| A | B | C | D | E | F | G | H | I | |
|---|---|---|---|---|---|---|---|---|---|
1 | Base | Item Type | Publication Year | Author | Title | Publication Title | Abstract Note | Pages | Keywords |
2 | ACM | conferencePaper | 2014 | Seibert, Jeff; Okhravi, Hamed; Söderström, Eric | Information Leaks Without Memory Disclosures: Remote Side Channel Attacks on Diversified Code | Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security | Code diversification has been proposed as a technique to mitigate code reuse attacks, which have recently become the predominant way for attackers to exploit memory corruption vulnerabilities. As code reuse attacks require detailed knowledge of where code is in memory, diversification techniques attempt to mitigate these attacks by randomizing what instructions are executed and where code is located in memory. As an attacker cannot read the diversified code, it is assumed he cannot reliably exploit the code. In this paper, we show that the fundamental assumption behind code diversity can be broken, as executing the code reveals information about the code. Thus, we can leak information without needing to read the code. We demonstrate how an attacker can utilize a memory corruption vulnerability to create side channels that leak information in novel ways, removing the need for a memory disclosure vulnerability. We introduce seven new classes of attacks that involve fault analysis and timing side channels, where each allows a remote attacker to learn how code has been diversified. | 54–65 | information leakage; address space layout randomization; code diversity; memory disclosure; side-channel attacks |
3 | ACM | conferencePaper | 2019 | Österlund, Sebastian; Koning, Koen; Olivier, Pierre; Barbalace, Antonio; Bos, Herbert; Giuffrida, Cristiano | KMVX: Detecting Kernel Information Leaks with Multi-Variant Execution | Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems | Kernel information leak vulnerabilities are a major security threat to production systems. Attackers can exploit them to leak confidential information such as cryptographic keys or kernel pointers. Despite efforts by kernel developers and researchers, existing defenses for kernels such as Linux are limited in scope or incur a prohibitive performance overhead. In this paper, we present kMVX, a comprehensive defense against information leak vulnerabilities in the kernel by running multiple diversified kernel variants simultaneously on the same machine. By constructing these variants in a careful manner, we can ensure they only show divergences when an attacker tries to exploit bugs present in the kernel. By detecting these divergences we can prevent kernel information leaks. Our kMVX design is inspired by multi-variant execution (MVX). Traditional MVX designs cannot be applied to kernels because of their assumptions on the run-time environment. kMVX, on the other hand, can be applied even to commodity kernels. We show our Linux-based prototype provides powerful protection against information leaks at acceptable performance overhead (20--50% in the worst case for popular server applications). | 559–572 | security; operating systems; information leaks; multi-variant exection |
4 | ACM | conferencePaper | 2015 | Laube, Stefan; Böhme, Rainer | Mandatory Security Information Sharing with Authorities: Implications on Investments in Internal Controls | Proceedings of the 2nd ACM Workshop on Information Sharing and Collaborative Security | New regulations mandating firms to share information on security breaches and security practices with authorities are high on the policy agenda around the globe. These initiatives are based on the hope that authorities can effectively advise and warn other firms, thereby strengthening overall defense and response to cyberthreats in an economy. If this mechanism works (as assumed in this paper with varying effectiveness), it has consequences on security investments of rational firms. We devise an economic model that distinguishes between investments in detective and preventive controls, and analyze its Nash equilibria. The model suggests that firms subject to mandatory security information sharing 1) over-invest in security breach detection as well as under-invest in breach prevention, and 2), depending on the enforcement practices, may shift investment priorities from detective to preventive controls. We also identify conditions where the regulation increases welfare. | 31–42 | policy; game theory; detective controls; economics of information security; externalities; mandatory security information sharing; preventive controls; security investment |
5 | ACM | conferencePaper | 2007 | Hicks, Boniface; King, Dave; McDaniel, Patrick | Jifclipse: Development Tools for Security-Typed Languages | Proceedings of the 2007 Workshop on Programming Languages and Analysis for Security | Security-typed languages such as Jif require the programmer to label variables with information flow security policies as part of application development. The compiler then flags errors wherever information leaks may occur. Resolving these information leaks is a critical task in security-typed language application development. Unfortunately, because information flows can be quite subtle, simple error messages tend to be insufficient for finding and resolving the source of information leaks; more sophisticated development tools are needed for this task. To this end we provide a set of principles to guide the development of such tools. Furthermore, we implement a subset of these principles in an integrated development environment (IDE) for Jif, called Jifclipse, which is built on the Eclipse extensible development platform. Our plug-in provides a Jif programmer with additional tools to view hidden information generated by a Jif compilation, to suggest fixes for errors, and to get more specific information behind an error message. Better development tools are essential for making security-typed application development practical; Jifclipse is a first step in this process | 1–10 | developer tools; Eclipse; Jif; security-typed languages |
6 | ACM | conferencePaper | 2019 | Deng, Shuwen; Gümüundefinedoundefinedlu, Doundefineduhan; Xiong, Wenjie; Sari, Sercan; Gener, Y. Serhan; Lu, Corine; Demir, Onur; Szefer, Jakub | SecChisel Framework for Security Verification of Secure Processor Architectures | Proceedings of the 8th International Workshop on Hardware and Architectural Support for Security and Privacy | This work presents a design-time security verification framework for secure processor architectures. Our new SecChisel framework is built upon the Chisel hardware construction language and tools, and uses information flow analysis to verify the security properties of an architecture at design-time. To enforce information flow security, the framework supports adding security tags to wires, registers, modules, and other parts of the design description, as well as allows for defining a custom security lattice and custom information flow policies. The framework performs automatic security tag propagation analysis in a new SecChisel parser and information flow checking using the Z3 SMT solver. The same SecChisel codebase is used to design hardware modules as well as to verify the security properties, ensuring that the verified design directly corresponds to the actual design. This framework is evaluated on RISC-V Rocket Chip expanded with AES and SHA modules. The framework was able to capture information leaks in the hardware bugs or Trojans that it was tested with. | Chisel; formal security verification; RISC-V; secure processors | |
7 | ACM | journalArticle | 2017 | Laube, Stefan; Böhme, Rainer | Strategic Aspects of Cyber Risk Information Sharing | ACM Comput. Surv. | Cyber risk management largely reduces to a race for information between defenders of ICT systems and attackers. Defenders can gain advantage in this race by sharing cyber risk information with each other. Yet, they often exchange less information than is socially desirable, because sharing decisions are guided by selfish rather than altruistic reasons. A growing line of research studies these strategic aspects that drive defenders’ sharing decisions. The present survey systematizes these works in a novel framework. It provides a consolidated understanding of defenders’ strategies to privately or publicly share information and enables us to distill trends in the literature and identify future research directions. We reveal that many theoretical works assume cyber risk information sharing to be beneficial, while empirical validations are often missing. | cyber risk management; Security information sharing | |
8 | ACM | conferencePaper | 2016 | Yoon, Man-Ki; Salajegheh, Negin; Chen, Yin; Christodorescu, Mihai | PIFT: Predictive Information-Flow Tracking | Proceedings of the Twenty-First International Conference on Architectural Support for Programming Languages and Operating Systems | Phones today carry sensitive information and have a great number of ways to communicate that data. As a result, malware that steal money, information, or simply disable functionality have hit the app stores. Current security solutions for preventing undesirable data leaks are mostly high-overhead and have not been practical enough for smartphones. In this paper, we show that simply monitoring just some instructions (only memory loads and stores) it is possible to achieve low overhead, highly accurate information flow tracking. Our method achieves 98% accuracy (0% false positive and 2% false negative) over DroidBench and was able to successfully catch seven real-world malware instances that steal phone number, location, and device ID using SMS messages and HTTP connections. | 713–725 | security; information flow tracking |
9 | ACM | conferencePaper | 2011 | Birgisson, Arnar; McSherry, Frank; Abadi, Martín | Differential Privacy with Information Flow Control | Proceedings of the ACM SIGPLAN 6th Workshop on Programming Languages and Analysis for Security | We investigate the integration of two approaches to information security: information flow analysis, in which the dependence between secret inputs and public outputs is tracked through a program, and differential privacy, in which a weak dependence between input and output is permitted but provided only through a relatively small set of known differentially private primitives. We find that information flow for differentially private observations is no harder than dependency tracking. Differential privacy's strong guarantees allow for efficient and accurate dynamic tracking of information flow, allowing the use of existing technology to extend and improve the state of the art for the analysis of differentially private computations. | differential privacy; information flow control | |
10 | ACM | conferencePaper | 2018 | Ardi, Calvin; Heidemann, John | Leveraging Controlled Information Sharing for Botnet Activity Detection | Proceedings of the 2018 Workshop on Traffic Measurements for Cybersecurity | Today's malware often relies on DNS to enable communication with command-and-control (C&C). As defenses that block C&C traffic improve, malware use sophisticated techniques to hide this traffic, including "fast flux" names and Domain-Generation Algorithms (DGAs). Detecting this kind of activity requires analysis of DNS queries in network traffic, yet these signals are sparse. As bot countermeasures grow in sophistication, detecting these signals increasingly requires the synthesis of information from multiple sites. Yet sharing security information across organizational boundaries to date has been infrequent and ad hoc because of unknown risks and uncertain benefits. In this paper, we take steps towards formalizing cross-site information sharing and quantifying the benefits of data sharing. We use a case study on DGA-based botnet detection to evaluate how sharing cybersecurity data can improve detection sensitivity and allow the discovery of malicious activity with greater precision. | 14–20 | botnet detection; cybersecurity; data sharing; information sharing |
11 | ACM | conferencePaper | 2018 | Hunger, Casen; Vilanova, Lluis; Papamanthou, Charalampos; Etsion, Yoav; Tiwari, Mohit | DATS - Data Containers for Web Applications | Proceedings of the Twenty-Third International Conference on Architectural Support for Programming Languages and Operating Systems | Data containers enable users to control access to their data while untrusted applications compute on it. However, they require replicating an application inside each container - compromising functionality, programmability, and performance. We propose DATS - a system to run web applications that retains application usability and efficiency through a mix of hardware capability enhanced containers and the introduction of two new primitives modeled after the popular model-view-controller (MVC) pattern. (1) DATS introduces a templating language to create views that compose data across data containers. (2) DATS uses authenticated storage and confinement to enable an untrusted storage service, such as memcached and deduplication, to operate on plain-text data across containers. These two primitives act as robust declassifiers that allow DATS to enforce non-interference across containers, taking large applications out of the trusted computing base (TCB). We showcase eight different web applications including Gitlab and a Slack-like chat, significantly improve the worst-case overheads due to application replication, and demonstrate usable performance for common-case usage. | 722–736 | information flow control; operating systems security |
12 | ACM | journalArticle | 2009 | Pistoia, Marco; Erlingsson, Úlfar | Programming Languages and Program Analysis for Security: A Three-Year Retrospective | SIGPLAN Not. | Software security has been traditionally enforced at the level of operating systems. However, operating systems have become increasingly large and complex, and it is very difficult--if not impossible--to enforce software security solely through them. Moreover, operating-system security allows dealing primarily with access-control policies on resources such as files and network connections. However, attacks may happen at both lower and higher levels of abstraction, and may target the internal behavior of applications, such as today's Web-based applications. Therefore, defenses must offer protection at the level of applications. Language-based security is the area of research that studies how to enforce application-level security using programming-language and program-analysis techniques. This area of research has become very active with the advent of Web applications. In 2006, the ACM SIGPLAN has introduced a new yearly forum entirely dedicated to the discussion of language-based-security research: Programming Languages and Analysis for Security (PLAS). This paper is a three-year survey of PLAS papers that discusses the progress made in the area of language-based security. | 32–39 | security; language-based security; program analysis; programming languages |
13 | ACM | conferencePaper | 2017 | Benson, Theophilus; Liu, Peng; Sundaresan, Srikanth; Zhang, Yuqing | IoT S&P 2017: First Workshop on Internet of Things Security and Privacy | Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security | The First Workshop on Internet of Things Security and Privacy is held in Dallas, TX, USA on November 3, 2017, co-located with the ACM Conference on Computer and Communications Security (CCS). The workshop aims to address the security and privacy challenges of the emerging Internet-of-Things landscape. The workshop aims to bring together academic and industrial researchers, and to that end, we have put together an exciting program offering a a mix of current and potential challenges. The workshop will also features 12 papers, 4 posters, and an invited keynote. | 2647–2648 | security; privacy; internet-of-things |
14 | ACM | conferencePaper | 2013 | Marchand de Kerchove, Florent; Noyé, Jacques; Südholt, Mario | Aspectizing JavaScript Security | Proceedings of the 3rd Workshop on Modularity in Systems Software | In this position paper we argue that aspects are well-suited to describe and implement a range of strategies to make secure JavaScript-based applications. To this end, we review major categories of approaches to make client-side applications secure and discuss uses of aspects that exist for some of them. We also propose aspect-based techniques for the categories that have not yet been studied. We give examples of applications where aspects are useful as a general means to flexibly express and implement security policies for JavaScript. | 7–12 | aspect-oriented programming; javascript; web application security |
15 | ACM | conferencePaper | 2006 | Masuya, Masato; Yamanoue, Takashi; Kubota, Shinichiro | An Experience of Monitoring University Network Security Using a Commercial Service and DIY Monitoring | Proceedings of the 34th Annual ACM SIGUCCS Fall Conference: Expanding the Boundaries | Monitoring network security of a university is one of the most important jobs for the network managers. Without the monitoring, it is hard to keep the network safe. It is common that the security policy of a university has the term which states that monitoring network security is a mandate. However it is very hard to monitor every part of a university's network by the limited number of staff and a limited amount of time and expense. In order to cope with these problems, we bought a commercial network security monitoring service for the doorway of our campus network and we are doing Do It Yourself (DIY) monitoring with free software for the inside of the network. By the commercial monitoring service, we could reach 24 hours a day and 365 days a year monitoring at the doorway. By the DIY monitoring, we could realize the precise monitoring of inside network, which is hard to realize by the commercial monitoring, because there are Network Address Translations (NATs). If an incident was found by the combination of these monitoring, we could deal with it as fast as we can. By these efforts, there was no serious incident such as unauthorized manipulation of important web pages by crackers and leaking serious personal information by using P2P file sharing software last year. In this paper, we report the experience of our monitoring. | 225–230 | security; audit; fire wall; IDS; monitor; network; policy |
