Search

The rapid growth of the Internet of Things (IoT) devices is paralleled by them being on the front-line of malicious attacks caused by malicious software. Machine learning (ML) algorithms, alongside the traditional signature-based methods, are typically used to detect malicious activities and behaviors. However, they are susceptible to malware evolution and sophistication, making them limited to the patterns that they have been trained upon. In this work, we systematically examine the state-of-the-art malware detection approaches using various representations, under a range of adversarial settings. Our preliminary analyses highlight the instability of the learning algorithms in learning patterns that distinguish the benign from the malicious. Our mutations with functionality-preserving operations, e.g., software stripping and binary padding, significantly deteriorate the accuracy of malware detectors.

Blockchain-based audit systems use “Practical Byzantine Fault Tolerance” (PBFT) consensus protocol which suffers from a high message complexity and low scalability. Alternatives to PBFT have not been tested in blockchain-based audit systems since no blockchain testbed supports the execution and benchmarking of different consensus protocols in a unified testing environment. In this paper, we address this gap by developing a blockchain testbed capable of executing and testing five consensus protocols in a blockchain network; namely PBFT, Proof-of-Work (PoW), Proof-of-Stake (PoS), Proof-of-Elapsed Time (PoET), and Clique. We carry out performance evaluation of those consensus algorithms using data from a real-world audit system. Our results show that the Clique protocol is best suited for blockchain-based audit systems, based on scalability features.

Deep learning algorithms have been widely used for security applications, including malware detection and classification. Recent results have shown that those algorithms are vulnerable to adversarial examples, whereby a small perturbation in the input sample may result in misclassification. In this paper, we systematically tackle the problem of adversarial examples detection in the control flow graph (CFG) based classifiers for malware detection using Soteria. Unique to Soteria, we use both density-based and level-based labels for CFG labeling to yield a consistent representation, a random walk-based traversal approach for feature extraction, and n-gram based module for feature representation. End-to-end, Soteria’s representation ensures a simple yet powerful randomization property of the used classification features, making it difficult even for a powerful adversary to launch a successful attack. Soteria also employs a deep learning approach, consisting of an auto-encoder for detecting adversarial examples, and a CNN architecture for detecting and classifying malware samples. We evaluate the performance of Soteria, using a large dataset consisting of 16,814 IoT samples, and demonstrate its superiority in comparison with state-of-the-art approaches. In particular, Soteria yields an accuracy rate of 97.79% for detecting AEs, and 99.91% overall accuracy for classification malware families.

The state-of-the-art of adversarial machine learning on malware detection systems generally yield unexecutable samples. In this work, we make the case for understanding the robustness of visualization-based malware detection system against adversarial examples (AEs) that not only are able to fool models, but also maintain the executability of the original input. To motivate for our vision, we first investigate the application of existing off-the-shelf adversarial attack approaches on malware detection systems through which we found that those approaches do not necessarily maintain the functionality of the original inputs. Then, we discuss an approach for achieving a high misclassification rate and maintaining the executability and functionality of the original input. We use visualization-based malware detection as an example to highlight the gap between blue-sky research that focuses on aspect of the learning process, and call for more practical techniques that respect the semantics of the underlying applications.

Sampling is a powerful tool to reduce the processing overhead in various systems. NetFlow uses a local table for counting records per flow, and sFlow sends out the collected packet headers periodically to a collecting server over the network. Any measurement system falls into either one of these two models. To reduce the overhead, as in sFlow, simple random sampling (SRS) has been widely used in practice because of its simplicity. However, SRS provides non-uniform sampling rates for different fine-grained flows (defined by 5-tuple), because it samples packets over an aggregated data flow (defined by switch port or VLAN). Consequently, some flows are sampled more than the designated sampling rate (resulting in over-estimation), and others are sampled fewer (resulting in under-estimation). Starting with a simple idea that "independent per-flow packet sampling provides the most accurate estimation of each flow", we introduce a new concept of per-flow systematic sampling, aiming to provide the same sampling rate across all flows. In addition, we provide a concrete sampling method called SketchFlow, which approximates the idea of the per-flow systematic sampling using a sketch saturation event. We demonstrate SketchFlow’s performance in terms of accuracy, sampling rate, and overhead using real-world datasets, including a backbone network trace, I/O trace, and Twitter dataset. Experimental results show that SketchFlow outperforms SRS (i.e., sFlow) and the non-linear sampling method while requiring a small CPU overhead to measure high-speed traffic in real-time.

