University
{bsaltafo, bhatia13, xyzhang, dxu}@cs.purdue.edu
2Department of Computer Science, University of New Orleans
golden@cs.uno.edu
Abstract
Smartphones are increasingly involved in cyber and real
world crime investigations.
In this paper, we demon-
strate a powerful smartphone memory forensics tech-
nique, called RetroScope, which recovers multiple previ-
ous screens of an Android app — in the order they were
displayed — from the phone’s memory image. Differ-
ent from traditional memory forensics, RetroScope en-
ables spatial-temporal forensics, revealing the progres-
sion of the phone user’s interactions with the app (e.g.,
a banking transaction, online chat, or document editing
session). RetroScope achieves near perfect accuracy in
both the recreation and ordering of reconstructed screens.
Further, RetroScope is app-agnostic, requiring no knowl-
edge about an app’s internal data deﬁnitions or rendering
logic. RetroScope is inspired by the observations ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Screen after Previous Screens: Spatial-Temporal Recreation of Android
App Displays from Memory Images
author:Brendan Saltaformaggio and
Rohit Bhatia and
Xiangyu Zhang and
Dongyan Xu and
Golden G. Richard III
Screen after Previous Screens:
Spatial-Temporal Recreation of Android App
Displays from Memory Images
Brendan Saltaformaggio, Rohit Bhatia, Xiangyu Zhang, and Dongyan Xu, Purdue University;
Golden G. Richard III, University of New Orleans
 https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/saltaformaggio
This paper is included in the Proceedings of the 25th USENIX Security SymposiumAugust 10–12, 2016 • Austin, TXISBN 978-1-931971-32-4Open access to the Proceedings of the 25th USENIX Security Symposium is sponsored by USENIX Screen After Previous Screens: Spatial-Temporal Recreation of Android
App Displays from Memory Images
Brendan Saltaformaggio1, Rohit Bhatia1, Xiangyu Zhang1, Dongyan Xu1, Golden G. Richard III2
1Department of Computer Science and CERIAS, Purdue University
{bsaltafo, bhatia13, xyzhang, dxu}@cs.purdue.edu
2Department of Computer Science, University of New Orleans
golden@cs.uno.edu
Abstract
Smartphones are increasingly involved in cyber and real
world crime investigations.
In this paper, we demon-
strate a powerful smartphone memory forensics tech-
nique, called RetroScope, which recovers multiple previ-
ous screens of an Android app — in the order they were
displayed — from the phone’s memory image. Differ-
ent from traditional memory forensics, RetroScope en-
ables spatial-temporal forensics, revealing the progres-
sion of the phone user’s interactions with the app (e.g.,
a banking transaction, online chat, or document editing
session). RetroScope achieves near perfect accuracy in
both the recreation and ordering of reconstructed screens.
Further, RetroScope is app-agnostic, requiring no knowl-
edge about an app’s internal data deﬁnitions or rendering
logic. RetroScope is inspired by the observations ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Automatic Evaluation of Intrusion Detection Systems
author:Fr'ed'eric Massicotte and
François Gagnon and
Yvan Labiche and
Lionel C. Briand and
Mathieu Couture
Automatic Evaluation of Intrusion Detection Systems
Frédéric Massicotte
Canada Communication Research Center
François Gagnon, Yvan Labiche,
Lionel Briand and Mathieu Couture
3701 Carling
Ottawa, Canada
Abstract
their  accuracy.  Only  a
An  Intrusion  Detection  System  (IDS)  is  a  crucial
element  of a network security posture. Although there are
many  IDS  products  available,  it  is  rather  difficult  to  find
information  about
few
organizations  evaluate  these  products.  Furthermore,  the
data  used  to  test  and  evaluate  these  IDS  is  usually
proprietary.  Thus,  the  research  community  cannot  easily
evaluate  the  next  generation  of  IDS.  Toward  this  end,
DARPA  provided  in  1998,  1999  and  2000  an  Intrusion
Detection Evaluation Data Set. However, no new data set
has been released by DARPA since 2000, in part because
of  the  cumbersomeness  of  the  task.  In  this  paper,  we
propose  a  strategy
to  address  certain  aspects  of
generating  a  publicly  available  documented  data  set  for
testing and evaluating intrusion detection systems. We also
present  a  tool  that  automatically  analyzes  and  evaluates
IDS using our proposed data set.
1  Introduction
Since  the DARPA Intrusion Detection Evaluation Data
Set  [1]  was  made  available  in  1998  and  then  updated  in
1999 and 2000, no other significant publicly available data
set  has  been  provided  to  benchmark  Intrusion  Detection
Systems (IDS).
Other  organizations  [2,  3]  also  provide  data  sets  of
traffic traces with attacks and intrusions such as worms and
denials  of  service.  However,  these  data  sets  are  mainly
used for the statistical and traffic behavior analysis of large
traffic  traces  (e.g.,  studying  the  infection  evolution  of
wo...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Automatic Evaluation of Intrusion Detection Systems
author:Fr'ed'eric Massicotte and
François Gagnon and
Yvan Labiche and
Lionel C. Briand and
Mathieu Couture
Automatic Evaluation of Intrusion Detection Systems
Frédéric Massicotte
Canada Communication Research Center
François Gagnon, Yvan Labiche,
Lionel Briand and Mathieu Couture
3701 Carling
Ottawa, Canada
Abstract
their  accuracy.  Only  a
An  Intrusion  Detection  System  (IDS)  is  a  crucial
element  of a network security posture. Although there are
many  IDS  products  available,  it  is  rather  difficult  to  find
information  about
few
organizations  evaluate  these  products.  Furthermore,  the
data  used  to  test  and  evaluate  these  IDS  is  usually
proprietary.  Thus,  the  research  community  cannot  easily
evaluate  the  next  generation  of  IDS.  Toward  this  end,
DARPA  provided  in  1998,  1999  and  2000  an  Intrusion
Detection Evaluation Data Set. However, no new data set
has been released by DARPA since 2000, in part because
of  the  cumbersomeness  of  the  task.  In  this  paper,  we
propose  a  strategy
to  address  certain  aspects  of
generating  a  publicly  available  documented  data  set  for
testing and evaluating intrusion detection systems. We also
present  a  tool  that  automatically  analyzes  and  evaluates
IDS using our proposed data set.
1  Introduction
Since  the DARPA Intrusion Detection Evaluation Data
Set  [1]  was  made  available  in  1998  and  then  updated  in
1999 and 2000, no other significant publicly available data
set  has  been  provided  to  benchmark  Intrusion  Detection
Systems (IDS).
Other  organizations  [2,  3]  also  provide  data  sets  of
traffic traces with attacks and intrusions such as worms and
denials  of  service.  However,  these  data  sets  are  mainly
used for the statistical and traffic behavior analysis of large
traffic  traces  (e.g.,  studying  the  infection  evolution  of
wo...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Poster: Towards Automated Quantitative Analysis and Forecasting of
Vulnerability Discoveries in Debian GNU/Linux
author:Nikolaos Alexopoulos and
Rolf Egert and
Tim Grube and
Max M"uhlh"auser
Poster: Towards Automated Quantitative Analysis and
Forecasting of Vulnerability Discoveries in Debian GNU/Linux
Nikolaos Alexopoulos
Rolf Egert
Tim Grube
Max Mühlhäuser
Technische Universität Darmstadt
{alexopoulos,egert,grube,max}@tk.tu-darmstadt.de
ABSTRACT
Quantitative analysis and forecasting of software vulnerability dis-
coveries is important for patching cost and time estimation, and
as input to security metrics and risk assessment methodologies.
However, as of now, quantitative studies (a) require considerable
manual effort, (b) make use of noisy datasets, and (c) are especially
challenging to reproduce.
In this poster abstract we describe our ongoing work towards
quantitative analysis of vulnerabilities in Debian GNU/Linux pack-
ages. We focus on the challenges of making the process as auto-
mated and reproducible as possible, while collecting good-quality
data necessary for the analysis. We then state a number of interest-
ing hypotheses that can be investigated, and present preliminary
results.
KEYWORDS
software security; vulnerabilities; open-source software; dataset
ACM Reference Format:
Nikolaos Alexopoulos, Rolf Egert, Tim Grube, and Max Mühlhäuser. 2019.
Poster: Towards Automated Quantitative Analysis and Forecasting of Vul-