16 | ACM | conferencePaper | 2004 | Vachharajani, Neil; Bridges, Matthew J.; Chang, Jonathan; Rangan, Ram; Ottoni, Guilherme; Blome, Jason A.; Reis, George A.; Vachharajani, Manish; August, David I. | RIFLE: An Architectural Framework for User-Centric Information-Flow Security | Proceedings of the 37th Annual IEEE/ACM International Symposium on Microarchitecture | Even as modern computing systems allow the manipulation and distribution of massive amounts of information, users of these systems are unable to manage the confidentiality of their data in a practical fashion. Conventional access control security mechanisms cannot prevent the illegitimate use of privileged data once access is granted. For example, information provided by a user during an online purchase may be covertly delivered to malicious third parties by an untrustworthy web browser. Existing information-flow security mechanisms do provide this assurance, but only for programmer-specified policies enforced during program development as a static analysis on special-purpose type-safe languages. Not only are these techniques not applicable to many commonly used programs, but they leave the user with no defense against malicious programmers or altered binaries. In this paper, we propose RIFLE, a runtime information-flow security system designed from the user's perspective. By addressing information-flow security using architectural support, RIFLE gives users a practical way to enforce their own information-flow security policy on all programs. We prove that, contrary to statements in the literature, run-time systems like RIFLE are no less secure than existing language-based techniques. Using a model of the architectural framework and a binary translator, we demonstrate RIFLE's correctness and illustrate that the performance cost is reasonable. | 243–254 | |
17 | ACM | conferencePaper | 2009 | Niño, Jaime | An Overview of Programming Language Based Security | Proceedings of the 47th Annual Southeast Regional Conference | This paper provides a survey of security features in modern programming languages for Computer Science instructors. We present the role that type safety and capabilities provide for the building of secure systems, and how language systems allow designers to model security issues that once were part-and-parcel of Operating Systems, or that can not be modeled by the latter. | access control; capability; information flow; type safety | |
18 | ACM | conferencePaper | 2017 | Wisniewski, Pamela; Vitak, Jessica; Page, Xinru; Knijnenburg, Bart; Wang, Yang; Fiesler, Casey | In Whose Best Interest? Exploring the Real, Potential, and Imagined Ethical Concerns in Privacy-Focused Agenda | Companion of the 2017 ACM Conference on Computer Supported Cooperative Work and Social Computing | Through a series of ACM SIGCHI workshops, we have built a research community of individuals dedicated to networked privacy--from identifying the key challenges to designing privacy solutions and setting a privacy-focused agenda for the future. In this workshop, we take an intentional pause to unpack the potential ethical questions and concerns this agenda might raise. Rather than strictly focusing on privacy as a state that is always desired--where more privacy is viewed unequivocally as "better"--we consider situations where privacy may not be optimal for researchers, end users, or society. We discuss the current research landscape, including the recent updates to the ACM's Code of Ethics, and how researchers and designers can make more informed decisions regarding ethics, privacy, and other competing values in privacy-related research and designs. Our workshop includes group discussions, breakout activities, and a panel of experts with diverse insights discussing topics related to privacy and ethics. | 377–382 | security; information disclosure; privacy; usability; ethics; research design |
19 | ACM | conferencePaper | 2016 | Sheff, Isaac; Magrino, Tom; Liu, Jed; Myers, Andrew C.; van Renesse, Robbert | Safe Serializable Secure Scheduling: Transactions and the Trade-Off Between Security and Consistency | Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security | Modern applications often operate on data in multiple administrative domains. In this federated setting, participants may not fully trust each other. These distributed applications use transactions as a core mechanism for ensuring reliability and consistency with persistent data. However, the coordination mechanisms needed for transactions can both leak confidential information and allow unauthorized influence. By implementing a simple attack, we show these side channels can be exploited. However, our focus is on preventing such attacks. We explore secure scheduling of atomic, serializable transactions in a federated setting. While we prove that no protocol can guarantee security and liveness in all settings, we establish conditions for sets of transactions that can safely complete under secure scheduling. Based on these conditions, we introduce \ti{staged commit}, a secure scheduling protocol for federated transactions. This protocol avoids insecure information channels by dividing transactions into distinct stages. We implement a compiler that statically checks code to ensure it meets our conditions, and a system that schedules these transactions using the staged commit protocol. Experiments on this implementation demonstrate that realistic federated transactions can be scheduled securely, atomically, and efficiently. | 229–241 | security; distributed systems; language-based security; information flow; consistency; serializability; transactions |
20 | ACM | conferencePaper | 2016 | Rodrigues, Bruno; Quintão Pereira, Fernando Magno; Aranha, Diego F. | Sparse Representation of Implicit Flows with Applications to Side-Channel Detection | Proceedings of the 25th International Conference on Compiler Construction | Information flow analyses traditionally use the Program Dependence Graph (PDG) as a supporting data-structure. This graph relies on Ferrante et al.'s notion of control dependences to represent implicit flows of information. A limitation of this approach is that it may create O(|I| x |E|) implicit flow edges in the PDG, where I are the instructions in a program, and E are the edges in its control flow graph. This paper shows that it is possible to compute information flow analyses using a different notion of implicit dependence, which yields a number of edges linear on the number of definitions plus uses of variables. Our algorithm computes these dependences in a single traversal of the program's dominance tree. This efficiency is possible due to a key property of programs in Static Single Assignment form: the definition of a variable dominates all its uses. Our algorithm correctly implements Hunt and Sands system of security types. Contrary to their original formulation, which required O(IxI) space and time for structured programs, we require only O(I). We have used our ideas to build FlowTracker, a tool that uncovers side-channel vulnerabilities in cryptographic algorithms. FlowTracker handles programs with over one-million assembly instructions in less than 200 seconds, and creates 24% less implicit flow edges than Ferrante et al.'s technique. FlowTracker has detected an issue in a constant-time implementation of Elliptic Curve Cryptography; it has found several time-variant constructions in OpenSSL, one issue in TrueCrypt and it has validated the isochronous behavior of the NaCl library. | 110–120 | implicit flows; Information flow; sparse analyses; SSA |
21 | ACM | conferencePaper | 2019 | Chakraborty, Dhiman; Hammer, Christian; Bugiel, Sven | Secure Multi-Execution in Android | Proceedings of the 34th ACM/SIGAPP Symposium on Applied Computing | Mobile operating systems, such as Google's Android, have become a fixed part of our daily lives and are entrusted with a plethora of private information. Congruously, their data protection mechanisms have been improved steadily over the last decade and, in particular, for Android, the research community has explored various enhancements and extensions to the access control model. However, the vast majority of those solutions has been concerned with controlling the access to data, but equally important is the question of how to control the flow of data once released. Ignoring control over the dissemination of data between applications or between components of the same app, opens the door for attacks, such as permission re-delegation or privacy-violating third-party libraries. Controlling information flows is a long-standing problem, and one of the most recent and practical-oriented approaches to information flow control is secure multi-execution. In this paper, we present Ariel, the design and implementation of an IFC architecture for Android based on the secure multi-execution of apps. Ariel demonstrably extends Android's system with support for executing multiple instances of apps, and it is equipped with a policy lattice derived from the protection levels of Android's permissions as well as an I/O scheduler to achieve control over data flows between application instances. We demonstrate how secure multi-execution with Ariel can help to mitigate two prominent attacks on Android, permission re-delegations and malicious advertisement libraries. | 1934–1943 | information flow control; Android; secure multi-execution |
22 | ACM | conferencePaper | 2017 | Cherupalli, Hari; Duwe, Henry; Ye, Weidong; Kumar, Rakesh; Sartori, John | Software-Based Gate-Level Information Flow Security for IoT Systems | Proceedings of the 50th Annual IEEE/ACM International Symposium on Microarchitecture | The growing movement to connect literally everything to the internet (internet of things or IoT) through ultra-low-power embedded microprocessors poses a critical challenge for information security. Gate-level tracking of information flows has been proposed to guarantee information flow security in computer systems. However, such solutions rely on non-commodity, secure-by-design processors. In this work, we observe that the need for secure-by-design processors arises because previous works on gate-level information flow tracking assume no knowledge of the application running in a system. Since IoT systems typically run a single application over and over for the lifetime of the system, we see a unique opportunity to provide application-specific gate-level information flow security for IoT systems. We develop a gate-level symbolic analysis framework that uses knowledge of the application running in a system to efficiently identify all possible information flow security vulnerabilities for the system. We leverage this information to provide security guarantees on commodity processors. We also show that security vulnerabilities identified by our analysis framework can be eliminated through software modifications at 15% energy overhead, on average, obviating the need for secure-by-design hardware. Our framework also allows us to identify and eliminate only the vulnerabilities that an application is prone to, reducing the cost of information flow security by 3.3× compared to a software-based approach that assumes no application knowledge. | 328–340 | security; internet of things; information flow; hardware-software co-analysis; ultra-low-power processors |
23 | ACM | conferencePaper | 2013 | Murphy, Diane R.; Murphy, Richard H. | Teaching Cybersecurity: Protecting the Business Environment | Proceedings of the 2013 on InfoSecCD ’13: Information Security Curriculum Development Conference | Traditional computer security has focused on protection against known threats, largely from outsider attacks. The number of cybersecurity incidents affecting businesses of all sizes demonstrates that our current cybersecurity posture is not entirely successful and that businesses are slowly moving from a risk avoidance stance to a risk mitigation strategy. The business world is changing and few businesses are able to easily protect their assets within a known business perimeter, particularly with inevitable budget constraints. Technology changes such as cloud computing, e-business, teleworking and bring-your-own device (BYOD) increase the potential for vulnerabilities from attacks to the business information technology infrastructure throughout the supply chain. In addition, business changes such as global suppliers, outsourcing and offshoring, and the need to cut costs in all aspects of manufacturing and operations are creating new vulnerabilities. To respond to these changes, businesses must consider cybersecurity strategies that are not focused primarily on firewall and encryption techniques, as threats are increasing from "trusted sources" including employees, customers, partners and suppliers. Supply chain security is an important consideration that is not covered in most cybersecurity educational programs. This paper addresses the need for a wider perspective on cybersecurity and the increasing need for educational programs that address this issue. | 88–93 | Risk management; cybersecurity education; supply chain security |
24 | ACM | conferencePaper | 2008 | Russo, Alejandro; Claessen, Koen; Hughes, John | A Library for Light-Weight Information-Flow Security in Haskell | Proceedings of the First ACM SIGPLAN Symposium on Haskell | Protecting confidentiality of data has become increasingly important for computing systems. Information-flow techniques have been developed over the years to achieve that purpose, leading to special-purpose languages that guarantee information-flow security in programs. However, rather than producing a new language from scratch, information-flow security can also be provided as a library. This has been done previously in Haskell using the arrow framework. In this paper, we show that arrows are not necessary to design such libraries and that a less general notion, namely monads, is sufficient to achieve the same goals. We present a monadic library to provide information-flow security for Haskell programs. The library introduces mechanisms to protect confidentiality of data for pure computations, that we then easily, and modularly, extend to include dealing with side-effects. We also present combinators to dynamically enforce different declassification policies when release of information is required in a controlled manner. It is possible to enforce policies related to what, by whom, and when information is released or a combination of them. The well-known concept of monads together with the light-weight characteristic of our approach makes the library suitable to build applications where confidentiality of data is an issue. | 13–24 | declassification; information-flow; library; monad |
25 | ACM | conferencePaper | 2012 | Austin, Thomas H.; Flanagan, Cormac | Multiple Facets for Dynamic Information Flow | Proceedings of the 39th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages | JavaScript has become a central technology of the web, but it is also the source of many security problems, including cross-site scripting attacks and malicious advertising code. Central to these problems is the fact that code from untrusted sources runs with full privileges. We implement information flow controls in Firefox to help prevent violations of data confidentiality and integrity. Most previous information flow techniques have primarily relied on either static type systems, which are a poor fit for JavaScript, or on dynamic analyses that sometimes get stuck due to problematic implicit flows, even in situations where the target web application correctly satisfies the desired security policy. We introduce faceted values, a new mechanism for providing information flow security in a dynamic manner that overcomes these limitations. Taking inspiration from secure multi-execution, we use faceted values to simultaneously and efficiently simulate multiple executions for different security levels, thus providing non-interference with minimal overhead, and without the reliance on the stuck executions of prior dynamic approaches. | 165–178 | information flow control; web security; dynamic analysis; javascript |
26 | ACM | conferencePaper | 2016 | Eliseev, Vladimir; Gurina, Anastasiya | Algorithms for Network Server Anomaly Behavior Detection without Traffic Content Inspection | Proceedings of the 9th International Conference on Security of Information and Networks | A problem of anomaly behavior detection for network server without traffic inspection is discussed. An importance of the problem is proved in a context of broad use of typical communication engines in servers and Internet of Things. A cross-correlation function for request-response characterization is introduced. An applicability of this approach was probed on SSH, DNS, HTTP and HTTPS real traffic. Two algorithms are provided to work with cross-correlation functions: one is based on Pearson correlation coefficient and another based on neural network one class classifier. Traffic of real HTTP and HTTPS servers is used to investigate algorithms and analyze their results. Key features and important parameters of both algorithms are highlighted. Not typical request-response events detection is demonstrated on test traffic series. Actuality and lightweight quality of the approach are emphasized regarding intrusion detection system implementation for typical servers, M2M and IoT applications. | 67–71 | Security; Internet of Things; Anomaly detection; Dynamic response; Input-output cross-correlation; Lightweight intrusion detection; Neural network; One-class classification |