The Onion Router (Tor) is designed to support an anonymous communication through end-to-end encryption. To prevent vulnerability of side channel attacks (e.g. website fingerprinting), dummy packet injection modules have been embedded in Tor to conceal trace patterns that are associated with the individual websites. However, recent study shows that current Website Fingerprinting (WF) defenses still generate patterns that may be captured and recognized by the deep learning technology. In this paper, we conduct in-depth analyses of two state-of-the-art WF defense approaches. Then, based on our new observations and insights, we propose a novel defense mechanism using a per-burst injection technique, called Deep Fingerprinting Defender (DFD), against deep learning-based WF attacks. The DFD has two operation modes, one-way and two-way injection. DFD is designed to break the inherent patterns preserved in Tor user’s traces by carefully injecting dummy packets within every burst. We conducted extensive experiments to evaluate the performance of DFD over both closed-world and open-world settings. Our results demonstrate that these two configurations can successfully break the Tor network traffic pattern and achieve a high evasion rate of 86.02% over one-way client-side injection rate of 100%, a promising improvement in comparison with state-of-the-art adversarial trace’s evasion rate of 60%. Moreover, DFD outperforms the state-of-the-art alternatives by requiring lower bandwidth overhead; 14.26% using client-side injection.

In this paper, we analyze the Internet of Things (IoT) Linux malware binaries to understand the dependencies among malware. Towards this end, we use static analysis to extract endpoints that malware communicates with, and classify such endpoints into targets and dropzones (equivalent to Command and Control). In total, we extracted 1,457 unique dropzone IP addresses that target 294 unique IP addresses and 1,018 masked target IP addresses. We highlight various characteristics of those dropzones and targets, including spatial, network, and organizational affinities. Towards the analysis of dropzones' interdependencies and dynamics, we identify dropzones chains. Overall, we identify 56 unique chains, which unveil coordination (and possible attacks) among different malware families. Further analysis of chains with higher node counts reveals centralization. We suggest a centrality-based defense and monitoring mechanism to limit the propagation and impact of malware.

With the rapid development of Software-Defined Networking (SDN) advocating a centralized view of networks, efficient and reliable Distributed Denial of Service (DDoS) defenses are necessary to protect the centralized SDN controller. Recently, an amalgamation of work has realized such defenses using Deep Learning (DL) based algorithms. Although DL-based algorithms are generally prone to adversarial learning attacks, the extent to which those attacks are applicable to DDoS defenses in SDN is unexamined. In this work, we explore the robustness of DL-based DDoS defenses in SDN against adversarial learning attacks. First, we investigate generic off-the-shelf adversarial attacks to test the robustness of DDoS defenses in SDN, and demonstrate that while they lead to misclassification, these attacks do not preserve the characteristics of flows. As a result, we propose Flow-Merge for realistic adversarial flows while achieving a high evasion rate, with both targeted and untargeted misclassification attacks. The proposed Flow-Merge is able to force the DL-based DDoS defenses to misclassify 100% of benign flows as malicious, while preserving original characteristics of flows. Using state-of-the-art defenses, we show that the adversarial flows generated using Flow-Merge are difficult to detect, with only 49.31% detection rate when using adversarial training.

In the zettabyte era, per-flow measurement becomes more challenging for the data center owing to the increment of both traffic volumes and the number of flows. Also, the swiftness of detection of anomalies (e.g., congestion, link failure, DDoS attack, and so on) becomes paramount. For fast and accurate traffic measurement, managing an accurate working set of active flows (WSAF) from massive volumes of packet influxes at line rates is a key challenge. WSAF is usually located in high-speed but expensive memory, such as TCAM or SRAM, and thus the number of entries to be stored is quite limited. To cope with the scalability issue of WSAF, we propose to use In-DRAM WSAF with scales, and put a compact data structure called FlowRegulator in front of WSAF to compensate for DRAM's slow access time by substantially reducing massive influxes to WSAF without compromising measurement accuracy. To verify its practicability, we further build a per-flow measurement system, called InstaMeasure, on an off-the-shelf Atom (lightweight) processor board. We evaluate our proposed system in a large scale real-world experiment (monitoring our campus main gateway router for 113 hours, and capturing 122.3 million flows). We verify that InstaMeasure can detect heavy hitters (HHs) with 99% accuracy and within 10 ms (detection is faster for heavier HHs) while providing the one million flows record with only tens of MB of DRAM memory. InstaMeasure's various performance metrics are further investigated by the packet trace-driven experiment using one-hour CAIDA dataset, where the target of measurement was all the 78 million L4 flows for one-hour.

