Research in Attacks, Intrusions, and Defenses

Name: Research in Attacks, Intrusions, and Defenses | 21st International Symposium, RAID 2018, Heraklion, Crete, Greece, September 10-12, 2018, Proceedings
Brand: Springer
Price: 90.94 EUR
Availability: OnlineOnly

21st International Symposium, RAID 2018, Heraklion, Crete, Greece, September 10-12, 2018, Proceedings

Michael Bailey Thorsten Holz Manolis Stamatogiannakis Sotiris Ioannidis(Herausgeber*in)

Springer (Verlag)

Erschienen am 6. September 2018

XIV, 712 Seiten

E-Book

PDF mit Wasserzeichen-DRM

Systemvoraussetzungen

978-3-030-00470-5 (ISBN)

90,94 €inkl. 7% MwSt.

Systemvoraussetzungen

für PDF mit Wasserzeichen-DRM

E-Book Einzellizenz

Als Download verfügbar

Beschreibung

Weitere Details

Weitere Ausgaben

Inhalt

Intro
Preface
Organization
Contents
Attacks
Proteus: Detecting Android Emulators from Instruction-Level Profiles
1 Introduction
2 Background
2.1 ARMv7-A Architecture
2.2 Threat Model
3 Proteus System Architecture
4 Proteus Implementation
4.1 Instruction-Level Tracing on ARM-Based Platforms
4.2 Identifying Emulated vs. Real CPU Discrepancies with Tracing
5 Evaluation
5.1 Divergence Statistics from Proteus
5.2 Root Cause Analysis
5.3 Demonstration with Real Smartphones and the SDK Emulator
5.4 Improving the Fidelity of QEMU
6 Discussion and Limitations
7 Related Work
8 Conclusion
References
BabelView: Evaluating the Impact of Code Injection Attacks in Mobile Webviews
1 Introduction
2 Android WebViews
3 Overview
3.1 Attacker Model
3.2 Instrumenting for Information Flow
3.3 Preserving Semantics
4 BabelView
4.1 Phase 1: Interface Analysis
4.2 Phase 2: Generating the BabelView
4.3 Phase 3: Instrumentation
4.4 Phase 4: Information Flow Analysis
4.5 Phase 5: Analysis Refinement
5 Evaluation
5.1 Methodology
5.2 Applicability
5.3 Alarms Triggered
5.4 Manual Validation
5.5 Feasibility Analysis
5.6 Correlation of Alarms
5.7 Individual Case Studies
6 Limitations and Discussion
7 Related Work
7.1 Webview: Attacks and Vulnerabilities
7.2 Webview Access Control
7.3 Instrumentation-Based Modeling
8 Conclusion
References
Defeating Software Mitigations Against Rowhammer: A Surgical Precision Hammer
1 Introduction
2 Background
2.1 DRAM Architecture
2.2 The Rowhammer Vulnerability
2.3 Rowhammer Attacks
2.4 Rowhammer Defenses
3 RAMSES Address Translation Library
3.1 Design
3.2 Implementation
4 Applications of RAMSES
4.1 Hammering with RAMSES
4.2 Flip Tables
4.3 Attack Simulator
5 Evaluation
5.1 Profiling Bit Flips
5.2 Comparison
5.3 Defenses
6 Related Work
7 Conclusion
References
Intrusion Detection and Prevention
Reading Between the Lines: Content-Agnostic Detection of Spear-Phishing Emails
1 Introduction
2 Traits in Email Structure
2.1 Behavior Features
2.2 Composition Features
2.3 Transport Features
3 Detection Methodology
3.1 Feature Extraction and Embedding
3.2 Model Learning and Classification
4 Evaluation
4.1 Evaluation Data
4.2 Attacker Model
4.3 Spoofed Email Detection
5 Discussion and Limitations
6 Related Work
7 Conclusions
A Appendix
References
Backdoors: Definition, Deniability and Detection
1 Introduction
2 Overview
2.1 Contributions
2.2 Related Work
3 Nomenclature and Preliminaries
3.1 Analysis and Formalisation of FSMs
3.2 Backdoor Definition
3.3 Backdoor Detection
4 A Framework for Modelling Backdoors
4.1 Input Source
4.2 Trigger Mechanism
4.3 Payload
4.4 Privileged State
5 Practical Detection and Deniability
6 Discussion and Case-Studies
6.1 Backdoor Detection Methodologies
7 Future Work
8 Conclusion
References
RWGuard: A Real-Time Detection System Against Cryptographic Ransomware
1 Introduction
2 Background
3 RWGuard Design