27 | ACM | conferencePaper | 2019 | Wolf, Flynn; Kuber, Ravi; Aviv, Adam J. | “Pretty Close to a Must-Have”: Balancing Usability Desire and Security Concern in Biometric Adoption | Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems | We report on a qualitative inquiry among security-expert and non-expert mobile device users about the adoption of biometric authentication using semi-structured interviews(n=38, 19/19 expert/non-expert). Security experts more readily adopted biometrics than non-experts but also harbored greater distrust towards its use for sensitive transactions,feared biometric signature compromise, and in some cases distrusted newer facial recognition methods. Both groups harbored misconceptions, such as misunderstanding of the functional role of biometrics in authentication, and were about equally likely to have stopped using biometrics due to usability. Implications include the need for tailored training for security-informed advocates, better design for device sharing and co-registration, and consideration for usability needs in work environments. Refinement of these features would remove perceived obstacles to ubiquitous computing among the growing population of mobile technology users sensitized to security risk. | authentication; biometric adoption; mobile device; security expertise | |
28 | ACM | conferencePaper | 2019 | Vijeev, Abhishek; Ganapathy, Vinod; Bhattacharyya, Chiranjib | Regulating Drones in Restricted Spaces | Proceedings of the 20th International Workshop on Mobile Computing Systems and Applications | Commercial and end-user drones come equipped with a wide array of sensors. Unregulated use of such drones in public airspaces poses a serious threat to the privacy of citizens. We make the case for restricted spaces for drones, which are geographic areas for which a host can specify its privacy policies. Guest drones must prove to the host that they are in compliance with the host's policies before entering the restricted space. We then make the case for an information-flow control-based policy enforcement framework on drones, and sketch the design of a prototype framework atop the Robot Operating System (ROS). | 27–32 | privacy; drones; restricted spaces; trusted hardware |
29 | ACM | conferencePaper | 2015 | Stepanova, T. V.; Zegzhda, D. P. | Large-Scale Systems Security Evolution: Control Theory Approach | Proceedings of the 8th International Conference on Security of Information and Networks | Rapidly expanding information technologies field clearly discovers tendency of increasing computer systems' heterogeneity and distribution level. In this paper authors reveal the hidden attributes of IT security evolution towards more assumptions about attacker power and less assertions on provided security level. The proposed view of IT security evolution makes it possible to classify security providing technologies in terms of control theory. This comparison, in turn, allows to borrow a rich theoretical framework of appropriate control theory methods (for non-linear, non-stationary, discrete-continuous automatic control systems) and adopt them for cyber security purposes. Moreover, proposed control theory view enables prediction of the future security evolution stages and allows to partially determine them. | 135–141 | control theory; dynamic security; evolution; large-scale systems; security modeling |
30 | ACM | conferencePaper | 2012 | De Groef, Willem; Devriese, Dominique; Nikiforakis, Nick; Piessens, Frank | FlowFox: A Web Browser with Flexible and Precise Information Flow Control | Proceedings of the 2012 ACM Conference on Computer and Communications Security | We present FlowFox, the first fully functional web browser that implements a precise and general information flow control mechanism for web scripts based on the technique of secure multi-execution. We demonstrate how FlowFox subsumes many ad-hoc script containment countermeasures developed over the last years. We also show that FlowFox is compatible with the current web, by investigating its behavior on the Alexa top-500 web sites, many of which make intricate use of JavaScript. The performance and memory cost of FlowFox is substantial (a performance cost of around 20% on macro benchmarks for a simple two level policy), but not prohibitive. Our prototype implementation shows that information flow enforcement based on secure multi-execution can be implemented in full-scale browsers. It can support powerful, yet precise policies refining the same-origin-policy in a way that is compatible with existing websites. | 748–759 | web security; information flow; web browser architecture |
31 | ACM | conferencePaper | 2006 | Dam, Mads | Decidability and Proof Systems for Language-Based Noninterference Relations | Conference Record of the 33rd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages | Noninterference is the basic semantical condition used to account for confidentiality and integrity-related properties in programming languages. There appears to be an at least implicit belief in the programming languages community that partial approaches based on type systems or other static analysis techniques are necessary for noninterference analyses to be tractable. In this paper we show that this belief is not necessarily true. We focus on the notion of strong low bisimulation proposed by Sabelfeld and Sands. We show that, relative to a decidable expression theory, strong low bisimulation is decidable for a simple parallel while-language, and we give a sound and relatively complete proof system for deriving noninterference assertions. The completeness proof provides an effective proof search strategy. Moreover, we show that common alternative noninterference relations based on traces or input-output relations are undecidable. The first part of the paper is cast in terms of multi-level security. In the second part of the paper we generalize the setting to accommodate a form of intransitive interference. We discuss the model and show how the decidability and proof system results generalize to this richer setting. | 67–78 | language-based security; information flow; intransitive noninterference; multi-level security; noninterference |
32 | ACM | conferencePaper | 2013 | Jee, Kangkook; Kemerlis, Vasileios P.; Keromytis, Angelos D.; Portokalidis, Georgios | ShadowReplica: Efficient Parallelization of Dynamic Data Flow Tracking | Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security | Dynamic data flow tracking (DFT) is a technique broadly used in a variety of security applications that, unfortunately, exhibits poor performance, preventing its adoption in production systems. We present ShadowReplica, a new and efficient approach for accelerating DFT and other shadow memory-based analyses, by decoupling analysis from execution and utilizing spare CPU cores to run them in parallel. Our approach enables us to run a heavyweight technique, like dynamic taint analysis (DTA), twice as fast, while concurrently consuming fewer CPU cycles than when applying it in-line. DFT is run in parallel by a second shadow thread that is spawned for each application thread, and the two communicate using a shared data structure. We avoid the problems suffered by previous approaches, by introducing an off-line application analysis phase that utilizes both static and dynamic analysis methodologies to generate optimized code for decoupling execution and implementing DFT, while it also minimizes the amount of information that needs to be communicated between the two threads. Furthermore, we use a lock-free ring buffer structure and an N-way buffering scheme to efficiently exchange data between threads and maintain high cache-hit rates on multi-core CPUs. Our evaluation shows that ShadowReplica is on average ~2.3× faster than in-line DFT (~2.75× slowdown over native execution) when running the SPEC CPU2006 benchmark, while similar speed ups were observed with command-line utilities and popular server software. Astoundingly, ShadowReplica also reduces the CPU cycles used up to 30%. | 235–246 | security; information flow tracking; optimization; parallelization |
33 | ACM | conferencePaper | 2019 | Feth, Denis; Polst, Svenja | Heuristics and Models for Evaluating the Usability of Security Measures | Proceedings of Mensch Und Computer 2019 | Security mechanisms are nowadays part of almost every software. At the same time, they are typically sociotechnical and require involvement of end users to be effective. The usability of security measures is thus an essential factor. Despite this importance, this aspect often does not receive the necessary attention, for example due to short resources like time, budget, or usability experts. In the worst-case, users reject or circumvent even strong security measures and technically secure systems become insecure. To tackle the problem of unusable security measures, we developed a heuristics-based usability evaluation and optimization approach for security measures. In order to make heuristics applicable also for non-usability experts, we enrich them with information from a joint model for usability and security. In particular, this approach allows developers and administrators to perform usability evaluations and thus enables an early tailoring to the user, complementary to expert or user reviews. In this paper, we present our approach, including an initial set of heuristics, a joint model for usability and security and a set of mapping rules that combine heuristics and model. We evaluated the applicability of our approach, which we present in this paper. | 275–285 | Heuristic Evaluation; Human-centered Design; Quality Model; Usability Evaluation; Usable Security |
34 | ACM | conferencePaper | 2013 | Gauthier, François; Lavoie, Thierry; Merlo, Ettore | Uncovering Access Control Weaknesses and Flaws with Security-Discordant Software Clones | Proceedings of the 29th Annual Computer Security Applications Conference | Software clone detection techniques identify fragments of code that share some level of syntactic similarity. In this study, we investigate security-sensitive clone clusters: clusters of syntactically similar fragments of code that are protected by some privileges. From a security perspective, security-sensitive clone clusters can help reason about the implemented security model: given syntactically similar fragments of code, it is expected that they are protected by similar privileges. We hypothesize that clones that violate this assumption, defined as security-discordant clones, are likely to reveal weaknesses and flaws in access control models. In order to characterize security-discordant clones, we investigated two of the largest and most popular open-source PHP applications: Joomla! and Moodle, with sizes ranging from hundred thousands to more than a million lines of code. Investigation of security-discordant clone clusters in these systems revealed several previously undocumented, recurring, and application-independent security weaknesses. Moreover, security-discordant clones also revealed four, previously unreported, security flaws. Results also show how these flaws were revealed through the investigation of as little as 2% of the code base. Distribution of weaknesses and flaws between the two systems is investigated and discussed. Potential extensions to this exploratory work are also presented. | 209–218 | security; access control; clones; flaws; measurements; PHP |
35 | ACM | conferencePaper | 2013 | Yao, Huiping; Shin, Dongwan | Towards Preventing QR Code Based Attacks on Android Phone Using Security Warnings | Proceedings of the 8th ACM SIGSAC Symposium on Information, Computer and Communications Security | QR (Quick Response) code has become quite popular in recent years due to its large storage capacity, ease of generation and distribution, and fast readability. However, it is not likely that users will be able to find out easily the content encoded, typically URLs, until after they scan QR codes. This makes QR codes a perfect medium for attackers to conceal and launch their attacks based on malicious URLs. We believe that security hardening on QR code scanners is the most effective way to detect and prevent the potential attacks exploiting QR codes. However, little attention has been paid to the security features of QR code scanners so far in literature. In this paper, we investigated the current status of existing QR code scanners in terms of their detection of malicious URLs exploited for two well-known attacks: phishing and malware. Our study results show the existing scanners either cannot detect or can very poorly detect those two attacks. Hence, we propose a QR code solution called SafeQR that enhances the detection rate of malicious URLs by leveraging two existing security APIs to detect phishing and malware attacks: Google Safe Browsing API and Phishtank API. Additionally, a visual warning scheme was carefully designed and implemented to enable users to better heed warnings. A user study was designed and conducted to investigate the effectiveness of our scheme compared with the methods adopted by existing QR code scanners. | 341–346 | malware; user study; phishing; qr code security; visual warning |
36 | ACM | conferencePaper | 2018 | Shu, Xiaokui; Araujo, Frederico; Schales, Douglas L.; Stoecklin, Marc Ph.; Jang, Jiyong; Huang, Heqing; Rao, Josyula R. | Threat Intelligence Computing | Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security | Cyber threat hunting is the process of proactively and iteratively formulating and validating threat hypotheses based on security-relevant observations and domain knowledge. To facilitate threat hunting tasks, this paper introduces threat intelligence computing as a new methodology that models threat discovery as a graph computation problem. It enables efficient programming for solving threat discovery problems, equipping threat hunters with a suite of potent new tools for agile codifications of threat hypotheses, automated evidence mining, and interactive data inspection capabilities. A concrete realization of a threat intelligence computing platform is presented through the design and implementation of a domain-specific graph language with interactive visualization support and a distributed graph database. The platform was evaluated in a two-week DARPA competition for threat detection on a test bed comprising a wide variety of systems monitored in real time. During this period, sub-billion records were produced, streamed, and analyzed, dozens of threat hunting tasks were dynamically planned and programmed, and attack campaigns with diverse malicious intent were discovered. The platform exhibited strong detection and analytics capabilities coupled with high efficiency, resulting in a leadership position in the competition. Additional evaluations on comprehensive policy reasoning are outlined to demonstrate the versatility of the platform and the expressiveness of the language. | 1883–1898 | intrusion detection; threat hunting; computing methodology |
37 | ACM | journalArticle | 2017 | Austin, Thomas H.; Schmitz, Tommy; Flanagan, Cormac | Multiple Facets for Dynamic Information Flow with Exceptions | ACM Trans. Program. Lang. Syst. | JavaScript is the source of many security problems, including cross-site scripting attacks and malicious advertising code. Central to these problems is the fact that code from untrusted sources runs with full privileges. Information flow controls help prevent violations of data confidentiality and integrity. This article explores faceted values, a mechanism for providing information flow security in a dynamic manner that avoids the stuck executions of some prior approaches, such as the no-sensitive-upgrade technique. Faceted values simultaneously simulate multiple executions for different security levels to guarantee termination-insensitive noninterference. We also explore the interaction of faceted values with exceptions, declassification, and clearance. | web security; dynamic analysis; Information flow control; JavaScript | |
38 | ACM | conferencePaper | 2019 | Rouf, Yar; Mukherjee, Joydeep; Fokaefs, Marios; Shtern, Mark; Le, Justin; Litoiu, Marin | Rule-Based Security Management System for Data-Intensive Applications | Proceedings of the 29th Annual International Conference on Computer Science and Software Engineering | Applications in today's software development landscape evolve at a rapid rate, constantly providing their users with new updates and features. This can result in growing complexity to understand the entire application even within the scope of a small enterprise. The security team may not understand such a large application completely and the developers may not understand or properly incorporate important security measures, thus creating a less secure system. As a result, the application can be subjected to security vulnerabilities that can result in serious data and reputation loss. In this work, we propose a platform for security control that uses a Business Rule Engine to provide a more simplified way of defining security rules at an operational level, allowing collaboration between developers and security analysts. The proposed platform is external to the system and enables the development and security teams to write simple business rules without disrupting the system. We first evaluate our platform on a private testbed where we show how it simplifies the task of detecting common Web application vulnerabilities. Next, we deploy the platform along with a real data-intensive industrial application. We validate our platform on this industrial application to show how it can detect and mitigate unknown security vulnerabilities, how it can handle complex vulnerabilities and how it can facilitate the teams to handle these issues at runtime. | 254–263 | |
