One simple and standard way to partly address these security concerns is to utilize blacklists of IP addresses that have exhibited malicious behavior in the recent past.

a network .ow destined to a known malicious IP is highly likely to be malicious as well.


How could an adversary deploy her forces in order to have the highest possible impact?

where and how should the adversary hit, or equivalently how should the adversary allocate her resources in order to distort the most of the data collected by the victim network?


In addition, we also look at activities across multiple PIPs.

we look at account stickiness distribution, which records the number of other PIPs used by each account.


This is due to the fact that MF takes into account of the total number of edges for each group.

we group the local structures in an iterative way.


We use individual bits in the message as the basic units of spreading.

each bit is spread with a different spreading code.


Though ActionScript is easier to analyze than JavaScript, it does include some language features that can be used to obfuscate its code.

actionScript 2.0 allows the _root object to invoke a function through parsing an input string.


D Though the criteria (Criterion 1 or Criterion 2) indicate that one system is more secure than the other one it is a rare case when the set of possible attacks for one system is completely included into the set of possible attacks for another system.

this criterion gives us only a partial order, and, thus, we need a more .ne-grained way for de.ning the more secure relation.


We describe new attacks that can be launched by a routing adversary, and allow the censoring authority to defeat each of the security goals of decoy routing schemes.

we show that a censoring authority, or warden, that has this capability can detect the network locations of decoy routers; we demonstrate that a warden in control of how a user s packets are routed can prevent those packets from being seen by the decoy routing system; we show how an adversary that can predict the properties of paths to innocent destinations can detect the use of decoy routing through timing analysis; and we show how that same warden can launch con.rmation attacks that, by exploiting the differences between a normal user and a decoy routing user, test if a host is utilizing a decoy routing system.


.. * after observing tags for (..1,..,..2,.., ··· ,....,.. ) from all participants in the ..-th time interval, the adversary generates a forgery .. * (..1,..,..2,.., ··· ,....,.. ) ..,... ..,.. of the same time interval for some participant .. .


Speci.cally, the authors consider the setting where intermediary services exchange a SOAP message and alter message parts based on di.erent security requirements.

whenever a message passes a hop, the intermediary may add, alter or delete some element be it signed or be it unsigned.


First, most prior approaches mainly have the capability to detect pairwise policy anomalies, while a complete anomaly detection should consider all policy components as a whole piece.

prior policy analysis approaches are still needed to be improved [8].


2 2 Now declare A to lose if a collision appears, decreasing its success probability by this negligible term, but allowing us to consider collision-free executions.

except for the matching session, all values T 0||T 1 in the attack are independent.


I would like to thank Avi Wigderson for his help throughout this project.

i would like to thank Avi for pointing out that one-round schemes are at least as good as multi-round schemes.


However, as expected of a high-water mark research prototype, it needed expert operators to interpret the information it captures and to use the provided response mechanisms effectively.

the human experts needed to play the role of an intelligent control loop supervising the tightly configured organization of various defense mechanisms.


This allows us to detect any attack, including zero-day attacks, as long as it a.ects the network s QoS parameters.

we do not attempt to monitor the by-products e.ects of speci.c types of attacks, such as the increased number of failed TCP connections, increased tra.c volume, shifts in port or IP distribution or changes to routing tables and DNS caches.


Notice that, supposing x and y are pre-computed and allowed to be exposed as in the traditional CK-framework, the leakage of both x and y will expose the session-key of NAXOS, and consequently NAXOS is actually insecure in the eCK-model in this case.

the eCKsecurity of NAXOS depends upon what are speci.ed in session-states.


We note that such informal de.nitions su.ce for our purposes, since we only modify the internals of black boxes.

the security proofs provided by Tsang et al.


Alignment sleds are special sequences of bytes by which we enforce aligned execution of a set of critical instructions.

we use this technique to prevent an attacker from bypassing our free branch protection code by executing it in an unaligned fashion.


It is easy for a prover P who has found out the correct result y of the computation task to .nd out the correct assignment z = (z1, z2, · · · , zn) including the correct result y and all the intermediate results of the circuit.

z satis.es all the constraints fu, u = 1, · · · , n. If P responds with correct values as in the protocol, all corresponding test equations (unencrypted version) will hold.


The consequence of the limited computing and storage capabilities is that modular arithmetic is dif.cult and therefore, asymmetric cryptography cannot be used.

standard Dif.e-Hellman (DH)[6] key exchange protocols are excluded.


Knowing this, if Alice runs the protocol, she may be certain that no attacker has learned any information about her secret,apartfromwhetheritmatchestheattacker s onlineguess.

the attacker cannot do an of.ine dictionary or bruteforce attack against the secret, even if it has very low entropy.


By modifying or replaying the control commands observed in SCADA networks, the attacker stealthily moves the system into insecure states by means of legitimate commands, which seldom introduce any network anomaly.

we refer this type of attack as control-related attacks in which a sophisticated attacker can exploit system vulnerabilities and possibly use a single maliciously crafted control command to cause a wide range of system disturbances or changes.


A wide range of trust scenarios must be supported without drawbacks on security or privacy.

the card must act securely in face of an untrusted or malicious terminal2 .


First, the RRQ associates each subject with its adversarial role, which explicitly identi.es the threat model used for identifying this sub ject s adversaries.

the subject s adversarial role explicitly relates the system call s subject to the other system subjects who may threaten it by identifying the permission sets accessible to non-adversaries.


The rule whose decisions are combined through Weighted Majority Voting (WMV) will choose class J, if ,,=,,.

if the total weighted vote received by wj is higher than the total vote received by any other class.


Given the described setting, in the following we show and discuss the results of our experiments.

section 5.1 discusses the experimental results for the basic methods, Section 5.2 the ones for the boolean combinations, while Section 5.3 present the ones for the combinations considering the normalized version of both DTW-D and DTW-S algorithms.


In order to receive b reliably, Rcv must observe a set of timing constraints.

rcv s interest for C must be processed by Rt after C is cached (and made available to consumers), yet before C expires from the same cache.


Then we have ext ext IC(f,0) = ICD (f,0).

there is a protocol p such that: 1. for each (x,y) .X×Y, p(x,y)= f(x,y), i.e.


If the phishing site convinces her not to click her bookmark (or she forgets), her password may be compromised, but this is only one of two required tokens for login.

it becomes much more di.cult to phish Alice: even if she makes a simple mistake, her credentials remain safe.


The app then acquires the capability to perform the operation (including broadcast, startActivity or startService) as if it was the sender.

to .nd out where the message comes from, the recipient can call the object s method getTargetPackage or getCreatorPackage to get the sender s package name.


The last factor corresponds to the probability of success of an on-line dictionary attack in a threshold setting: An adversary who learns the shares of t' = t servers can test any password p in D by executing User( p, st0) and interacting with any subset of t - t' +1 uncorrupted servers.

to the best of our knowledge all previous works on T-PAKE s bound attackers success by qS , which is higher than the above bound, except if the adversary |D| ' corrupts the maximum threshold of servers, t= t. if each server locally bounds the number of sessions it performs with the same user to k, such de.nition bounds the number of passwords which a network attacker can test to n * k passwords, instead of the optimal number of L n*k J passwords.


b) Soundness: A cheating con.rmer C ' cannot convince an honest veri.er V that an extractable designated con.rmer signature s ' is invalid.


We performed experiments on a prototype implementation of our protocols.

we measured the the bandwidth and robustness of our approaches on a local (LAN) setup and in a geographically distributed environment the o.cial NDN testbed.


Because laptops are one of our major use cases, we consider it important to interact with the operating system s power management features.

tethers needs to know when the system has been instructed to go to sleep, because it must assume that the computer will wake up in a minimally secure environment, and thus must take proactive steps to protect whatever sensitive data is present.


In this work, we focus on the e.ciency of UFH-based communication and make the following contributions: First, we describe a frequency channel selection strategy for UFH communication and prove its optimality.

we show that, in UFH, the probability that a packet is successfully received is maximized if the sender and receiver choose the frequency channels on which they send and receive uniformly at random from a set of common frequency channels.


In this paper, we intensively examine the vulnerability of private information in online sources as well as the validity of di.erent types of attribute-based privacy attacks.

we de.ne two types of attackers, resourceful attacker and tireless attacker, based on their di.erent attack capabilities and strategies.


For Scalper we could drop all HTTP tra.c with the token x0dnTransfer-Encoding:x20chunkedx0dnx0dn which will not allow any chunked encodings, and is in fact the rule that Snort [53] uses.

it may be acceptable to block a valid portion of a protocol (or even an entire protocol by blocking its ports) if that portion is not often used by legitimate tra.c.


We demonstrate that such content-addressing can be effectively used to obtain automata that are very compact and can achieve high throughput.

we show that for an application using thousands of patterns defined by regular expressions, CD2FAs use as little as 10% of the space required by a conventional compressed DFA, and match the throughput of an uncompressed DFA.


The goal of Mallory is to successfully ascertain the sequence of keywords KB = (Ka1 , ···Kal ),where KB .K and .i .

[1,l], T rapdoorKai = Qi.Mallory wishes to uniquely identify the underlying keywords of each of the queries Qi.In this paper, we show that Mallory has a very high probability of succeeding if she has access to the following background knowledge on the document set.


A DDoS-defense system could attempt to share bandwidth equally over all sources of traf.c.

in a system with ng + nm senders, a legitimate host would achieve .. .


To gain further insights into this process, we study some generated signatures in more detail.

we examine the tokens and support values of three signatures generated for the malware classes Hupigon, Banload and Storm listed in Table 1. tokens : "GET a2965583/ip.txt HTTP/1.0nr User-Agent: MYURL[...]" : 1.000 threshold : 1.00 Figure 5: Signature for the malware Hupigon.


