Conference
Engineering Secure Software and Systems
About: Engineering Secure Software and Systems is an academic conference. The conference publishes majorly in the area(s): Computer science & Software security assurance. Over the lifetime, 104 publications have been published by the conference receiving 1576 citations.
Topics: Computer science, Software security assurance, Security engineering, Security testing, Software
Papers
6 Apr 2016
TL;DR: The attack detection system HexPADS detects attacks through divergences from normal behavior using attack signatures and can mitigate the attacks or significantly reduce their effectiveness with negligible overhead to benign processes.
Abstract: Current systems are under constant attack from many different sources. Both local and remote attackers try to escalate their privileges to exfiltrate data or to gain arbitrary code execution. While inline defense mechanisms like DEP, ASLR, or stack canaries are important, they have a local, program centric view and miss some attacks. Intrusion Detection Systems IDS use runtime monitors to measure current state and behavior of the system to detect an attack orthogonal to active defenses.
Attacks change the execution behavior of a system. Our attack detection system HexPADS detects attacks through divergences from normal behavior using attack signatures. HexPADS collects information from the operating system on runtime performance metrics with measurements from hardware performance counters for individual processes. Cache behavior is a strong indicator of ongoing attacks like rowhammer, side channels, covert channels, or CAIN attacks. Collecting performance metrics across all running processes allows the correlation and detection of these attacks. In addition, HexPADS can mitigate the attacks or significantly reduce their effectiveness with negligible overhead to benign processes.
161 citations
4 Mar 2015
TL;DR: Understanding the adversaries capabilities for guessing attacks is a fundamental necessity for estimating their impact and advising countermeasures.
Abstract: Passwords are widely used for user authentication, and will likely remain in use in the foreseeable future, despite several weaknesses. One important weakness is that human-generated passwords are far from being random, which makes them susceptible to guessing attacks. Understanding the adversaries capabilities for guessing attacks is a fundamental necessity for estimating their impact and advising countermeasures.
128 citations
4 Mar 2015
TL;DR: The relevance of timeline in the construction of datasets is considered to highlight its impact on the performance of a machine learning-based malware detection scheme and to confirm a number of intuitive assumptions about Android malware.
Abstract: In this paper, we consider the relevance of timeline in the construction of datasets, to highlight its impact on the performance of a machine learning-based malware detection scheme. Typically, we show that simply picking a random set of known malware to train a malware detector, as it is done in many assessment scenarios from the literature, yields significantly biased results. In the process of assessing the extent of this impact through various experiments, we were also able to confirm a number of intuitive assumptions about Android malware. For instance, we discuss the existence of Android malware lineages and how they could impact the performance of malware detection in the wild.
77 citations
3 Jul 2017
TL;DR: FPRandom is presented, a modified version of Firefox that adds randomness to mitigate the most recent fingerprinting algorithms, namely canvas fingerprinting, AudioContext fingerprinting and the unmasking of browsers through the order of JavaScript properties.
Abstract: The rich programming interfaces (APIs) provided by web browsers can be diverted to collect a browser fingerprint A small number of queries on these interfaces are sufficient to build a fingerprint that is statistically unique and very stable over time Consequently, the fingerprint can be used to track users Our work aims at mitigating the risk of browser fingerprinting for users privacy by 'breaking' the stability of a fingerprint over time We add randomness in the computation of selected browser functions, in order to have them deliver slightly different answers for each browsing session Randomization is possible thanks to the following properties of browsers implementations: (i) some functions have a nondeterministic specification, but a deterministic implementation ; (ii) multimedia functions can be slightly altered without deteriorating user's perception We present FPRandom, a modified version of Firefox that adds randomness to mitigate the most recent fingerprinting algorithms, namely canvas fingerprinting, AudioContext fingerprinting and the unmasking of browsers through the order of JavaScript properties We evaluate the effectiveness of FPRandom by testing it against known fingerprinting tests We also conduct a user study and evaluate the performance overhead of randomization to determine the impact on the user experience
59 citations
27 Mar 2009
TL;DR: This paper utilises a security enhanced BPMN notation to define access control properties of a security annotated business process model and uses an automatic translation of the process model into a process meta language (Promela) based on Coloured Petri net semantics.
Abstract: The verification of access controls is essential for providing secure systems. Model checking is an automated technique used for verifying finite state machines. The properties to be verified are usually expressed as formula in temporal logic. In this paper we present an approach to verify access control security properties of a security annotated business process model. To this end we utilise a security enhanced BPMN notation to define access control properties.
To enhance the usability the complex and technical details are hidden from the process modeller by using an automatic translation of the process model into a process meta language (Promela) based on Coloured Petri net (CPN) semantics.
The model checker SPIN is used for the process model verification and a trace file is written to provide visual feedback to the modeller on the abstraction level of the verified process model. As a proof of concept the described translation methodology is implemented as a plug-in for the free web-based BPMN modelling tool Oryx.
51 citations
Performance Metrics
| Year | Papers |
|---|---|
| 2018 | 10 |
| 2017 | 15 |
| 2016 | 20 |
| 2015 | 17 |
| 2014 | 16 |
| 2013 | 3 |