39 | ACM | journalArticle | 2018 | Toro, Matías; Garcia, Ronald; Tanter, Éric | Type-Driven Gradual Security with References | ACM Trans. Program. Lang. Syst. | In security-typed programming languages, types statically enforce noninterference between potentially conspiring values, such as the arguments and results of functions. But to adopt static security types, like other advanced type disciplines, programmers face a steep wholesale transition, often forcing them to refactor working code just to satisfy their type checker. To provide a gentler path to security typing that supports safe and stylish but hard-to-verify programming idioms, researchers have designed languages that blend static and dynamic checking of security types. Unfortunately, most of the resulting languages only support static, type-based reasoning about noninterference if a program is entirely statically secured. This limitation substantially weakens the benefits that dynamic enforcement brings to static security typing. Additionally, current proposals are focused on languages with explicit casts and therefore do not fulfill the vision of gradual typing, according to which the boundaries between static and dynamic checking only arise from the (im)precision of type annotations and are transparently mediated by implicit checks. In this article, we present GSLRef, a gradual security-typed higher-order language with references. As a gradual language, GSLRef supports the range of static-to-dynamic security checking exclusively driven by type annotations, without resorting to explicit casts. Additionally, GSLRef lets programmers use types to reason statically about termination-insensitive noninterference in all programs, even those that enforce security dynamically. We prove that GSLRef satisfies all but one of Siek et al.’s criteria for gradually-typed languages, which ensure that programs can seamlessly transition between simple typing and security typing. A notable exception regards the dynamic gradual guarantee, which some specific programs must violate if they are to satisfy noninterference; it remains an open question whether such a language could fully satisfy the dynamic gradual guarantee. To realize this design, we were led to draw a sharp distinction between syntactic type safety and semantic type soundness, each of which constrains the design of the gradual language. | language-based security; gradual typing; Noninterference | |
40 | ACM | conferencePaper | 2016 | Balliu, Musard; Liebe, Benjamin; Schoepe, Daniel; Sabelfeld, Andrei | JSLINQ: Building Secure Applications across Tiers | Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy | Modern web and mobile applications are complex entities amalgamating different languages, components, and platforms. The rich features span the application tiers and components, some from third parties, and require substantial efforts to ensure that the insecurity of a single component does not render the entire system insecure. As of today, the majority of the known approaches fall short of ensuring security across tiers. This paper proposes a framework for end-to-end security, by tracking information flow through the client, server, and underlying database. The framework utilizes homogeneous meta-programming to provide a uniform language for programming different components. We leverage .NET meta-programming capabilities from the F# language, thus enabling language-integrated queries on databases and interoperable heterogeneous execution on the client and the server. We develop a core of our security enforcement in the form of a security type system for a functional language with mutable store and prove it sound. Based on the core, we develop JSLINQ, an extension of the WebSharper library to track information flow. We demonstrate the capabilities of JSLINQ on the case studies of a password meter, two location-based services, a movie rental database, an online Battleship game, and a friend finder app. Our experiments indicate that JSLINQ is practical for implementing high-assurance web and mobile applications. | 307–318 | web application security; declassification; noninterference; formal security model; information-flow control; security type system |
41 | ACM | conferencePaper | 2019 | Taram, Mohammadkazem; Venkat, Ashish; Tullsen, Dean | Context-Sensitive Fencing: Securing Speculative Execution via Microcode Customization | Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems | This paper describes context-sensitive fencing (CSF), a microcode-level defense against multiple variants of Spectre. CSF leverages the ability to dynamically alter the decoding of the instruction stream, to seamlessly inject new micro-ops, including fences, only when dynamic conditions indicate they are needed. This enables the processor to protect against the attack, but with minimal impact on the efficacy of key performance features such as speculative execution. This research also examines several alternative fence implementations, and introduces three new types of fences which allow most dynamic reorderings of loads and stores, but in a way that prevents speculative accesses from changing visible cache state. These optimizations reduce the performance overhead of the defense mechanism, compared to state-of-the-art software-based fencing mechanisms by a factor of six. | 395–410 | side-channel attacks; microcode; secure architectures; spectre; speculative execution; taint tracking |
42 | ACM | journalArticle | 2015 | Roy, Arpan; Sarkar, Santonu; Ganesan, Rajeshwari; Goel, Geetika | Secure the Cloud: From the Perspective of a Service-Oriented Organization | ACM Comput. Surv. | In response to the revival of virtualized technology by Rosenblum and Garfinkel [2005], NIST defined cloud computing, a new paradigm in service computing infrastructures. In cloud environments, the basic security mechanism is ingrained in virtualization—that is, the execution of instructions at different privilege levels. Despite its obvious benefits, the caveat is that a crashed virtual machine (VM) is much harder to recover than a crashed workstation. When crashed, a VM is nothing but a giant corrupt binary file and quite unrecoverable by standard disk-based forensics. Therefore, VM crashes should be avoided at all costs. Security is one of the major contributors to such VM crashes. This includes compromising the hypervisor, cloud storage, images of VMs used infrequently, and remote cloud client used by the customer as well as threat from malicious insiders. Although using secure infrastructures such as private clouds alleviate several of these security problems, most cloud users end up using cheaper options such as third-party infrastructures (i.e., private clouds), thus a thorough discussion of all known security issues is pertinent. Hence, in this article, we discuss ongoing research in cloud security in order of the attack scenarios exploited most often in the cloud environment. We explore attack scenarios that call for securing the hypervisor, exploiting co-residency of VMs, VM image management, mitigating insider threats, securing storage in clouds, abusing lightweight software-as-a-service clients, and protecting data propagation in clouds. Wearing a practitioner's glasses, we explore the relevance of each attack scenario to a service company like Infosys. At the same time, we draw parallels between cloud security research and implementation of security solutions in the form of enterprise security suites for the cloud. We discuss the state of practice in the form of enterprise security suites that include cryptographic solutions, access control policies in the cloud, new techniques for attack detection, and security quality assurance in clouds. | Cloud security; attack scenarios; enterprise security suites; open problems; service-oriented organization | |
43 | ACM | journalArticle | 2019 | Chouhan, Chhaya; LaPerriere, Christy M.; Aljallad, Zaina; Kropczynski, Jess; Lipford, Heather; Wisniewski, Pamela J. | Co-Designing for Community Oversight: Helping People Make Privacy and Security Decisions Together | Proc. ACM Hum.-Comput. Interact. | Collective feedback can support an individual's decision-making process. For instance, individuals often seek the advice of friends, family, and co-workers to help them make privacy decisions. However, current technologies often do not provide mechanisms for this type of collaborative interaction. To address this gap, we propose a novel model of Community Oversight for Privacy and Security ("CO-oPS"), which identifies mechanisms for users to interact with people they trust to help one another make digital privacy and security decisions. We apply our CO-oPS model in the context of mobile applications ("apps"). To interrogate and refine this model, we conducted participatory design sessions with 32 participants in small groups of 2-4 people who know one another, with the goal of designing a mobile app that facilitates collaborative privacy and security decision-making. We describe and reflect on the opportunities and challenges that arise from the unequal motivation and trust in seeking support and giving support within and beyond a community. Through this research, we contribute a novel framework for collaborative digital privacy and security decision-making and provide empirical evidence towards how researchers and designers might translate this framework into design-based features. | security; collaborative privacy; collective feedback; community; mobile privacy; oversight | |
44 | ACM | conferencePaper | 2019 | Najafi, Pejman; Mühle, Alexander; Pünter, Wenzel; Cheng, Feng; Meinel, Christoph | MalRank: A Measure of Maliciousness in SIEM-Based Knowledge Graphs | Proceedings of the 35th Annual Computer Security Applications Conference | In this paper, we formulate threat detection in SIEM environments as a large-scale graph inference problem. We introduce a SIEM-based knowledge graph which models global associations among entities observed in proxy and DNS logs, enriched with related open source intelligence (OSINT) and cyber threat intelligence (CTI). Next, we propose MalRank, a graph-based inference algorithm designed to infer a node maliciousness score based on its associations to other entities presented in the knowledge graph, e.g., shared IP ranges or name servers. After a series of experiments on real-world data captured from a global enterprise's SIEM (spanning over 3TB of disk space), we show that MalRank maintains a high detection rate (AUC = 96%) outperforming its predecessor, Belief Propagation, both in terms of accuracy and efficiency. Furthermore, we show that this approach is effective in identifying previously unknown malicious entities such as malicious domain names and IP addresses. The system proposed in this research can be implemented in conjunction with an organization's SIEM, providing a maliciousness score for all observed entities, hence aiding SOC investigations. | 417–429 | SIEM; big data analytics in security; graph inference; graph mining; malicious domain detection |
45 | ACM | journalArticle | 1981 | Harris Cheheyl, Maureen; Gasser, Morrie; Huff, George A.; Millen, Jonathan K. | Verifying Security | ACM Comput. Surv. | 279–339 | ||
46 | ACM | book | 2016 | FSE 2016: Proceedings of the 2016 24th ACM SIGSOFT International Symposium on Foundations of Software Engineering | |||||
47 | ACM | book | 2017 | CSCW ’17: Proceedings of the 2017 ACM Conference on Computer Supported Cooperative Work and Social Computing | |||||
48 | ACM | conferencePaper | 2016 | Tall, Anne; Wang, Jun; Han, Dezhi | Survey of Data Intensive Computing Technologies Application to to Security Log Data Management | Proceedings of the 3rd IEEE/ACM International Conference on Big Data Computing, Applications and Technologies | Data intensive computing research and technology developments offer the potential of providing significant improvements in several security log management challenges. Approaches to address the complexity, timeliness, expense, diversity, and noise issues have been identified. These improvements are motivated by the increasingly important role of analytics. Machine learning and expert systems that incorporate attack patterns are providing greater detection insights. Finding actionable indicators requires the analysis to combine security event log data with other network data such and access control lists, making the big-data problem even bigger. Automation of threat intelligence is recognized as not complete with limited adoption of standards. With limited progress in anomaly signature detection, movement towards using expert systems has been identified as the path forward. Techniques focus on matching behaviors of attackers to patterns of abnormal activity in the network. The need to stream, parse, and analyze large volumes of small, semi-structured data files can be feasibly addressed through a variety of techniques identified by researchers. This report highlights research in key areas, including protection of the data, performance of the systems and network bandwidth utilization. | 268–273 | data intensive computing; hadoop; security event log information management; spark |
49 | ACM | conferencePaper | 2012 | Yang, Liu; Manadhata, Pratyusa; Horne, William; Rao, Prasad; Ganapathy, Vinod | Fast Submatch Extraction Using OBDDs | Proceedings of the Eighth ACM/IEEE Symposium on Architectures for Networking and Communications Systems | Network-based intrusion detection systems (NIDS) commonly use pattern languages to identify packets of interest. Similarly, security information and event management (SIEM) systems rely on pattern languages for real-time analysis of security alerts and event logs. Both NIDS and SIEM systems use pattern languages extended from regular expressions. One such extension, the submatch construct, allows the extraction of substrings from a string matching a pattern. Existing solutions for submatch extraction are based on non-deterministic finite automata (NFAs) or recursive backtracking. NFA-based algorithms are time-inefficient. Recursive backtracking algorithms perform poorly on pathological inputs generated by algorithmic complexity attacks. We propose a new approach for submatch extraction that uses ordered binary decision diagrams (OBDDs) to represent and operate pattern matching. Our evaluation using patterns from the Snort HTTP rule set and a commercial SIEM system shows that our approach achieves its ideal performance when patterns are combined. In the best case, our approach is faster than RE2 and PCRE by one to two orders of magnitude. | 163–174 | ordered binary decision diagram (OBDD); pattern matching; regular expression; submatch; tagged-nfa |
50 | ACM | conferencePaper | 2006 | Kim, Yoon-Gu; Kim, Han-Kil; Lee, Suk-Gyu; Lee, Ki-Dong | Ubiquitous Home Security Robot Based on Sensor Network | Proceedings of the IEEE/WIC/ACM International Conference on Intelligent Agent Technology | We propose and develop home security system based on sensor network (HSSN) configured by sensor nodes including radio frequency (RF), ultrasonic, temperature, light and sound sensors. Our system can acknowledge security alarm events that are acquired by sensor nodes and relayed in the hop-by-hop transmission way. There are sensor network, home security mobile robot (HSMR) and home server in this system. In the experimental results of this system, we presented that our system has more enhanced performance of response to emergency context and more speedy and accurate path planning to target position for arriving an alarm zone and acquiring the context-aware information. | 700–704 | |
51 | ACM | conferencePaper | 2019 | Polpinij, Jantima; Namee, Khanista | Internet Usage Patterns Mining from Firewall Event Logs | Proceedings of the 2019 International Conference on Big Data and Education | Understanding users' behavior of internet usage is essential for the quality of service (QoS) analysis on the internet. If the internet providers can better understand their users, they may be able to provide better service, and also enhance the quality of the service. In general, the information about users' behavior is stored as the internet access log files, called event logs, on the server. To have the patterns of users' behavior from the event logs, this work aims to extract an interesting pattern of inappropriate user behaviors through the method of internet usage patterns mining. The primary mechanism of the proposed method is the Generalized Sequential Pattern (GSP) algorithm, which is an algorithm of sequential pattern mining. This study uses real event logs from an organization in Thailand. The results have identified exciting findings that have made possible to propose some improvements and increasing the QoS of the internet service. | 93–97 | Data mining; Event logs; Generalized Sequential Pattern; Inappropriate user pattern; Internet usage; Sequential pattern mining |