We also analyze the vulnerabilities in information and possible attacks.

we have presented two types of attackers: the resourceful attackers and the tireless attackers.


Then the data sender can enjoy light encryption process on unlimited messages for up to n receivers.

as long as there are less than n receivers, the data sender can avoid all heavy computations.


However, we believe our approach to be mostly innocuous because we speci.cally target search queries that are issued by malicious attackers.

legitimate sites are not likely to lose tra.c from ordinary users.


Biometrics can provide sufficient information entropy for good security.

human iris patterns are unique even for identical twins [1].


2.1 Proximity and grid systems In principle, the neighborhood of a position can be de.ned by a circle of a given range, and the proximity testing problem is to test whether a contact is inside or outside of the circle.

checking whether a user is in proximity simply means obtaining the location of the user (e.g., via GPS); calculating the distance to this location and testing if the distance is less than the given range.


INTRODUCTION A fundamental assumption made by many disassemblers is that the bytes of instructions do not overlap.

permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for pro.t or commercial advantage and that copies bear this notice and the full citation on the .rst page.


TMI allows security enforcement to bene.t from STM guarantees, yet remains compatible with existing security mechanisms, such as those based on history-or state-based enforcement[2,17,30].TMI helps ensure that enforcement remains correct,evenin corner cases.

tMI-based enforcement needs neither consider concurrent interleavings of execution nor worry about remedial steps on policyviolation.


Despite allowing the use of an external entity to control authorization for Web resources, OAuth V2.0 fails to provide certain features required in the open Web environment.

it does not support dynamic introductions by users, requires relationships between parties to be pre-established, and does not de.ne how a Resource Server comes to trust an Authorization Server.


The protection points selection optimization removes a pair of set to read-only and set to writable protection operations.

if an operation allowing a memory object to be written is deleted, the corresponding operations that set the memory object to be read-only are also removed.


The objective of LP is to get as close to the expected temperatures as possible.

we need to minimize the discrepancy between the generated temperature and expected temperature.


Figure 7: Example transformation 6.1 SOAP to TCP In practice, a transformation from SOAP to TCP typically works as follows: First each SOAP request and response message is encapsulated by a HTTP request and response header, respectively, then a new so-called TCP session is created for each HTTP request-response pair.

for each HTTP request-response pair, (1) a connection is established between the two sides of communication, (2) both the request and response are segmented, encapsulated by TCP frames and transmitted, (3) .nally the connection is explicitly terminated.


In this paper we discuss how this technique can be used in the context of the smart home.

the jamming mechanism must not prevent legitimate transmissions in neighbouring properties.


As a bene.t, TrustDroid o.ers a good scalability in terms of the number of parallel existing domains.

trustDroid exploits coloring of separate and distinguishable components (this approach has its origins in information-.ow theory [36]).


We assume sensor nodes are evenly distributed in the deployment .eld so that the probability of .nding a node in each equal size region can be made approximately equal.

the density of sensor nodes is approximately one sensor node per 100 square meter.


Indeed, a crucial aspect of the meta-market is its capability to scale over a large number of devices and applications.

we need to de.ne new tests for showing the e.ectiveness of the PMC compo  Table 1: Computation times and outcomes.


We only measured the time of the soft-reboot of the operating system.

the time duration from the operating system boot menu to a completely logged on session.


9, one byte of the key K[7:0] can be derived based on knowledge of CTs.

a hypothetical intermediate result (IR) can be computed based on one hypothetical K[7:0] and the known CT, with the publicly known AES algorithm.


When a measurement is extended into a PCR, the new digest value is calculated as follows: P C Rnew = H(P C Rold||digest) where P C Rnew is the new digest value being stored in the PCR P C Rold is the previous digest value stored in the PCR H() is the hash function associated with the PCR digest is the measurement value extended into the PCR  As a result of the old digest value being hashed into the new one, any deviation in a reported sequence of events causes an irrevocable change in the eventual PCR digest value.

the PCR digest value is unique for the speci.c order and combination of digest values that have been extended into a particular PCR.


Contrary to the above example, suppose Alice has means of denying all her messages in front of everyone, by arguing that an entity di.erent from herself faked messages coming from her3 .

any message purportedly from Alice could have been authored by Mallory.


Finally, we examine achieving AEAD by generic composition.

we look at gluing together a nonce-based symmetric encryption scheme and a PRF.


To de.ne anonymity formally, we consider the probability PA(k, s0, s1) that the ciphertext occupying slot s1 at the end of round k is the image (through successive permutations) of the input ciphertext that occupied slot s0 before mixing began, in the view of the adversary.

the probability PA(k, s0, s1) is the probability that the path of the element that started in slot s0 goes through slot s1 after k rounds of mixing, in the view of the adversary.


tHEN IF (x= K[i] C[i]) THEN Hash[x] .H[i] ELSE IF (c,i)=(g1,g2) THEN Ki Ci .x; Yx .Y ; Yx[i] .Ki ; L.RecoverPSS (Yx) RETURN Hash [x] when (c,i) is equal to (g1,g2),adversary B2 records the candidate key as L.When A has terminated, adversary B2 returns Land halts.


In doing so, we follow the approach proposed in [11], where a frame based segmented SNR is used to assess speech signal quality.

the same idea can be applied to many other types of signals having a .xed range of frequencies that can be a.ected by burst of noise such as, videos, ECGs, etc.


Thus, our TMI reference monitor accurately models system-level access control in Java.

our TMI reference monitor is invoked whenever any.les are opened for reading or writing.


(b) Similarity in Software and Services: Small correlation groups may be due to recent attack trends.

two IDSs may share correlated attacks because they are on a single hit list, or they run software or a service that is targeted by the common attacker.


However, our approach addresses the latter two aspects.

our algorithm for revocation performs global propagation and strong dominance.


This correlation was statistically signi.cant (f = -0.589, p < 0.007).

those who were concerned about speci.c individuals were less likely to share their unlock codes than those only concerned with strangers.


The attack on the MSN scheme was also tested on other CAPTCHAs.

a variant of the attack has achieved a high segmentation rate on a CAPTCHA that was widely deployed by Yahoo until early this year.


Let (g, g a , g b, h) be the instance of the DDH problem that we need to distinguish.

we need to distinguish R between the case h = g ab or h .


The sizes of 256 bits and 1,184 bits are demanded in permanent storage and temporary storage, respectively.

there is totally 1.4kb data required in the tag.


To obtain ground truth for evaluating e.cacy, we took advantage of the fact that during our experiments we controlled both the attacker and victim instances.

we augmented the above procedure to also have both attack instances and the target victim establish a TCP connection with an external server under our control.


The primary drawback of this approach is that it is binary.

the e.ectiveness of this approach hinges on the ability of the network administrator to implement all hardening recommendations.


While a single method can only output a binary value with respect to a threshold, combining methods together, as described below, can convey more information.


Although a hyper-alert can be generalized in different granularities, it is not an arbitrary process.

if one hyper-alert prepares for another hyper-alert before generalization, the generalized hyper-alerts should maintain the same relationship.


Working within the UC framework also yields other advantages, as highlighted by Canetti and Krawczyk in the context of two-party key exchange [14].

additional advantages include: (1) protocols proven secure within the UC framework remain secure even when run concurrently with any other set of protocols; (2) the session keys generated by any UC-secure protocol may be securely used by any application calling the protocol as a sub-routine; also (3) we obtain a de.nition which guarantees security even in the so-called strong corruption model where honest players may be compromised at any point during execution of the protocol.


deployed in business transactions: They provide employees a means to remain connected to the company s network thereby enabling on the road access to company s data.

they allow employees to read and send e-mails, synchronize calendars, organize meetings, attend telephone and video conferences, obtain news, and much more.


using condition M ' '* (b) but not M ' (a).

for every t < t , ps = pt '' * A.phases[t ].T B.phases[t ].T but there is some t < t such that ps RTr = pt RTs.


However, when considering a direct implementation of it, we note the following three areas for improvement: Robustness: At some stages of the protocol, if broad- cast update messages are lost, the corresponding group key cannot be recovered, no matter how many other update messages are received.

the level of robustness is inconsistent.


The memory phrase was an equivalent of the madeleine for Marcel, the main protagonist of Proust s famous novel Recherche du Temps Perdu [20]: just as the madeleine transports Marcel back into a world that is long gone but still vivid in his waking memory, so was the memory phrase intended to bring the memory of participants back to the events on which they provided feedback.

the memory phrase, as we intended it, is not simply a tag onto a memory in a memory archive, because it may have no semantic relation to the event to which it is associated.


s3 once the identity of the user that performs s2 has been .xed), whereas ((s1,s3,s2,s4),p) is a solution (since there is no restriction on the user that performs s2 if s3 is performed .rst).

there exist work.ows for which a plan p is not a solution to WSP, but for which (s, p)isasolution to OWSP for certain choices of s. Crampton introduced the notion of a well-formed work.ow, which has the following property: for all si I sj ,(., si,sj ) .


Unlike the hot update systems described above, Ginseng cannot be used to update legacy binaries because it requires signi.cant changes to programs at the source code layer before they are originally compiled.

ginseng rewrites a program s C source code to support upgrades via function indirection and type wrapping, and Ginseng expects a programmer to annotate the to-be-updated software to indicate one or more safe update points.


The model also handles a transitive aspect of chained exploits.

hosts can also gain higher levels of access indirectly through a series of exploits on numerous hosts.


INTRODUCTION As defense techniques such as intrusion detection systems (IDSs) become widely deployed, attackers now have to consider how to defeat these mechanisms when launching their attacks.

permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for pro.t or commercial advantage and that copies bear this notice and the full citation on the .rst page.


D Informally, these lemmas demonstrate that the Request(·)and Enroll(·)protocols guarantee integrity and con.dentiality against PPT adversaries.

by viewing a transcript of both protocols, A failstolearnthe administrator spwd orthePUF challengeresponse pairs.