3.1 Threat Model
3.2 Overview
3.3 Decoy Monitoring (DMon) Module
3.4 Process Monitoring (PMon) Module
3.5 File Change Monitoring (FCMon) Module
3.6 File Classification (FCls) Module
3.7 CryptoAPI Function Hooking (CFHk) Module
4 RWGuard Implementation
4.1 IRPParser
4.2 Decoy File Generator
4.3 CryptoAPI Function Hooking
5 Evaluation
5.1 Experiment Dataset
5.2 Detection Effectiveness
5.3 Size of Encrypted Data
5.4 File Recovery
5.5 Performance Overhead
5.6 Comparison with Existing Approaches
6 Discussion and Limitations
7 Related Work
8 Conclusions and Future Work
References
DDoS Attacks
DNS Unchained: Amplified Application-Layer DoS Attacks Against DNS Authoritatives
1 Introduction
2 Threat Model
3 Application Layer DDoS Against DNS
3.1 DNS Water Torture
3.2 Chaining-Based DNS DoS Attack
3.3 Leveraging DNS Caching
3.4 Attack Variant with DNAME Resource Records
4 Evaluation
4.1 Caching
4.2 Amplification
4.3 Overall Impact
5 Countermeasures
5.1 Identification and Remedy by ANSs
5.2 Response Rate Limiting (RRL)
5.3 Back-Off Strategies
5.4 Recursion Depth Limit
6 Related Work
7 Conclusion
References
Control Plane Reflection Attacks in SDNs: New Attacks and Countermeasures
1 Introduction
2 Background
3 Control Plane Reflection Attacks
3.1 Threat Model
3.2 Control Plane Reflection Attacks
4 Attack Evaluation
4.1 Experiment Setup
4.2 Attack Feasibility and Effects
4.3 Attack Fundamentals and Analysis
5 Defense Approach
5.1 Countermeasure Analysis
5.2 SWGuard: A Priority-Based Scheduler on Switch
5.3 Defense Evaluation
6 Discussion
7 Related Work
8 Conclusion
References
Proof-of-Blackouts? How Proof-of-Work Cryptocurrencies Could Affect Power Grids
1 Introduction
2 Background
3 Threat Model
4 Assessment of Models for Power Consumption
5 Total Power Consumption of Popular Mining Networks
6 Geographic Spread of Miners
7 Impacts on the Power Grid
8 Discussion
9 Related Work
10 Conclusion
References
Passwords, Accounts, and Users
Characterizing Eve: Analysing Cybercrime Actors in a Large Underground Forum
1 Introduction
2 Background and Related Work
3 Dataset
3.1 Key Actors
4 Characterizing Key Actors
4.1 Natural Language Processing
4.2 Social Network Analysis
4.3 Machine Learning - Clustering
4.4 Results
5 Predicting Key Actors
5.1 Logistic Regression
5.2 Clustering
5.3 Predicting Actors Using Topic Analysis
6 Ethical Considerations
7 Limitations
8 Conclusion
References
SybilBlind: Detecting Fake Users in Online Social Networks Without Manual Labels
1 Introduction
2 Related Work
2.1 Structure-Based Approaches
2.2 Other Approaches
3 Problem Definition
3.1 Structure-Based Sybil Detection Without Manual Labels
3.2 Threat Model
4 Design of SybilBlind
4.1 Overview
4.2 Sampler
4.3 Detector
4.4 Homophily-Entropy Aggregator
5 Theoretical Analysis
5.1 Sampling Size and Number of Sampling Trials
5.2 Complexity Analysis
6 Experiments
6.1 Experimental Setup
6.2 Results
7 Conclusion and Future Work
A Performance of the Average Aggregator
B Proof of Theorem 1
References
GuidedPass: Helping Users to Create Strong and Memorable Passwords
1 Introduction
2 Background and Related Work
3 Methodology
4 Memorable Password Analysis
4.1 Syntactic Characteristics
4.2 Semantic Structure
4.3 Summary of Our Findings
5 GuidedPass System Design
5.1 Password Suggestion Model
5.2 Suggestion Rules
6 Experiment
6.1 Approaches
6.2 User Study Design
6.3 Limitations and Ecological Validity
7 Results
7.1 Participant Statistics
7.2 Password Statistics
7.3 Recall Performance
7.4 Password Strength
7.5 Password Creation Time
7.6 Suggestions Adopted by Users
7.7 Users Sentiment
8 Discussion and Conclusions
References
