检索结果-内蒙古大学图书馆

您好，读者！请登录

内蒙古大学图书馆

首页
概况
党建
资源
服务
科研支持
- 论文收录引用证明
- 科技查新
知识产权
档案馆
帮助

咨询与建议

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

您的常用邮箱：*

您的手机号码：*

问题描述：

当前已输入0个字，您还可以输入200个字

全部搜索
期刊论文
图书
学位论文
标准
纸本馆藏
外文资源发现
数据库导航
超星发现

高级检索

时间限定

出版年份：

文献类型

图书期刊文献学位论文多媒体

馆藏选择

电子馆藏纸本馆藏

核心期刊

全部期刊 SCI 收录期刊 SSCI 收录期刊 EI 收录期刊 CSCD 收录期刊 CSSCI 收录期刊

语言

中文英文

文献类型

期刊文献图书学位论文标准纸本馆藏

帮助

文字说明：

T=题名（书名、题名），A=作者（责任者），K=主题词，P=出版物名称，PU=出版社名称，O=机构（作者单位、学位授予单位、专利申请人），L=中图分类号，C=学科分类号，U=全部字段，Y=年（出版发行年、学位年度、标准发布年）

检索规则说明：

AND代表“并且”；OR代表“或者”；NOT代表“不包含”；(注意必须大写,运算符两边需空一格)

检索范例：

范例一：(K=图书馆学 OR K=情报学) AND A=范并思 AND Y=1982-2016
范例二：P=计算机应用与软件 AND (U=C++ OR U=Basic) NOT K=Visual AND Y=2011-2016

分类表

所选分类

>> <<

限定检索结果

文献类型

559 篇 会议
1 篇 期刊文献

馆藏范围

560 篇 电子文献
0 种 纸本馆藏

日期分布

学科分类号

434 篇 工学
- 422 篇 计算机科学与技术...
- 140 篇 软件工程
- 104 篇 信息与通信工程
- 28 篇 网络空间安全
- 21 篇 电气工程
- 12 篇 控制科学与工程
- 9 篇 安全科学与工程
- 5 篇 建筑学
- 4 篇 生物工程
- 3 篇 动力工程及工程热...
- 3 篇 生物医学工程（可授...
- 2 篇 机械工程
- 2 篇 仪器科学与技术
- 2 篇 电子科学与技术（可...
- 2 篇 土木工程
- 2 篇 交通运输工程
114 篇 理学
- 105 篇 数学
- 8 篇 统计学（可授理学、...
- 5 篇 生物学
- 5 篇 系统科学
- 2 篇 物理学
33 篇 管理学
- 21 篇 图书情报与档案管...
- 15 篇 管理科学与工程(可...
- 8 篇 工商管理
8 篇 法学
- 7 篇 社会学
- 1 篇 法学
3 篇 经济学
- 3 篇 应用经济学
3 篇 医学
- 3 篇 基础医学(可授医学...
- 3 篇 临床医学
- 2 篇 公共卫生与预防医...
1 篇 教育学
1 篇 军事学

主题

59 篇 privacy
44 篇 security
25 篇 data privacy
22 篇 differential pri...
21 篇 machine learning
20 篇 access control
14 篇 sensitive data
11 篇 iot
11 篇 android
11 篇 mobile security
10 篇 internet of thin...
10 篇 deep learning
9 篇 static analysis
9 篇 blockchain
8 篇 federated learni...
7 篇 homomorphic encr...
7 篇 web security
7 篇 network security
7 篇 cloud security
7 篇 cloud computing

机构

8 篇 purdue univ w la...
6 篇 north carolina s...
6 篇 rhein westfal th...
6 篇 carnegie mellon ...
5 篇 univ texas dalla...
4 篇 stevens inst tec...
4 篇 fraunhofer aisec...
4 篇 purdue universit...
4 篇 carnegie mellon ...
4 篇 concordia univ m...
3 篇 singapore inst t...
3 篇 ericsson secur r...
3 篇 purdue universit...
3 篇 ecole polytech f...
3 篇 umass boston bos...
3 篇 univ illinois ur...
3 篇 tech univ darmst...
3 篇 king's college l...
3 篇 university of pi...
3 篇 university of te...