The total storage cost of Table A then remains sub-linear as long as the information for each piece is polynomial in its size m= O(log n).

explicit answers to local queries can be stored (as local adjacency queries on elementary cells).


Because processor speeds have increased at a more rapid pace than bandwidth availability over the past years, network bandwidth is likely to be the bottleneck for a number of applications.

our protocols are especially useful for applications operating over networks with limited bandwidth, such as wireless and sensor networks.


Because this example has independent but homogeneous components, the two conditional time-to-compromise functions are identical.

the time-to-compromise of one component does not depend on when the other component was compromised.


Since both signatures P x can be veri.ed, we have { { R1 · K1 c = P1 s , R1 · K1 c= P1 s, {{ R2 · K2 c = P2 s , R2 · K2 c= P2 s. Let .c = c - c ' and .s = s - s ' ,wehave K1 .c = P1 .s and K2 .c = P2 .s, where at least one of P1 and P2 is not the identity element.

the algorithm B can compute x := .s/.c where x =logP1 K1 =logP2 K2.B can compute the secret key x of the static DH and break the static DH problem.


Since we do not know the ideal relationship between execution score and word probability at any intermediate stage, we use a greedy algorithm that maximizes our execution goal .rst.

we always keep the best m(= 20, 000) candidates by highest execution score and use language probability to settle ties.


This approach makes labeling easy; however it is vulnerable to a confused deputy attack.

the kernel cannot determine if it is the Dalvik VM that requested the .ag to be unset or a malicious third-party native code.


Our proposed approach is also policy neutral.

the MP model allows for the .exible con.guration of access control primitives for representing a wide range of access control model and policy requirements.


Then it is clear that one can generalize two-valued to many valued logics by using a lattice of truth values.

one can form a four-valued logic from the Belnap bilattice, interpreting conjunction as ., disjunction as ., and negation as ¬.


(3) Apply security patches: patching V s vulnerability results in both Supplier and Customer networks satisfying the invariance property.

to avoid violating security policies for both networks, host V should not exhibit any vulnerability that might be used in gaining access from host Cm to host Cf (since both Sm and Cm utilize this vulnerability in leverages their accesses on Sf and Cf , respectively).


[1, t - 1] such that ps * pt A.phases[t - j].T = B .phases[t - j].T .

j = t - 1, since in pt B s .rst phase its outgoing message m1 contains extC = empty but ps received a message m1 with A extc = empty.


The task must be performed by a set of two or more Accountants.

a set of three Accountants can perform the task, but a set of two Accountants and one non-Accountant cannot.


There are some tricks that can be used to ensure uniqueness of the hash values computed for each content label.

for each character set in a content label, the order in which the characters are listed is arbitrary.


The most significant similarity is that both random censoring and malicious intrusions are unpredictable.

we generally do not even know the probability that the event may happen.


However, the way ICN interest ful.llments work pose a great privacy risk.

the time difference between response for interest of cached and uncached contents can be used as a side channel to infer whether a near-by user previously requested the same contents as the adversary.


(H(Sc)) = T ,then H(Sc) becomes a rule in the transformed program, and (H(Sc),I) .

mS(P) for some rule indexset I.the three-valued immediate consequence operator, program transformation and the materialization produces exactly the same valid instances of reserved predicates.


The MQV and HMQV protocols stand for the current state-of-the-art of (public key cryptography based) e.cient authenticated DHKE, and marked the great milestones of IA-DHKE developments.

the .rst formal analysis of IA-DHKE within the Canetti-Krawczyk framework (CK-framework) was conducted w.r.t.


{1,2,··· ,m}), .i hosts in this group are targeted by that scan with the same likelihood.

when considering a vulnerable host in group i, it has a probability of .1 i to be hit by a worm scan given that the scan hits the group.


In this paper we are concerned with schemes that spare Alice and her friends this tedious process and allow her to share her pictures securely and easily.

we consider the scenario sketched in Figure 1.


Furthermore, c ' must look like a plausible reencryption of c. Thus, a scheme that realizes FsP RE must allow a simulator to convincingly transform a ciphertext c that s unrelated to m into a ciphertext c ' linked to m. This is a property that seems to be an artifact of the simulation paradigm; it is not implied by De.nition 2.5.


In the Booking protocol, we assume that the network administrator decides for every node what is the ID of the other node it is going to track.

in our simulation the node with ID i monitors the node with ID i + 1 modulo 39.


Informally, the state of the worm collective can be represented as the superset of each of the worm sets of the individual worm agents.

the target set of the collective TS = TS1 U TS2 U U TSn, where TSi is the ith worm agent in the collective, and so forth for the other sets.


detonation of a bomb by sending a text message to the bomb Today s digital forensic examiners must be familiar with mobile phones and understand the intricacies of mobile phone forensics.

they must be familiar with the acquisition and analysis of the data on the device, the possibly attached SIM cards, and the possibly inclusive memory cards.


Some researchers have explored this domain and reported encouraging results, but few focused on applicability in a realistic setting.

many of the existing approaches require an impractically long verification time to achieve a reasonable accuracy.


On the other hand, there are no appropriate mechanisms for preventing denial-of-service (DoS) attacks on a mobile device.

there has been no effort to protect a mobile device against CPU overuse, performance degradation, and DoS attacks caused by excessive I/O requests due to the misuse of an IDD architecture by malware.


Let Kbe an instance whose elements are constants and nulls.

let be some element of K. We say that is rigid if h)Wfor every homomorphism hof K. (all n( constants occuring in Kare rigid.)


[4] based on sum-product estimates in .nite .elds; see [35, §2.8] for background on such estimates.

for our purposes, it is also convenient (but not strictly necessary) to have bipartite graphs that are 1a regular graph with a large gap between the largest and second largest eigenvalue of its adjacency matrix.


The result of the election then counts the honest vote twice, which provides a bias to the attacker.

in the case of three voters, the attacker knows the vote of the voter under attack.


The central in our construction is to protect MAC keys by means of public-key-based encryption.

the MACing key k~, used by server i to check the integrity of a given input, is encrypted in such a way that it is only available to server i itself, and not to any of the other servers.


A TVD is a coalition of virtual machines that trust each other, share a common security policy and enforce it independently of the particular platform they are running on.

the TVD infrastructure provides isolated computing environments, secure communication and storage, explicit trust relationships, and transparent policy enforcement within TVDs.


In total, there were 15 di.erent interactions where each subject were asked to perform 2 independent set of interactions back to back in order to avoid muscle memory.

each pair of the same interaction was interrupted by 13 other interactions.


CACQ-SoD1 prevents the acquisition of permissions through the conflicting roles that will not be caught by PAS-SoD3, similar to the way CACT-SoD1 prevents the activation of conflicting roles not prevented by ACT-SoD1.

constraint CACQ-SoD1 employs the can acquire semantics and hence captures both explicit and implicit role-permission assignments.


By analyzing both the properties of the set of visitors of a page and its corresponding redirection graph, we can accurately distinguish between legitimate and malicious pages.

we show that malicious web pages have redirection graphs with very di.erent characteristics than the ones shown by legitimate ones.


Process.Create(mn, role) The resultant principal has the form parent@role + mn, where parent is the principal name of the parent process and role is an optional modification of the parent s authority.

occurrences of the + operator within a principal name represent the history of application invocations that resulted in the currently executing application.


The beauty of Lemma 4.2 is that if we know the depth d of the circuit we want to evaluate (in our case, d = ddec, the depth of the augmented decryption circuit), then we can construct a ladder of decreasing moduli q0,...,qd and perform modulus reduction after each operation so that at level i all ciphertexts reside in Rqi and the magnitude of the noise at each level is small.

this is true at level d so that once the evaluation is complete, it is possible to decrypt the resulting ciphertext without decryption errors.


The main e.ect is indeed to fragment the original clusters into a high number of smaller clusters.

after the insertion of m = 20 data points, i.e., when 20% of the data is controlled by the attacker, the selected number of clusters increases from 4 to about 7-14 clusters depending on the considered method.


Appendix This section gives further details on the proposal evaluation.

we reportFARandIPRfortheseveral proposedwaysof combining methods.


Since request packets contain no input from the capability-granting destination to allow distinctions between desired and undesired requests, the best the network can do is provide an equal level of service to all requesters.

each requester should receive a 1 share of the available nm +ng request channel ., regardless of whether that node is an attacker with a high request rate or a legitimate node with a low request rate.


2  2.3 ERBAC07 syntax It has been observed that there are a number of situations where it is necessary to distinguish between role activation and permission usage [13].

it solves certain issues that arise when there is a role hierarchy and separation of duty constraints (as in RBAC3).


INTRODUCTION Security is a crucial requirement in any communication network.

being able to identify and exclude misbehaving nodes from the network is absolutely necessary to guarantee trustworthiness of network services.


Since a MCB path has some desired patterns, e.g., typically containing a sinkhole point of network transmission routines such as a send library call, it makes sense to choose paths that likely reach these sinkholing routines.

to expand such limited small number of sinkholing routines to a larger hit surface, we introduce the concept of Function Containers to assist directed exploration.


Certain design guidelines that aim to protect the privacy of both raters and ratees have been proposed in the literature.

while [13] proposes to limit the number of possible reputation values in order to hamper an adversary s ability to re-identify otherwise anonymous ratees, [15] proposes to compute a ratee s reputation only after multiple ratings for the ratee have been collected.


In order to give a more accurate estimation of the prior we extracted statistics about visits from the ALAD dataset.

we measured frequency with which the users requested the URLs of the four monitored pages and its domains.


This action represents the ongoing tra.c sent rate.

the height where a node is placed within this quarter reveals its tra.c sent rate in packets/sec.