Machine Learning for Computer Security
Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks
1 Introduction
2 Background
2.1 Neural Network Basics
2.2 Threat Model
2.3 Backdoor Attacks
3 Methodology
3.1 Pruning Defense
3.2 Pruning-Aware Attack
3.3 Fine-Pruning Defense
4 Discussion
4.1 Threats to Validity
5 Related Work
6 Conclusion
References
Dictionary Extraction and Detection of Algorithmically Generated Domain Names in Passive DNS Traffic
1 Introduction
2 Related Work
3 Preliminaries
4 WordGraph Method
5 Experimental Methodology
5.1 Datasets
5.2 Classification Models: Random Forest and Deep Learning
6 Results
6.1 Experimental Results: Ground Truth Data
6.2 Experimental Results: Real DNS Traffic
7 Discussion and Limitations
8 Conclusion
References
OTTer: A Scalable High-Resolution Encrypted Traffic Identification Engine
1 Introduction
2 Encrypted Traffic Pattern Language
2.1 Design Goals
2.2 Pattern Language Specification
3 Effectiveness Evaluation
3.1 Flow Sample Collection Mechanism
3.2 Sample Traffic Generation
3.3 Accuracy Evaluation
4 Implementation and Performance
4.1 Efficient Automaton
4.2 DPI Engine Integration
4.3 Performance Evaluation
5 Amenability to Data Mining
5.1 Rule Mining Methodology
5.2 Rule Mining Evaluation
6 Related Work
7 Ethical Considerations
8 Conclusion
References
Hardware-Assisted Security
Hardware Assisted Randomization of Data
1 Introduction
2 Background
2.1 Mitigation with DSR
3 Threat Model
4 DSR Design
4.1 Enabling Context Sensitivity
4.2 Memory Encryption
4.3 Support for External Code and Data
5 Hardware Design
5.1 Hardware Initialization
5.2 New Instructions
6 DSR Implementation
6.1 Computing Equivalence Classes
6.2 Handling External Code and Data
6.3 Program Transformation
7 Hardware Implementation
7.1 Instruction Encoding
7.2 Processor Pipeline
8 Evaluation
8.1 Performance
8.2 Area Overhead
8.3 Precision
8.4 Real World Exploit
9 Limitations
10 Related Work
11 Conclusion
References
MicroStache: A Lightweight Execution Context for In-Process Safe Region Isolation
1 Introduction
2 Background and Motivation
2.1 Safe Region Paradigm
2.2 Mechanisms
2.3 Extending the Safe Region to Cache Level Isolation
2.4 MicroStache Design Goals
3 Threat Model and Assumptions
4 MicroStache Design
4.1 Stache Segment
4.2 Safe Stack
4.3 Safe Cache
5 Security Applications
5.1 Safe Stack Protection
5.2 Code-Pointer Integrity
5.3 Secret Pointer Protection
5.4 Secret Computation Defense
6 Implementation
6.1 Gem5 Hardware Prototype
6.2 Software Support
6.3 Security Applications
7 Security and Performance Evaluation
7.1 Safe Stack Security Evaluation
7.2 Security Analysis
7.3 Performance Evaluation
8 Discussion and Future Work
9 Conclusion
References
CryptMe: Data Leakage Prevention for Unmodified Programs on ARM Devices
1 Introduction
2 Background
2.1 Memory Disclosure Attack
2.2 TrustZone
3 Threat Model and Security Requirements
3.1 Threat Model
3.2 Security Requirements
4 Design
4.1 Overview
4.2 Executing in the Secure World
4.3 Transparent Encryption
4.4 Disabling Access to the Sliding Window
5 Implementation
5.1 Secure World
5.2 Normal World
5.3 Key Management and Encryption
6 Evaluation
6.1 Security Evaluation
6.2 Performance Evaluation
7 Related Work
7.1 Memory Encryption
7.2 TrustZone-Based Solutions
8 Limitations and Future Work
9 Conclusions
References
Software Security
PartiSan: Fast and Flexible Sanitization via Run-Time Partitioning
1 Introduction
2 Background
3 Design
3.1 Creating Function Variants
3.2 Creating the Indirection Layer
3.3 Embedding Metadata
3.4 The PartiSan Runtime
4 Implementation
4.1 Profiling
4.2 Compiler Pass
4.3 The PartiSan Runtime
5 Effectiveness
6 Efficiency
