Much of the research that our community publishes is based on data. However, an open question remains: are the results of data science trustworthy, and how can we increase our trust in data science? Accomplishing this...
详细信息
ISBN:
(纸本)9781450345231
Much of the research that our community publishes is based on data. However, an open question remains: are the results of data science trustworthy, and how can we increase our trust in data science? Accomplishing this goal is difficult, as we must trust the inputs, systems, and results of data science. This panel will discuss the current state of trustworthy data science, and explore possible technical, legal, and cultural solutions that can increase our trust in the input, systems, and results of data science.
Life Cycle Assessment(LCA) is crucial for evaluating the ecological sustainability of a product or service, and the accurate evaluation of sustainability requires detailed and transparent information about industrial ...
详细信息
ISBN:
(纸本)9781450345231
Life Cycle Assessment(LCA) is crucial for evaluating the ecological sustainability of a product or service, and the accurate evaluation of sustainability requires detailed and transparent information about industrial activities. However, such information is usually considered confidential and withheld from the public. In this paper, we present a study of privacy in the context of LCA. The main goal is to explore the privacy challenges in sustainability assessment considering the protection of trade secrets while increasing transparency of industrial activities. To overcome privacy concerns, we apply differential privacy to LCA computations considering the idiosyncratic features of LCA data. Our assessments on a specific real-life example show that it is possible to achieve privacy-preserving LCA computations without losing the utility of data completely.
The proceedings contain 38 papers. The topics discussed include: building privacy-preserving cryptographic credentials from federated online identities;Neuralyzer: flexible expiration times for the revocation of onlin...
ISBN:
(纸本)9781450339353
The proceedings contain 38 papers. The topics discussed include: building privacy-preserving cryptographic credentials from federated online identities;Neuralyzer: flexible expiration times for the revocation of online data;HCFi: hardware-enforced control-flow integrity;derandomizing kernel address space layout for memory introspection and forensics;patching logic vulnerabilities for web applications using LogicPatcher;to fear or not to fear that is the question: code characteristics of a vulnerable function with an existing exploit;on the effectiveness of sensor-enhanced keystroke dynamics against statistical attacks;on the feasibility of cryptography for a wireless insulin pump system;SPICE: a software tool for bridging the gap between end-user's insecure cyber behavior and personality traits;automatic summarization of privacy policies using ensemble learning;and evaluating analysis tools for android apps: status quo and robustness against obfuscation.
Organizations often expose business processes and services as web applications. Improper enforcement of security policies in these applications leads to business logic vulnerabilities that are hard to find and may hav...
详细信息
ISBN:
(纸本)9781450345231
Organizations often expose business processes and services as web applications. Improper enforcement of security policies in these applications leads to business logic vulnerabilities that are hard to find and may have dramatic security implications. Aegis is a tool to automatically synthesize run-time monitors to enforce control-flow and data-flow integrity, as well as authorization policies and constraints in web applications. The enforcement of these properties can mitigate attacks, e.g., authorization bypass and workflow violations, while allowing regulatory compliance in the form of, e.g., Separation of Duty. Aegis is capable of guaranteeing business continuity while enforcing the security policies. We evaluate Aegis on a set of real-world applications, assessing the enforcement of policies, mitigation of vulnerabilities, and performance overhead.
Current bartering platforms place the burden of finding simultaneously executable quotes on their users. In addition, these bartering platforms do not keep quotes private. To address these shortcomings, this paper int...
详细信息
ISBN:
(纸本)9781450345231
Current bartering platforms place the burden of finding simultaneously executable quotes on their users. In addition, these bartering platforms do not keep quotes private. To address these shortcomings, this paper introduces a privacy-preserving bartering protocol secure in the semi-honest model. At its core, the novel bartering protocol uses a newly-developed bipartite matching protocol which determines simultaneously executable quotes in an efficient manner. While the new privacy-preserving bipartite matching protocol does not always yield the maximal set of simultaneously executable quotes, it keeps the parties' quotes private at all times. Moreover, our new privacy-preserving bipartite matching protocol is more efficient than existing solutions in that it only requires linear communication in the number of quotes the parties specify.
High-speed research networks (e.g., Internet2, Geant) represent the backbone of large-scale research projects that bring together stakeholders from academia, industry and government. Such projects have increasing dema...