Let U = {u0,u1,··· ,un}, R = {r1,··· ,rn}and UR = {(ui,ri) | 1 = i = n}.

u0 is a user that is not assigned to any role.


It is worth mentioning that even though, strictly speaking, XACML v2 considers a four-valued decision set, some combining algorithms distinguish the case where Indeterminate is obtained from a permit rule and the case where Indeterminate is obtained from a deny rule; however, such a distinction is not explicit.

the semantics of decision Indeterminate might change according to the e.ect of the policy that returned it.


Furthermore, the recoding mechanism must satisfy a natural simulation requirement: namely, we can generate rk given just pk0, pk1 (and neither of the two secret keys), if we are allowed to program pktgt .

there are three ways of generating the pair (pktgt , rk) that are (statistically) indistinguishable: (1) given pktgt , generate rk using the secret key sk0; (2) given pktgt , generate rk using the secret key sk1;and (3) generate rk without either secret key, by programming the output public key pk tgt .


Addressing such issues in an appropriate way presents a major challenge for research and industry.

we can observe that current e-health solutions and standards mainly focus on network security and access control policies, however, they do not address the client platform security appropriately [26], i.e., the security of the software and hard ware that is used by health professionals locally.


Are there meaningful countermeasures for techniques like ours?

can users be given tools or training to make them less susceptible to such attacks?


Realizing this space has legal as well as technical dimensions that need to go hand in hand.

we have argued for a geoprocessing license model which does not license data but its use, an ontology of geoprocessing, which distinguishes actions and purposes and allows machines to compare them against a license, as well as a permission service which allows users to issue processing requests for private data of citizens and (semi-)automatically grants processing rights.


Command Name Code Description CMD ERROR 0x200 + 0 General Error CMD SUCCESS 0x200 + 1 Cmd Successful CMD GET NODE INFO 0x500 + 0 Get node information CMD GET NODE SUCCESSOR 0x500 + 1 Get node successor CMD GET NODE PREDECESSOR 0x500 + 2 Get node predecessor CMD UPDATE PREDECESSOR 0x600 + 1 Update predecessor info CMD UPDATE SUCCESSOR 0x600 + 2 Update successor info CMD LOOKUP NODE 0x600 + 2 Perform a lookup CMD LOOKUP FEDERATION 0x600 + 2 Federation participation CMD PKI MESSAGE 0x800 + 0 PKI Data Packet of processing PKS messages.

when a message is received via the PKS network, the Responder Engine unwraps the PKI message embedded in the rawBytes .eld.


We believe that to achieve ef.cient execution of a broad range of functionalities, the available options for parallelizing the execution should not be either too narrow or unnecessarily too .exible.

the parallelism offered by Sharemind and SEPIA will allow for ef.cient execution of many functionalities, but can be very limiting for other applications and operations.


Extending our security analysis towards the recent work in [9] is another direction for further study.

evaluating the guessing entropy of our construction appears as an interesting open question in order to determine the extent to which combining a side-channel attack against our PRNG with computational power would lead to similar conclusions on the security of the primitive.


Although support for some of the proposed defences was already integrated in existing DNS resolvers software, they are not known to be used in the wild.

the name servers of Alexa and TLDs have not adopted them.


To ensure that no information about private values is leaked during program execution, we place certain restrictions on the data .ow that involves both private and public data.

statements that assign an expression that contains private values to a public variable are not allowed.


Various procedures to measure or evaluate anonymity have been devised, e.g., [8], [10] or [6].

numerous methods of analyzing anonymity in data exist, such as Anonymity Set Size (ASS), k-anonymity, Individual Anonymity Degree (IAD), or Entropy Anonymity Degree.


PUBLIC KEY CRYPTOGRAPHIC SYSTEM Authentication is a service that is used to establish the origin of any information in the Internet.

authentication services verify the identity of a user or system that owns any information.


Our pro.le does not depend on the implementation choices of the application in hand.

the way the policies and the abstract values can be made available to the Enablement Authorities is not imposed.


The reason is that the data set is very diverse.

it is common that benign applications produce system call sequences that match ngrams that were previously considered to be indicators of malicious activity.


For example, journalists use Evernote during interviews while employees are increasingly starting to use cameras and microphones to capture meeting notes.

there is a convergence between the ways in which personal and enterprise applications are being used on the phone.


This information is then used in the second step of the protocol in Figure 2 to validate POST requests.

jCSRF-proxy checks if Pat = Cat, and if so, the request is forwarded to the server after stripping out Pat.


An instance of monotone one-in-three 3SAT problem is similar to an instance of 3SAT, except that all literals are positive.

every clause is a disjunction of three variables.


[13] presented a weighted evolutionary game-theoretic model to study the behavior of users in OSNs regarding how they choose their privacy settings.


The important aspect of LaFA is that it is purely based on RegEx sets and does not depend on the input string, thus the analysis here covers any tra.c including worst-case.

laFA is secure against Denial-of-Service (DoS) attacks.


¯ ¯ Let B be the event that there exists at least one Xj = X q such that H(X¯j ) mod 2Q : D. B = .


First, we required the ability to identify a device uniquely.

our scheme mustbe able todistinguishbetween twodevices with software that is con.gured identically.


To verify the certificate, any user should use the CA's public key PKCA to verify the CA's signature on [T || IDA || PKA] to run a verification algorithm of a dedicated signature scheme.

to evaluate Verify (PKCA, CertA), which will output "valid" or "invalid".


One of the innovations introduced in our work is the de.nition of a di.erent representation model: buckets are represented implicitly by storing the hierarchical partition overlying the histogram, whose representation can be accomplished more e.ciently than the explicit representation of bucket boundaries.

the hierarchy adopted for determining the structure of a histogram is also used as a basis for representing it, thus introducing surprising e.ciency in terms of both space consumption and accuracy of estimations.


Since one the most important concerns in the IoT is energye.ciency, we consider the Bell Laboratories Layered Space-Time (BLAST) multi-antenna scheme [16].

the Vertical BLAST (VBLAST) architecture [17, 18] has been implemented in our experiments in order to keep the complexity and power consumption as low as possible.


This can be achieved by exploiting a vulnerable deputy [15, 10, 17], or by malicious colluding applications [37, 5].

privilege escalation attacks have been utilized to send unauthorized text messages [10], to trigger malicious downloads [24, 29], to change the WiFi settings [17], or to perform context-aware voice recording [37].


Figure 1: Disconnected SSL Tunnel and Attestation Endpoints 3.1 Problem A No Link Although the client establishes SSL endpoint identity and platform trust, there is no linkage between the two.

the two parts may come from different servers (cf.


However, we found that the linking process can be exploited to launch a serious login CSRF attack, without any malicious app running on the user s device.

in our attack, the adversary uses the 3 URL arguments collected from his own device to build a URL: db-://1/connect?oauth_token &oauth_token_ secret & uid , where oauth_token , oauth_token _secret , and uid are the adversary s Dropbox credentials, and APP_ID identifies the PlainText app.


These limitations are well-known [14] and led others to combine the use of TXT with a hypervisor to build isolation on x86 platforms [27, 13].

the TXT environment is used to perform a mea sured launch of a hypervisor whose trustworthiness can be attested by the TPM.


A Tale of Two Kernels: Towards Ending Kernel Hardening Wars with Split Kernel Anil Kurmus Robby Zippel IBM Research Zurich, SwitzerlandIBM Research Zurich, Switzerland kur@zurich.ibm.com zip@zurich.ibm.com  ABSTRACT Software security practitioners are often torn between choosing performance or security.

oS kernels are sensitive to the smallest performance regressions.


for all users the probability of successful authentication is the probability of authenticating to the .rst service and the probability of authenticating to the second.


For the Experiment1, we aim to evaluate the e.ect of giving user guidelines to users on creating their graphical passwords.

after giving the user guidelines, how participants re-create or change their previous passwords.


from [1]), we consider the traces collected at INFOCOM 2005 conference [21], already used in previous research works [4].

the traces of mobile nodes were gathered using Bluetooth devices distributed to 41 people attending the INFOCOM 2005 conference.


However, this does not always appear to be the case.

users may not always understand or care about the sometimes complex issues involved, and in fact convenience is often the main factor in determining what systems a user chooses, and how they are used.


In this paper, we propose a privacy preserving protocol that assesses signal quality and combines this with a linear classi.er used to decide whether the measured signal is of high enough quality or not.

the protocol computes a frame based Signal-To-Noise Ratio (SNR) from the original signal and a .ltered version of the signal itself; evaluates the mean and the variance of the SNRs obtained and computes the overall signal SNR.


On validating B s integrity, specifically, A will compute the checksum of B s code stored in the physical storage (using a secure cryptographic hash function) and compare with the true value pre-computed and injected to A s code by D (with cooperation of P in case of A being GC).

gC will validate-then-activate GC-agent, which will do the same with GG (which may do the same with other modules in a more refined model).


On the other hand, we have provided much stronger trust propositions, solving some open problems in user-mode SP.

our authority-mode SP architecture provides remote trust, transient trust, policy-bound secrets and controlled transitive trust none of which are achievable with the user-mode SP architecture.


We estimate that it would be possible to get rid of most of the current con.guration options faced by vendors in preparing UIs, thus allowing for easier UIs and faster development times in applications.

for TAS Management, PRQP could be used to discover TAMP data sources.


CONFIDENTIALITY OF SELECTIVELY ENCRYPTED MESSAGES This section derives equations for entropy and guesswork of selectively encrypted messages for languages up to the second order.

how entropy and guesswork changes with the number of encrypted units, ne = i bi, i.e., the encryption level, and the order .


This problem has then been solved by means of specialized search heuristics speci.cally tailored to the considered clustering algorithm.

we have considered greedy optimization approaches in which the attacker aims to maximize the objective function by adding one attack sample at a time, i.e., |A ' | = m = 1.