nerability Discoveries in Debian GNU/Linux. In 2019 ACM SIGSAC Con-
ference on Computer and Communications Security (CCS ’19), November
11–15, 2019, London, United Kingdom. ACM, New York, NY, USA, 3 pages.
https://doi.org/10.1145/3319535.3363285
1 INTRODUCTION
As the security community matures and progresses, the need for
well-founded security metrics and measurements becomes ever
more pressing [1], since the limitations of previous approaches are
better understood [5]. Quantitative analysis of the vulnerability
discovery pro...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Poster: Towards Automated Quantitative Analysis and Forecasting of
Vulnerability Discoveries in Debian GNU/Linux
author:Nikolaos Alexopoulos and
Rolf Egert and
Tim Grube and
Max M"uhlh"auser
Poster: Towards Automated Quantitative Analysis and
Forecasting of Vulnerability Discoveries in Debian GNU/Linux
Nikolaos Alexopoulos
Rolf Egert
Tim Grube
Max Mühlhäuser
Technische Universität Darmstadt
{alexopoulos,egert,grube,max}@tk.tu-darmstadt.de
ABSTRACT
Quantitative analysis and forecasting of software vulnerability dis-
coveries is important for patching cost and time estimation, and
as input to security metrics and risk assessment methodologies.
However, as of now, quantitative studies (a) require considerable
manual effort, (b) make use of noisy datasets, and (c) are especially
challenging to reproduce.
In this poster abstract we describe our ongoing work towards
quantitative analysis of vulnerabilities in Debian GNU/Linux pack-
ages. We focus on the challenges of making the process as auto-
mated and reproducible as possible, while collecting good-quality
data necessary for the analysis. We then state a number of interest-
ing hypotheses that can be investigated, and present preliminary
results.
KEYWORDS
software security; vulnerabilities; open-source software; dataset
ACM Reference Format:
Nikolaos Alexopoulos, Rolf Egert, Tim Grube, and Max Mühlhäuser. 2019.
Poster: Towards Automated Quantitative Analysis and Forecasting of Vul-
nerability Discoveries in Debian GNU/Linux. In 2019 ACM SIGSAC Con-
ference on Computer and Communications Security (CCS ’19), November
11–15, 2019, London, United Kingdom. ACM, New York, NY, USA, 3 pages.
https://doi.org/10.1145/3319535.3363285
1 INTRODUCTION
As the security community matures and progresses, the need for
well-founded security metrics and measurements becomes ever
more pressing [1], since the limitations of previous approaches are
better understood [5]. Quantitative analysis of the vulnerability
discovery pro...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A 60Gbps DPI Prototype based on Memory-Centric FPGA
author:Jinshu Su and
Shuhui Chen and
Biao Han and
Chengcheng Xu and
Xin Wang
A 60Gbps DPI Prototype based on
Memory-Centric FPGA
Jinshu Su† ‡, Shuhui Chen†, Biao Han†, Chengcheng Xu†, Xin Wang†
†College of Computer, National University of Defense Technology, Changsha, 410073, China
‡National Key Laboratory of Parallel and Distributed Processing, Changsha, 410073, China
{sjs, shchen, nudtbill, xuchengcheng, wangxin}@nudt.edu.cn
ABSTRACT
Deep packet inspection (DPI) is widely used in content-
aware network applications to detect string features. It
is of vital importance to improve the DPI performance
due to the ever-increasing link speed.
In this demo,
we propose a novel DPI architecture with a hierarchy
memory structure and parallel matching engines based
on memory-centric FPGA. The implemented DPI pro-
totype is able to provide up to 60Gbps full-text string
matching throughput and fast rules update speed.
CCS Concepts
•Networks → Deep packet inspection; •Theory
of computation → Pattern matching;
Keywords
DPI; string matching; hierarchical memory
1.
INTRODUCTION
DPI is a hardware and software solution that moni-
tors a network’s data stream by looking deep into data
packets. It provides important security and translation
functions in many network applications, such as net-
work intrusion detection system (NIDS), anti-virus pro-
tection, Internet content ﬁltering, etc. Until recently,
most DPI systems are not able to keep up with mod-
ern, 40Gbps+ network speed.
String pattern matching (SPM) is one of the most
widely used DPI mechanisms, in which the payload byte
sequence is matched against a dictionary of strings. As
the SPM methodology has to inspect the payload char-
acters byte by byte, it is usually regarded as the bottle-
neck of DPI. Most SPM solutions employ the classical
Permission to make digital or hard copies of all or part of this work for personal
or classroom use is granted without fee provided ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A 60Gbps DPI Prototype based on Memory-Centric FPGA
author:Jinshu Su and
Shuhui Chen and
Biao Han and
Chengcheng Xu and
Xin Wang
A 60Gbps DPI Prototype based on
Memory-Centric FPGA
Jinshu Su† ‡, Shuhui Chen†, Biao Han†, Chengcheng Xu†, Xin Wang†
†College of Computer, National University of Defense Technology, Changsha, 410073, China
‡National Key Laboratory of Parallel and Distributed Processing, Changsha, 410073, China
{sjs, shchen, nudtbill, xuchengcheng, wangxin}@nudt.edu.cn
ABSTRACT
Deep packet inspection (DPI) is widely used in content-
aware network applications to detect string features. It
is of vital importance to improve the DPI performance
due to the ever-increasing link speed.
In this demo,
we propose a novel DPI architecture with a hierarchy
memory structure and parallel matching engines based
on memory-centric FPGA. The implemented DPI pro-
totype is able to provide up to 60Gbps full-text string
matching throughput and fast rules update speed.
CCS Concepts
•Networks → Deep packet inspection; •Theory
of computation → Pattern matching;
Keywords
DPI; string matching; hierarchical memory
1.
INTRODUCTION
DPI is a hardware and software solution that moni-
tors a network’s data stream by looking deep into data
packets. It provides important security and translation
functions in many network applications, such as net-
work intrusion detection system (NIDS), anti-virus pro-
tection, Internet content ﬁltering, etc. Until recently,
most DPI systems are not able to keep up with mod-
ern, 40Gbps+ network speed.
String pattern matching (SPM) is one of the most
widely used DPI mechanisms, in which the payload byte
sequence is matched against a dictionary of strings. As
the SPM methodology has to inspect the payload char-
acters byte by byte, it is usually regarded as the bottle-
neck of DPI. Most SPM solutions employ the classical
Permission to make digital or hard copies of all or part of this work for personal
or classroom use is granted without fee provided ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Out of control: stealthy attacks against robotic vehicles protected
by control-based techniques
author:Pritam Dash and
Mehdi Karimibiuki and
Karthik Pattabiraman
Demo: Impact of Stealthy Attacks on Autonomous
Robotic Vehicle Missions
Pritam Dash, Mehdi Karimibiuki, and Karthik Pattabiraman
University of British Columbia
I. MOTIVATION AND KEY INSIGHTS
Robotic Vehicles (RV) use sensors to measure their phys-
ical states and derive the appropriate actuator signals for
autonomous navigation and other control operations. Unfor-
tunately, attackers can manipulate sensor and actuator signals
through malicious code injection [2], sensor spooﬁng [7], and
acoustic noise injection [6].
Model-based techniques have been recently proposed to
detect attacks against RVs. Control Invariants (CI) [3] and
Extended Kalman Filter (EKF) [1] are techniques that use
control-based estimations to derive invariants and monitor the
RV’s runtime behaviour to detect attacks. In this paper, we
demonstrate three stealthy attacks, namely false data injection
(FDI), artiﬁcial delay (AD), and switch mode (SM) attacks,
based on the ﬁndings of our previous work [4], [5]. The
stealthy attacks evade the CI and EKF detection techniques
and result in signiﬁcant adverse impact on the RV’s mission
(e.g., signiﬁcant deviations from the target or result in a crash).
Our main insight is that by design, CI and EKF techniques
have to tolerate some degree of deviation from the planned
trajectory due to environmental factors such as wind or sensor
noise, and hence set a threshold for ﬂagging errors between
model estimations and observed behaviour as attacks. Further,
we found that the control based estimation techniques fail to