6.1 Performance
6.2 Binary Size
7 Use Case: Fuzzing
7.1 Partitioning Policy
7.2 Evaluation
8 Discussion
9 Related Work
9.1 Run-Time Partitioning
9.2 Sanitizers
9.3 Control-Flow Diversity
10 Conclusion
References
CFI: Type-Assisted Control Flow Integrity for x86-64 Binaries
1 Introduction
2 Background
2.1 Exploiting Object Dispatches in C++
2.2 Type-Inference on Executables
2.3 Security Implications of Indirect Transfers
3 Threat Model
4 Design and Implementation
4.1 Approach Overview
4.2 Parameter Count and Type Policy
4.3 Instruction Read-Write Effect
4.4 Calltarget Analysis
4.5 Callsite Analysis
4.6 Return Values
4.7 Backward-Edge Analysis
4.8 Binary Instrumentation
4.9 Implementation
5 Evaluation
5.1 Effectiveness
5.2 Forward-Edge Policy Vs. Other Tools
5.3 Effectiveness Against COOP
5.4 Comparison with the Shadow-Stack
5.5 Security Analysis
5.6 Mitigation of Advanced CRAs
5.7 Runtime Overhead
6 Discussion
7 Related Work
8 Conclusion
References
Trusted Execution Path for Protecting Java Applications Against Deserialization of Untrusted Data
1 Introduction
2 Background
2.1 Java Virtual Machine
2.2 Java Technologies
2.3 Vulnerability Example
2.4 Threat Model
3 Overview
4 System Design and Implementation
4.1 Architectural Overview
4.2 Building Trusted Execution Path
4.3 Input Stimulation
5 Experimental Evaluation
5.1 JBoss Application Server
5.2 Jenkins
5.3 Effectiveness
5.4 Overhead
6 Related Work
7 Discussion
7.1 Data Attacks
7.2 Native Call Restrictions
7.3 Improving Learning
8 Conclusion
References
Malware
Error-Sensor: Mining Information from HTTP Error Traffic for Malware Intelligence
1 Introduction
2 Background
2.1 HTTP Errors
2.2 Problem Statement
3 Insights into HTTP Errors
3.1 Key Observations
4 System Design
4.1 System Overview
4.2 Filtering
4.3 Clustering
4.4 Classification
5 Evaluation
5.1 Effectiveness of Error-Sensor
5.2 Robustness of Error-Sensor
5.3 Case Study
6 Discussion
7 Related Work
8 Conclusion
References
Generic Black-Box End-to-End Attack Against State of the Art API Call Based Malware Classifiers
1 Introduction
2 Background and Related Work
3 Methodology
3.1 Black-Box API Call Based Malware Classifier
3.2 Black-Box API Call Based Malware Classifier Attack
4 Experimental Evaluation
4.1 Dataset
4.2 Malware Classifier Performance
4.3 Attack Performance
4.4 Transferability for RNN Models
5 GADGET: End-to-End Attack Framework Description
5.1 Adversarial Example Functionality Validation
5.2 Handling API Arguments
5.3 Handling Hybrid Classifiers and Multiple Feature Types
6 Conclusions and Future Work
References
Next Generation P2P Botnets: Monitoring Under Adverse Conditions
1 Introduction
2 Background
2.1 P2P Botnets
2.2 Botnet Monitoring Mechanisms
3 Related Work
3.1 P2P Botnet Monitoring
3.2 Monitoring Countermeasures
4 Botnet Monitoring Under Adverse Conditions
4.1 Identifying the Worst-Case Monitoring Scenario
4.2 Limiting Monitoring Information Through the MM Design
4.3 Botnet Design Constraints
4.4 Connecting the Dots
5 Modeling and Simulating Botnet Churn
5.1 Simulation of Real World Churn Models
5.2 The BotChurn (BC) Generator
6 Evaluation
6.1 Datasets and Evaluation Metrics
6.2 Simulation Setup
6.3 Results
7 Conclusion and Future Work
References
IoT/CPS Security
Malicious IoT Implants: Tampering with Serial Communication over the Internet
1 Introduction
2 Preliminaries
2.1 LPWAN Infrastructure
2.2 Serial Communication
2.3 I2C Communication Protocol
3 Threat Model
3.1 Untrusted Supply Chain
3.2 Attacker Model
4 Malicious IoT Implant
4.1 Design Criteria
4.2 Attack Procedures
4.3 Implementation
5 Evaluation
5.1 Effort of Insertion
5.2 Feasibility of Attacks
