Search

Abstract Exploiting an out‐of‐bounds write vulnerability in general‐purpose applications has become a current research focus. Given the large scale of code in programs, selecting appropriate memory objects for exploitation is challenging. This letter proposes a corrupted data propagation‐guided fuzzing method. By tracking the propagation process of corrupted data among memory objects, a multi‐level fuzzing schedule is proposed to search the execution paths. Experimental results show that this proposed method, EMOFuzz, can effectively identify exploitable objects under various overflow lengths, significantly enhancing the efficiency of exploitability analysis.

Abstract Multiple‐input multiple‐output‐sparse code multiple access, a non‐trivial integration of sparse code multiple access and multiple‐input multiple‐output techniques, is able to achieve high spectrum efficiency and massive user connections. However, this integration also increases the complexity of signal detection. Here, the signal detection problem of multiple‐input multiple‐output sparse code multiple access is transformed into a tree search problem and use sphere decoding to detect the signal. By setting the initial radius to positive infinity, sphere decoding can achieve optimal maximum likelihood performance while the complexity is high. In order to further reduce the complexity of sphere decoding, a block‐wise sorted QR decomposition algorithm is proposed. Based on block‐wise sorted QR decomposition, the improved sphere decoding, namely block‐wise sorted QR decomposition‐sphere decoding, is able to make the tree search more efficient. Since only the detection order of each user's signal has been changed, block‐wise sorted QR decomposition‐sphere decoding can maintain the optimal maximum likelihood performance. Simulation results and complexity analysis show that block‐wise sorted QR decomposition‐sphere decoding can achieve optimal performance and both hard‐output and soft‐output block‐wise sorted QR decomposition‐sphere decoding have much lower complexity than joint message passing algorithm. Furthermore, given the same signal‐to‐noise ratio, the complexity of block‐wise sorted QR decomposition‐sphere decoding decreases with the increase of receiving antennas, while the complexity of joint message passing algorithm increases linearly.

The exponential expansion of Internet interconnectivity has led to a dramatic increase in cyber-attack alerts, which contain a considerable proportion of false positives. The overwhelming number of false positives cause tremendous resource consumption and delay responses to the really severe incidents, namely, alert fatigue. To cope with the challenge from alert fatigue, we focus on enhancing the capability of detectors to reduce the generation of false alerts from the detection perspective. The core idea of our work is to train a machine-learning-based detector to grasp the empirical intelligence of security analysts to estimate the feasibility of an incoming HTTP request to cause substantial threats, and integrate the estimation into the detection stage to reduce false alarms. To this end, we innovatively introduce the concept of attack feasibility to characterize the composition rationality of an inbound HTTP request as a feasible attack under static scrutinization. First, we adopt a fast request-reorganization algorithm to transform an HTTP request into the form of interface:payload pair for further alignment of structural components which can reveal the processing logic of the target program. Then, we build a dual-channel attention-based circulant convolution neural network (DualAC2NN) to integrate the attack feasibility estimation into the alert decision, by comprehensively considering the interface sensitivity, payload maliciousness, and their bipartite compatibility. Experiments on a real-world dataset show that the proposed method significantly reduces invalid alerts by around 86.37% and over 61.64% compared to a rule-based commercial WAF and several state-of-the-art methods, along with retaining a detection rate at 97.89% and a lower time overhead, which indicates that our approach can effectively mitigate alert fatigue from the detection perspective.