52 | ACM | conferencePaper | 2011 | Bertino, Elisa; Ghinita, Gabriel | Towards Mechanisms for Detection and Prevention of Data Exfiltration by Insiders: Keynote Talk Paper | Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security | Data represent an extremely important asset for any organization. Confidential data such as military secrets or intellectual property must never be disclosed outside the organization. Therefore, one of the most severe threats in the case of cyber-insider attacks is the loss of confidential data due to exfiltration. A malicious insider who has the proper credentials to access the organization databases may, over time, send data outside the organization network through a variety of channels, such as email, crafted HTTP requests that encapsulate data, etc. Existing security tools for detection of cyber-attacks focus on protecting the boundary between the organization and the outside world. Numerous network-level intrusion detection systems (IDS) exist, which monitor the traffic pattern and attempt to infer anomalous behavior. While such tools may be effective in protecting against external attacks, they are less suitable when the data exfiltration is performed by an insider who has the proper credentials and authorization to access resources within the organization. In this paper, we argue that DBMS-layer detection and prevention systems are the best alternative to defend against data exfiltration because: (1) DBMS access is performed through a standard, unique language (SQL) with well-understood semantics; (2) monitoring the potential disclosure of confidential data is more effective if done as close as possible to the data source; and (3) the DBMS layer already has in place a thorough mechanism for enforcing access control based on subject credentials. By analyzing the pattern of interaction between subjects and the DBMS, it is possible to detect anomalous activity that is indicative of early signs of exfiltration. In the paper, we outline a taxonomy of cyber-insider dimensions of activities that are indicative of data exfiltration, and we discuss a high-level architecture and mechanisms for early detection of exfiltration by insiders. We also outline a virtualization-based mechanism that prevents insiders from exfiltrating data, even in the case when they manage to gain control over the network. The protection mechanism relies on explicit authorization of data transfers that cross the organizational boundary. | 10–19 | insider threat; data exfiltration |
53 | ACM | conferencePaper | 2009 | Myers, Justin; Grimaila, Michael R.; Mills, Robert F. | Towards Insider Threat Detection Using Web Server Logs | Proceedings of the 5th Annual Workshop on Cyber Security and Information Intelligence Research: Cyber Security and Information Intelligence Challenges and Strategies | Malicious insiders represent one of the most difficult categories of threats an organization must consider when mitigating operational risk. Insiders by definition possess elevated privileges; have knowledge about control measures; and may be able to bypass security measures designed to prevent, detect, or react to unauthorized access. In this paper, we discuss our initial research efforts focused on the detection of malicious insiders who exploit internal organizational web servers. The objective of the research is to apply lessons learned in network monitoring domains and enterprise log management to investigate various approaches for detecting insider threat activities using standardized tools and a common event expression framework. | common event expression; insider threat; insider threat detection; log management; web server logs | |
54 | ACM | conferencePaper | 2016 | Pawar, Shwetambari; Jain, Nilakshi; Deshpande, Swati | System Attribute Measures of Network Security Analyzer | Proceedings of the ACM Symposium on Women in Research 2016 | In this paper, we have mentioned a method to find the performance of projectwhich detects various web - attacks. The project is capable to identifying and preventing attacks like SQL Injection, Cross -- Site Scripting, URL rewriting, Web server 400 error code etc. The performance of system is detected using the system attributes that are mentioned in this paper. This is also used to determine efficiency of the system. | 51–54 | Security; Cross-Site Scripting; Efficiency; Intrusion Detection System; Intrusion Prevention System; Multiple Attacks; Packets; SQL Injection; URL Rewriting |
55 | ACM | conferencePaper | 2011 | Huh, Jun Ho; Kim, Hyoungshick; Lyle, John; Martin, Andrew | Achieving Attestation with Less Effort: An Indirect and Configurable Approach to Integrity Reporting | Proceedings of the Sixth ACM Workshop on Scalable Trusted Computing | This paper proposes an indirect attestation paradigm for verifying the trustworthiness of end user platforms. This approach overcomes several criticisms of attestation by maintaining the user's freedom to choose their own software configurations and minimising the whitelist management overhead for the relying party. Each user platform defines its own acceptable software combination in terms of reference integrity measurements, and reports the local verification results to the relying party through a late-launched, trusted Platform Trust Service. The relying party simply checks this verification result and a security meta-policy that has been used to ensure the quality of the security checks performed locally. The Platform Trust Service is also responsible for reporting whether this meta-policy is satisfied. By configuring the meta-policy, the relying party selects an indirect attestation paradigm that best meets their high-level security requirements. | 31–36 | indirect attestation; security meta-policy; whitelist management |
56 | ACM | conferencePaper | 2007 | Abi-Antoun, Marwan; Wang, Daniel; Torr, Peter | Checking Threat Modeling Data Flow Diagrams for Implementation Conformance and Security | Proceedings of the Twenty-Second IEEE/ACM International Conference on Automated Software Engineering | Threat modeling is a lightweight approach to reason about application security and uses Data Flow Diagrams (DFDs) with security annotations. We extended Reflexion Models to check the conformance of an as-designed DFD with an approximation of the as-built DFD obtained from the implementation. We also designed a set of properties and an analysis to help novice designers think about security threats such as spoofing, tampering and information disclosure. | 393–396 | data flow diagrams; denial of service; information disclosure; reflexion models; security analysis; spoofing; tampering; threat modeling |
57 | ACM | conferencePaper | 2012 | Kai, Satoshi; Shigemoto, Tomohiro; Kito, Tetsuro; Takemoto, Satoshi; Kaji, Tadashi | Development of Qualification of Security Status Suitable for Cloud Computing System | Proceedings of the 4th International Workshop on Security Measurements and Metrics | Cloud services have recently been expanding rapidly, but business users are still in the minority compared with consumer users. From the viewpoint of organizational risk management, it is necessary to control the risks of the cloud computing environment used as part of an organization's information system in order to minimize any negative influence on the organization's mission or business processes. In a previous article, the authors divided cloud security metrics into two security levels. One level shows how the security metrics influence the mission or business processes in 27 dimensions. The other level shows the security status at the time and the influence range when an incident occurs. This article focuses the latter variable security level and describes the results of developing a cloud security visualization system that was designed based on collection, analysis, and visualization architecture to calculate the level. From the viewpoint of security risk management, the system is considerered to be effective for cloud service providers because it reduces the time needed to investigate the cause of incidents and to recover from them, it helps in triage assessment when many incidents happen simultaneously, and it can detect warnings of an incident and forestall such incidents before they occur. | 17–24 | visualization; cloud computing; risk management; security level |
58 | ACM | conferencePaper | 2015 | Birngruber, Erich; Forai, Petar; Zauner, Aaron | Total Recall: Holistic Metrics for Broad Systems Performance and User Experience Visibility in a Data-Intensive Computing Environment | Proceedings of the Second International Workshop on HPC User Support Tools | User support personnel, systems engineers, and administrators of HPC installations need to be aware of log and telemetry information from different systems in order to perform routine tasks ranging from systems management to user inquiries. We present an integrated, distributed HPC tailored monitoring system, based on a current generation software stack from the DevOps community, with integration into the work load management system. The goal of this system is to provide a quicker turnaround time for user inquiries in response to errors. Dashboards provide an overlay of system and node level events on top of correlated metrics data. This information is directly available for querying, manipulation, and filtering, allowing statistical analysis and aggregation of collected data. Furthermore, additional dashboards offer in-sight into how users are interacting with available resources and pin-point fluctuations in utilization. The system can integrate sources of information from other monitoring solutions and event-based sources. | DevOps; distributed systems monitoring; event correlation; HPC; job scheduling; metrics; performance analysis; systems performance; telemetry; time-series databases; user support tools | |
59 | ACM | conferencePaper | 2015 | Baumgärtner, Lars; Strack, Christian; Houndefinedbach, Bastian; Seidemann, Marc; Seeger, Bernhard; Freisleben, Bernd | Complex Event Processing for Reactive Security Monitoring in Virtualized Computer Systems | Proceedings of the 9th ACM International Conference on Distributed Event-Based Systems | The number of security incidents in computer systems is steadily increasing, despite intrusion detection and prevention mechanisms deployed as countermeasures. Many existing intrusion detection and prevention systems struggle to keep up with new threats posed by zero-day attacks and/or have serious performance impacts through extensive monitoring, questioning their effectiveness in most real-life scenarios. In this paper, we present a new approach for reactive security monitoring in a virtualized computer environment based on minimally-intrusive dynamic sensors deployed vertically across virtualization layers and horizontally within a virtual machine instance. The sensor streams are analyzed using a novel federation of complex event processing engines and an optimized query index to maximize the performance of continuous queries, and the results of the analysis are used to trigger appropriate actions on different virtualization layers in response to detected security anomalies. Furthermore, a novel event store that supports fast event logging is utilized for offline analysis of collected historical data. Experiments show that the proposed system can execute tens of thousands of complex, stateful detection rules simultaneously and trigger actions efficiently and with low latency. | 22–33 | complex event processing; monitoring; security |
60 | ACM | conferencePaper | 2019 | Almeida, Ricardo Borges; Covalski, Victor; Machado, Roger; Rosa, Diórgenes Yuri Leal da; Yamin, Adenauer Corrundefineda; Donato, Lucas Medeiros; Pernas, Ana Marilza | A Hierarchical Architectural Model for Network Security Exploring Situational Awareness | Proceedings of the 34th ACM/SIGAPP Symposium on Applied Computing | Often network security technologies used by organizations for securing their computational systems are deficient in providing holistic view of the environment. Based on this, our paper presents an architectural model based on a Situational Awareness approach for securing computational systems in distributed environments. The architecture is called EXEHDA-ISSA and is inspired by SIEM systems. It is composed of three modular software components called Collector, SmartLogger, and Manager. These components are interconnected following a multi-level hierarchical model and provide features such as event collection, hybrid event processing and a hybrid approach to contextual data storage. For the purpose of evaluating this proposal, four case studies were developed to validate the holistic view of security events as well as the model's characteristics such as flexibility, autonomy, scalability and the support to heterogeneity. Finally, the strengths and limitations of our approach are discussed, then followed by future works. | 1365–1372 | architectural model; network security; situational awareness |
61 | ACM | journalArticle | 2018 | Ramaki, Ali Ahmadian; Rasoolzadegan, Abbas; Bafghi, Abbas Ghaemi | A Systematic Mapping Study on Intrusion Alert Analysis in Intrusion Detection Systems | ACM Comput. Surv. | Intrusion alert analysis is an attractive and active topic in the area of intrusion detection systems. In recent decades, many research communities have been working in this field. The main objective of this article is to achieve a taxonomy of research fields in intrusion alert analysis by using a systematic mapping study of 468 high-quality papers. The results show that there are 10 different research topics in the field, which can be classified into three broad groups: pre-processing, processing, and post-processing. The processing group contains most of the research works, and the post-processing group is newer than others. | alert correlation; intrusion alert analysis; Network security; systematic mapping study (SMS); systematic review | |
62 | ACM | journalArticle | 2016 | Khan, Suleman; Gani, Abdullah; Wahab, Ainuddin Wahid Abdul; Bagiwa, Mustapha Aminu; Shiraz, Muhammad; Khan, Samee U.; Buyya, Rajkumar; Zomaya, Albert Y. | Cloud Log Forensics: Foundations, State of the Art, and Future Directions | ACM Comput. Surv. | Cloud log forensics (CLF) mitigates the investigation process by identifying the malicious behavior of attackers through profound cloud log analysis. However, the accessibility attributes of cloud logs obstruct accomplishment of the goal to investigate cloud logs for various susceptibilities. Accessibility involves the issues of cloud log access, selection of proper cloud log file, cloud log data integrity, and trustworthiness of cloud logs. Therefore, forensic investigators of cloud log files are dependent on cloud service providers (CSPs) to get access of different cloud logs. Accessing cloud logs from outside the cloud without depending on the CSP is a challenging research area, whereas the increase in cloud attacks has increased the need for CLF to investigate the malicious activities of attackers. This paper reviews the state of the art of CLF and highlights different challenges and issues involved in investigating cloud log data. The logging mode, the importance of CLF, and cloud log-as-a-service are introduced. Moreover, case studies related to CLF are explained to highlight the practical implementation of cloud log investigation for analyzing malicious behaviors. The CLF security requirements, vulnerability points, and challenges are identified to tolerate different cloud log susceptibilities. We identify and introduce challenges and future directions to highlight open research areas of CLF for motivating investigators, academicians, and researchers to investigate them. | authenticity; big data; Cloud computing; cloud log forensics; confidentiality; correlation of cloud logs; integrity | |
63 | ACM | journalArticle | 2019 | Bridges, Robert A.; Glass-Vanderlan, Tarrah R.; Iannacone, Michael D.; Vincent, Maria S.; Chen, Qian (Guenevere) | A Survey of Intrusion Detection Systems Leveraging Host Data | ACM Comput. Surv. | This survey focuses on intrusion detection systems (IDS) that leverage host-based data sources for detecting attacks on enterprise network. The host-based IDS (HIDS) literature is organized by the input data source, presenting targeted sub-surveys of HIDS research leveraging system logs, audit data, Windows Registry, file systems, and program analysis. While system calls are generally included in audit data, several publicly available system call datasets have spawned a flurry of IDS research on this topic, which merits a separate section. To accommodate current researchers, a section giving descriptions of publicly available datasets is included, outlining their characteristics and shortcomings when used for IDS evaluation. Related surveys are organized and described. All sections are accompanied by tables concisely organizing the literature and datasets discussed. Finally, challenges, trends, and broader observations are throughout the survey and in the conclusion along with future directions of IDS research. Overall, this survey was designed to allow easy access to the diverse types of data available on a host for sensing intrusion, the progressions of research using each, and the accessible datasets for prototyping in the area. | anomaly detection; host; Intrusion detection | |