6 Discussion
6.1 Limitations
6.2 Countermeasures
7 Related Work
8 Conclusion
References
Before Toasters Rise Up: A View into the Emerging IoT Threat Landscape
1 Introduction
2 Data Collection Infrastructure
3 Insights into the IoT Threat Landscape
3.1 IoT Device Reconnaissance and Intrusion
3.2 IoT Device Infection
3.3 IoT Device Monetisation
4 Related Work
5 Conclusion
References
Statistical Similarity of Critical Infrastructure Network Traffic Based on Nearest Neighbor Distances
1 Introduction
2 Related Work
3 Chi-Square Distribution of NNS Distances for Normal Network Traffic
3.1 Representation of Normal Network Traffic
3.2 Traffic Behavior Modeling Using NNS
3.3 Learning Distribution of NNS Solution
3.4 Detecting Anomaly of Traffic
4 An Efficient Algorithm for Anomaly Detection
4.1 Windowed NNS
4.2 Partitioned NNS
4.3 Anomaly Detection on All Sub-Sequences
4.4 Efficient Distance Calculation
5 Experiments
5.1 Dataset
5.2 Precision: Detecting Normal Traffic
5.3 Recall: Detecting Anomaly of Traffic
5.4 Speed of Anomaly Detection
6 Conclusion
References
Security Measurements
PostScript Undead: Pwning the Web with a 35 Years Old Language
1 Introduction
2 Foundations
3 Attacker Model
4 Attacking via PostScript
5 Obfuscating Malicious PostScript Files
6 Evaluation
6.1 Image Conversion Websites
6.2 Alexa Top 15 Sites
6.3 Responsible Disclosure and Ethical Considerations
7 Towards a Hybrid Exploit
8 Related Work
9 Countermeasures
10 Future Work and Discussion
10.1 Further Targets
10.2 Obfuscation
11 Conclusion
A Comprehensive Attack Catalog
B Evaluation of Image Conversion Websites
References
Identifying Key Leakage of Bitcoin Users
1 Introduction
2 Background
3 Explicit Key Leaks: Open Source Intelligence
3.1 Finding Bitcoin Secrets
3.2 Results
4 Implicit Key Leaks: Incorrectly Used Cryptography
4.1 Elliptic Curve Digital Signature Algorithm (ECDSA)
4.2 Using Duplicate Nonces to Leak Keys
4.3 Beyond Single-Key Nonce Reuse
4.4 Results
4.5 Measuring the Impact of Weak Nonces
4.6 Identifying Past Attacks
5 Discussion
5.1 Ethical Considerations
5.2 Countermeasures
6 Related Work
7 Conclusion
References
Defenses
Furnace: Self-service Tenant VMI for the Cloud
1 Introduction
2 VMI Background
3 Design Goals
4 Design
4.1 Security
4.2 Performance
5 Case Studies
6 Evaluation and Results
6.1 Security Evaluation
6.2 Performance Evaluation
6.3 Related Work
7 Conclusion
References
ShadowMonitor: An Effective In-VM Monitoring Framework with Hardware-Enforced Isolation
1 Introduction
2 Overview
2.1 Threat Model
2.2 Basic Idea
2.3 Challenges
3 System Design
3.1 Isolation of Compartments
3.2 Efficient Compartment Switching
3.3 Work-Flow of Event Monitoring
3.4 Exploiting EPT Violation
3.5 Functionality of Monitor Code
4 Implementation
4.1 Enabling EPTP-switching and #VE
4.2 Deploying ShadowMonitor Framework
5 Security Analysis
6 Evaluation
6.1 Overhead of Monitoring Invocation
6.2 Memory Access Speed
6.3 Overall System Performance
7 Related Works
8 Conclusion
References
KASR: A Reliable and Practical Approach to Attack Surface Reduction of Commodity OS Kernels
1 Introduction
2 Threat Model and Design Goals
2.1 Threat Model
2.2 Design Goals
3 Design Rationale
3.1 Attack Surface Measurement
3.2 Benefits of Hardware-Assisted Virtualization
4 KASR Design
4.1 Offline Training Stage
4.2 Runtime Enforcement Stage
5 KASR Database
5.1 Data Structure
5.2 Database Operations
6 Evaluation
6.1 Kernel Attack Surface Reduction
6.2 Rootkit Prevention
6.3 Performance Evaluation
6.4 Offline Training Efficiency
7 Discussion
8 Related Work
9 Conclusion
References
Author Index

Systemvoraussetzungen

Als PDF speichern Als Link merken