In this paper, we present a new form of attack that can be carried out on the memory pools (mempools) of blockchain-based cryptocurrencies. Towards that end, we study such an attack on Bitcoin mempool and explore its effects on transactions fee paid by legitimate users. We also propose countermeasures to contain such an attack. Our countermeasures include fee-based and age-based designs, which optimize the mempool size and help in countering the effects of DDoS attacks. We further evaluate our designs by simulations and analyze their usefulness in varying attack conditions. Our analyses can be extended to other blockchain-based applications which use memory pools to cache network activities.

Distributed Denial-of-Service (DDoS) is a big threat to the security and stability of Internet-based services today. Among the recent advanced application-layer DDoS attacks, the Very Short Intermittent DDoS (VSI-DDoS) is the attack, which can bypass existing detection systems and significantly degrade the QoS experienced by users of web services. However, in order for the VSI-DDoS attack to work effectively, bots participating in the attack should be tightly synchronized, an assumption that is difficult to be met in reality. In this paper, we conducted a quantitative analysis to understand how a minimal deviation from perfect synchronization in botnets affects the performance and effectiveness of the VSI-DDoS attack. We found that VSI-DDoS became substantially less effective. That is, it lost 85.7% in terms of effectiveness under about 90ms synchronization inaccuracy, which is a very small inaccuracy under normal network conditions.

Ransomware is a malware that encrypts victim's data, where the decryption key is released after a ransom is paid by the data owner to the attacker. Many ransomware attacks were reported recently, making anti-ransomware a crucial need in security operation, and an issue for the security community to tackle. In this paper, we propose a new approach to defending against ransomware inside NAND flash-based SSDs. To realize the idea of defense-inside-SSDs, both a lightweight detection technique and a perfect recovery algorithm to be used as a part of SSDs firmware should be developed. To this end, we propose a new set of lightweight behavioral features on ran-somware's overwriting pattern, which are invariant across various ransomwares. Our features rely on observing the block I/O request headers only, and not the payload. For perfect and instant recovery, we also propose using the delayed deletion feature of SSDs, which is intrinsic to NAND flash. To demonstrate their feasibility, we implement our algorithms atop an open-channel SSD as a working prototype called SSD-Insider. In experiments using eight real-world and two in-house ransomwares with various background applications running, SSD-Insider achieved a detection accuracy 0% FRR/FAR in most scenarios, and only 5% FAR when heavy overwriting resembling ransomware's data wiping occurs. SSD-Insider detects ransomware activity within 10s, and recovers instantly an infected SSD within 1s with 0% data loss. The additional software overheads incurred by the SSD-Insider is just 147 ns and 254 ns for 4-KB reads and writes, respectively, which is negligible considering NAND chip latency (50-1000 µs).

We introduce DigitalSeal, a transaction authentication tool that works in both online and offline use scenarios. Digi-talSeal is a digital scanner that reads transaction information sent by an issuing entity of the DigitalSeal reader for authentication, and the information is encoded using a specially crafted bar-code. DigitalSeal views various pieces of transaction information for users to verify and proceed with transaction authentication. DigitalSeal is generic, and is capable of reading information viewed on paper, computer monitors (similarly, kiosk monitors), and mobile phones. A prototype of DigitalSeal is built using a Arduino UNO, four LLS05-A sensors, four TCRT5000 sensors, a 1602 LCD and a 9V battery.