作者

13 篇 bertino elisa
11 篇 sandhu ravi
7 篇 enck william
6 篇 ghinita gabriel
6 篇 meyer ulrike
6 篇 kantarcioglu mur...
5 篇 gupta maanak
5 篇 wang lingyu
4 篇 lee adam j.
4 篇 conti mauro
4 篇 murat kantarciog...
4 篇 elisa bertino
4 篇 liu fang
4 篇 mittal sudip
4 篇 gabriel ghinita
4 篇 gunter carl a.
4 篇 pourzandi makan
4 篇 pretschner alexa...
4 篇 wetzel susanne
4 篇 majumdar suryadi...

语言

555 篇 英文
4 篇 其他
1 篇 中文

检索条件"任意字段=Proceedings of the Twelfth ACM Conference on Data and Application Security and Privacy"

共 560 条记录，以下是351-360 订阅

全选清除本页清除全部题录导出标记到"检索档案"

详细简洁

排序：

To Fear or Not to Fear That is the Question: Code Characteristics of a Vulnerable Function with an Existing Exploit 16

To Fear or Not to Fear That is the Question: Code Characteri...

引用

6th acm conference on data and application security and privacy (CODASPY)

作者： Younis, Awad Malaiya, Yashwant K. Anderson, Charles Ray, Indrajit Colorado State Univ Dept Comp Sci Ft Collins CO 80523 USA

ISBN: (纸本)9781450339353

Not all vulnerabilities are equal. Some recent studies have shown that only a small fraction of vulnerabilities that have been reported has actually been exploited. Since finding and addressing potential vulnerabilities in a program can take considerable time and effort, recently effort has been made to identify code that is more likely to be vulnerable. This paper tries to identify the attributes of the code containing a vulnerability that makes the code more likely to be exploited. We examine 183 vulnerabilities from the National Vulnerability database for Linux Kernel and Apache HTTP server. These include eighty-two vulnerabilities that have been found to have an exploit according to the Exploit database. We characterize the vulnerable functions that have no exploit and the ones that have an exploit using eight metrics. The results show that the difference between a vulnerability that has no exploit and the one that has an exploit can potentially be characterized using the chosen software metrics. However, predicting exploitation of vulnerabilities is more complex than predicting just the presence of vulnerabilities and further research is needed using metrics that consider security domain knowledge for enhancing the predictability of vulnerability exploits.

关键词： Vulnerabilities Severity Exploitability Software security Exploits data mining and machine learning Feature selection Prediction Software metrics

来源：评论

学校读者我要写书评

暂无评论

Program-object Level data Flow Analysis with applications to data Leakage and Contamination Forensics 16

Program-object Level Data Flow Analysis with Applications to...

引用

6th acm conference on data and application security and privacy (CODASPY)

作者： Xiao, Gaoyao Wang, Jun Liu, Peng Ming, Jiang Wu, Dinghao Penn State Univ Coll Informat Sci & Technol University Pk PA 16802 USA

ISBN: (纸本)9781450339353

We introduce a novel data Flow Analysis (DFA) technique, called PoL-DFA (Program-object Level data Flow Analysis), to analyze the dynamic data flows of server programs. PoL-DFA symbolically analyzes every instruction in the execution trace of a process to keep track of the data flows among program objects (e.g., integers, structures, arrays), and concatenates these pieces of data flows to obtain the overall data flow graph of the execution. We leverage PoL-DFA to identify malicious data flows in data leakage and contamination forensics. In two mocked digital forensic scenarios, for data leakage and contamination respectively, we tested the ability of PoL-DFA to identify data flows among multiple inputs and outputs of server programs. Our results show that PoL-DFA can accurately determine whether the data (or the processed results) from a source file or socket flow to a certain output channel. Based on this information, security administrators can pinpoint the path of data leakage or data contamination. Different from existing dynamic DFA techniques that require excessive amount of instrumentation, PoL-DFA only requires logging the execution traces of the processes being monitored. The measured performance overhead for server programs is 4.24%, on average. The results indicate PoL-DFA is a lightweight DFA solution for data leakage and contamination forensics.

关键词： information accountability information flow control usage control

来源：评论

学校读者我要写书评

暂无评论

Building privacy-Preserving Cryptographic Credentials from Federated Online Identities 16

Building Privacy-Preserving Cryptographic Credentials from F...