Functions processing unchanged data should not have their arguments changed.

computations should be structured in a memoizationfriendly way.


, mju ) and a proof p vouching for the correctness of y.

when F consists of all linear functions, such MACs or signatures have been constructed under the name of linearly homomorphic MACs or signatures [1, 19, 9, 7, 15, 17, 2, 3, 4, 11, 12].


The required separation properties were translated into a set of LTL-based constraints.

we analyse the interaction between delegation and revocation activities in the context of dynamic separation of duty policies.


This leads to a staged execution scheduleinwhich nodesdeeperinthetreeneed tobe activated before their parents.

the delivery section must be scheduled earlier the deeper a node is in the tree, such that the execution of the delivery section of a node overlaps with the timeitsparentislisteningfor results.


The security lemma and proof can be easily modi.ed to include security parameters.

the above lemma can be extended to give the security parameters of the RAT scheme as a function of the security parameters of the underlying attestation scheme.


4.2 SSH Command Attestation We have added human attestation to the Dropbear 0.52 [1] SSH client/server suite so that each ssh command carries an attestation signature and the server veri.es the signature before launching the command.

for every enter key, we send the signature to the server for human veri.cation.


We consider a 32bit carry lookahead adder and equality comparator as case study, since they are common components in modern digital circuits (e.g., processor).

the paper makes the following major contributions: It presents a low-cost robust validation approach for identifying recycled chips from an untrusted supply chain.


Assume that there exists a distinguisher Athat given the public key can distinguish encryptions of 0 from encryptions of 1.

the di.erence between the acceptance probabilities p0 on encryptions of 0 and the acceptance probability p1 on encryptions of 1 is non-negligible.


This test established a baseline of the number of connections per second each cipher suite could handle without any puzzles or denial of service countermeasures.

(for the FVDS-based cipher suite, FVDS signatures from Section 3.1 were used for client authentication but the FVDS-puzzle protocol of Section 3.2 was not used.)


Kolb had this to say about the interplay among the different learning styles; This, the structural model of learning can be likened to a musical instrument and the process of learning to a musical score that depicts a succession and combination of notes played on the instrument over time Since each Information Assurance Class contains students utilizing each learning style, Kolb s model indicates that moving the class through each quadrant should optimize learning.

optimizing the learning process requires the appropriate succession and combination of learning activities.


First, is it possible to make an involuntary localization of a random LBSN user by exploiting the public available information only?

without hacking into the services and using only the client side information that is publicly available through the unmodi.ed app of LBSNs, could we accurately localize a random online user of no priori knowledge?


However, existing generic unpackers rely on the dynamic instrumentation of executables [37, 28, 24].

these systems need to execute the sample.


We analyzed several widely used PRNG (from providers OpenSSL, OpenJDK, Android, IBM and Bouncycastle) by clearly describing their operations in the security model.

we showed that all of them are highly sensitive to a relatively small corruption of their internal state.


For this reason, we drive our evaluation with a vulnerable population distribution extracted from a real dataset.

the dataset is provided by DShield [12] and contains intrusion traces collected over a period of three months fromover 1,600 intrusiondetectionsystems distributedaroundthe globe.


We require that if all parties honestly run the protocols then the owner and requester tokens are valid and S N will be able to recover the policy and the identities of the users who generated the owner and requester tokens, respectively.

for all registered users Ui and Uj with respective secret keys ski and skj and for all plc .


The set of participants can collaborate to introduce non-existent users into the chatroom.

if agreed, a set of users can create a transcript that allegedly involves an absent user Alice.


Note that our assumption does not prevent an adversary from trying to run the UPM command.

in case it has su.ciently many keys of level Max, it may well build a well formed Update Max command and send it to a TRD.


Based on this observation, we devised a search heuristic that considers only k-1 potential attack samples, being k the actual number of clusters found by the single-linkage hierarchical clustering at a given dendrogram cut.

we only considered the k-1 points lying in between the connections that have been cut to separate the k given clusters from the top of the hierarchy, highlighted in our example in the leftmost plot of Fig.


NFAs and DFAs are at the two extremes in this exploration space.

nFAs have a limited size but can require expensive per-character processing, whereas DFAs offer limited per-character processing at the cost of a possibly large automaton.


However, our VMI facilitates the much easier alternative of patching the instruction code.

the boxed jns0x401176 instruction in Fig.


In the active version of trusted computing, the lower layer (e.g bootloader) allows the upper layer (e.g OS) to be loaded only if the hash of its binary matches the set of known hashes stored in a tamper-proof storage.

trusted computing only allows well-known software (including applications) to execute.


In order to preserve the properties of a provenance graph, we need to place restrictions on the assertions made in a RDF graph.

we require a directed acyclic RDF graph to retain the causal dependencies among the nodes as needed in provenance.


We keep track of functions, constants, objects, methods, keywords and attributes referenced by JavaScript code, and use them to distinguish between malicious and benign samples.

we focus on API references, i.e., those references that are recognized by a speci.c JavaScript API.


Also, for simplicity, we implemented a snapshot-based stub to map and update the GVM memory.

we will map the physical memory which is a snapshot of the GVM.


RELATED WORK In the context of security, some previous solutions to the signature detection problem have proposed the use of hash tables to enhance scanning speed.

solutions have been proposed for scanning at the network level i.e.


OncetheoptimalLPPM o.ersthe maximal location privacy for a given user pro.le, loosening the service-quality constraint does not signi.cantly change the LPPM s underlying function f, and thus there is no reduction in service quality.

there is no need to sacri.ce the service quality, because doing so does not increase the user s location privacy.


We provide a tool for a workflow designer to specify a data access policy for each task.

each task has its associated data access policy that has a series of the following triples, : [{Data object, field name, permission}, { }, ]  declares that this is a data access control assignment for task n. The permission in this statement can either be read-only, full-control, no-access, etc.


From this collection of observations he should not be able to increase the precision of his knowledge on the real position up to some de.ned and .xed parameter chosen by the user.

if the user decides he wants to obfuscate his position up to a radius of 5 Kms, then an adversary should not be able to reduce this area any further by making multiple location requests.


With this reservation, the notion of trust as used by us is a synonym of trustworthiness.

we focus on using trust defined and determined as objectively as possible.


Therefore, the adversary knows the private keys corresponding to the ElGamal public keys Ki 0 = (p, q, h, ci) and Ki 1 = (p, q, h, cig -1).

the adversary knows r where hr = ci, and r ' where hr ' = cig -1 .


Exception handling via structural adaptations of process models are also considered in [17].

several correctness criteria and their application to speci.c process metamodels are discussed.


The fundamental properties include some of those traditionally proved for type systems.

one can formulate various consistency, type soundness, parametricity, and noninterference results.


Caching: The security of the protocol is not a.ected if the same RTT is given every time that the same username and password are provided.

the RTT itself could be a deterministic function of the username and password that are entered by the user.


We suppose that an attacker can manage to remove a fraction of pointers to hide certain kernel objects, without causing a system crash.

we would like to see how MACE s identi.cation performance degrades while a fraction of deterministic pointers are removed, because all the existing tools only examine deterministic pointers.


DVM does not provide opcode to directly execute these instruc  Figure 3: Potential Vulnerabilities of API-Level Access Control tions.

java code must invoke the native code, such as the Bionic libraries, to communicate with the kernel.


The protocol described in Section 4 is compatible with every garbling schemes that can be used in standard cut-nchoose protocols.

it is possible to use very optimized garbling schemes.


The procedure is performed by an edge router, and takes several parameters based on the speci.c protocol in which it used to generate td, the number of hops to be added as noise to prevent the timing attack.


The contrapositives of the two assertions in the theorem may also be of interest.

a forward (backward) safe system is not forward (backward) available.


[10] discussed the security of the original Rainbow Rainbow(K; v1, o1, o2) with two layers and the .nite .eld with 256 elements, K = GF (256).

rainbow(GF (256); 31, 19, 24) has 100-bit against direct attacks, UOV-Reconciliation attack, Rainbow-Band-Separation attack and UOV attack.


Image Integrity Informally, the OS, programs, and data making up the customer s image must have the contents intended by the customer at the time of each instance launch.

the sequence of management operations image installation, image customization, and instance launch given an image have the same effect on instance launches (i.e., cause the same image to boot upon instance launch) as they would have if the customer were executing these operations on a trusted exclusive platform.


Similarly, operating system recon.gurations are local to the host.

they rarely need to be exposed to other entities in the network.


To simplify our proofs later, we will assume an ideal PUF, meaning that there is no predictable connection between the challenges and responses.

assume an observer has knowledge of (Ci,Ri) and another challenge Ci' , where Ci and Ci ' di.er in only a single bit, the observer can predict the corresponding Ri ' with only negligible probability.


Moreover, obligations, in the sense of provisional authorizations, can be understood under a general interpretation of can .

for a principal p .P to do action a on resource r at time t the can requires a willingness by the party that controls access to r to allow access on the basis of p s promise to perform an act at some time point t. such that t. >t.


While an ideal PUF is assumed to produce random mappings, we employ the hash function in this way to add to the entropy of the system.

if Ri and Rj (the responses produced by two di.erent PUF pollings) di.er by only a single bit, H(Ri) and H(Rj ) will have a Hamming distance of 128 bits on average.


With the speci.c characteristics of CRNs, new threats have arisen [5, 10].

the community research has paid special attention to the Primary User Emulation (PUE) attack and False Feedback attacks, since they can severely undermine the primary detection process.


Based on the new techniques, we present a tool which can automatically construct the Jump-Oriented Programming shellcode.

we make the following contributions in this paper: We proposed an improved ROP techniques.


We remind the reader that the attacker s goal in this case is to manipulate some samples to have them clustered according to a desired criterion, without a.ecting signi.cantly the normal system operation.

we assume here that the attacker can manipulate samples corresponding to the digit 3 in order to have them clustered together with the cluster corresponding to the digit 6 , while preserving the initial clusters.