详细信息
ISBN:
(纸本)9781450345231
High-speed research networks (e.g., Internet2, Geant) represent the backbone of large-scale research projects that bring together stakeholders from academia, industry and government. Such projects have increasing demands on throughput (e.g., 100Gbps line rates), and require a high amount of configurability. Collecting and sharing traffic data for such networks can help in detecting hotspots, troubleshooting, and designing novel routing protocols. However, sharing network data directly introduces serious privacy breaches, as an adversary may be able to derive private details about individual users (e.g., personal preferences or activity patterns). Our objective is to sanitize high-speed research network data according to the de-facto standard of differential privacy (DP), thus supporting benefic applications of traffic measurement without compromising individuals' privacy. In this paper, we present an initial framework for computing DP-compliant big data analytics for high-speed research network data. Specifically, we focus on sharing data at flow-level granularity, and we describe our initial steps towards an environment that relies on Hadoop and HBase to support privacy-preserving NetFlow analytics.
Using data about individuals without revealing sensitive information about them is important. In recently years, a new privacy protection concept is called k-anonymity has been introduced. On the other hand, applicati...
详细信息
ISBN:
(纸本)9781450350846
Using data about individuals without revealing sensitive information about them is important. In recently years, a new privacy protection concept is called k-anonymity has been introduced. On the other hand, application of person trip data analysis is demanded for public policy making such as tourism and security. In this research, TTPP and Kn-Query method is introduced to solved a conflict between privacy protection and utilization of person trip data. TTPP method is proposed as a data structure which describes person trip using the paired entries of fixed point observed personal location with track ID, time window and place. Kn-Query is a query summarizing the number of samples under given conditions satisfying k-anonymity. In an ordinal method, validation of k-anonymity and person trip analysis have been considered separately. The proposed method solved a conflict between privacy and utilization of personal data.
After more than a year of research and development, Netflix recently upgraded their infrastructure to provide HTTPS encryption of video streams in order to protect the privacy of their viewers. Despite this upgrade, w...
详细信息
ISBN:
(纸本)9781450345231
After more than a year of research and development, Netflix recently upgraded their infrastructure to provide HTTPS encryption of video streams in order to protect the privacy of their viewers. Despite this upgrade, we demonstrate that it is possible to accurately identify Netflix videos from passive traffic capture in real-time with very limited hardware requirements. Specifically, we developed a system that can report the Netflix video being delivered by a TCP connection using only the information provided by TCP/IP headers. To support our analysis, we created a fingerprint database comprised of 42,027 Netflix videos. Given this collection of fingerprints, we show that our system can differentiate between videos with greater than 99.99% accuracy. Moreover, when tested against 200 random 20-minute video streams, our system identified 99.5% of the videos with the majority of the identifications occurring less than two and a half minutes into the video stream.
Mobile application spoofing is an attack where a malicious mobile app mimics the visual appearance of another one. A common example of mobile application spoofing is a phishing attack where the adversary tricks the us...
详细信息
ISBN:
(纸本)9781450345231
Mobile application spoofing is an attack where a malicious mobile app mimics the visual appearance of another one. A common example of mobile application spoofing is a phishing attack where the adversary tricks the user into revealing her password to a malicious app that resembles the legitimate one. In this paper, we propose a novel spoofing detection approach, tailored to the protection of mobile app login screens, using screenshot extraction and visual similarity comparison. We use deception rate as a novel similarity metric for measuring how likely the user is to consider a potential spoofing app as one of the protected applications. We conducted a large-scale online study where participants evaluated spoofing samples of popular mobile app login screens, and used the study results to implement a detection system that accurately estimates deception rate. We show that efficient detection is possible with low overhead.
Browser extensions provide a powerful platform to enrich browsing experience. At the same time, they raise important security questions. From the point of view of a website, some browser extensions are invasive, remov...
详细信息
ISBN:
(纸本)9781450345231
Browser extensions provide a powerful platform to enrich browsing experience. At the same time, they raise important security questions. From the point of view of a website, some browser extensions are invasive, removing intended features and adding unintended ones, e.g. extensions that hijack Facebook likes. Conversely, from the point of view of extensions, some websites are invasive, e.g. websites that bypass ad blockers. Motivated by security goals at clash, this paper explores browser extension discovery, through a non-behavioral technique, based on detecting extensions' web accessible resources. We report on an empirical study with free Chrome and Firefox extensions, being able to detect over 50% of the top 1,000 free Chrome extensions, including popular security- and privacy-critical extensions such as AdBlock, LastPass, Avast Online security, and Ghostery. We also conduct an empirical study of non-behavioral extension detection on the Alexa top 100,000 websites. We present the dual measures of making extension detection easier in the interest of websites and making extension detection more difficult in the interest of extensions. Finally, we discuss a browser architecture that allows a user to take control in arbitrating the conflicting security goals.
暂无评论