引用

6th acm conference on data and application security and privacy (CODASPY)

作者： Maheswaran, John Jackowitz, Daniel Zhai, Ennan Wolinsky, David Isaac Ford, Bryan Yale Univ New Haven CT 06520 USA Ecole Polytech Fed Lausanne Swiss Fed Inst Technol Lausanne Switzerland

ISBN: (纸本)9781450339353

Federated identity providers, e.g., Facebook and PayPal, offer a convenient means for authenticating users to third-party applications. Unfortunately such cross-site authentications carry privacy and tracking risks. For example, federated identity providers can learn what applications users are accessing;meanwhile, the applications can know the users' identities in reality. This paper presents Crypto-Book, an anonymizing layer enabling federated identity authentications while preventing these risks. Crypto-Book uses a set of independently managed servers that employ a (t, n)-threshold cryptosystem to collectively assign credentials to each federated identity (in the form of either a public/private key-pair or blinded signed messages). With the credentials in hand, clients can then leverage anonymous authentication techniques such as linkable ring signatures or partially blind signatures to log into third-party applications in an anonymous yet accountable way. We have implemented a prototype of Crypto-Book and demonstrated its use with three applications: a Wiki system, an anonymous group communication system, and a whistleblower submission system. Crypto-Book is practical and has low overhead: in a deployment within our research group, Crypto-Book group authentication took 1.607s end-to-end, an overhead of 1.2s compared to traditional non-privacy-preserving federated authentication.

关键词： anonymity anonymous communication authentication online social networks

来源：评论

学校读者我要写书评

暂无评论

On the Origin of Mobile Apps: Network Provenance for Android applications 16

On the Origin of Mobile Apps: Network Provenance for Android...

引用

6th acm conference on data and application security and privacy (CODASPY)

作者： Stevens, Ryan Crussell, Jonathan Chen, Hao Univ Calif Davis Davis CA 95616 USA ShanghaiTech Univ Shanghai Shi Peoples R China

ISBN: (纸本)9781450339353

Many mobile services consist of two components: a server providing an API, and an application running on smart phones and communicating with the API. An unresolved problem in this design is that it is difficult for the server to authenticate which app is accessing the API. This causes many security problems. For example, the provider of a private network API has to embed secrets in its official app to ensure that only this app can access the API;however, attackers can uncover the secret by reverse-engineering. As another example, malicious apps may send automatic requests to ad servers to commit ad fraud. In this work, we propose a system that allows network API to authenticate the mobile app that sends each request so that the API can make an informed access control decision. Our system, the Mobile Trusted-Origin Policy, consists of two parts: 1) an app provenance mechanism that annotates outgoing HTTP(S) requests with information about which app generated the network traffic, and 2) a code isolation mechanism that separates code within an app that should have different app provenance signatures into mobile origin. As motivation for our work, we present two previously-unknown families of apps that perform click fraud, and examine how the lack of mobile origin information enables the attacks. Based on our observations, we propose Trusted Cross-Origin Requests to handle point (1), which automatically includes mobile origin information in outgoing HTTP requests. Servers may then decide, based on the mobile origin data, whether to process the request or not. We implement a prototype of our system for Android and evaluate its performance, security, and deployability. We find that our system can achieve our security and utility goals with negligible overhead.

关键词： mobile security advertising security mobile advertising app authentication

来源：评论

学校读者我要写书评

暂无评论

SMASheD: Sniffing and Manipulating Android Sensor data 16

SMASheD: Sniffing and Manipulating Android Sensor Data

引用

6th acm conference on data and application security and privacy (CODASPY)

作者： Mohamed, Manar Shrestha, Babins Saxena, Nitesh Univ Alabama Birmingham 1300 Univ Blvd Birmingham AL 35487 USA

ISBN: (纸本)9781450339353

The current Android sensor security model either allows only restrictive read access to sensitive sensors (e.g., an app can only read its own touch data) or requires special install-time permissions (e.g., to read microphone, camera or GPS). Moreover, Android does not allow write access to any of the sensors. Sensing-based security applications therefore crucially rely upon the sanity of the Android sensor security model. In this paper, we show that such a model can be effectively circumvented. Specifically, we build SMASheD, a legitimate framework under the current Android ecosystem that can be used to stealthily sniff as well as manipulate many of the Android's restricted sensors (even touch input). SMASheD exploits the Android Debug Bridge (ADB) functionality and enables a malicious app with only the INTERNET permission to read, and write to, multiple different sensor data files at will. SMASheD is the first framework, to our knowledge, that can sniff and manipulate protected sensors on unrooted Android devices, without user awareness, without constant device-PC connection and without the need to infect the PC. The primary contributions of this work are two-fold. First, we design and develop the SMASheD framework. Second, as an offensive implication of the SMASheD framework, we introduce a wide array of potentially devastating attacks. Our attacks against the touchsensor range from accurately logging the touchscreen input (TouchLogger) to injecting touch events for accessing restricted sensors and resources, installing and granting special permissions to other malicious apps, accessing user accounts, and authenticating on behalf of the user - essentially almost doing whatever the device user can do (secretively). Our attacks against various physical sensors (motion, position and environmental) can subvert the functionality provided by numerous existing sensing-based security applications, including those used for (continuous) authentication, and authorization.