64 | ScienceDirect | journalArticle | 2006 | Kerr, Fred C. | Media analyses based on Microsoft® NTFS file ownership | Forensic Science International | The ever-increasing size of digital media presents a continuous challenge to digital investigators who must rapidly assess computer media to find and identify evidence. To meet this challenge, methods must continuously be sought to expedite the examination process. This paper investigates using the file ownership property as an analytical tool focusing on activity by individuals associated with the computer. Research centered on the New Technology File System (NTFS), which is the default file system in Microsoft® Windows Operating System (OS). This was done because Microsoft®'s worldwide market penetration makes Windows® and NTFS the most likely OS and file system to be encountered in digital forensic examinations. Significantly, digital forensic software now allows examination of NTFS file attributes and properties including the ownership property. The paper outlines potential limitations regarding interpreting ownership findings, and suggests areas for further research. Overall, file ownership is seen as a potentially viable new digital forensic tool. | 44 - 48 | Digital Forensic Examination; File ownership; Media examination; NTFS |
65 | ScienceDirect | journalArticle | 2013 | Small, Mike | From data breach to information stewardship | Network Security | Loss and theft of information from organisations continues to be a significant problem. Given the amount of attention to this issue and the wealth of standards and technology available, why do these leaks still occur and what can be done to improve matters? Loss and theft of information from organisations continues to be a significant problem. Why do these leaks still occur and what can be done to improve matters? People would not treat money with the same disregard that they treat information and data. Taking care to look after property that is not your own is called stewardship, and what is needed is better information stewardship, explains Mike Small, a member of the London Chapter of the ISACA Security Advisory Group. | 5 - 8 | |
66 | ScienceDirect | journalArticle | 2019 | Li, Ling; He, Wu; Xu, Li; Ash, Ivan; Anwar, Mohd; Yuan, Xiaohong | Investigating the impact of cybersecurity policy awareness on employees’ cybersecurity behavior | International Journal of Information Management | As internet technology and mobile applications increase in volume and complexity, malicious cyber-attacks are evolving, and as a result society is facing greater security risks in cyberspace more than ever before. This study has extended the published literature on cybersecurity by theoretically defining the conceptual domains of employees’ security behavior, and developed and tested operational measures to advance information security behavior research in the workplace. A conceptual framework is proposed and tested using survey results from 579 business managers and professionals. Structural equation modeling and ANOVA procedures are employed to test the proposed hypotheses. The results show that when employees are aware of their company’s information security policy and procedures, they are more competent to manage cybersecurity tasks than those who are not aware of their companies’ cybersecurity policies. The study also indicates that an organizational information security environment positively influences employees’ threat appraisal and coping appraisal abilities, which in turn, positively contribute to their cybersecurity compliance behavior. | 13 - 24 | Information security; Protection motivation theory; Cues to action; Cybersecurity policy compliance; Peer behavior |
67 | ScienceDirect | journalArticle | 2019 | Sharafaldin, Iman; Lashkari, Arash Habibi; Ghorbani, Ali A. | An evaluation framework for network security visualizations | Computers & Security | Visualization helps to comprehend and analyze large amounts of data, a fundamental necessity for network security due to the large volume of audits traces produced each day. In this paper, we dissect the majority of recent work conducted in network security visualization and offer a taxonomy that provides a basis for classifying recently published works using nine criteria. Moreover, a comprehensive evaluation framework for comparing and ranking network security visualization systems and techniques is developed and presented. Finally, we present a taxonomy of network attacks, which covers most of the existing network attacks and provides a framework for the categorization of recent network security visualization systems. | 70 - 92 | Evaluation framework; Information visualization; Network attack taxonomy; Network attacks; Network security visualization |
68 | ScienceDirect | journalArticle | 2015 | Accorsi, Rafael; Lehmann, Andreas; Lohmann, Niels | Information leak detection in business process models: Theory, application, and tool support | Information Systems | Despite the correct deployment of access control mechanisms, information leaks can persist and threaten the reliability of business process execution. This paper presents an automated and effective approach for the verification of information flow control for business process models. Building on the concept of place-based non-interference and declassification, the core contribution of this paper is the application of Petri net reachability to detect places in which information leaks occur. Such a feature allows for the use of state-of-the-art tool support to model-check business process models and detect leaks. We show that the approach is sound and complete, and present the Anica tool to identify leaks. An extensive evaluation comprising over 550 industrial process models is carried out and shows that information flow analysis of process models can be done in milliseconds. This motivates a tight integration of business process modeling and non-interference checking. | 244 - 257 | Automated analysis; Business process security; Software and process engineering |
69 | ScienceDirect | journalArticle | 1999 | Hassan, Charaf; Tuschák, Róbert; Vajk, István; Bars, Ruth; Hetthéssy, Jenö; Kovács, Ferenc; Szitnyai, György | A New Web/Matlab Based System in Control Education | IFAC Proceedings Volumes | At the Department of Automation, Technical University of Budapest in the last years the basic course of control theory has been renewed significantly using CAD devices, especially Matlab in the computer classroom. In this way the theoretical knowledge became more understandable and convincing for the students. Recently the Internet culture has burst into our everyday life, providing new possibilities for control education, too. It was a challenge lo combine the facilities provided both by the Web and Matlab. In the background of the system the Matlab program package supports the teaching process executing the computations. A new control curriculum using these facilities has been being developed. | 6410 - 6415 | user interfaces; reachability; CAD/CAM models; control education; integration; teaching |
70 | ScienceDirect | journalArticle | 2006 | Johnston, Andy; Reust, Jessica | Network intrusion investigation – Preparation and challenges | Digital Investigation | As new legislation is written mandating notification of affected parties following the compromise of confidential data, reliable investigative procedures into unauthorized access of such data assume increasing importance. The increasing costs and penalties associated with exposure of sensitive data can be mitigated through forensic preparation and the ability to employ digital forensics. A case study of the compromise of several systems containing sensitive data is outlined, with particular attention given to the procedures followed during the initial response and their impact on the subsequent digital forensic examination. Practical problems and challenges that arise in intrusion investigations are discussed, along with solutions and methodologies to address these issues. This case study illustrates both the importance of evaluating the evidence analyzed and of corroborating findings and conclusions with multiple independent sources of evidence. An initial response that incorporates forensic procedures provides a solid foundation for a successful and thorough forensic examination. | 118 - 126 | Incident response; Compromise of sensitive information; Digital forensic examination; Forensic preparedness; Intrusion investigation; Network forensics |
71 | ScienceDirect | journalArticle | 2019 | Khan, Saad; Parkinson, Simon | Discovering and utilising expert knowledge from security event logs | Journal of Information Security and Applications | Vulnerability assessment and security configuration of computer systems is heavily dependent on human experts, which are widely attributed as being in short supply. This can result in a system being left insecure because of the lack of easily accessible experience and specialist resources. While performing security tasks, human experts often revert to a system’s event logs to establish security information (configuration changes, errors, etc.). However, finding and exploiting knowledge from event logs is a challenging and time-consuming task for non-experts. Hence there is a strong need to provide mechanisms to make the process easier for security experts, as well as providing tools for those with significantly less security expertise. In this paper, we present a novel technique to process security event logs of a system that have been evaluated and configured by a security expert, extract key domain knowledge indicative of human decision making, and automatically apply acquired knowledge to previously unseen systems by non-experts to propose security improvements. The proposed solution utilises rule mining algorithms to extract security actions from event log entries. The set of identified rules is represented as a domain action model. The domain model and problem instance generated from a previously unseen system can then be used to produce a plan-of-action, which can be exploited by non-professionals to improve their system’s security. Empirical analysis is subsequently performed on 21 event logs, where the acquired domain model and identified plans are discussed in terms of accuracy and performance. | 102375 | Event logs; Association rule mining; Automated planning; Causality |
72 | ScienceDirect | journalArticle | 2015 | Zineddine, Mhamed | Vulnerabilities and mitigation techniques toning in the cloud: A cost and vulnerabilities coverage optimization approach using Cuckoo search algorithm with Lévy flights | Computers & Security | Information and Communication Technology (ICT) security issues have been a major concern for decades. Today's ICT infrastructure faces sophisticated attacks using combinations of multiple vulnerabilities to penetrate networks with devastating impact. With the recent rise of cloud computing as a new utility computing paradigm, organizations have been considering it as a viable option to outsource major IT services in order to cut costs. Some organizations have opted for a private or hybrid cloud to take advantage of the emerging technologies and services. However, ICT security issues have to be appropriately mitigated. This research proposes a cloud security framework and an approach for vulnerabilities coverage and cost optimization using Cuckoo search algorithm with Lévy flights as random walks. The objective is to mitigate an identified set of vulnerabilities using a selected set of techniques when minimizing cost and maximizing coverage. The results show that Cloud Computing providers and organizations implementing cloud technology within their premises can effectively balance IT security coverage and cost using the proposed approach. | 1 - 18 | Cloud computing; Cuckoo search algorithm; ICT security; Lévy flights algorithm; Optimization; Vulnerabilities mapping |
73 | ScienceDirect | journalArticle | 2020 | Landauer, Max; Skopik, Florian; Wurzenberger, Markus; Rauber, Andreas | System log clustering approaches for cyber security applications: A survey | Computers & Security | Log files give insight into the state of a computer system and enable the detection of anomalous events relevant to cyber security. However, automatically analyzing log data is difficult since it contains massive amounts of unstructured and diverse messages collected from heterogeneous sources. Therefore, several approaches that condense or summarize log data by means of clustering techniques have been proposed. Picking the right approach for a particular application domain is, however, non-trivial, since algorithms are designed towards specific objectives and requirements. This paper therefore surveys existing approaches. It thereby groups approaches by their clustering techniques, reviews their applicability and limitations, discusses trends and identifies gaps. The survey reveals that approaches usually pursue one or more of four major objectives: overview and filtering, parsing and signature extraction, static outlier detection, and sequences and dynamic anomaly detection. Finally, this paper also outlines a concept and tool that support the selection of appropriate approaches based on user-defined requirements. | 101739 | Cyber security; Anomaly detection; Log clustering; Log mining; Signature extraction |
74 | ScienceDirect | journalArticle | 2019 | Zhang, Qikun; Wang, Xianmin; Yuan, Junling; Liu, Lu; Wang, Ruifang; Huang, Hong; Li, Yuanzhang | A hierarchical group key agreement protocol using orientable attributes for cloud computing | Information Sciences | Group key agreement is one of the key technologies for ensuring information exchange security among group members. Due to different sensitivities of the information, group members may only want to exchange certain secret information under certain circumstances, and also due to different access permissions of member, certain information exchange may aim at different access authorities. Aiming at these requirements, a hierarchical group key agreement protocol using orientable attribute (HGKA-OA) is proposed in this paper. In this protocol, different secret information is shared among a set of members who have different authority levels. Assuming different permission levels correspond to different attributes or their combinations of the terminal, when one people has some secret information he can exchange information with some people who have the appropriate level of security permissions, rather than all the members in the group. The proposed scheme eliminates a majority of the computation task of terminals by moving identity authentication computation to the registration. In addition, the group key factors are also calculated before the group key agreement, which eliminates most of computation overhead due to group key agreement. This protocol is proven secure under the Decisional Bilinear Diffie-Hellman (DBDH) problem assumption and performance analysis shows that the proposed scheme is more efficient than existing works. | 55 - 69 | Asymmetric group key agreement; Attribute-based sharing permissions; Information exchange; Permission level |
75 | ScienceDirect | journalArticle | 2017 | Ezhei, Mansooreh; Ladani, Behrouz Tork | Information sharing vs. privacy: A game theoretic analysis | Expert Systems with Applications | Sharing cyber security information helps firms to decrease cyber security risks, prevent attacks, and increase their overall resilience. Hence it affects reducing the social security cost. Although previously cyber security information sharing was being performed in an informal and ad hoc manner, nowadays through development of information sharing and analysis centers (ISACs), cyber security information sharing has become more structured, regular, and frequent. This is while, the privacy risk and information disclosure concerns are still major challenges faced by ISACs that act as barriers in activating the potential impacts of ISACs. This paper provides insights on decisions about security investments and information sharing in consideration of privacy risk and security knowledge growth. By the latest concept i.e. security knowledge growth, we mean fusing the collected security information, adding prior knowledge, and performing extra analyses to enrich the shared information. The impact of this concept on increasing the motivation of firms for voluntarily sharing their sensitive information to authorities such as ISACs has been analytically studied for the first time in this paper. We propose a differential game model in which a linear fusion model for characterizing the process of knowledge growth via the ISAC is employed. The Nash equilibrium of the proposed game including the optimized values of security investment, and the thresholds of data sharing with the price of privacy are highlighted. We analytically find the threshold in which the gain achieved by sharing sensitive information outweighs the privacy risks and hence the firms have natural incentive to share their security information. Moreover, since in this case the threshold of data sharing and the security investment levels chosen in Nash equilibrium may be lower than social optimum, accordingly we design mechanisms which would encourage the firms and lead to a socially optimal outcome. The direct impact of the achieved results is on analyzing the way ISACs can convince firms to share their security information with them. | 327 - 337 | Privacy; Information sharing; Differential game; Information security economics; Security investment; Security knowledge growth |
