DNS is an important data source for security for many reasons. If the DNS infrastructure can be brought down, many networking tasks would be impossible to complete. If the integrity of the mapping between domain names...
详细信息
ISBN:
(纸本)9781450331913
DNS is an important data source for security for many reasons. If the DNS infrastructure can be brought down, many networking tasks would be impossible to complete. If the integrity of the mapping between domain names and IP addresses is compromised, attackers can redirect users undetectably to IP addresses of their choosing. And malware of many types must in one way or another use the DNS infrastructure as part of their operations. For example, botnets often use fast flux techniques and domain name generation algorithms to rendezvous with command and control *** DNS is a significant challenge. In HP, our core internal DNS clusters process approximately 16 billion DNS packets every day. Ideally, we would like to turn each and every one of those packets into an event for our security information and event management (SIEM) system. However, we would have to grow our SIEM, which is one of the largest deployments in the world, by a factor of six to collect this data. Moreover, traditional logging has a substantial performance impact on the DNS infrastructure, and therefore from an operational perspective enabling logging is also impractical. Finally, DNS servers generally do not log the information necessary to detect many security *** deal withthese problems we collect and filter this traffic using hardware network packet sniffers, which have no impact on the performance of the DNS servers and allows us to collect all of the information we need for security purposes. We model known good traffic, and discard it, keeping only anomalous *** developed a custom analytics engine, which analyzes this data looking for evidence of botnet infections, blacklist hits, cloud platform abuse, beaconing, data exfiltration, and cache poisoning attempts. the results of these analyses is turned into a set of alerts which are sent to our security Operations Center (SOC). We've also developed a user interface including various visualizations to help analysts exp
Enterprises are increasingly subject to compliance rules that originate from corporate guidelines, industry sector standards, and laws. the goal of access control is to protect against unauthorized users. However, thr...
详细信息
ISBN:
(纸本)9781450331913
Enterprises are increasingly subject to compliance rules that originate from corporate guidelines, industry sector standards, and laws. the goal of access control is to protect against unauthorized users. However, threats also often reside within organizations where authorized users may misuse system resources. Although access control is fundamental in protecting information systems, it can pose an obstacle to achieving business objectives. Today, security policies have to be aligned withthe business goals and are not anymore a purely technical issue. Business processes are therefore of special interest. When described by workflows, they define the causal dependencies between a set of tasks, whose execution constitutes a business objective. Already in 1999, Bertino, Ferrari and Atluri showed how to specify and enforce authorization constraints in workflow management systems [1]. But only in recent years, triggered by the raise of high-level modeling languages such as the Business Process Model and Notation (BPMN), business processes were enhanced with compliance requirements in terms of process annotations, tying the control objectives into the execution *** talk will look at recent research results in this area, including approaches to scope authorization constraints within workflows with loops and conditional execution [2], to capture the effects of enforcement on business objectives [3], and to select the optimal between multiple authorization policies satisfying the given constraints [4].this work was mainly done in collaboration with Samuel Burri, when we both were at IBM Research -- Zurich, and David Basin from Eth Zurich.
Research on effective and efficient mobile threat analysis becomes an emerging and important topic in cybersecurity research area. Static analysis and dynamic analysis constitute two of the most popular types of techn...
详细信息
ISBN:
(纸本)9781450336239
Research on effective and efficient mobile threat analysis becomes an emerging and important topic in cybersecurity research area. Static analysis and dynamic analysis constitute two of the most popular types of techniques for security analysis and evaluation; nevertheless, each of them has its strengths and weaknesses. To leverage the benefits of both approaches, we propose a hybrid approach that integrates the static and dynamic analysis for detecting securitythreats in mobile applications. the key of this approach is the unification of data states and software execution on critical test paths. the approach consists of two phases. In the first phase, a pilot static analysis is conducted to identify potential critical attack paths based on Android APIs and existing attack patterns. In the second phase, a dynamic analysis follows the identified critical paths to execute the program in a limited and focused manner. Attacks shall be detected by checking the conformance of the detected paths with existing attack patterns. the method will report the types of detected attack scenarios based on types of sensitive datathat may be compromised, such as web browser cookie.
We present a non-probabilistic model for dynamic quantitative data flow tracking. Estimations of the amount of data stored in a particular representation at runtime - a file, a window, a network packet - enable the ad...
详细信息
ISBN:
(纸本)9781450322782
We present a non-probabilistic model for dynamic quantitative data flow tracking. Estimations of the amount of data stored in a particular representation at runtime - a file, a window, a network packet - enable the adoption of finegrained policies which authorize or prohibit partial leaks of data. We prove the correctness of the estimations, provide an implementation that we evaluate w.r.t. precision and performance, and analyze one instantiation at the OS level. Copyright is held by the owner/author(s).
High data rates are essential for next-generation wireless networks to support a growing number of computing devices and networking services. Small cell base station (SCBS) (e.g., picocells, microcells, femtocells) te...