关键词： sensors android

来源：评论

学校读者我要写书评

暂无评论

Detecting Malicious Exploit Kits using Tree-based Similarity Searches 16

Detecting Malicious Exploit Kits using Tree-based Similarity...

引用

6th acm conference on data and application security and privacy (CODASPY)

作者： Taylor, Teryl Hu, Xin Wang, Ting Jang, Jiyong Stoecklin, Marc Ph. Monrose, Fabian Sailer, Reiner Univ North Carolina Chapel Hill Chapel Hill NC 27514 USA IBM TJ Watson Res Ctr Armonk NY 10504 USA Lehigh Univ Bethlehem PA USA

ISBN: (纸本)9781450339353

Unfortunately, the computers we use for everyday activities can be infiltrated while simply browsing innocuous sites that, unbeknownst to the website owner, may be laden with malicious advertisements. So-called malvertising, redirects browsers to web-based exploit kits that are designed to find vulnerabilities in the browser and subsequently download malicious payloads. We propose a new approach for detecting such malfeasance by leveraging the inherent structural patterns in HTTP traffic to classify exploit kit instances. Our key insight is that an exploit kit leads the browser to download payloads using multiple requests from malicious servers. We capture these interactions in a "tree-like" form, and using a scalable index of malware samples, model the detection process as a sub-tree similarity search problem. The approach is evaluated on 3800 hours of real-world traffic including over 4 billion flows and reduces false positive rates by four orders of magnitude over current state-of-the-art techniques with comparable true positive rates. We show that our approach can operate in near real-time, and is able to handle peak traffic levels on a large enterprise network-identifying 28 new exploit kit instances during our analysis period.

关键词： network security exploit kit subtree similarity search intrusion detection security information retrieval

来源：评论

学校读者我要写书评

暂无评论

Context Matters?: How Adding the Obfuscation Option Affects End Users' data Disclosure Decisions 16

Context Matters?: How Adding the Obfuscation Option Affects ...

引用

21st International conference on Intelligent User Interfaces (IUI)

作者： Wang, Jing Wang, Na Jin, Hongxia Samsung Res Amer Mountain View CA 94043 USA

ISBN: (纸本)9781450341370

Recent advancement of smart devices and wearable technologies greatly enlarges the variety of personal data people can track. applications and services can leverage such data to provide better life support, but also impose privacy and security threats. Obfuscation schemes, consequently, have been developed to retain data access while mitigate risks. Compared to offering choices of releasing raw data and not releasing at all, we examine the effect of adding a data obfuscation option on users' disclosure decisions when configuring applications' access, and how that effect varies with data types and application contexts. Our online user experiment shows that users are less likely to block data access when the obfuscation option is available except for locations. This effect significantly differs between applications for domain-specific dynamic tracking data, but not for generic personal traits. We further unpack the role of context and discuss the design opportunities.

关键词： data obfuscation privacy tracking user behavior mobile

来源：评论

学校读者我要写书评

暂无评论

Multi cloud iaas with domain trust in OpenStack 16

Multi cloud iaas with domain trust in OpenStack

引用

6th acm conference on data and application security and privacy, CODASPY 2016

作者： Pustchi, Navid Patwa, Farhan Sandhu, Ravi Institute for Cyber Security Dept. of Computer Science Univ. of Texas San Antonio United States Institute for Cyber Security Univ. of Texas San Antonio United States

ISBN: (纸本)9781450339353

As cloud services have been firmly accepted by enterprises, the current challenge is how to share these resources among increasing number of cloud platforms. Currently, cloud platforms such as OpenStack, the de facto open-source platform for cloud Infrastructure-as-a-Service (IaaS), offer limited cross-cloud access capabilities in their federation APIs. In this paper, we present a fine-grained cross-cloud domaintrust model enabling resource sharing between domains across distinct homogeneous clouds. We further present a formalized description of core multi-cloud OpenStack access control (MC-OSAC) with proposed domain trust extension. We have implemented a proof of concept with extending Open Stack identity and federation services to support cross-cloud domain trust. Our approach does not introduce any authorization overhead within current OpenStack federation model.