The integration of industrial control systems (ICS) with information technologies offers not only convenience but also creates security problems, from public networks to ICS. Spear-phishing attacks account for a considerable proportion of such security incidents. Therefore, there have been many studies about dealing with spear-phishing attacks. Most of these studies focus on studying strategies with better defense capabilities for spear-phishing attacks while neglecting the cost of implementing the strategies. However, a strategy with strong defense capabilities may not always be highly cost-effective. Moreover, considerable research has tended to consider the attacker and defender separately while ignoring the fact that the spear-phishing attack-defense process is a dynamic process of confrontation between the attacker and the defender. Actually, the deployment of defense strategies should comprehensively consider the defender's condition and the adversary's possible actions. Therefore, how to select the optimal strategy that defends against spear-phishing attacks with minimum overhead is a problem worthy of further study. Motivated by this consideration, we construct the multistage spear-phishing attack-defense signaling game model (MSPAD-SGM), which comprehensively considers the defense capability, the strategy cost, and the possible strategies of the two sides. Based on this model, we propose the optimal strategy selection algorithm for the spear-phishing attack-defense process. In addition, rather than numerical values, we adopt symbolic variables to quantify the payoffs and present a deep analysis of how the variation of payoffs influences the game result, which helps to reduce the subjectivity and improve the feasibility of our model. The simulation and deduction of the proposed approach are presented in a case study of MSPAD-SGM to demonstrate the feasibility and effectiveness of the proposed strategy's optimal selection approach. Our method provides decision support for the spear-phishing attack-defense process and improves the dynamic analysis efficiency of defense decision-making.

Fuzz testing is a widely used technique for software vulnerability detection, but it is still limited in finding bugs nested in the deep program states. Parallel testing is an augmented method aiming to make the best of the computing resource to expose more deep program bugs. However, current parallel testing methods cannot deal well with task slicing so that the parallel nodes show serious duplication with each other, thus decreasing the efficiency in total. For instance, the original parallel mode of the well-known fuzzer American fuzzy lop (AFL) does not split the task and just synchronizes the interesting seeds without any internal execution information. In this paper, we put forward a novel program state sensitive parallel testing method, which: 1) splits the task into low correlated subtasks according to the program states and 2) adjusts the mutation engine to confine one instance's testing among its subtask-related code region as more as possible. Our method is an objective to reduce the testing collision between parallel instances and therefore improve the performance. We developed a new fuzzer called PAFL and implemented some experiments to investigate that if our parallel testing framework is positive when deploying multiple instances and if it shows a better path discovery compared with two state-of-the-art fuzzers, AFL and AFLFast. In the experiments, we employed PAFL with 1/2/4/8/16 to observe their path discovery and conclude that our new parallel framework is positive when using more multiple instances. We also compared PAFL with AFL and AFLFast by employing eight parallel instances for each fuzzer, and the results prove that our tool has the best path discovery among the three fuzzers. Compared with the original parallel AFL, PAFL can achieve averaged performance gains of 3.98, 3.04, 4.18, and 1.45 on the c++filt, objdump, readelf, and tcpdump, respectively. Besides, we took PAFL on binutils and libtiff, and finally, we found ten new bugs.

Dynamic taint analysis techniques are a popular dynamic software analysis method. Marking a key segment of program function by dynamic taint analysis is an important part of software vulnerability research. Key segment marking usually related to the control flow taint analysis, however, several specific program structure may cause failure in key segment marking due to the control flow dependence, and overtainting and undertainting problem. In this paper, we proposed a novel method to mark a key segment accurately and efficiently with deep learning technology. Firstly, we fit the program function execution into a continuous function by the convoluntional network, and then mark the key segment roughly through derivative information of fitted nerual network. Finally, we mark the key segment of specific program function completely and accurately by filtering and diffusion algorithm. We developed the key segment marking tool NeuralTaint on this principle. We design an experiment to select the specific neural network structure of NeuralTaint. Our extensive evaluations demonstrate that NeuralTaint significantly outperforms the two state-of-the-art traditional dynamic taint analysis tool on seven popular real-world programs.

For supporting the massive connectivities and better adapting the high dynamical channel states of the cellular Internet of things networks, in this paper we proposed a new grant-free rateless sparse code multiple access (RSCMA) protocol. In the proposed grant-free RSCMA, users switch from the inactive mode to the active mode as soon as they receive data packages, and start to transmit the data without the request-grant process between the base station (BS) and users. In each transmission, the active users firstly choose a certain number of the modulated SCMA symbols according to the pre-assigned access control function (ACF), and then transmit the linearly superimposed SCMA symbols to the BS over the available resource elements. At the BS, owing to the sparsity of RSCMA, message passing algorithm which allows multi-user detection with near-optimal performance can be utilized to decode the messages. The transmission will continue until the user successfully receives an ACK signal sent back from the BS. Theoretical analysis in terms of achievable constellation constrained throughput is provided to show the maximal sum rate of RSCMA and to optimize the ACF design under the trade-off between the complexity and throughput performance. Both theoretical and simulation results show that the RSCMA can achieve higher throughput than the existing rateless multiple access schemes, such as hybrid automatic repeat request SCMA, LT code coded SCMA, and rateless multiple access.