ISBN:
(纸本)9781450336239
High data rates are essential for next-generation wireless networks to support a growing number of computing devices and networking services. Small cell base station (SCBS) (e.g., picocells, microcells, femtocells) technology is a cost-effective solution to address this issue. However, one challenging issue withthe increasingly dense network is the need for a distributed and scalable access point association protocol. In addition, the reduced cell size makes it easy for an adversary to map out the geographical locations of the mobile users, and hence breaching their location privacy. To address these issues, we establish a game-theoretic framework to develop a privacy-preserving stable matching algorithm that captures the large scale and heterogeneity nature of 5G networks. We show that without the privacy-preserving mechanism, an attacker can infer the location of the users by observing wireless connections and the knowledge of physical-layer system parameters. the protocol presented in this work provides a decentralized differentially private association algorithm which guarantees privacy to a large number of users in the network. We evaluate our algorithm using case studies, and demonstrate the tradeoff between privacy and system-wide performance for different privacy requirements and a varying number of mobile users in the network. Our simulation results corroborate the result that the total number of mobile users should be lower than the overall network capacity to achieve desirable levels of privacy and QoS.
the prolonged lifetime of sensitive data (such as passwords) in applications gives rise to several security risks. A promising approach is to erase sensitive data in an "eager fashion", i.e., as soon as its ...
详细信息
ISBN:
(纸本)9781450322782
the prolonged lifetime of sensitive data (such as passwords) in applications gives rise to several security risks. A promising approach is to erase sensitive data in an "eager fashion", i.e., as soon as its use is no longer required in the application. this approach of minimizing the lifetime of sensitive data has been applied to sequential programs. In this short paper, we present an extension of the this approach to concurrent programs where the interleaving of threads makes such eager erasures a challenging research problem. Copyright is held by the author/owner(s).
In this paper we propose a method for detecting man-in-themiddle attacks using the timestamps of TCP packet headers. From these timestamps, the delays can be calculated and by comparing the mean of the delays in the c...
详细信息
ISBN:
(纸本)9781450322782
In this paper we propose a method for detecting man-in-themiddle attacks using the timestamps of TCP packet headers. From these timestamps, the delays can be calculated and by comparing the mean of the delays in the current connection to data gathered from previous sessions it is possible to detect if the packets have unusually long delays. We show that in our small case study we can find and set a threshold parameter that accurately detects man-in-the-middle attacks with a low probability of false positives. thus, it may be used as a simple precautionary measure against malicious attacks. the method in its current form is limited to nonmobile systems, where the variations in the delay are fairly low and uniform. Copyright is held by the author/owner(s).
Cloud computing is a revolutionary computing paradigm which enables flexible, on-demand and low-cost usage of computing resources. those advantages are the causes of security and privacy problems, which emerge because...
详细信息
ISBN:
(纸本)9781479932795
Cloud computing is a revolutionary computing paradigm which enables flexible, on-demand and low-cost usage of computing resources. those advantages are the causes of security and privacy problems, which emerge because the data owned by different users are stored in some cloud servers instead of under their own control. How to protect the dataprivacy is the most important in cloud computing. In this paper, based on virtual adversary structure, a datasecurity access scheme is proposed to protect sensitive data. the virtual adversary structure is realized by an efficient secret sharing scheme. the scheme has been shown to have reconstruction and perfect properties of the secret sharing. It only performs modular additions and subtractions and every share is replicated in multiple share sets. Based on virtual adversary structure and secret sharing, the scheme also has some advantages: low computational complexity and high recoverability.
the multiplicative perturbation is a popular scheme for privacy preserving data mining. It transforms the original data withthe projection matrix. the security of projection matrix is a main concern in the multiplica...
详细信息
ISBN:
(纸本)9781479932795
the multiplicative perturbation is a popular scheme for privacy preserving data mining. It transforms the original data withthe projection matrix. the security of projection matrix is a main concern in the multiplicative perturbation scheme. In this paper, we propose a novel multiplicative perturbation scheme which has a large key space. And we utilize the special property of chaotic systems, i.e., sensitivity to the initial condition and parameter, to design a new projection matrix generation algorithm. the experiment results show that the proposed scheme can preserve the privacy and maintain the utility for data miming.
Provenance workflows capture the data movement and the operations changing the data in complex applications such as scientific computations, document management in large organizations, content generation in social med...
详细信息
ISBN:
(纸本)9781450322782
Provenance workflows capture the data movement and the operations changing the data in complex applications such as scientific computations, document management in large organizations, content generation in social media, etc. Provenance is essential to understand the processes and operations that data undergo, and many research efforts focused on modeling, capturing and analyzing provenance information. Sharing provenance brings numerous benefits, but may also disclose sensitive information, such as secret processes of synthesizing chemical substances, confidential business practices and private details about social media participants' lives. In this paper, we study privacy-preserving provenance workflow publication using differential privacy. We adapt techniques designed for sanitization of multi-dimensional spatial data to the problem of provenance workflows. Experimental results show that such an approach is feasible to protect provenance workflows, while at the same time retaining a significant amount of utility for queries. In addition, we identify influential factors and trade-offs that emerge when sanitizing provenance workflows. Copyright is held by the author/owner(s).
暂无评论