76 | ScienceDirect | journalArticle | 2019 | Park, Jaemin; Park, Sungjin; Kang, Brent Byunghoon; Kim, Kwangjo | eMotion: An SGX extension for migrating enclaves | Computers & Security | Software Guard Extensions (SGX) is a good candidate to address sensitive information disclosure in cloud computing because SGX creates enclaves for applications that protect security sensitive code and data from malicious access. However, existing SGX-enabled Virtual Machine Managers (VMMs) do not provide live migration of SGX-enabled Virtual Machines (VMs). This management operation is impossible because the VMM cannot directly access the Enclave Page Cache (EPC) pages where the VM’s enclaves reside. SGX supports the EPC page swapping mechanism that evicts the EPC pages into the untrusted memory which the VMM can access. However, this mechanism has the limitations to be applied to enclave migration. In this paper, we propose an SGX extension for migrating enclaves called eMotion that adds additional instructions and migration support to the SGX architecture for enabling the secure managed migration of running enclaves. eMotion allows that the participating hosts establish a key used in enclave migration and the VMMs in the hosts migrate running enclaves using the established key. We implement a prototype on top of OpenSGX, an open source SGX emulator, to demonstrate the operations of eMotion and to estimate the impact on enclave migration. | 173 - 185 | Enclave migration; Managed migration; OpenSGX; SGX; Trusted execution environment |
77 | ScienceDirect | journalArticle | 2001 | Mokdad, Akram; Probst, Wilfried | The computational object approach for network and systems management | Telematics and Informatics | In the past 20 years, Network and Systems Management (N&SM) has thrived on mostly centralized or weakly distributed paradigms. Advances in technologies and software engineering suggested new ways of doing N&SM. The computational object approach is one of the main management technologies that have recently appeared. Based on this approach, the architecture proposed in this paper uses programming concepts instead of protocol concepts and conceals protocol complexity by easily manipulated components. Concerning the information model, the Common Information Model (CIM) is used which is designed in an object-oriented manner that is the key behind scalable N&SM.The implementation is done in the Windows environment and using the C++ programming language. | 211 - 247 | Common information model; Computational objects; Distributed objects; Network and Systems Management; Object-oriented methodology; Web-Based Enterprise Management |
78 | ScienceDirect | journalArticle | 2017 | Bashir, Masooda; Wee, Colin; Memon, Nasir; Guo, Boyi | Profiling cybersecurity competition participants: Self-efficacy, decision-making and interests predict effectiveness of competitions as a recruitment tool | Computers & Security | This paper presents the main results of a large-scale survey on cybersecurity competition participants in the past decade. 588 participants of the Cybersecurity Awareness Week (CSAW) competition were surveyed with measures of personality, interests, culture, decision-making and attachment styles in an exploratory study designed to identify the characteristics of cybersecurity competition participants. Subgroups analyses were performed to examine individual differences between self-proclaimed hackers and non-hackers, males and females, and cybersecurity employees versus students. Regression analyses were used to identify variables that influenced the extent to which cybersecurity competitions were effective at convincing participants to pursue a future career in cybersecurity. Cybersecurity participants who displayed higher self-efficacy, rational decision-making style, and more investigative interests were more likely to declare an interest in a career in cybersecurity after the competition. | 153 - 165 | Cybersecurity; Information assurance; Career choice; Cybersecurity competitions; Human factors; Recruitment |
79 | ScienceDirect | journalArticle | 2016 | Chakraborty, Rajarshi; Lee, Jaeung; Bagchi-Sen, Sharmistha; Upadhyaya, Shambhu; Rao, H. Raghav | Online shopping intention in the context of data breach in online retail stores: An examination of older and younger adults | Decision Support Systems | Data breaches through hacking incidents have become a significant phenomenon in the world of online shopping. These breaches can result in loss of personal data belonging to customers. This study builds a research model to examine people's intention to engage in e-commerce in the context of a significant data breach (the Target breach in December 2013). In addition, this paper focuses on the difference in responses regarding post-breach online shopping intent among younger adults (below 55years) and older adults (senior citizens—above 55years). Our findings show the importance of internal (self) monitoring of bank transactions in reducing the effect of perceptions of severity of data breaches on post-breach online shopping intent particularly for senior citizens. The study also demonstrates that perceptions of severity of a hacking incident are significant drivers of perceived online shopping risk for both age groups. Further, perceptions of severity of a hacking incident are significant drivers of post-breach online shopping intent but only marginally significant for younger adults. Trusting beliefs in online shopping services and attitude toward e-commerce are significant for the older generation for post-breach online shopping intentions and also for younger adults. Gender is significant for seniors while it is not significant for younger adults. The impact of perceived online shopping risk on post-breach online shopping is significantly different between the two age groups. The implication of this research lies in informing shopping websites the need to prepare better plans for notifying customers about not only data breaches but also their proposed mitigation steps so as to increase trust and reduce perceived risks associated with online shopping. | 47 - 56 | Trust; Age; Data breach; Internal monitoring; Online shopping; Perceived risk |
80 | ScienceDirect | journalArticle | 2014 | Knijff, R. M. van der | Control systems/SCADA forensics, what's the difference? | Digital Investigation | Immature IT security, increasing network connectivity and unwavering media attention is causing an increase in the number of control system cyber security incidents. For forensic examinations in these environments, knowledge and skills are needed in the field of hardware, networks and data analysis. For forensic examiners, this paper is meant to be a crash course on control systems and their forensic opportunities, focussing on the differences compared to regular IT systems. Assistance from experienced field engineers during forensic acquisition of control systems seems inevitable in order to guarantee process safety, business continuity and examination efficiency. For people working in the control system community, this paper may be helpful to get an idea about specific forensic issues about which they would normally not bother, but may be crucial as soon as their systems are under attack or become part of a law enforcement investigation. For analysis of acquired data, existing tools for network security monitoring have useful functionality for forensic applications but are designed for real-time acquisition and often not directly usable for post-mortem analysis of acquired data in a forensically sound way. The constant and predictable way in which control systems normally behave makes forensic application of anomaly-based threat detection an interesting topic for further research. | 160 - 174 | Cyber security; SCADA; Forensics; Control systems; ICS |
81 | ScienceDirect | journalArticle | 2006 | Mitropoulos, Sarandis; Patsos, Dimitrios; Douligeris, Christos | On Incident Handling and Response: A state-of-the-art approach | Computers & Security | Incident Response has always been an important aspect of Information Security but it is often overlooked by security administrators. Responding to an incident is not solely a technical issue but has many management, legal, technical and social aspects that are presented in this paper. We propose a detailed management framework along with a complete structured methodology that contains best practices and recommendations for appropriately handling a security incident. We also present the state-of-the art technology in computer, network and software forensics as well as automated trace-back artifacts, schemas and protocols. Finally, we propose a generic Incident Response process within a corporate environment. | 351 - 370 | Computer forensics; Incident Handling; Incident Response; Internet forensics; Software forensics; Trace-back mechanisms |
82 | ScienceDirect | journalArticle | 2016 | Biondi, Fabrizio; Given-Wilson, Thomas; Legay, Axel | Attainable unconditional security for shared-key cryptosystems | Information Sciences | Preserving the privacy of private communication is a fundamental concern of computing addressed by encryption. Information-theoretic reasoning models unconditional security where the strength of the results does not depend on computational hardness or unproven results. Usually the information leaked about the message by the ciphertext is used to measure the privacy of a communication, with perfect secrecy when the leakage is 0. However this is hard to achieve in practice. An alternative measure is the equivocation, intuitively the average number of message/key pairs that could have produced a given ciphertext. We show a theoretical bound on equivocation called max-equivocation and show that this generalizes perfect secrecy when achievable, and provides an alternative measure when perfect secrecy is not achievable. We derive bounds for max-equivocation for symmetric encoder functions and show that max-equivocation is achievable when the entropy of the ciphertext is minimized. We show that max-equivocation easily accounts for key re-use scenarios, and that large keys relative to the message perform very poorly under equivocation. We study encoders under this new perspective, deriving results on their achievable maximal equivocation and showing that some popular approaches such as Latin squares are not optimal. We show how unicity attacks can be naturally modeled, and how relaxing encoder symmetry improves equivocation. We present some algorithms for generating encryption functions that are practical and achieve 90−95% of the theoretical best, improving with larger message spaces. | 80 - 99 | Entropy; Max-equivocation; Perfect secrecy; Private-key cryptography; Symmetric encryption; Unconditional security |
83 | ScienceDirect | journalArticle | 2017 | Finogeev, Alexey G.; Finogeev, Anton A. | Information attacks and security in wireless sensor networks of industrial SCADA systems | Journal of Industrial Information Integration | The effectiveness of automated process control systems (APCS) and supervisory control and data acquisition systems (SCADA) information security depends on the applied protection technologies of transport environment data transmission components. This article investigates the problems of detecting attacks in wireless sensor networks (WSN) of SCADA systems. As a result of analytical research the authors developed the detailed classification of external attacks and intrusion detection in sensor networks and brought a detailed description of attacking impacts on components of SCADA systems in accordance with the selected directions of attacks. The cryptographic encryption tasks in the wireless sensor networks have been resolved by means of the built-in mechanism for symmetric AES encryption with 128 bit keys according to the ZigBee Pro Feature Set specification. However, analysis of the current state in the field of security of wireless sensor networks has shown that the key management problem is almost no solved. The article considers the problems and objectives of key management for data encryption in wireless sensor networks (WSN) of SCADA systems. The structure of the key information in the ZigBee network and methods of keys obtaining are discussed. The use of a hybrid key management schemes is most suitable for WSN. The session symmetric key is used to encrypt the sensor data, asymmetric keys are used to encrypt the session key transmitted from the routing information. Three algorithms of hybrid key management using routing information frames determined by routing methods and the WSN topology are presented. | 6 - 16 | Information security; Network attacks; Intrusion detection system; Key management; Attacks detection; Data encryption; Routing protocol; SCADA system; Wireless sensor network |
84 | ScienceDirect | journalArticle | 2019 | Karbab, ElMouatez Billah; Debbabi, Mourad | MalDy: Portable, data-driven malware detection using natural language processing and machine learning techniques on behavioral analysis reports | Digital Investigation | In response to the volume and sophistication of malicious software or malware, security investigators rely on dynamic analysis for malware detection to thwart obfuscation and packing issues. Dynamic analysis is the process of executing binary samples to produce reports that summarise their runtime behaviors. The investigator uses these reports to detect malware and attribute threat types leveraging manually chosen features. However, the diversity of malware and the execution environments make manual approaches not scalable because the investigator needs to manually engineer fingerprinting features for new environments. In this paper, we propose, MalDy (mal die), a portable (plug and play) malware detection and family threat attribution framework using supervised machine learning techniques. The key idea of MalDy portability is the modeling of the behavioral reports into a sequence of words, along with advanced natural language processing (NLP) and machine learning (ML) techniques for automatic engineering of relevant security features to detect and attribute malware without the investigator intervention. More precisely, we propose to use bag-of-words (BoW) NLP model to formulate the behavioral reports. Afterward, we build ML ensembles on top of BoW features. We extensively evaluate MalDy on various datasets from different platforms (Android and Win32) and execution environments. The evaluation shows the effectiveness and the portability of MalDy across the spectrum of the analyses and settings. | S77 - S87 | Malware; Android; Machine learning; Behavioral analysis; NLP; Win32 |
85 | ScienceDirect | journalArticle | 2017 | Domínguez, Manuel; Prada, Miguel A.; Reguera, Perfecto; Fuertes, Juan J.; Alonso, Serafín; Morán, Antonio | Cybersecurity training in control systems using real equipment**This work was supported by the Spanish Secretary of State for Research, Development and Innovation (Ministry of Economy and Competitivity), under grant UNLE13-3E-1578 of the National Programme for Fostering Excellence in Scientific and Technical Research -FEDER funds, and by the Spanish National Cybersecurity Institute (INCIBE), through the 17th Addendum of the Framework Agreement between INCIBE and the University of León | IFAC-PapersOnLine | The relevance of cybersecurity in the field of critical infrastructures has been reinforced in the last years, as a result of the increased number of incidents. The European Union has developed policies oriented to promote research and education in security and critical infrastructure protection. It is widely recognized that there is a shortage of qualified cybersecurity professionals due to the increasing demand. The situation is even more serious in the area of cybersecurity of critical infrastructures, due to the special characteristics of the control and monitoring systems needed for their operation. Furthermore, there is a knowledge gap between the industrial control experts, who generally have not received training in computer security, and the cybersecurity experts, who ignore the operation of industrial control systems. It is therefore necessary to create educational environments that support training and research oriented to bridge this gap without. For that reason, this paper presents a Laboratory of Critical Infrastructures Cybersecurity (CICLab) that is flexible enough to create different settings that simulate real situations on the critical infrastructure control systems. For that purpose, the laboratory includes different field, control and monitoring technologies that are widely used in four sectors: industry, energy management, building management and smart cities. Some educational activities are presented in the framework of this laboratory. | 12179 - 12184 | Cybersecurity; Education; Industrial Control Systems; Laboratory |
86 | ScienceDirect | journalArticle | 2019 | Lin, Jiaping; Niu, Jianwei; Li, Hui; Atiquzzaman, Mohammed | A Secure and Efficient Location-based Service Scheme for Smart Transportation | Future Generation Computer Systems | With the advance of wireless communication techniques and the popularity of embedded devices, Location-Based Service (LBS) has gained a great attention in the Internet-of-Things (IoT) recently. For instance, in smart transportation, reporting all the drivers’ location in a regular frequency is conducive to sense urban traffic congestion. However, it also posts a serious threat to drivers’ privacy because of the exposure to the real-time location. To alleviate this problem, we propose a Secure and Efficient Location-based Service (SELS) scheme for smart transportation in this paper. In the SELS scheme, drivers first utilize smart phones to encrypt their location-based data and then outsource them to a cloud center incessantly. Then they have the ability to call the cloud center to compute the ciphertext of LBS queries, by using a secure homomorphic encryption scheme and group signature scheme. After decrypting the ciphertext, they obtain accurate results of the queries without sacrificing the location privacy. Furthermore, the SELS scheme also supports multi-dimension data by employing a weighted distance algorithm. Finally, the security of the SELS scheme is proved and the cost of computation and communication is analyzed, in order to prove the security and efficiency of the scheme. | 694 - 704 | Internet-of-Things (IoT); Location-based Service (LBS); Outsourced cloud; Privacy preserving |