accurately model RV’s runtime behavior. Because of the model
inaccuracies, CI and EKF techniques set a high threshold, and
perform stateless analysis in order to avoid false alarms. This
opens up new vulnerabilities, and allows attackers to launch
stealthy sensor and actuator attacks a...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Out of control: stealthy attacks against robotic vehicles protected
by control-based techniques
author:Pritam Dash and
Mehdi Karimibiuki and
Karthik Pattabiraman
Demo: Impact of Stealthy Attacks on Autonomous
Robotic Vehicle Missions
Pritam Dash, Mehdi Karimibiuki, and Karthik Pattabiraman
University of British Columbia
I. MOTIVATION AND KEY INSIGHTS
Robotic Vehicles (RV) use sensors to measure their phys-
ical states and derive the appropriate actuator signals for
autonomous navigation and other control operations. Unfor-
tunately, attackers can manipulate sensor and actuator signals
through malicious code injection [2], sensor spooﬁng [7], and
acoustic noise injection [6].
Model-based techniques have been recently proposed to
detect attacks against RVs. Control Invariants (CI) [3] and
Extended Kalman Filter (EKF) [1] are techniques that use
control-based estimations to derive invariants and monitor the
RV’s runtime behaviour to detect attacks. In this paper, we
demonstrate three stealthy attacks, namely false data injection
(FDI), artiﬁcial delay (AD), and switch mode (SM) attacks,
based on the ﬁndings of our previous work [4], [5]. The
stealthy attacks evade the CI and EKF detection techniques
and result in signiﬁcant adverse impact on the RV’s mission
(e.g., signiﬁcant deviations from the target or result in a crash).
Our main insight is that by design, CI and EKF techniques
have to tolerate some degree of deviation from the planned
trajectory due to environmental factors such as wind or sensor
noise, and hence set a threshold for ﬂagging errors between
model estimations and observed behaviour as attacks. Further,
we found that the control based estimation techniques fail to
accurately model RV’s runtime behavior. Because of the model
inaccuracies, CI and EKF techniques set a high threshold, and
perform stateless analysis in order to avoid false alarms. This
opens up new vulnerabilities, and allows attackers to launch
stealthy sensor and actuator attacks a...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Planck: millisecond-scale monitoring and control for commodity networks
author:Jeff Rasley and
Brent E. Stephens and
Colin Dixon and
Eric Rozner and
Wes Felter and
Kanak Agarwal and
John B. Carter and
Rodrigo Fonseca
Planck: Millisecond-scale Monitoring and Control for
Commodity Networks
Jeff Rasley†
Brent Stephens‡
Kanak Agarwal∗
Colin Dixon(cid:5)
Eric Rozner∗ Wes Felter∗
John Carter∗ Rodrigo Fonseca†
†Brown University
‡Rice University
∗IBM Research–Austin,TX
(cid:5)Brocade
ABSTRACT
Software-deﬁned networking introduces the possibility of building
self-tuning networks that constantly monitor network conditions and
react rapidly to important events such as congestion. Unfortunately,
state-of-the-art monitoring mechanisms for conventional networks
require hundreds of milliseconds to seconds to extract global net-
work state, like link utilization or the identity of “elephant” ﬂows.
Such latencies are adequate for responding to persistent issues, e.g.,
link failures or long-lasting congestion, but are inadequate for re-
sponding to transient problems, e.g., congestion induced by bursty
workloads sharing a link.
In this paper, we present Planck, a novel network measurement
architecture that employs oversubscribed port mirroring to extract
network information at 280 µs–7 ms timescales on a 1 Gbps com-
modity switch and 275 µs–4 ms timescales on a 10 Gbps commodity
switch, over 11x and 18x faster than recent approaches, respectively
(and up to 291x if switch ﬁrmware allowed buffering to be disabled
on some ports). To demonstrate the value of Planck’s speed and
accuracy, we use it to drive a trafﬁc engineering application that
can reroute congested ﬂows in milliseconds. On a 10 Gbps com-
modity switch, Planck-driven trafﬁc engineering achieves aggregate
throughput within 1–4% of optimal for most workloads we evalu-
ated, even with ﬂows as small as 50 MiB, an improvement of up to
53% over previous schemes.
Categories and Subject Descriptors
C.2.3 [Computer-Communica...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Planck: millisecond-scale monitoring and control for commodity networks
author:Jeff Rasley and
Brent E. Stephens and
Colin Dixon and
Eric Rozner and
Wes Felter and
Kanak Agarwal and
John B. Carter and
Rodrigo Fonseca
Planck: Millisecond-scale Monitoring and Control for
Commodity Networks
Jeff Rasley†
Brent Stephens‡
Kanak Agarwal∗
Colin Dixon(cid:5)
Eric Rozner∗ Wes Felter∗
John Carter∗ Rodrigo Fonseca†
†Brown University
‡Rice University
∗IBM Research–Austin,TX
(cid:5)Brocade
ABSTRACT
Software-deﬁned networking introduces the possibility of building
self-tuning networks that constantly monitor network conditions and
react rapidly to important events such as congestion. Unfortunately,
state-of-the-art monitoring mechanisms for conventional networks
require hundreds of milliseconds to seconds to extract global net-
work state, like link utilization or the identity of “elephant” ﬂows.
Such latencies are adequate for responding to persistent issues, e.g.,
link failures or long-lasting congestion, but are inadequate for re-
sponding to transient problems, e.g., congestion induced by bursty
workloads sharing a link.
In this paper, we present Planck, a novel network measurement
architecture that employs oversubscribed port mirroring to extract
network information at 280 µs–7 ms timescales on a 1 Gbps com-
modity switch and 275 µs–4 ms timescales on a 10 Gbps commodity
switch, over 11x and 18x faster than recent approaches, respectively
(and up to 291x if switch ﬁrmware allowed buffering to be disabled
on some ports). To demonstrate the value of Planck’s speed and
accuracy, we use it to drive a trafﬁc engineering application that
can reroute congested ﬂows in milliseconds. On a 10 Gbps com-
modity switch, Planck-driven trafﬁc engineering achieves aggregate
throughput within 1–4% of optimal for most workloads we evalu-
ated, even with ﬂows as small as 50 MiB, an improvement of up to
53% over previous schemes.
Categories and Subject Descriptors
C.2.3 [Computer-Communica...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:WATSON: Abstracting Behaviors from Audit Logs via Aggregation of
Contextual Semantics
author:Jun Zeng and
Zheng Leong Chua and
Yinfang Chen and
Kaihang Ji and
Zhenkai Liang and
Jian Mao
WATSON: Abstracting Behaviors from Audit Logs
via Aggregation of Contextual Semantics
Jun Zeng† Zheng Leong Chua‡+ Yinfang Chen† Kaihang Ji† Zhenkai Liang†
Jian Mao§∗
†School of Computing, National University of Singapore
‡Independent Researcher
§School of Cyber Science and Technology, Beihang University
{junzeng, yinfang, kaihang, liangzk}@comp.nus.edu.sg
czl@iiyume.org maojian@buaa.edu.cn
Abstract—Endpoint monitoring solutions are widely deployed
in today’s enterprise environments to support advanced attack
detection and investigation. These monitors continuously record
system-level activities as audit logs and provide deep visibility
into security incidents. Unfortunately, to recognize behaviors
of interest and detect potential threats, cyber analysts face a
semantic gap between low-level audit events and high-level system
behaviors. To bridge this gap, existing work largely matches
streams of audit logs against a knowledge base of rules that
describe behaviors. However, specifying such rules heavily relies
on expert knowledge. In this paper, we present WATSON, an
automated approach to abstracting behaviors by inferring and
aggregating the semantics of audit events. WATSON uncovers the
semantics of events through their usage context in audit logs. By
extracting behaviors as connected system operations, WATSON
then combines event semantics as the representation of behaviors.
To reduce analysis workload, WATSON further clusters semanti-
cally similar behaviors and distinguishes the representatives for
analyst investigation. In our evaluation against both benign and
malicious behaviors, WATSON exhibits high accuracy for behavior
abstraction. Moreover, WATSON can reduce analysis workload by
two orders of magnitude for attack investigation.
I.
INTRODUCTION
Security incidents in l...