This paper introduces a new surveillance platform which is equipped with multiple parallel deep learning frameworks. The deep learning frameworks are used for the face recognition of input image and video streams from CCTV cameras in security applications. Each deep learning framework has its own accuracy (related to recognition performance) and operation time (related to system stability) those are in tradeoff relationship. Based on this system architecture, a new dynamic control algorithm which selects one deep learning framework for time-average security-level (i.e., machine learning accuracy for recognition and classification) maximization under the consideration of system stability. The performance of the proposed algorithm was evaluated and also verified that it achieves desired performance.

DNSSEC Look-aside Validation (DLV) is examined, highlighting its lax specifications and privacy implications. By performing extensive experiments over datasets of domain names under comprehensive experimental settings, our findings firmly confirm the privacy leakages caused by DLV. We discover that a large number of domains that should not be sent to DLV servers are being leaked. We explore the root causes, and propose two approaches to fix the privacy leakages.

In this work, we introduce a powerful hardware-based rogue access point (PrAP), which can relay traffic between a legitimate AP and a wireless station back and forth, and act as a man-in-the-middle attacker. Our PrAP is built of two dedicated wireless routers interconnected physically, and can relay traffic rapidly between a station and a legitimate AP. Through extensive experiments, we demonstrate that the state-of-the-art time-based rogue AP (rAP) detectors cannot detect our PrAP, although effective against software-based rAP. To defend against PrAPs, we propose PrAP-Hunter based on intentional channel interference. PrAP-Hunter is highly accurate, even under heavy traffic scenarios. Using a high-performance (desktop) and low-performance (mobile) experimental setups of our PrAP-Hunter in various deployment scenarios, we demonstrate close to 100% of detection rate, compared to 60% detection rate by the state-of-the-art. We show that PrAP-Hunter is fast (takes 5-10 sec), does not require any prior knowledge, and can be deployed in the wild by real world experiments at 10 coffee shops.

In this work, we propose an SDN-based WLAN monitoring and management framework called RFlow+ to address WiFi service dissatisfaction caused by the limited view (lack of scalability) of network traffic monitoring and absence of intelligent and timely network treatments. Existing solutions (e.g., OpenFlow and sFlow) have limited view, no generic flow description, and poor trade-off between measurement accuracy and network overhead depending on the selection of the sampling rate. To resolve these issues, we devise a two-level counting mechanism, namely a distributed local counter (on-site and real-time) and central collector (a summation of local counters). With this, we proposed a highly scalable monitoring and management framework to handle immediate actions based on short-term (e.g., 50 ms) monitoring and eventual actions based on long-term (e.g., 1 month) monitoring. The former uses the local view of each access point (AP), and the latter uses the global view of the collector. Experimental results verify that RFlow+ can achieve high accuracy (less than 5% standard error for short-term and less than 1% for long-term) and fast detection of flows of interest (within 23 ms) with manageable network overhead. We prove the practicality of RFlow+ by showing the effectiveness of a MAC flooding attacker quarantine in a real-world testbed.

Biometric verification systems have security issues regarding the storage of biometric data in that a user's biometric features cannot be changed into other ones even when a system is compromised. To address this issue, it may be safe to store the biometrics data on a reliable remote server instead of storing them in a local device. However, this approach may raise a privacy issue. In this paper, we propose a biometric verification system where the biometric data are stored in a remote server in an encrypted form and the similarity of the user input to the registered biometric data is computed in an encrypted domain using a homomorphic encryption. We evaluated the performance of the proposed system through an implementation on an Android-based smartphone and an i7-based server.

In this paper, we present a short group signature scheme for dynamic membership with controllable link ability. The controllable link ability enables an entity who possesses a special linking key to check if two signatures are from the same signer while preserving anonymity. It can be used for various anonymity-based applications that require necessarily the link ability such as vehicular adhoc network, and privacy-preserving data mining. Our scheme is sufficiently efficient and so, well-suited for real-time applications even with restricted resources, such as vehicular adhoc network and Trusted Platform Module. We prove that it achieves anonymity, trace ability, and non-frame ability. Our scheme supporting controllable link ability yields a signature that is shorter than the best-known normal group signature by one group element. Furthermore, we show by experiment that our scheme is comparable to the group signature scheme in terms of the amount of computation for basic operations such as signing, verification, and the key update caused by revocation. Using the link ability for dynamic membership, computation overhead in opening signer's identity can be significantly reduced.