Thousands of vulnerabilities are discovered in programs every day, which is extremely harmful to software security. Thus, discovering vulnerabilities in projects has become a central issue. Facing a sustained growth of software complexity and large code size, manual code auditing becomes time-consuming and labor-intensive. With more open source programs available and a high degree of code formalization, it is possible to study features from source code to guide vulnerability discovery work. In this paper, we present a lightweight-assisted vulnerability discovery method using a deep neural network (LAVDNN) to detect weakness and to provide guidance for manual auditing. The method proposed in this paper leverages function names as semantics features to uncover weak functions in large-scale open source programs. First, we extract function names and classify into weak and benign datasets. Then, we construct deep neural networks and compare the performances of different models. According to the experimental results, our method performs well for both C/C++ and Python programs, with the $F_{2}$ -score reaching 0.91 and 0.915, respectively. Ultimately, we evaluate the method by comparing with other approaches using the libraries FFmpeg 0.6 and LibTIFF 4.0.6. The results show that the LAVDNN could narrow the range of functions to be analyzed and report more weak functions without any prior vulnerability information. As a lightweight-assisted tool, the LAVDNN significantly reduces the false positive rate and hardly misses weak functions.

Key segment of a program input is the specific part of the input that has significant affect on the execution of target function. Marking key segment plays an important role in software security analysis. Traditional dynamic analysis methods can not mark the key segments correctly because of control flow dependency problem. The root cause of such problem is that implicit flow analysis method cannot cover all the behavior of the code fragment in a branch, especially when the code snippet contains unexpected jump behavior. The neural network can learn to fit the behavior of the program with proper training data. In this paper, we introduce the attention based neural network to mark the key segments of program input accurately and efficiently. We propose an attention based two-parts network structure and map program inputs into the target code execution by such network. Then we propose a two-step training method to train our network to calculate the importance of each input component on the execution of target function. Finally, we mark the key segments by statistical analysis method. We implement such method and develop a key segment marking tool AttentionMark. Experiments on four real-world software show that AttentionMark outperforms NeuralTaint and traditional dynamic analysis tool in key segment marking.

Binary fault localization is important for vulnerability analysis, but many current techniques face problems in locating vulnerability accurately and effectively, especially for real-world programs. In this paper, we propose a novel gradient-guided vulnerability locating method named DeepVL, which leverages deep neural networks to diagnose the root cause of weakness in binaries and provide guidance information for further analysis. DeepVL collects sufficient amounts of crashed execution traces and normal execution traces as input of the constructed neural networks. Based on trained neural network, DeepVL calculates the gradient information for each basic block in traces and filter out the vulnerable basic blocks according to corresponding gradients. To demonstrate the applicability of DeepVL, we perform plenty of experiments on different datasets. According to the experimental results on Common Weakness Enumeration (CWE) dataset, DeepVL could locate different types of vulnerabilities accurately and effectively, with recall@10 reaching 96.9% and precision@10 reaching 70.1%. Additionally, the results on Cyber Grand Challenge (CGC) program and LibTIFF 4.0.10 show that DeepVL is capable of locating vulnerable basic blocks in large-scale programs. As a fault localization tool, DeepVL could greatly reduce the manual effort of finding vulnerabilities in binaries.