87 | ScienceDirect | journalArticle | 2006 | Maurer, Ueli | Secure multi-party computation made simple | Discrete Applied Mathematics | Known secure multi-party computation protocols are quite complex, involving non-trivial mathematical structures and sub-protocols. The purpose of this paper is to present a very simple approach to secure multi-party computation with straight-forward security proofs. This approach naturally yields protocols secure for mixed (active and passive) corruption and general (as opposed to threshold) adversary structures, confirming the previously proved tight bounds in a simpler framework. Due to their simplicity, the described protocols are well-suited for didactic purposes, which is a main goal of this paper. | 370 - 381 | Adversary structures; Secure multi-party computation; Verifyable secret sharing |
88 | ScienceDirect | journalArticle | 2015 | Suarez-Tangil, Guillermo; Palomar, Esther; Ribagorda, Arturo; Sanz, Ivan | Providing SIEM systems with self-adaptation | Information Fusion | Security information and event management (SIEM) is considered to be a promising paradigm to reconcile traditional intrusion detection processes along with most recent advances on artificial intelligence techniques in providing automatic and self-adaptive systems. However, classic management-related flaws still persist, e.g. the fusion of large amounts of security events reported from many heterogeneous systems, whilst novel intriguing challenges arise specially when dealing with the adaptation to newly encountered and multi-step attacks. In this article, we provide SIEM correlation with self-adaptation capabilities to optimize and significantly reduce the intervention of operators. In particular, our enhanced correlation engine automatically learns and produces correlation rules based on the context for different types of multi-step attacks using genetic programming. The context is considered as the knowledge and reasoning, not only acquired by a human expert but also inferred by our system, which assist in the identification and fusion of events. In this regard, a number of artificial neural networks are trained to classify events according to the corresponding context established for the attack. Experimentation is conducted on a real deployment within OSSIM to validate our proposal. | 145 - 158 | SIEM; Adaptive system; Artificial neural networks; Event correlation; Genetic programming |
89 | ScienceDirect | journalArticle | 2015 | Astakhova, L. V. | Evaluation Assurance Levels for Human Resource Security of an Information System | Procedia Engineering | Present methods for evaluating reliance on the information system security do not take into account the socio-technical nature of the information system and modern humanitarian approaches to the evaluation of reliance on them. The article defines the term “reliance to the personnel security of the information system” and substantiates a multi-criteria classification that categorizes evaluation levels of the reliance on the information system personnel security. The classification is the scientific novelty of this research. Seven stated evaluation levels of reliance on the personnel security are relevant to the seven evaluation levels of reliance on the information technologies embodied in the international standard ISO / IEC 15408-3: 2008 Information Technology - Security Techniques - Evaluation Criteria For IT Security - Part 3. Security Assurance Components. | 635 - 639 | information security; assessment; information system.; level; personnel security; reliance; user |
90 | ScienceDirect | journalArticle | 2008 | Askarov, Aslan; Hedin, Daniel; Sabelfeld, Andrei | Cryptographically-masked flows | Theoretical Computer Science | Cryptographic operations are essential for many security-critical systems. Reasoning about information flow in such systems is challenging because typical (noninterference-based) information-flow definitions allow no flow from secret to public data. Unfortunately, this implies that programs with encryption are ruled out because encrypted output depends on secret inputs: the plaintext and the key. However, it is desirable to allow flows arising from encryption with secret keys provided that the underlying cryptographic algorithm is strong enough. In this article we conservatively extend the noninterference definition to allow safe encryption, decryption, and key generation. To illustrate the usefulness of this approach, we propose (and implement) a type system that guarantees noninterference for a small imperative language with primitive cryptographic operations. The type system prevents dangerous program behavior (e.g., giving away a secret key or confusing keys and nonkeys), which we exemplify with secure implementations of cryptographic protocols. Because the model is based on a standard noninterference property, it allows us to develop some natural extensions. In particular, we consider public-key cryptography and integrity, which accommodate reasoning about primitives that are vulnerable to chosen-ciphertext attacks. | 82 - 101 | Cryptography; Information flow; Noninterference; Language-based security; Security type systems |
91 | ScienceDirect | journalArticle | 2017 | Anastopoulos, Vasileios; Katsikas, Sokratis | A structured methodology for deploying log management in WANs | Journal of Information Security and Applications | The collection of log data is a challenging operation for organizations that wish to monitor their infrastructure for security reasons. In this paper a methodology for the implementation of a log management infrastructure for real-time security monitoring on a large scale infrastructure is proposed. Related methods are adjusted and adopted to compose parts of the proposed methodology, avoiding to “re-invent the wheel” where possible. Social network analysis is employed to make and justify decisions that were formerly performed either intuitively or based on experience and vendors’ best practices. The methodology concludes with the creation of a repository of the necessary data. The result is an innovative methodology that can be used as a step-by-step guide for the implementation of a log management infrastructure in an organization. The proposed methodology is applied to a real WAN. | 120 - 132 | SIEM; Log management; Security monitoring; Social network analysis |
92 | ScienceDirect | journalArticle | 2019 | Bhardwaj, Akashdeep; Goundar, Sam | A framework to define the relationship between cyber security and cloud performance | Computer Fraud & Security | Cloud computing has become one of the most critical components of businesses and corporate organisations worldwide. It is a technology that has applications and services running on distributed networks and pooled virtualised resources that small, medium and large organisations can utilise to host their applications, processes and portals online via datacentres to provide access over the Internet to end users, customers and employees. In today's dynamic business world, traditional IT systems cannot keep up with ever-changing market demands and complex environments. Cloud computing has become one of the most critical components of enterprises worldwide. In today's dynamic business world, traditional IT systems cannot keep up with ever-changing market demands and complex environments. Many organisations are seeking an all-purpose cloud deployment to achieve increased service quality, which translates into better security and higher performance. In such cases, it becomes critical to concentrate on metrics for security and performance. Akashdeep Bhardwaj and Sam Goundar propose a framework for examining those two crucial elements. | 12 - 19 | |
93 | ScienceDirect | journalArticle | 2006 | Cazier, Joseph A.; Shao, Benjamin B. M.; Louis, Robert D. St | E-business differentiation through value-based trust | Information & Management | For e-business, location is irrelevant and competition is intense. To succeed in this environment, organizations must find new ways to differentiate themselves from their competition. One way to achieve e-business differentiation is to foster trust by building a perception of value congruence and avoiding a perception of value conflict. We explore how value congruence contributes to and how value conflict decreases trust in e-businesses. An experiment was conducted to examine the respective impacts of value congruence and value conflict on trust in an e-commerce setting. Our results show that, for e-businesses, value congruence has an enabling effect on trust while value conflict reduces trust. Such effects are strong enough to suggest that value congruence can be employed as an effective way for e-businesses to differentiate themselves while creating and sustaining competitive advantage. Managerial implications are drawn from our results. | 718 - 727 | E-commerce; Trust; Competitive advantage; Differentiation; E-business; Value conflict; Value congruence |
94 | ScienceDirect | journalArticle | 1990 | Roos, Jan; Jordaan, Derick; Markgraaff, Marieta; Rooyen, Frieda van | Model and architecture of a generalized network management system | Computer Communications | The standards for network management developed by the open systems interconnection working groups and prescribed by the OSI/NM Forum are based on the managed object and manager-agent concepts. Because multi-level management systems will exist, a management system must be able to support both manager and agent roles simultaneously. This manager role could be to agents, managed by the system and the agent role could be to a superior manager. Such a management system model is proposed and compared with other models defined for network management. Based on the model, an implementation architecture for management systems is described covering both the manager and agent roles. Aspects of a user interface for a network management system are also described. Some unique features of the user interface for multi-vendor, integrated network management are high-lighted. | 517 - 526 | user interface; network management; open systems interconnection; OSI/NM Forum |
95 | ScienceDirect | journalArticle | 2004 | Chang, Beom-Hwan; Kim, Dong-Soo; Kim, Hyun-Ku; Na, Jung-Chan; Chung, Tai-Myoung | Active security management based on Secure Zone Cooperation | Future Generation Computer Systems | Due to its open protocol, the Internet has revolutionized computer networks, but this revolution brings new risks and threats. The best way to protect computer networks is to prevent attackers from intruding, using fast automated procedures. However, the current state of protection is insufficient, because providing for all attacks or preventing unknown types of attack is almost impossible, and the methods used are manual. We solve this problem by using active security management, based on sharing information about attacks and cooperation between organizations. Secure Zone Cooperation, a framework that establishes mutual collaboration and cooperation between trusted zones, can protect systems and networks from potential attacks. This framework can predict and respond to attacks by exchanging security information and cooperating with each zone. It is a dynamic, powerful security architecture that rapidly enables security policy to be updated and response modules to be deployed. | 283 - 293 | Active network; Secure Zone Cooperation; Security management |
96 | ScienceDirect | journalArticle | 2016 | Bracken, Paul | The Cyber Threat to Nuclear Stability | Orbis | The thesis of this article is that cyber war technologies are spilling over into precision strike and nuclear mission areas. The result will transform deterrence and arms race stability and lead to other significant changes. The driver behind this is a combination of long standing problems with mobile missiles along with new technologies not usually factored into strategic assessments: big data analytics, computer vision, and related information systems. When combined with drones and precision strike, the hunt for mobile missiles is becoming faster, cheaper, and better. The implications of this finding vary by country, but will shape major power nuclear modernization, crisis stability among secondary powers, and conventional attack of nuclear deterrents. | 188 - 203 | |
97 | ScienceDirect | journalArticle | 2018 | Reyna, Ana; Martín, Cristian; Chen, Jaime; Soler, Enrique; Díaz, Manuel | On blockchain and its integration with IoT. Challenges and opportunities | Future Generation Computer Systems | In the Internet of Things (IoT) vision, conventional devices become smart and autonomous. This vision is turning into a reality thanks to advances in technology, but there are still challenges to address, particularly in the security domain e.g., data reliability. Taking into account the predicted evolution of the IoT in the coming years, it is necessary to provide confidence in this huge incoming information source. Blockchain has emerged as a key technology that will transform the way in which we share information. Building trust in distributed environments without the need for authorities is a technological advance that has the potential to change many industries, the IoT among them. Disruptive technologies such as big data and cloud computing have been leveraged by IoT to overcome its limitations since its conception, and we think blockchain will be one of the next ones. This paper focuses on this relationship, investigates challenges in blockchain IoT applications, and surveys the most relevant work in order to analyze how blockchain could potentially improve the IoT. | 173 - 190 | Internet of Things; Trust; Blockchain; Smart contract |
98 | ScienceDirect | journalArticle | 2017 | Raja, M. Siva Niranjan; Vasudevan, A. R. | Rule Generation for TCP SYN Flood attack in SIEM Environment | Procedia Computer Science | Security Information and Event Management (SIEM) is a combination of Security Information Management and Security Event Management. SIEM helps in the collection of events from heterogeneous devices and ordering into Common Event Format. The events collected are correlated and observed for changes in the system behaviour. Homogeneous Events such as DoS/Probe attacks can be detected by monitoring single event source. In this paper, TCP SYN flood attack is considered. RETE algorithm is applied on the network event attributes to formulate the rules and stored in database. An alert is triggered, when the rule for TCP SYN attack is matched. | 580 - 587 | Homogeneous Event; RETE Algorithm; SIEM tool; TCP SYN attack |
99 | ScienceDirect | journalArticle | 2011 | Wu, Shinn-Shyan; Liu, Chen-Ching; Shosha, Ahmed F.; Gladyshev, Pavel | Cyber Security and Information Protection in a Smart Grid Environment | IFAC Proceedings Volumes | Abstract The concept of smart grid is built on both electrical and two-way information flow, which is intended to facilitate efficient usage of energy for the future. However, cyber security and information privacy issues have raised concerns as potential loopholes since large-scale communication networks will be needed to connect numerous devices from geographically dispersed sites to a control centre. Leakage or manipulation of sensitive operational data in a smart grid may result in serious financial losses as well as power system contingencies. Hence, for the interdependencies between the electric power infrastructure and networked computers, defence of the cyber network in a smart grid must be strengthened in order to avoid catastrophes that can be caused by electronic intrusions. The focus of this paper is to propose intrusion prevention systems to provide secure communications in a smart grid environment. Detailed functions of intrusion prevention systems are described and attack scenarios are developed to validate the effectiveness of the proposed methodology. | 13696 - 13704 | cyber security; information security; information and communications technology; intrusion prevention system; smart grid |
100 | ScienceDirect | journalArticle | 2003 | Zdancewic, Steve | A Type System for Robust Declassification | Electronic Notes in Theoretical Computer Science | Language-based approaches to information security have led to the development of security type systems that permit the programmer to describe confidentiality policies on data. Security type systems are usually intended to enforce noninterference, a property that requires that high-security information not affect low-security computation. However, in practice, noninterference is often too restrictive—the desired policy does permit some information leakage. To compensate for the strictness of noninterference, practical approaches include some mechanism for declassifying high-security information. But such declassification is potentially dangerous, and its use should be restricted to prevent unintended information leaks. Zdancewic and Myers previously introduced the notion of robust declassification in an attempt to capture the desired restrictions on declassification, but that work did not propose a method for determining when a program satisfies the robust declassification condition. This paper motivates robust declassification and shows that a simple change to a security type system can enforce it. The idea is to extend the lattice of security labels to include integrity constraints as well as confidentiality constraints and then require that the decision to perform a declassification have high integrity. | 263 - 277 |