Instruction: 总结这篇安全研究的主要观点

Input:
title:WATSON: Abstracting Behaviors from Audit Logs via Aggregation of
Contextual Semantics
author:Jun Zeng and
Zheng Leong Chua and
Yinfang Chen and
Kaihang Ji and
Zhenkai Liang and
Jian Mao
WATSON: Abstracting Behaviors from Audit Logs
via Aggregation of Contextual Semantics
Jun Zeng† Zheng Leong Chua‡+ Yinfang Chen† Kaihang Ji† Zhenkai Liang†
Jian Mao§∗
†School of Computing, National University of Singapore
‡Independent Researcher
§School of Cyber Science and Technology, Beihang University
{junzeng, yinfang, kaihang, liangzk}@comp.nus.edu.sg
czl@iiyume.org maojian@buaa.edu.cn
Abstract—Endpoint monitoring solutions are widely deployed
in today’s enterprise environments to support advanced attack
detection and investigation. These monitors continuously record
system-level activities as audit logs and provide deep visibility
into security incidents. Unfortunately, to recognize behaviors
of interest and detect potential threats, cyber analysts face a
semantic gap between low-level audit events and high-level system
behaviors. To bridge this gap, existing work largely matches
streams of audit logs against a knowledge base of rules that
describe behaviors. However, specifying such rules heavily relies
on expert knowledge. In this paper, we present WATSON, an
automated approach to abstracting behaviors by inferring and
aggregating the semantics of audit events. WATSON uncovers the
semantics of events through their usage context in audit logs. By
extracting behaviors as connected system operations, WATSON
then combines event semantics as the representation of behaviors.
To reduce analysis workload, WATSON further clusters semanti-
cally similar behaviors and distinguishes the representatives for
analyst investigation. In our evaluation against both benign and
malicious behaviors, WATSON exhibits high accuracy for behavior
abstraction. Moreover, WATSON can reduce analysis workload by
two orders of magnitude for attack investigation.
I.
INTRODUCTION
Security incidents in l...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Draco: A System for Uniform and Fine-grained Access Control for
Web Code on Android
author:G"uliz Seray Tuncay and
Soteris Demetriou and
Carl A. Gunter
Draco: A System for Uniform and Fine-grained
Access Control for Web Code on Android
Güliz Seray Tuncay
University of Illinois at
Urbana-Champaign
tuncay2@illinois.edu
Soteris Demetriou
University of Illinois at
Urbana-Champaign
sdemetr2@illinois.edu
Carl A. Gunter
University of Illinois at
Urbana-Champaign
cgunter@illinois.edu
ABSTRACT
In-app embedded browsers are commonly used by app developers
to display web content without having to redirect the user to heavy-
weight web browsers. Just like the conventional web browsers, em-
bedded browsers can allow the execution of web code. In addition,
they provide mechanisms (viz., JavaScript bridges) to give web code
access to internal app code that might implement critical function-
alities and expose device resources. This is intrinsically dangerous
since there is currently no means for app developers to perform
origin-based access control on the JavaScript bridges, and any web
code running in an embedded browser is free to use all the exposed
app and device resources. Previous work that addresses this prob-
lem provided access control solutions that work only for apps that
are built using hybrid frameworks. Additionally, these solutions fo-
cused on protecting only the parts of JavaScript bridges that expose
permissions-protected resources. In this work, our goal is to provide
a generic solution that works for all apps that utilize embedded web
browsers and protects all channels that give access to internal app
and device resources. Towards realizing this goal, we built Draco,
a uniform and ﬁne-grained access control framework for web code
running on Android embedded browsers (viz., WebView). Draco
provides a declarative policy language that allows developers to
deﬁne policies to specify the desired access characteristics of web
origins in a ﬁne-grained fashion...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Draco: A System for Uniform and Fine-grained Access Control for
Web Code on Android
author:G"uliz Seray Tuncay and
Soteris Demetriou and
Carl A. Gunter
Draco: A System for Uniform and Fine-grained
Access Control for Web Code on Android
Güliz Seray Tuncay
University of Illinois at
Urbana-Champaign
tuncay2@illinois.edu
Soteris Demetriou
University of Illinois at
Urbana-Champaign
sdemetr2@illinois.edu
Carl A. Gunter
University of Illinois at
Urbana-Champaign
cgunter@illinois.edu
ABSTRACT
In-app embedded browsers are commonly used by app developers
to display web content without having to redirect the user to heavy-
weight web browsers. Just like the conventional web browsers, em-
bedded browsers can allow the execution of web code. In addition,
they provide mechanisms (viz., JavaScript bridges) to give web code
access to internal app code that might implement critical function-
alities and expose device resources. This is intrinsically dangerous
since there is currently no means for app developers to perform
origin-based access control on the JavaScript bridges, and any web
code running in an embedded browser is free to use all the exposed
app and device resources. Previous work that addresses this prob-
lem provided access control solutions that work only for apps that
are built using hybrid frameworks. Additionally, these solutions fo-
cused on protecting only the parts of JavaScript bridges that expose
permissions-protected resources. In this work, our goal is to provide
a generic solution that works for all apps that utilize embedded web
browsers and protects all channels that give access to internal app
and device resources. Towards realizing this goal, we built Draco,
a uniform and ﬁne-grained access control framework for web code
running on Android embedded browsers (viz., WebView). Draco
provides a declarative policy language that allows developers to
deﬁne policies to specify the desired access characteristics of web
origins in a ﬁne-grained fashion...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:How the Internet reacted to Covid-19: A perspective from Facebook's
Edge Network
author:Timm B"ottger and
Ghida Ibrahim and
Ben Vallis
How the Internet reacted to Covid-19 – A perspective from
Facebook’s Edge Network
Timm Böttger, Ghida Ibrahim and Ben Vallis
Facebook
ABSTRACT
The Covid-19 pandemic has led to unprecedented changes in the
way people interact with each other, which as a consequence has
increased pressure on the Internet. In this paper we provide a per-
spective of the scale of Internet traffic growth and how well the
Internet coped with the increased demand as seen from Facebook’s
edge network.
We use this infrastructure serving multiple large social networks
and their related family of apps as vantage points to analyze how
traffic and product properties changed over the course of the be-
ginning of the Covid-19 pandemic. We show that there have been
changes in traffic demand, user behavior and user experience. We
also show that different regions of the world saw different magni-
tudes of impact with predominantly less developed regions exhibit-
ing larger performance degradations.
CCS CONCEPTS
• Networks→ Network measurement; • Information systems
→ Social networks.
ACM Reference Format:
Timm Böttger, Ghida Ibrahim and Ben Vallis. 2020. How the Internet reacted
to Covid-19 – A perspective from Facebook’s Edge Network. In ACM Internet
Measurement Conference (IMC ’20), October 27–29, 2020, Virtual Event, USA.
ACM, New York, NY, USA, 8 pages. https://doi.org/10.1145/3419394.3423621
1 INTRODUCTION
The Covid-19 pandemic is a global crisis without precedent in recent
history. The only other event which comes close is the 1918 Spanish
flu pandemic. Many countries world-wide have imposed lock-down
measures of varying degrees, leading to closures of offices, schools,
restaurants, factories and other venues.
This sudden and unpredictable change in people’s behavior also
changed the way Internet products are consumed and used. In this
paper we study ...