关键词： Authorization

来源：评论

学校读者我要写书评

暂无评论

Exploiting data-Usage Statistics for Website Fingerprinting Attacks on Android 16

Exploiting Data-Usage Statistics for Website Fingerprinting ...

引用

9th acm conference on security and privacy in Wireless and Mobile Networks (WiSec)

作者： Spreitzer, Raphael Griesmayr, Simone Korak, Thomas Mangard, Stefan Graz Univ Technol IAIK A-8010 Graz Austria

ISBN: (纸本)9781450342704

The browsing behavior of a user allows to infer personal details, such as health status, political interests, sexual orientation, etc. In order to protect this sensitive information and to cope with possible privacy threats, defense mechanisms like SSH tunnels and anonymity networks (e.g., Tor) have been established. A known shortcoming of these defenses is that website fingerprinting attacks allow to infer a user's browsing behavior based on traffic analysis techniques. However, website fingerprinting typically assumes access to the client's network or to a router near the client, which restricts the applicability of these attacks. In this work, we show that this rather strong assumption is not required for website fingerprinting attacks. Our client-side attack overcomes several limitations and assumptions of network-based fingerprinting attacks, e.g., network conditions and traffic noise, disabled browser caches, expensive training phases, etc. Thereby, we eliminate assumptions used for academic purposes and present a practical attack that can be implemented easily and deployed on a large scale. Eventually, we show that an unprivileged application can infer the browsing behavior by exploiting the unprotected access to the Android data-usage statistics. More specifically, we are able to infer 97% of 2 500 page visits out of a set of 500 monitored pages correctly. Even if the traffic is routed through Tor by using the Orbot proxy in combination with the Orweb browser, we can infer 95% of 500 page visits out of a set of 100 monitored pages correctly. Thus, the READ_HISTORY_BOOKMARKS permission, which is supposed to protect the browsing behavior, does not provide protection.

关键词： Mobile security side-channel attack website fingerprinting data-usage statistics mobile malware

来源：评论

学校读者我要写书评

暂无评论

Don't Touch that Column: Portable, Fine-Grained Access Control for Android's Native Content Providers 16

Don't Touch that Column: Portable, Fine-Grained Access Contr...

引用

9th acm conference on security and privacy in Wireless and Mobile Networks (WiSec)

作者： Ali-Gombe, Aisha Richard, Golden G., III Ahmed, Irfan Roussev, Vassil Univ New Orleans Dept Comp Sci New Orleans LA 70148 USA

ISBN: (纸本)9781450342704

Android applications access native SQLite databases through their Universal Resource Identifiers (URIs), exposed by the Content provider library. By design, the SQLite engine used in the Android system does not enforce access restrictions on database content nor does it log database accesses. Instead, Android enforces read and write permissions on the native providers through which databases are accessed via the mandatory applications permissions system. This system is very coarse grained, however, and can allow applications far greater access to sensitive data than a user might intend. In this paper, we present a novel technique called priVy that merges static bytecode weaving and database query rewriting to achieve low-level access control for Android native providers at the application level. priVy defines access control for both database schema and entities and does not require any modifications to the underlying operating system and/or framework code. Instead, it provides a new Controller stub which is statically woven into the target application and a Controller interface for setting access levels, thus making it accessible and easily adoptable by average users. We provide an evaluation in terms of the resilience of applications to instrumentation as well as static and runtime instrumentation overhead. In our testing, priVy incurs an average of 1032 additional method calls or joinpoints created and it takes an average of 15 seconds to recompile an app and imposes virtually no runtime overhead.

关键词： aspectj sqlite bytecode weaving privacy instrumentation android access control security

来源：评论

学校读者我要写书评

暂无评论

没有更多数据了...

全选清除本页清除全部题录导出标记到“检索档案”

共56页 << < 32 33 34 35 36 37 38 39 40 41 > >>

检索报告对象比较合并检索0

隐藏清空

合并搜索

回到顶部

执行限定条件

内容：

评分：

请选择保存的检索档案：

请选择收藏分类：

订阅名称：

通借通还

温馨提示：

图书名称：

借书校区：

取书校区：

手机号码：

邮箱地址：

一卡通帐号：

电话和邮箱必须正确填写，我们会与您联系确认。

联系人：

所在院系：

联系邮箱：

联系电话：

内蒙古自治区呼和浩特市赛罕区大学西街235号邮编: 010021

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：