Nowadays, huge amount of documents are increasingly trans- ferred to the remote servers due to the appealing features of cloud computing. On the other hand, privacy and se- curity of the sensitive information in untru...
详细信息
Cloud computing, the architecture which shares dynamic heterogeneous characteristics in the cross-layer service composition, has affected traditional security, trust and privacy mechanisms which are mainly based on da...
详细信息
Cloud computing, the architecture which shares dynamic heterogeneous characteristics in the cross-layer service composition, has affected traditional security, trust and privacy mechanisms which are mainly based on data encryption and access control. Approaches that can support accurate privacy requirement description and verifiable compliance between the privacy requirement and system practice need to be developed to fit this new paradigm. To tackle the issues of privacy requirement modeling and verification in cloud computing, a framework that supports model checking consistency, entailment and compliance with the formal definition of privacy requirements and privacy model of cloud application is proposed. This paper provides an overview of the scientific research problem, approaches to solve the problem and ways to evaluate the solution found by the research related PhD thesis.
Research on effective and efficient mobile threat analysis becomes an emerging and important topic in cybersecurity research area. Static analysis and dynamic analysis constitute two of the most popular types of techn...
详细信息
ISBN:
(纸本)9781450336239
Research on effective and efficient mobile threat analysis becomes an emerging and important topic in cybersecurity research area. Static analysis and dynamic analysis constitute two of the most popular types of techniques for security analysis and evaluation;nevertheless, each of them has its strengths and weaknesses. To leverage the benefits of both approaches, we propose a hybrid approach that integrates the static and dynamic analysis for detecting security threats in mobile applications. The key of this approach is the unification of data states and software execution on critical test paths. The approach consists of two phases. In the first phase, a pilot static analysis is conducted to identify potential critical attack paths based on Android APIs and existing attack patterns. In the second phase, a dynamic analysis follows the identified critical paths to execute the program in a limited and focused manner. Attacks shall be detected by checking the conformance of the detected paths with existing attack patterns. The method will report the types of detected attack scenarios based on types of sensitive data that may be compromised, such as web browser cookie.
The fairly recent explosion in the availability of reasonably fast wireless and mobile data networks has spurred demand for more capable mobile computing devices. Conversely, the emergence of new devices increases dem...
详细信息
ISBN:
(纸本)9781450334730
The fairly recent explosion in the availability of reasonably fast wireless and mobile data networks has spurred demand for more capable mobile computing devices. Conversely, the emergence of new devices increases demand for better networks, creating a virtuous cycle. The current concept of a smartphone as an always-connected computing device with multiple sensing modalities was brought into the mainstream by the Apple iPhone just a few years ago. Such devices are now seeing an explosive growth. Additionally, for many people in the world, such devices will be the first computers they use. Furthermore, small, cheap, always-connected devices (standalone or peripheral) with additional sensing capabilities are very recently emerging, further blurring the lines between the Web, mobile applications (a.k.a. apps), and the real world. All of this opens up countless possibilities for data collection and analysis, for a broad range of applications. In this tutorial, we survey the state-of-the-art in terms of mining mobility data across different application areas such as ads, geo-social, privacy and security. Our tutorial consists of three parts. (1) We summarize the possibilities and challenges in the collection of data from various sensing modalities. (2) We cover cross-cutting challenges such as real-time analysis and security;and we outline cross-cutting algorithms for mobile data mining such as network inference and streaming algorithms. (3) We focus on how all of this can be usefully applied to broad classes of applications, notably mobile and location-based social, mobile advertising and search, mobile Web, and privacy and security. We conclude by showcasing the opportunities for new data collection techniques and new data mining methods to meet the challenges and applications that are unique to the mobile arena (e.g., leveraging emerging embedded computing and sensing technologies to collect a large variety and volume of new kinds of "big data").
Exploiting memory disclosure vulnerabilities like the Heart Bleed bug may cause arbitrary reading of a victim's memory, leading to leakage of critical secrets such as crypto keys, personal identity and financial i...
详细信息
ISBN:
(纸本)9781450338325
Exploiting memory disclosure vulnerabilities like the Heart Bleed bug may cause arbitrary reading of a victim's memory, leading to leakage of critical secrets such as crypto keys, personal identity and financial information. While isolating code that manipulates critical secrets into an isolated execution environment is a promising countermeasure, existing approaches are either too coarse-grained to prevent intra-domain attacks, or require excessive intervention from low-level software (e.g., hypervisor or OS), or both. Further, few of them are applicable to large-scale software with millions of lines of code. This paper describes a new approach, namely SeCage, which retrofits commodity hardware virtualization extensions to support efficient isolation of sensitive code manipulating critical secrets from the remaining code. SeCage is designed to work under a strong adversary model where a victim application or even the OS may be controlled by the adversary, while supporting large-scale software with small deployment cost. SeCage combines static and dynamic analysis to decompose monolithic software into several compartments, each of which may contain different secrets and their corresponding code. Following the idea of separating control and data plane, SeCage retrofits the VMFUNC mechanism and nested paging in Intel processors to transparently provide different memory views for different compartments, while allowing low-cost and transparent invocation across domains without hypervisor intervention. We have implemented SeCage in KVM on a commodity Intel machine. To demonstrate the effectiveness of SeCage, we deploy it to the Nginx and OpenSSH server with the OpenSSL library as well as CryptoLoop with small efforts. security evaluation shows that SeCage can prevent the disclosure of private keys from HeartBleed attacks and memory scanning from rootkits. The evaluation shows that SeCage only incurs small performance and space overhead.
Android has 81.5% of the smartphone market now, and it is also suffering from the explosive growth of malicious applications (or apps). These apps steal users' secret data and transmit it out of the phones. By ana...
详细信息
ISBN:
(纸本)9781450338325
Android has 81.5% of the smartphone market now, and it is also suffering from the explosive growth of malicious applications (or apps). These apps steal users' secret data and transmit it out of the phones. By analyzing the required permissions and the abnormal behaviors, some malicious apps may be easily detected. However, in this paper, we present a bidirectional covert channel in Android, named biTheft, which steals secrets and privacies covertly without any permission. biTheft firstly collects secret data from a set of unprotected shared resources in Android system. Then, it analyzes and infers secrets from the data. With the Intent mechanism, biTheft transmits secrets by legally launching some activities of other apps without requiring any permission itself. biTheft also monitors the usages and statuses of the shared resources to receive commands from remote server. We implement a biTheft scenario, and demonstrate that some types of secrets can be stolen and transmitted out. With pre-agreement, biTheft dynamically adjusts according with the remote server commands. Comparing with the traditional covert channels, biTheft is more practical in the real world scenarios.
暂无评论