Instruction: 总结这篇安全研究的主要观点

Input:
title:How the Internet reacted to Covid-19: A perspective from Facebook's
Edge Network
author:Timm B"ottger and
Ghida Ibrahim and
Ben Vallis
How the Internet reacted to Covid-19 – A perspective from
Facebook’s Edge Network
Timm Böttger, Ghida Ibrahim and Ben Vallis
Facebook
ABSTRACT
The Covid-19 pandemic has led to unprecedented changes in the
way people interact with each other, which as a consequence has
increased pressure on the Internet. In this paper we provide a per-
spective of the scale of Internet traffic growth and how well the
Internet coped with the increased demand as seen from Facebook’s
edge network.
We use this infrastructure serving multiple large social networks
and their related family of apps as vantage points to analyze how
traffic and product properties changed over the course of the be-
ginning of the Covid-19 pandemic. We show that there have been
changes in traffic demand, user behavior and user experience. We
also show that different regions of the world saw different magni-
tudes of impact with predominantly less developed regions exhibit-
ing larger performance degradations.
CCS CONCEPTS
• Networks→ Network measurement; • Information systems
→ Social networks.
ACM Reference Format:
Timm Böttger, Ghida Ibrahim and Ben Vallis. 2020. How the Internet reacted
to Covid-19 – A perspective from Facebook’s Edge Network. In ACM Internet
Measurement Conference (IMC ’20), October 27–29, 2020, Virtual Event, USA.
ACM, New York, NY, USA, 8 pages. https://doi.org/10.1145/3419394.3423621
1 INTRODUCTION
The Covid-19 pandemic is a global crisis without precedent in recent
history. The only other event which comes close is the 1918 Spanish
flu pandemic. Many countries world-wide have imposed lock-down
measures of varying degrees, leading to closures of offices, schools,
restaurants, factories and other venues.
This sudden and unpredictable change in people’s behavior also
changed the way Internet products are consumed and used. In this
paper we study ...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:A Characterization of Load Balancing on the IPv6 Internet
author:Rafael Almeida and
Osvaldo L. H. M. Fonseca and
Elverton C. Fazzion and
Dorgival O. Guedes and
Wagner Meira Jr. and
'Italo S. Cunha
A Characterization of Load Balancing
on the IPv6 Internet
Rafael Almeida1(B), Osvaldo Fonseca1, Elverton Fazzion1,2, Dorgival Guedes1,
Wagner Meira Jr.1, and ´Italo Cunha1
1 Department of Computer Science,
Universidade Federal de Minas Gerais, Belo Horizonte, Brazil
{rlca,osvaldo.morais,elverton,dorgival,meira,cunha}@dcc.ufmg.br
2 Department of Computer Science,
Universidade Federal de S˜ao Jo˜ao del-Rei, S˜ao Jo˜ao del-Rei, Brazil
Abstract. As IPv6 deployment grows, it is important to develop new
measurement techniques that allow us to study the IPv6 Internet. We
implement an IPv6 version of the Multipath Detection Algorithm and
use it from 12 geographically-distributed vantage points on two diﬀer-
ent platforms to characterize IPv6 routers that perform load balancing.
Overall, we ﬁnd that 74% of IPv6 routes traverse at least one router
that performs load balancing. Similar to previous reports for IPv4, we
ﬁnd per-destination is the most prevalent type of load balancing; sur-
prisingly, we ﬁnd a signiﬁcantly higher prevalence of per-packet load
balancing for IPv6 traﬃc than previously reported for IPv4. We investi-
gate which header ﬁelds are used for load balancing, and ﬁnd that 4% of
IPv6 routers that perform load balancing consider IPv6’s Traﬃc Class
or Flow Label ﬁelds. Finally, we quantify how often routers modify the
Traﬃc Class and Flow Label IPv6 header ﬁelds and their impact on load
balancing.
Keywords: IPv6 · Traceroute · Measurement · Load balancing ·
Topology
1 Introduction
The growing deployment of IPv6 [7] increases its relevance for application perfor-
mance and reliability. As a result, the networking community has developed new
(and adapted existing IPv4) measurement tools to collect datasets and study the
IPv6 Internet (e.g., [4,12]).
Topology...