A few weaknesses of the system, such as permission re-delegation [21] and capability leaks [27], are revealed by researchers.

a recent blog [16] from Leviathan Security Group describes the malicious activities that could be performed by an app without any permissions, including reading from SD card, accessing a list of installed apps, getting some device and system information (GSM and SIM vendor ID, the Android ID and kernel version) and pinging through a Linux Shell.


It has been shown that RP and .P coincide [11, 13].

for ex- Recall that for a program P a quantitative policy is a ample for the modulo program above under the assumption natural number N which limits the cardinality of .P to N. of uniform distribution on the input there are 4 equivalence a program violates a quantitative policy if classes each having probability 1 4 .


The landing positions are chained together to reach the shellcode entry.

each landing position is a set of jump-equivalent instructions that point to the next landing position.


For the interfaces, we will make use of network-based enforcement and monitoring.

we plan to investigate an approach that will restrict access to actions/sensors to those coming from the controller (we can verify the entire path with the underlying programmable network) and we will monitor/log all message exchanges.


Taint is propogated whenever a particular tainted data bit can a.ect the output.

if the output of a function is dependent on changes to tainted inputs, then the output is marked as tainted.


one in which an adversary may schedule executions of protocols and delay messages in arbitrary ways.

unforgeability and deniability should still hold against such a powerful attacker.


3.2 Test Results After the installation and user enrollment issues were worked out, the resulting test of PGP Desktop for Macintosh on a departmental MacBook was successful.

iTSG determined that policy settings were appropriately enforced, whole disk recovery tokens (WDRT) were generated for Mac users and were successfully used by ITSG to gain access to an encrypted drive, and the PGP software was compatible with other standard departmental software including Adobe Creative Design Standard, Microsoft Office, Parallels Desktop, VMware Fusion, iPhoto, and iMovie.


it lacks representations of domain state, world model, attention, and memory.


An environment pattern can be empty, denoted by f, which is most general; every state matches f.We say that e1 is subsumed by e2,i.

: the set of all environment states that match e1 is a subset of the set that match e2.subsume(e2,e1), i.: {s|e1(s)}.{s|e2(s)}.


Note that model safety is a necessary step whenever the code consumer does not trust the model provided by the code producer.

the producer may provide an incorrect model either due to malice, or errors/omissions in the model extractor (e.g., failure to account for all possible program behaviors).


Namely, with overwhelming probability, the output s of Sinj describes an injective function fs that F -1 inverts correctly on all values in the image of fs.

ltdf there is only a negligible probability (over the choice of s)that fs(·) is not injective or that F -1 (t, ·) ltdf incorrectly computes fs -1(·) for some input.


An attacker successfully forges a signature if he/she is able to ensure the forged group-g signature elements lie on any ng one-way chains from the set Gg; the forged group-(g - 1) signature elements lie on ng-1 one-way chains from the set Gg-1 that are distinct from previously chosen one-way chains; and so on.

the number of ways to forge a signature is rng rnr-1 +(r - 1)ng ··· ng ng-1 rn1 +(r - 1)(ng + ng-1 + ·· · + n2) n1 } g rng g-1 rni +(r - 1) nj j=i+1 = .


the different data types that we observed during our monitoring.

mailbox account items contain the con.guration information for email accounts, i.e., the email address associated with the mailbox and the credentials required to access the mailbox and to send emails from it.


Unfortunately,intheCUDA runtime system[32], on whichMIDeAisbased, eachCPU threadis executedinits own CUDA context.

a different memory space has to be allocated in the GPU for each process, since they cannot share memory on the GPU device.


The plan p satis.es constraint (.,s,s 1), for example, if the same user is assigned to both steps by p,and satis.es constraint (.c ,s,s 1) if di.erent users are assigned to s and s 1 .

these represent, respectively, binding-of-duty and separation-of-duty constraints.


Besides the users should also be informed that their personal data will be used to compute further reputation and about all their rights and the procedures guaranteeing this rights.

the users must be informed about which personal data will be processed, how long they will be stored and who will have access to it.


These ratings are generally based on the content of the associated review, and possibly, the reviewer s history in the community, as this is the only information that is readily available to the community.

the self-regulation system as it commonly exists today does not support the discovery of information external to the community.


We show that the proposed defences are not interoperable with the common DNS servers con.gurations.

adoption of encryption would disrupt availability of 38% of 50K-top Alexa domains 2 and 12% Top-Level Domains (TLDs).


A single role can have its resilience to key compromise increased by using a (t, n) threshold signature scheme.

the signatures of at least t signers are required out of a set of n potential signers.


The second goal of precision constraints is to identify and remove imprecision introduced because of .owinsensitive program analysis.

a pair of code patterns pat1 and pat2 may appear together in a candidate .ngerprint, but may not appear together in all executions of the server.


given an ßsound time-lock puzzle (Gen, Sol, Ver), we can envision (Sol, Ver) as de.ning a timestamping scheme that is ß-sound against documents in the distribution generated by Gen. when Bob receives a document D at time T and wants to timestamp it for duration d, he treats D as the puzzle and solves it for parameter N such that Time(S)= N ·poly(n)= d to obtain the timestamp S. The ß-soundness of the time-lock puzzle guarantees that no adversary running in parallel time less than ß · ParTime(Sol) can convince the veri.er to accept a valid timestamp.


However, there may be static accountability analysis which can be done.

we would like to investigate those properties of obligation policies which ensure that when a system enforces its policies it will never become unaccountable.


Second, attacks that leverage existing native code, like return-oriented programming (ROP) [31], require control-.ow hijacking, which Virtual Ghost explicitly prevents as well.

virtual Ghost enforces Control Flow Integrity (CFI) [3] on kernel code in order to ensure that the compiler instrumentation of kernel code is not bypassed.


Such a one-dimensional security level assumes that each player optimally allocates his resources among the aforementioned security choices i) vi).

we assume that each node is capable of making the best security choices for self; i.e., the node s reaches the highest possible security level conditional on total amount of security resources that it expands.


The symbol of Perfigo as a control mechanism over our network was unpopular with a few students, and specific settings received reasonable criticisms.

(students wanted longer login periods, which we were able to grant.)


(o)is the object security classi.cation.

information .ow is only allowed between entities within the same domain.


These key data structures facilitate the MemSherlock debugging process.

state maintenance actions update the data structures so that the current state of execution is re.ected accurately, while memory checking actions ensure that only legitimate write instructions are executed.


Because the sender and its receivers share the same secret key, any one of the receivers can impersonate the sender and forge messages to other receivers.

both sender and receivers can sign messages.


However, their credential selection approach for policy compliance does not consider policies with .exible threshold on individual credential types which are considered in this paper (see Figure 1).

this does not allow speci.cation of complex policies in the form of tree structures.


This led to the partial implementation of such concepts in the SAP Research workflow stack [13].

we implemented a security enforcement point for a workflow tasklist manager, automated support for delegation and revocation schemes [14] and specification and enforcement of separation of duty policies using the JESS and iLog rule systems.


Let X be distributed according to probability distribution f. Then the probability that the anomalousness exceeds a is no greater than 2-a .

pf (Af (x) = a) = 2-a Note that for univariate and multivariate Gaussians, this de.nition agrees with the typical de.nitions of anomalousness, which are either based on the z-score or Mahalanobis distance.


The web form ensures that the delivery instructions (parameter directions) contain only uppercase and lowercase letters.

special characters and punctuation are disallowed to prevent command injection attacks on the server.


We present a formal security de.nition for dynamic SSE.

our de.nition captures a strong notion of security for SSE, which is adaptive security against chosen-keyword attacks(CKA2)[8].


This technique requires three pre-processed" secretshared values, say ([u], [v], [w]), unknown to the adversary A, such that w = u · v. Given such a shared multiplication triple, and shared inputs of a multiplication gate, say [x]and [y], the multiplication gate is securely evaluated using the equation [x · y] = (x - u)· (y - v)+ [v]· (x - u)+ [u]· (y - v)+ [u · v].

the parties compute the sharings of (x - u)and (y - v), and publicly reconstruct the same.


If a failure occurs or an invalid certificate is supplied during the negotiation, the connection is denied without overriding opportunities.


Since voice call records only contain limited information, such as call time, originating/terminating numbers, country codes and call durations, we explore the relationship among partiesparticipating inthecalls(i.e., whocallswhom ) for the fraud detection task.

we advance the notion of voice call graphs for representing the call records.


4.2 Overview The main insight of our work is embodied in subject certi.cate policies (SCPs), which bind a policy key pair (i.e., a policy public key and a policy private key)to parameters governing and protecting the usage of a domain s certi.cates.

sCPs provide information such as CAs authorized to sign certi.cates for a domain, minimum security levels for TLS parameters, and how certain TLS handshake errors should be handled, as well as which of these requirements also must be respected by certi.cates issued to subdomains.


The signature is calculated by signing the concatenation of the ID, password, public key, and an optional attribute with the private key of the user.

the user information is self-signed data.


First, the state vector updates at lines 1, 5 and 11 are executed in parallel by all threads.

consecutive threads access consecutive memory words, thus ensuring conflict-free shared memory accesses.


To prevent a version rollback of the loaded software, the PBBL uses a certi.cation list (blacklist or whitelist) to distinguish between valid and invalid software versions.

the PBBL only attests properties of software versions that are marked as valid.


The security audience for authorization is the service provider.

the user s sensitive information is located on the service provider, and the service provider must verify that the protected resource is sent to the same party that the user had granted access to.


As the basis of knowledge-based authentication in both schemes, we assume that it is possible to use passwords or personal questions, but not a mix of them.

the users are asked either previously determined passwords or previously registered personal questions.