Bitcoin combines a peer-to-peer network and cryptographic algorithm to implement a distributed digital currency system, which keeps all transaction history on a public blockchain. Since all transactions recorded on the blockchain are public to everyone, Bitcoin users face a threat of leaking financial privacy. Many analysis and deanonymization approaches have been proposed to link transaction records to real identities. To eliminate this threat, we present an unlinkable coin mixing scheme that allows users to mix their bitcoins without trusting a third party. This mixing scheme employs a primitive known as ring signature with elliptic curve digital signature algorithm (ECDSA) to conceal the transfer of coins between addresses. The mixing server is only able to check whether the output addresses belong to its customers, but it cannot tell which address owned by which customer. Customers do not have to rely on the reputation of a third party to ensure his money will be returned, and his privacy will not be leaked. This scheme needs no modifications on current Bitcoin system and is convenient to deploy by any communities. We implemented a prototype of our scheme and tested it under the Bitcoin core's regtest mode. Security and privacy of our mixing scheme are ensured through the standard ring signature and ECDSA unforgeability.

SCMA and polar coding are possible candidates for 5G systems. In this paper, we firstly propose the joint iterative detection and decoding (JIDD) receiver for the uplink polar coded sparse code multiple access (PC-SCMA) system. Then, the EXIT chart is used to investigate the performance of the JIDD receiver. Additionally, we optimize the system design and polar code construction based on the EXIT chart analysis. The proposed receiver integrates the factor graph of SCMA detector and polar soft-output decoder into a joint factor graph, which enables the exchange of messages between SCMA detector and polar decoder iteratively. Simulation results demonstrate that the JIDD receiver has better BER performance and lower complexity than the separate scheme. Specifically, when polar code length N = 256 and code rate R = 1/2, JIDD outperforms the separate scheme 4.8 and 6 dB over AWGN channel and Rayleigh fading channel, respectively. It also shows that, under 150% system loading, the JIDD receiver only has 0.3 dB performance loss compared to the single user uplink PC-SCMA over AWGN channel and 0.6 dB performance loss over Rayleigh fading channel.

Bugs and vulnerabilities in binary executables threaten cyber security. Current discovery methods, like fuzz testing, symbolic execution and manual analysis, both have advantages and disadvantages when exercising the deeper code area in binary executables to find more bugs. In this paper, we designed and implemented a hybrid automatic bug finding tool-Ffuzz-on top of fuzz testing and selective symbolic execution. It targets full system software stack testing including both the user space and kernel space. Combining these two mainstream techniques enables us to achieve higher coverage and avoid getting stuck both in fuzz testing and symbolic execution. We also proposed two key optimizations to improve the efficiency of full system testing. We evaluated the efficiency and effectiveness of our method on real-world binary software and 844 memory corruption vulnerable programs in the Juliet test suite. The results show that Ffuzz can discover software bugs in the full system software stack effectively and efficiently.

Formal techniques have been devoted to analyzing whether network protocol specifications violate security policies; however, these methods cannot detect vulnerabilities in the implementations of the network protocols themselves. Symbolic execution can be used to analyze the paths of the network protocol implementations, but for stateful network protocols, it is difficult to reach the deep states of the protocol. This paper proposes a novel model-guided approach to detect vulnerabilities in network protocol implementations. Our method first abstracts a finite state machine (FSM) model, then utilizes the model to guide the symbolic execution. This approach achieves high coverage of both the code and the protocol states. The proposed method is implemented and applied to test numerous real-world network protocol implementations. The experimental results indicate that the proposed method is more effective than traditional fuzzing methods such as SPIKE at detecting vulnerabilities in the deep states of network protocol implementations.

Network protocol vulnerability detection plays an important role in many domains, including protocol security analysis, application security, and network intrusion detection. In this study, by analyzing the general fuzzing method of network protocols, we propose a novel approach that combines network traffic analysis with the binary reverse engineering method. For network traffic analysis, the block-based protocol description language is introduced to construct test scripts, while the binary reverse engineering method employs the genetic algorithm with a fitness function designed to focus on code coverage. This combination leads to a substantial improvement in fuzz testing for network protocols. We build a prototype system and use it to test several real-world network protocol implementations. The experimental results show that the proposed approach detects vulnerabilities more efficiently and effectively than general fuzzing methods such as SPIKE.