Instruction: 总结这篇安全研究的主要观点

Input:
title:A Characterization of Load Balancing on the IPv6 Internet
author:Rafael Almeida and
Osvaldo L. H. M. Fonseca and
Elverton C. Fazzion and
Dorgival O. Guedes and
Wagner Meira Jr. and
'Italo S. Cunha
A Characterization of Load Balancing
on the IPv6 Internet
Rafael Almeida1(B), Osvaldo Fonseca1, Elverton Fazzion1,2, Dorgival Guedes1,
Wagner Meira Jr.1, and ´Italo Cunha1
1 Department of Computer Science,
Universidade Federal de Minas Gerais, Belo Horizonte, Brazil
{rlca,osvaldo.morais,elverton,dorgival,meira,cunha}@dcc.ufmg.br
2 Department of Computer Science,
Universidade Federal de S˜ao Jo˜ao del-Rei, S˜ao Jo˜ao del-Rei, Brazil
Abstract. As IPv6 deployment grows, it is important to develop new
measurement techniques that allow us to study the IPv6 Internet. We
implement an IPv6 version of the Multipath Detection Algorithm and
use it from 12 geographically-distributed vantage points on two diﬀer-
ent platforms to characterize IPv6 routers that perform load balancing.
Overall, we ﬁnd that 74% of IPv6 routes traverse at least one router
that performs load balancing. Similar to previous reports for IPv4, we
ﬁnd per-destination is the most prevalent type of load balancing; sur-
prisingly, we ﬁnd a signiﬁcantly higher prevalence of per-packet load
balancing for IPv6 traﬃc than previously reported for IPv4. We investi-
gate which header ﬁelds are used for load balancing, and ﬁnd that 4% of
IPv6 routers that perform load balancing consider IPv6’s Traﬃc Class
or Flow Label ﬁelds. Finally, we quantify how often routers modify the
Traﬃc Class and Flow Label IPv6 header ﬁelds and their impact on load
balancing.
Keywords: IPv6 · Traceroute · Measurement · Load balancing ·
Topology
1 Introduction
The growing deployment of IPv6 [7] increases its relevance for application perfor-
mance and reliability. As a result, the networking community has developed new
(and adapted existing IPv4) measurement tools to collect datasets and study the
IPv6 Internet (e.g., [4,12]).
Topology...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:POSTER: Understanding the Hidden Cost of Software Vulnerabilities:
Measurements and Predictions
author:Afsah Anwar and
Aminollah Khormali and
Aziz Mohaisen
Understanding the Hidden Cost of
Software Vulnerabilities: Measurements
and Predictions
Afsah Anwar1(B), Aminollah Khormali1, DaeHun Nyang2, and Aziz Mohaisen1
1 University of Central Florida, Orlando, FL 32816, USA
{afsahanwar,aminkhormali}@knights.ucf.edu, mohaisen@ucf.edu
2 Inha University, Incheon, Republic of Korea
nyang@inha.ac.kr
Abstract. Vulnerabilities have a detrimental eﬀect on end-users and
enterprises, both direct and indirect; including loss of private data, intel-
lectual property, the competitive edge, performance, etc. Despite the
growing software industry and a push towards a digital economy, enter-
prises are increasingly considering security as an added cost, which makes
it necessary for those enterprises to see a tangible incentive in adopting
security. Furthermore, despite data breach laws that are in place, prior
studies have suggested that only 4% of reported data breach incidents
have resulted in litigation in federal courts, showing the limited legal
ramiﬁcations of security breaches and vulnerabilities.
In this paper, we study the hidden cost of software vulnerabilities
reported in the National Vulnerability Database (NVD) through stock
price analysis. Towards this goal, we perform a high-ﬁdelity data aug-
mentation to ensure data reliability and to estimate vulnerability dis-
closure dates as a baseline for estimating the implication of software
vulnerabilities. We further build a model for stock price prediction using
the NARX Neural Network model to estimate the eﬀect of vulnerability
disclosure on the stock price. Compared to prior work, which relies on
linear regression models, our approach is shown to provide better accu-
racy. Our analysis also shows that the eﬀect of vulnerabilities on vendors
varies, and greatly depends on the speciﬁc software industry. Whereas
some indu...