While this .exibility is certainly an advantage, the downside is that more care needs to be taken when writing (or integrating) native code.

when using native code (e.g., C or C++) in a BHO, one needs to ensure robust input validation and memory management.


This contravention will constitute proof that the ordinance has indeed been contravened in the absence of evidence that the data subject complied with the requirement other than by way of observance of the code.

the formulation of codes of practice is a fair, transparent, and effective way of translating the principles into practice.


4.5 Administration One problem with the Bell-LaPadula model has been the di.culty of maintaining a secure system when arbitrary changes can be made to security levels.

mcLean showed that a secure system as de.ned by Bell-LaPadula does not necessarily imply that the system exhibits secure behaviour in any practical sense.


lattice based constructions can be based on the worst case hardness of a problem.

breaking them would imply a solution to any instance of a certain lattice problem.


This means that the if condition in Line 2 of SIMPLE-SECURITY(s, o) evaluates to true.

there exists some o 11 that serves as the o 1 in Line 2.


PBDM0, the first model of PBDM, supports permission level user-to-user delegation, i.e., a subset of permissions is allowed to be delegated.

a new delegation role is created with the set of permissions to be delegated explicitly assigned to it.


In this paper, we propose an approach to enable collaborative privacy management of shared data in OSNs.

we provide a systematic mechanism to identify and resolve privacy con.icts for collaborative data sharing.


Actually, this protocol is just a slightly modi.cation of the Base protocol.

the only difference is in the way the K nodes that a node is going to track are selected.


it minimizes message latency by constructing locally optimal routing tables from initialization and by maintaining them in order to reduce routing stretch.


Fixing this problem turns out to be much more complicated than it appears to be.

the Dropbox security team told us they were working on changing the architecture in our Android app to make that API secure , but the next-intent feature is unfortunately also very useful for us .


This property says that if the trust of a in b or the trust of b in c is untrust with ud = 1, the derived trust of a in c is also untrust with ud = 1.

in a trust network, a trust relationship with ud = 1 is the same as there is no trust relation between the two entities.


In DFA-based systems, compiling m regular expressions into a composite DFA provides guaranteed performance benefit over running m individual DFA.

a composite DFA reduces processing cost from O(m) (O(1) for each automaton) to O(1), i.e., a single lookup to obtain the next state for any given character.


The main downside of this approach is, of course, the need for an honest majority of clouds.

this method requires at least three clouds to be viable.


To render the problem tractable via brute force, the bastion speci.es a small range [rc,t , (rc,t + l) mod q] of possible seed values for its ephemeral key.

the bastion publishes pc,t = (gc,t , rc,t ).


We utilize the Prime+ Trigger+Probe load measurement technique to detect momentary activity spikes in an otherwise idle machine.

we repeatedly perform load measurements and report a keystroke when the measurement indicates momentarily high cache usage.


E2, then an adversary can tentatively assume the range [s1 , f1 ] is completely contained within the range [s2 , f2 ].


In [21] normative con.icts are addressed from the .eld of deontic logic, i.e., a logic focused on permission and/or obligation.

deontic logics are investigated that tolerate normative con.icts without allowing arbitrary derivations from inconsistencies.


One concept used in [3] is to use a level of indirection for the keys.

the system creates two keys for every key in the system.


We collected ground truth from the contacts and SMS databases taken from the logical image of each of the phones.

we used tokens collected from the allocated versions of the SQLite databases contacts2.db and mmssms.db, respectively.


Furthermore, we show that the circumvention of copy protections is embedded in an active ecosystem, describing its actors and interdependencies.

the main contributions of this work are:  We collected more than 43, 900 download links and performed automated and manual analysis on more than 23, 100 (3, 551 unique) resulting real-world crack downloads, providing deep insights into how cracks and keygens are used to spread malware.


This approach could be easily circumventedby running the code within adebugging environment that halts execution of the code before the deletion occurs.

the notion of a ROK entails a stronger protection method wherein the process of reading the key inherently results in it immediate destruction.


We choose to distinguish two random numbers by looking at the first binary digit of the random number.

let r1 and r2 be random numbers that has the same hash-image.


Initially, in both cases, we assume the adversary is capable of (at most) eavesdropping on bus communication.

the adversary is unable to observe communication between the cores in the SoC design.


Ideal correctness: We assume that server misbehavior is always detected, i.e., we assume perfect public veri.ability.

we abstract away the underlying cryptographic features of mixop proofs, and instead assume an ideal proof mechanism.


Also, while it is possible to go through these 2, 437 apps one by one, we .nd that we can still signi.cantly reduce the number of apps that need to be analyzed.

instead of analyzing each app, we opt to analyze each unique path our system detects (as such paths represent the actual behavior of concern).


The main advantage of PIRs is their privacy goal which is protecting access pattern.

iT-PIR protocols are slightly more suitable for NCRT applications.


We evaluate the system on a dataset of 3.4 million benign and 8,282 malicious webpages, which has been acquired over a period of 5 months.

we study the detection performance as well as the learning process over time for di.erent features and learning methods, such as anomaly detection and classi.cation approaches.


Backward Traceability: A strong attacker cannot identifythepastinteractions ofTi, evenifitknows Ti s present internal state.

an attacker is unable to discover the previous identi.ers of Ti because they are the cryptographic hashes of values not available to the tag.


XACML Permit-overrides PCA has the preference P > D > IN > NA.

when any sub-policy permits the request, the policy as a whole permits it.


However, depending on the way two parties interact with each other, one s private information may .ow to others in various forms, which are not always controlled by access control policies.

the di.erent behaviors of a negotiation participant may be exploited to infer sensitive information, even if credentials containing that information are never directly disclosed.


Since in Twitter, legitimate users tend to follow those accounts that share more useful information, it is relatively weird that these dummies has close relationships with criminal accounts while sharing little information, but they have many followers.

we extract intriguing dummy accounts, who post fewer than 5 tweets4 and whose follower numbers are at the top 10percentile.


Note that due to the postprocessing of data in memory as discussed in Section 4.5, the output of deRop is also independent of any speci.c running instance.

although the output of the dynamic analysis of deRop (value of esp) di.ers in each running instance, the output of deRop can be always the same, and is semantically equivalent to the original ROP and executes on the vulnerable application in all running instances.


Through experimentation, we established that the .rst code fragments that are validated in our secure-introspection algorithm are suf.cient to uniquely identify the guest OS.

the interrupt handlers (as pointed to by the IDT entries) vary signi.cantly across OS types, versions, and even patch levels.


Indeed, in these benchmarks, some of the processes run in base mode while others in hardened mode.

in the case of SSH with binding 1 the performance is comparable to the split-base performance.


Any UC-secure group key-exchange protocol is secure against insider attacks.

it is secure against insider impersonation attacks and guarantees agreement.


1.848) are the 1st, 2nd and 3rd column of Table 3.

if the victim s images were found being leaked on the Internet, the most likely leakage path is that the technician copied the images from the victim s laptop computer and then stored the copied images to a computer with Internet access.


The Primitive Domain 2 is included in the Primitive Domain 1, because the TCGbased attestation is stricter than the hash value comparison attestation.

tVD Agents 3 and 4 have already established shared primitive domains with TVD Agents 1 and 2.


We apply our watermark creation mechanism to known algorithms for image/video/audio watermarking.

for audio watermarking of mp3 audio files we use the algorithm proposed in [13, 14], while for uncompressed audio files (wav) we use the algorithm proposed in [7].


In our design, we strive to make our system model as general and applicable as possible.

we desire to minimize any assumptions regarding the client s performance or security capacities.


Many group key management techniques for wireless ad hoc networks and sensor networks fall into the third category.

these schemes may take the threshold-based approach, in which the group key is either agreed among group members or generated based on shares from group members [14, 6, 7].


Fig 6 shows that when word shift modi.cation grows larger, the classi.er s detection e.ciency goes better.

steganographic scheme which shifts words far away from its origin position will have a high risk to be detected out.


Odd(T ), then the reduced game is G(Y,X)Tv .

the game with parameters (k, d ' , PYTv , PXTv ), where d ' is the depth of Tv.


This paper is therefore not primarily about experimentation with security solutions (such as cryptographic protocols), yet with technologies in a wider sense in which security controls appear as important building blocks.

we focus on the deployment of such technologies as experiments (Table 1), which has also been termed societal experiment , and might as well be called sociotechnical experiment .


Clients and other entities that interact with an SID instance I must have a means to infer trust properties of I and associate them with I s public key.

it is no longer su.cient to bind I s public key to a DNS domain controlled by S a cornerstone of the security architecture of today s Web.


When encountering a ret or a direct or indirect jmp instruction, we stop disassembling this function.

our disassembling adopts a linear sweep algorithm [31].


A more strict property may require the access machine to refresh attributes before granting any access.

when S1 requests access to O1, the stricter version of the stale-safe property mandates that the access machine refreshes the subject attributes before making an authorization decision.


UC-SimList is generated by first considering the semantically similar characters for each character in UCS, finding all visually similar characters of each semantically similar character, and finally ranking all these characters with their visual similarities for each character.

uC-SimList(c)=UC-SimListv(UC-SimLists(c)), where c is a given character, UC-SimLists(c) denotes the semantically similar character set of c, UC-SimListv(·) denotes the visually similar character set of character set · , and UC-SimList(c) denotes the similar character set of character c. We denote UC-SimListT as the Unicode Character Similarity List that only contains the characters with similarities larger than T (the similarity threshold), e.g., UC-SimList0.8 is a subset of UC-SimList that only contains the characters with similarities larger than 0.8.


It statically extracts JavaScript code from a PDF .le and then dynamically analyzes it by using SpiderMonkey as interpreter.

the interpreter is instructed to scan each new string that is allocated into memory for the presence of shellcode.