Sensor nodes are usually vulnerable to be compromised due to their unattended deployment. The low cost requirement of the sensor node precludes using an expensive tamper resistant hardware for sensor physical protection. Thus, the adversary can reprogram the compromised sensors and deviates sensor network functionality. In this paper, we propose two simple software-based remote code attestation schemes for different WSN criterion. Our schemes use different independent memory noise filling techniques called pre-deployment and post-deployment noise filling, and also different communication protocols for attestation purpose. The protocols are well-suited for wireless sensor networks, where external factors, such as channel collision, result in network delay. Hence, the success of our schemes of attestation does not depend on the accurate measurement of the execution time, which is the main drawback of previously proposed wireless sensor network attestation schemes.

With the growth of decentralized network users, preserving privacy becomes a critical issue in this open community. Kad-based network, as a typical decentralized system, has been widely used nowadays. However, there is not enough research to achieve anonymity on it. In this paper, we propose an anonymous protocol based on Kad network, named Anonymous Kad (A-Kad), which achieves complete privacy and security for file providers and requesters. A-Kad has the desired property of anonymity and still keeps high efficiency in publishing and querying phases. To achieve anonymity, we establish two anonymous channels which help file providers to anonymously publish file information and securely transfer files. Through these two channels, the file requester can also efficiently query and retrieve files without worrying about exposing its behavior. Moreover, we propose an anonymity degree evaluation model (ADEM) according to three different attacking capabilities and anonymity degree.

This paper proposes an environmental compensation algorithm to the general reputation model. The algorithm provides a scheme as a mean to mitigate the detrimental effect of selfish nodes. And it deals for the first time with the security - the environment's influence on node's behavior. It also shows how to establish trusts in different areas with different environmental characteristics. Finally this paper suggests that the scheme developed herein be generalized into other reputation algorithms

In this paper, we state a method of incorporating the distributed PKI (public key infrastructure) mechanisms to the MANET (mobile ad hoc networks) routing protocol. For doing this, we assume that MANET regards the CBRP (cluster based routing protocol) as base routing protocol. By using the basic operations of CBRP and the distributed PKI mechanisms, our scheme efficiently finds a certificate chain and performs the secure routing. This means that by incorporating the distributed PKI mechanisms to the CBRP, our scheme can provide the procedure of certificate chain discovery for packet routing. Also, by signing the HELLO message, our scheme can provide the reliable exchange of authentic routing/topology information.

Zero-knowledge interactive proof is a useful tool for designing identification and digital signature schemes. We propose a new interactive proof based identification and signature scheme.

Personal communications services (PCS) should support several times more users than cellular systems. Using the fact that many call patterns in PCS have the locality between the callers and callees, the proposed mobility management strategy is able to track the user locations efficiently in a hierarchically distributed fashion. In the proposed structure, the larger number of nodes per parent node shows better results. The virtually hierarchical link is used for fast call set up, which is useful especially in international roaming. The locality consideration effectively reduces home location register query processings.

Personal communications services (PCS) should support a number of users that is several times larger than that of cellular systems. Using the fact that many call patterns in PCS have the locality between the callers and callees, the proposed mobility management strategy is able to track the user locations efficiently in a hierarchically distributed fashion. In the proposed structure, the larger number of nodes per parent node shows better results. The virtually hierarchical link is used to support the call locality, which is useful especially in long-distance roaming. The locality consideration effectively reduces the database queries.

We present a problem of commonly used characterization sequences and propose a new test sequence to resolve the problem. The proposed test sequence could decide whether the output fault arises in the edge being tested or one of edges in the UIO sequence. Additionally, the fault coverage is much wider than other test sequence generation methods. To achieve the goal, we introduce k-strong FSM, and show that it can be constructed from a characterization sequence. Also, we illustrate our technique on a specific example.

We suggest a systematic way to design secure password-based authentication protocols, which is the password verifier model. The method makes use of zero-knowledge interactive proof (ZKIP), which has been known not to be useful for the protection of passwords. For the proper usage of ZKIP, we introduce a specialized form of ZKIP, which has a secret coin tossing stage.