Instruction: 总结这篇安全研究的主要观点

Input:
title:POSTER: Understanding the Hidden Cost of Software Vulnerabilities:
Measurements and Predictions
author:Afsah Anwar and
Aminollah Khormali and
Aziz Mohaisen
Understanding the Hidden Cost of
Software Vulnerabilities: Measurements
and Predictions
Afsah Anwar1(B), Aminollah Khormali1, DaeHun Nyang2, and Aziz Mohaisen1
1 University of Central Florida, Orlando, FL 32816, USA
{afsahanwar,aminkhormali}@knights.ucf.edu, mohaisen@ucf.edu
2 Inha University, Incheon, Republic of Korea
nyang@inha.ac.kr
Abstract. Vulnerabilities have a detrimental eﬀect on end-users and
enterprises, both direct and indirect; including loss of private data, intel-
lectual property, the competitive edge, performance, etc. Despite the
growing software industry and a push towards a digital economy, enter-
prises are increasingly considering security as an added cost, which makes
it necessary for those enterprises to see a tangible incentive in adopting
security. Furthermore, despite data breach laws that are in place, prior
studies have suggested that only 4% of reported data breach incidents
have resulted in litigation in federal courts, showing the limited legal
ramiﬁcations of security breaches and vulnerabilities.
In this paper, we study the hidden cost of software vulnerabilities
reported in the National Vulnerability Database (NVD) through stock
price analysis. Towards this goal, we perform a high-ﬁdelity data aug-
mentation to ensure data reliability and to estimate vulnerability dis-
closure dates as a baseline for estimating the implication of software
vulnerabilities. We further build a model for stock price prediction using
the NARX Neural Network model to estimate the eﬀect of vulnerability
disclosure on the stock price. Compared to prior work, which relies on
linear regression models, our approach is shown to provide better accu-
racy. Our analysis also shows that the eﬀect of vulnerabilities on vendors
varies, and greatly depends on the speciﬁc software industry. Whereas
some indu...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Policy-based routing with non-strict preferences
author:Chi-Kin Chau
Policy-based Routing with Non-strict Preferences
Chi-kin Chau
Computer Laboratory
University of Cambridge
chi-kin.chau@cl.cam.ac.uk
ABSTRACT
Traditional studies of routing problems often assumed strict
preferences on paths, by eliminating ambiguity in path com-
parisons, or imposing a priori deterministic tie-breaking.
Such an assumption is outpaced by today’s common prac-
tice of non-deterministic, multi-path routing, which is cru-
cial to traﬃc engineering, QoS routing, multicasting and
virtual private networking. A pair of paths may be incom-
parable or equally preferred. In the presence of ambiguous
preferences at pairs, or even multiple collections of paths,
a challenge is to ensure robustness in the complex and so-
phisticated situations of policy-based routing where hetero-
geneous routing policies are allowed among routing systems.
This paper presents an extensive study of policy-based rout-
ing with non-strict preferences, deriving suﬃcient conditions
that ensure the existence, optimality and asynchronous con-
vergence of stable routings.
Categories and Subject Descriptors: C.2 [Computer
Systems Organization]: Computer-Communication Networks
—Network Protocols, Internetworking
General Terms: Design, Theory, Algorithms
Keywords: Policy-based Routing, Robustness
1.
INTRODUCTION
Even though routing is a relatively old problem and stud-
ied extensively in the traditional minimum-weight routing
approach, the issue of strict and non-strict preferences has
usually been overlooked. Routing systems, which might be
routers or ASes, often face the decision of multiple alterna-
tive paths to a destination. The notion of strict preferences
refers to the practice of no ambiguity in comparing every
pair of paths. For instance, it is often assumed that each
routing system may select and announce only one of its al-
ternative available paths, which is so-called uni-path routing.
Essentially, this wil...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Policy-based routing with non-strict preferences
author:Chi-Kin Chau
Policy-based Routing with Non-strict Preferences
Chi-kin Chau
Computer Laboratory
University of Cambridge
chi-kin.chau@cl.cam.ac.uk
ABSTRACT
Traditional studies of routing problems often assumed strict
preferences on paths, by eliminating ambiguity in path com-
parisons, or imposing a priori deterministic tie-breaking.
Such an assumption is outpaced by today’s common prac-
tice of non-deterministic, multi-path routing, which is cru-
cial to traﬃc engineering, QoS routing, multicasting and
virtual private networking. A pair of paths may be incom-
parable or equally preferred. In the presence of ambiguous
preferences at pairs, or even multiple collections of paths,
a challenge is to ensure robustness in the complex and so-
phisticated situations of policy-based routing where hetero-
geneous routing policies are allowed among routing systems.
This paper presents an extensive study of policy-based rout-
ing with non-strict preferences, deriving suﬃcient conditions
that ensure the existence, optimality and asynchronous con-
vergence of stable routings.
Categories and Subject Descriptors: C.2 [Computer
Systems Organization]: Computer-Communication Networks
—Network Protocols, Internetworking
General Terms: Design, Theory, Algorithms
Keywords: Policy-based Routing, Robustness
1.
INTRODUCTION
Even though routing is a relatively old problem and stud-
ied extensively in the traditional minimum-weight routing
approach, the issue of strict and non-strict preferences has
usually been overlooked. Routing systems, which might be
routers or ASes, often face the decision of multiple alterna-
tive paths to a destination. The notion of strict preferences
refers to the practice of no ambiguity in comparing every
pair of paths. For instance, it is often assumed that each
routing system may select and announce only one of its al-
ternative available paths, which is so-called uni-path routing.
Essentially, this wil...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:Detecting and characterizing social spam campaigns
author:Hongyu Gao and
Jun Hu and
Christo Wilson and
Zhichun Li and
Yan Chen and
Ben Y. Zhao
Detecting and Characterizing Social Spam Campaigns
Hongyu Gao
Northwestern University
Evanston, IL, USA
Jun Hu
HUST
Wuhan, China
hygao@u.northwestern.edu
junehu1210@gmail.com
Zhichun Li
Yan Chen
Northwestern University
Northwestern University
Evanston, IL, USA
Evanston, IL, USA
lizc@cs.northwestern.edu
ychen@northwestern.edu
Christo Wilson
U. C. Santa Barbara
Santa Barbara, CA USA
bowlin@cs.ucsb.edu
Ben Y. Zhao
U. C. Santa Barbara
Santa Barbara, CA USA
ravenben@cs.ucsb.edu
ABSTRACT
Online social networks (OSNs) are exceptionally useful collab-
oration and communication tools for millions of users and their
friends. Unfortunately, in the wrong hands, they are also extremely
effective tools for executing spam campaigns and spreading mal-
ware.
In this poster, we present an initial study to detect and quanti-
tatively analyze the coordinated spam campaigns on online social
networks in the wild. Our system detected about 200K malicious
wall posts with embedded URLs, traced back to roughly 57K ac-
counts. We ﬁnd that more than 70% of all malicious wall posts are
advertising phishing sites.
Categories and Subject Descriptors
J.4 [Computer Applications]: Social and behavioral sciences
General Terms
Human Factors, Measurement, Security
Keywords
Online social networks, Spam, Spam Campaigns
1.
INTRODUCTION
Online social networks (OSNs) are exceptionally useful collabo-
ration and communication tools for millions of Internet users. Un-
fortunately, recent evidence shows that these trusted communities
could become highly effective mechanisms for spreading malware
and phishing attacks. Popular OSNs have recently become the
target of phishing attacks launched from large botnets [2, 3], and
account credentials are already being sold online in underground
forums [5]. Using compromised or fake accounts, attackers can
turn the trusted OS...


Instruction: 总结这篇安全研究的主要观点

Input:
title:Detecting and characterizing social spam campaigns
author:Hongyu Gao and
Jun Hu and
Christo Wilson and
Zhichun Li and
Yan Chen and
Ben Y. Zhao
Detecting and Characterizing Social Spam Campaigns
Hongyu Gao
Northwestern University
Evanston, IL, USA
Jun Hu
HUST
Wuhan, China
hygao@u.northwestern.edu
junehu1210@gmail.com
Zhichun Li
Yan Chen
Northwestern University
Northwestern University
Evanston, IL, USA
Evanston, IL, USA
lizc@cs.northwestern.edu
ychen@northwestern.edu
Christo Wilson
U. C. Santa Barbara
Santa Barbara, CA USA
bowlin@cs.ucsb.edu
Ben Y. Zhao
U. C. Santa Barbara
Santa Barbara, CA USA
ravenben@cs.ucsb.edu
ABSTRACT
Online social networks (OSNs) are exceptionally useful collab-
oration and communication tools for millions of users and their
friends. Unfortunately, in the wrong hands, they are also extremely
effective tools for executing spam campaigns and spreading mal-
ware.
In this poster, we present an initial study to detect and quanti-
tatively analyze the coordinated spam campaigns on online social
networks in the wild. Our system detected about 200K malicious
wall posts with embedded URLs, traced back to roughly 57K ac-
counts. We ﬁnd that more than 70% of all malicious wall posts are
advertising phishing sites.
Categories and Subject Descriptors
J.4 [Computer Applications]: Social and behavioral sciences
General Terms
Human Factors, Measurement, Security
Keywords
Online social networks, Spam, Spam Campaigns
1.
INTRODUCTION
Online social networks (OSNs) are exceptionally useful collabo-
ration and communication tools for millions of Internet users. Un-
fortunately, recent evidence shows that these trusted communities
could become highly effective mechanisms for spreading malware
and phishing attacks. Popular OSNs have recently become the
target of phishing attacks launched from large botnets [2, 3], and
account credentials are already being sold online in underground
forums [5]. Using compromised or fake accounts, attackers can
turn the trusted OS...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:When Malware Changed Its Mind: An Empirical Study of Variable Program
Behaviors in the Real World
author:Erin Avllazagaj and
Ziyun Zhu and
Leyla Bilge and
Davide Balzarotti and
Tudor Dumitras
When Malware Changed Its Mind: An Empirical Study
of Variable Program Behaviors in the Real World
Erin Avllazagaj, University of Maryland, College Park; Ziyun Zhu, Facebook;
Leyla Bilge, NortonLifeLock Research Group; Davide Balzarotti, EURECOM;
Tudor Dumitras, University of Maryland, College Park
https://www.usenix.org/conference/usenixsecurity21/presentation/avllazagaj
This paper is included in the Proceedings of the 30th USENIX Security Symposium.August 11–13, 2021978-1-939133-24-3Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX.When Malware Changed Its Mind
An Empirical Study of Variable Program Behaviors in the Real World
Erin Avllazagaj, Ziyun Zhu+, Leyla Bilge*, Davide Balzarotti†, Tudor Dumitras,
University of Maryland, College Park
*NortonLifeLock Research Group
+Facebook
†EURECOM
Abstract
Behavioral program analysis is widely used for understanding
malware behavior, for creating rule-based detectors, and for
clustering samples into malware families. However, this ap-
proach is ineffective when the behavior of individual samples
changes across different executions, owing to environment
sensitivity, evasive techniques or time variability. While the
inability to observe the complete behavior of a program is a
well-known limitation of dynamic analysis, the prevalence of
this behavior variability in the wild, and the behavior com-
ponents that are most affected by it, are still unknown. As
the behavioral traces are typically collected by executing the
samples in a controlled environment, the models created and
tested using such traces do not account for the broad range
of behaviors observed in the wild, and may result in a false
sense of security.
In this paper we conduct the ﬁrst quantitative analysis
of behavioral vari...