The Precise Query Protocols (PQPs) (e.g., [4 7, 23, 29]) use sophisticated encryption techniques that enables the server to execute range queries without incurring any false positives.

for any given encrypted range query, the server returns the exact set of etuples that satis.es the given query.


Property of semi-honest party was first introduced by Goldreich in [9] and it simply assumes that such parties are honest but curious.

they do not participate in extra protocol activities but gather anyleaked information from the protocol.


To decorate the proxy certificate, Science Gateways install the GridShib SAML Tools software, which generates and inserts a SAML assertion containing user attributes into a proxy certificate associated with the user s session.

the SAML assertion contains a user identifier that allows the Resource Provider to uniquely associate jobs submitted using that certificate with a particular Science Gateway user.


(where |t | is the bit representation length of t ).

the encoding of each indexed ring element is a uniformly random string of length l. this implies that the only way that A can obtain valid encodings is by calls to the oracle RG (except with negligible probability).


3.3 A Note on the Chain Rule of Guesswork In De.nition 5, i.e., the de.nition of guesswork, the smallest probability value in the sum is weighted by the permutation with n. This is, however, not completely correct, since the last guess in the guessing process discriminate the last two values of the random variable [10].

if the answer of the last question is yes then the correct value is X = xn-1, and the search terminates.


Unlike port numbers, the popular source IP subnets of scans keep changing.


For camera-related behavior, users opinions varied considerably between the four associated rules.

using the camera to show a preview only was viewed as far less objectionable than the other behavior, which involved actually taking a picture.


R, where C denotes a set of input challenges (usually encoded as a bit string) and R is a set of responses.

for a single device, providing the same input Ci to the PUF will yield approximately the same result Ri.


MINE-TAG: MINING TAGS FOR MINED ROLES After we obtain the roles using the above role mining algorithms, administrators have no way of knowing how to use those roles, because the mined roles are only a symbol connecting applications (subjects ) and permissions.

if an application requires roles, the administrators might not know which roles should be assigned to the application.


They are thus more separated from the vulnerable application and its wide variety of potential environment con.gurations and therefore less likely to have unforeseen side e.ects.

their compatibility with normal operation is in principle relatively easy to test: Since they operate only on network tra.c, and are intended only to drop attack tra.c, they can be tested simply by exposing them to a suitably rich collection of network tra.c such as a long trace of past network activity, or a synthetic test suite of representative tra.c to verify that they would allow it all through una.ected.


We also took the following steps to ensure that the interpretation of our results was clear: We compare the information .ow from source to sink(i.e., network to CPU control path) during attacks to the information .ow for the same exact network request against a nonvulnerable version of the system.

we repeat the attack against a patched version of the system.


(w, p, v) is de.ned to be {f | K, w, v |= p says f}.

our .rst concern is whether k2b(K) produces a belief model that is equivalent to K. a formula should be valid in K i. it is valid in k2b(K).


the .rst player starts from the vertex V1, and the second player starts from V2.


NFC proximity enables secure delegation over the NFC interface.

the car owner O can authenticate the user U based on a visual contact, while both platforms can use a secure channel based on a key established via NFC3 .


Assuming the host has given the guest enough memory for its regular operation, the guest can also use as much of that memory as it wishes for DMA.

the quota will be indirectly applied since the pages that are used by the balloon will never be added to the map cache, and pages which were previously in the map cache and the balloon allocated will be removed from the map cache.


While facilitating the enforcement of a consistent policy throughout the system, this architecture relies on the PEP being able to contact the PDP to query decisions, and therefore su.ers from a single point of failure.

key factors that a.ect the performance of the PEP are latency of the communication with the PDP, reliability and survivability of this connection (and the PDP itself), as well as the aggregated impact of communication costs (which can include contacting a human to perform the authorization).


Our goal is therefore to identify opportunities for parameter tampering while requiring as little manual guidance as possible.

we ask two things of human developers / testers: to provide hints about vital information not present on the client and to check whether or not the parameter tampering opportunities we identify are true vulnerabilities (perhaps by generating actual exploits).


In contrast, a social network service (SNS) which wants to increase membership would give high priority to minimizing the impact on the usability rather than to the strength of the security.

the implementation of a distributed coalition should allow choosing what priority is given by coordinating for a good balance between the strength of security and the impact on usability depending on various usage scenarios.


The limitations of using these solutions in our setting, however, outweigh its advantages.

we want to permit a user to access the service an unlimited number of times during each time interval, which means that the threshold k will have to be set to a high value.


2.4 Similarity Matrix Computation Having extracted variable length sequences from a malware corpus, we proceed to compute a similarity matrix.

we construct Boolean sample vectors based on the occurrence of these variable-length sequences in each sample.


An important requirement is that the calling convention for these libraries is not changed.

it must be possible to pass a pointer to the library, as this is a common idiom in many programming languages for passing large arguments, or for returning data to the caller.


safeE ((UA, PA, RH ))] if C enforces (E, PA, RH ), then C rules out every user-role assignment relation UA such that (UA, PA, RH )is not safe with respect to E. Example 2.


We tested all exploits for which we were able to obtain the software.

all the attacks were performed against vulnerabilities in software available with the professional version of the OS, with the exception of the War-FTPD ftp server which is third-party software.


None of this needs to be represented in the replica, so this heap size constitutes the baseline for our experiments.

we focus on heap size increase seen when we run Hotmail within Firefox.


By event 24, where the attack attempts to complete, the response measures in place prevent it from succeeding.

write access has been disabled for the temporary version of the password .le in the temporary directory where uploads are allowed.


Due to the fact that the functionality and the computational power of mobilephonesarestillgrowing theriskswillalso increase,and software security of mobile phones becomes an important issue.

a broken link concept together with an error in the FileConnection API led to a security hole giving access to the entire internal .le system.


should not be assigned to multiple attack characters.

4.2.3 Translation to ILP X constrij =1, .j .N (5) i.M For a sFSA IDS, we propose translating the problem of .nding a where M and N are the set of attack and normal characters, regood path in a DAG into an Integer Linear Programming problem.


4.1 Techniques and Examples We now exemplify IND constructions using three known signature schemes: FDH-RSA [4], Schnorr [26], and Boneh-Boyen [5].

we show that indistinguishable schemes can be obtained in di.erent cryptographic setting, i.e.


For each of these combinations, he speci.es his preference to disclose location information.


Note that, in order for a DIC query to be satis.ed by a variable assignment, both conditions (a) and (b) must hold.

if a variable assignment fails to satisfy the DIC query, then either the subpolicy is not evaluated, or else its evaluation yields a decision value that is not in ds.


The delivery service delivers the goods to the client.

e-cashless transactions involve the client s and merchant s secure information such as credit/debit card numbers and private information.


Shamir [33] and Blakley [6] were the .rst to propose a construction for secret-sharing schemes where the access structure is a threshold gate.

if any t or more parties come together, they can reconstruct the secret by using their shares; however, any lesser number of parties do not get any information about the secret.


Finally, for federal elections, responsibility for seating in the U. S. Senate and House of Representatives is exclusively theirs.

congress itself decides who its members are.


We present a comprehensive way in which the risk values can be associated with permissions and roles.

we introduce the notion of inference of unauthorized permissions when calculating the risk of activation of a set of roles.


The state of the art of CAPTCHA design suggests that the robustness of text-based schemes should rely on the difficulty of finding where the character is (segmentation), rather than which character it is (recognition) [11, 3, 4, 5, 6].

such CAPTCHAs should be segmentation-resistant.


The third row shows the overhead of our implementation versus a VM that is running our taint-friendly kernel and network driver, but without any emulator; there is no taint tracking, and no switching into emulation.

we add about 10 percent total overhead to LMbench for running it on a virtual machine that is doing full system taint tracking.


A problem that arises with this type of PUF though is that there is a one-to-one correspondence between a changing input bit and a changing output bit.

on a 128bit PUF, changing bit 54 of the input will change only bit 54 of the output.


The following de.nition introduces special rights (metarights),called transaction-rights,which authorise its owner to perform certain transactions.

ownership of such rights is explicitly required to perform certain transactions.


The result is not surprising because Tl is point-wisely the smallest t-norms in these three operations.

to reach a same con.dence degree of a low risk, Tl requires higher con.dence degrees of these two risk factors.


In realistic settings however, key management techniques should take into account the possible weaknesses of the computing environment.

key-evolving signatures should be endowed with a safeguard against maliciously controlled computing platforms.


It is obvious that we can specify these requirements using RBAC = for the con.gurations shown in Figures 1(a) ST and 1(b).


The placements of a .eld and of a statement that accesses the .eld must be consistent.

if a statement writes to a .eld, then the statement and the .eld must have the same placement; if a statement reads a .eld, then the statement must be replicated on a subset of the hosts that the .eld is replicated on.


a certain node v, and the labeling function L; the output is a yes-or-no answer that indicates whether AG, L, v |= f holds.

model checking is the process of testing whether a plan adheres to a policy rule.


The function is intended to capture the dependency relationship between the resistance value of exploits.

executing some exploits may affect the resistance value of another exploit, even though the latter cannot be executed yet.


More fundamentally, even for a browser not using the wide-character representation, the attack still lacks an important prerequisite there is no way for the attacker frame to detect a syntax error in the victim frame, because the two frames are in different domains.

for the probing attack to succeed, the attacker frame already needs the capability to communicate with the victim frame (e.g., through the onerror method of the victim frame), but such a prerequisite is exactly the domain-isolation violation that the attacker tries to achieve.


In the new attack, certain return-like instruction sequences take the place of the return instruction.

these instruction sequences are rare but a single one used as a trampoline suf.ces to chain together other instruction sequences that each end in an indirect jump, which makes it possible to construct a Turing-complete 13http://code.google.com/p/androidterm/ 14Tan and Croft [44] identi.ed various vulnerabilities in native code of the JDK (Java Development Kit).