Instruction: 总结这篇安全研究的主要观点

Input:
title:When Malware Changed Its Mind: An Empirical Study of Variable Program
Behaviors in the Real World
author:Erin Avllazagaj and
Ziyun Zhu and
Leyla Bilge and
Davide Balzarotti and
Tudor Dumitras
When Malware Changed Its Mind: An Empirical Study
of Variable Program Behaviors in the Real World
Erin Avllazagaj, University of Maryland, College Park; Ziyun Zhu, Facebook;
Leyla Bilge, NortonLifeLock Research Group; Davide Balzarotti, EURECOM;
Tudor Dumitras, University of Maryland, College Park
https://www.usenix.org/conference/usenixsecurity21/presentation/avllazagaj
This paper is included in the Proceedings of the 30th USENIX Security Symposium.August 11–13, 2021978-1-939133-24-3Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX.When Malware Changed Its Mind
An Empirical Study of Variable Program Behaviors in the Real World
Erin Avllazagaj, Ziyun Zhu+, Leyla Bilge*, Davide Balzarotti†, Tudor Dumitras,
University of Maryland, College Park
*NortonLifeLock Research Group
+Facebook
†EURECOM
Abstract
Behavioral program analysis is widely used for understanding
malware behavior, for creating rule-based detectors, and for
clustering samples into malware families. However, this ap-
proach is ineffective when the behavior of individual samples
changes across different executions, owing to environment
sensitivity, evasive techniques or time variability. While the
inability to observe the complete behavior of a program is a
well-known limitation of dynamic analysis, the prevalence of
this behavior variability in the wild, and the behavior com-
ponents that are most affected by it, are still unknown. As
the behavioral traces are typically collected by executing the
samples in a controlled environment, the models created and
tested using such traces do not account for the broad range
of behaviors observed in the wild, and may result in a false
sense of security.
In this paper we conduct the ﬁrst quantitative analysis
of behavioral vari...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。


Instruction: 请分析这篇安全论文的内容

Output:
安全论文分析：

title:AURORA: Statistical Crash Analysis for Automated Root Cause Explanation
author:Tim Blazytko and
Moritz Schl"ogel and
Cornelius Aschermann and
Ali Abbasi and
Joel Frank and
Simon W"orner and
Thorsten Holz
Aurora: Statistical Crash Analysis for
Automated Root Cause Explanation
Tim Blazytko, Moritz Schlögel, Cornelius Aschermann, Ali Abbasi,
Joel Frank, Simon Wörner, and Thorsten Holz, Ruhr-Universität Bochum
https://www.usenix.org/conference/usenixsecurity20/presentation/blazytko
This paper is included in the Proceedings of the 29th USENIX Security Symposium.August 12–14, 2020978-1-939133-17-5Open access to the Proceedings of the 29th USENIX Security Symposium is sponsored by USENIX.AURORA: Statistical Crash Analysis for Automated Root Cause Explanation
Tim Blazytko, Moritz Schlögel, Cornelius Aschermann, Ali Abbasi,
Joel Frank, Simon Wörner and Thorsten Holz
Ruhr-Universität Bochum, Germany
Abstract
Given the huge success of automated software testing tech-
niques, a large amount of crashes is found in practice. Identi-
fying the root cause of a crash is a time-intensive endeavor,
causing a disproportion between ﬁnding a crash and ﬁxing
the underlying software fault. To address this problem, vari-
ous approaches have been proposed that rely on techniques
such as reverse execution and backward taint analysis. Still,
these techniques are either limited to certain fault types or
provide an analyst with assembly instructions, but no context
information or explanation of the underlying fault.
In this paper, we propose an automated analysis approach
that does not only identify the root cause of a given crash-
ing input for a binary executable, but also provides the ana-
lyst with context information on the erroneous behavior that
characterizes crashing inputs. Starting with a single crashing
input, we generate a diverse set of similar inputs that either
also crash the program or induce benign behavior. We then
trace the program’s states while executing e...


Instruction: 总结这篇安全研究的主要观点

Input:
title:AURORA: Statistical Crash Analysis for Automated Root Cause Explanation
author:Tim Blazytko and
Moritz Schl"ogel and
Cornelius Aschermann and
Ali Abbasi and
Joel Frank and
Simon W"orner and
Thorsten Holz
Aurora: Statistical Crash Analysis for
Automated Root Cause Explanation
Tim Blazytko, Moritz Schlögel, Cornelius Aschermann, Ali Abbasi,
Joel Frank, Simon Wörner, and Thorsten Holz, Ruhr-Universität Bochum
https://www.usenix.org/conference/usenixsecurity20/presentation/blazytko
This paper is included in the Proceedings of the 29th USENIX Security Symposium.August 12–14, 2020978-1-939133-17-5Open access to the Proceedings of the 29th USENIX Security Symposium is sponsored by USENIX.AURORA: Statistical Crash Analysis for Automated Root Cause Explanation
Tim Blazytko, Moritz Schlögel, Cornelius Aschermann, Ali Abbasi,
Joel Frank, Simon Wörner and Thorsten Holz
Ruhr-Universität Bochum, Germany
Abstract
Given the huge success of automated software testing tech-
niques, a large amount of crashes is found in practice. Identi-
fying the root cause of a crash is a time-intensive endeavor,
causing a disproportion between ﬁnding a crash and ﬁxing
the underlying software fault. To address this problem, vari-
ous approaches have been proposed that rely on techniques
such as reverse execution and backward taint analysis. Still,
these techniques are either limited to certain fault types or
provide an analyst with assembly instructions, but no context
information or explanation of the underlying fault.
In this paper, we propose an automated analysis approach
that does not only identify the root cause of a given crash-
ing input for a binary executable, but also provides the ana-
lyst with context information on the erroneous behavior that
characterizes crashing inputs. Starting with a single crashing
input, we generate a diverse set of similar inputs that either
also crash the program or induce benign behavior. We then
trace the program’s states while executing e...

Output: 这篇论文提供了重要的安全研究见解，对网络安全防护具有指导意义。