Computer Security Research Research Articles

HAformer: Semantic fusion of hex machine code and assembly code for cross-architecture binary vulnerability detection

Binary vulnerability detection is a significant area of research in computer security. The existing methods for detecting binary vulnerabilities primarily rely on binary code similarity analysis, detecting vulnerabilities by comparing the similarities embedded in binary codes. Recently, Transformer-based models have achieved significant progress in this field, leveraging their advantage in handling sequential data to better understand the semantics of assembly code. However, to prevent the out-of-vocabulary (OOV) problems, assembly code typically needs to be normalized, which would lose some important numerical and jump information. In this paper, we propose HAformer, a Transformer-based model, which semantically fuses hexadecimal machine codes and assembly codes to extract richer semantic information from binary codes. By incorporating the hexadecimal machine code and a newly designed assembly code normalization method, HAformer can alleviate the problem of numerical information loss caused by traditional assembly code normalization, thereby addressing the issue of OOV. Evaluation results demonstrate that our HAformer outperforms the baseline method in the Recall@1 metric by 16.9%, 25.5% and 19.2% in cross-optimization level, cross-compiler and cross-architecture environments, respectively. In real-world vulnerability detection experiments, HAformer exhibits the highest accuracy.

Recent Trends of Authentication Methods in Extended Reality: A Survey

Extended Reality (XR) is increasingly gaining momentum in industries such as retail, health, and education. To protect users’ personal data, establishing a secure authentication system for XR devices becomes essential. Recently, the focus on authentication methods for XR devices has been limited. To further our understanding of this topic, we surveyed authentication schemes, particularly systems and methods deployed in XR settings. In this survey, we focused on reviewing and evaluating papers published during the last decade (between 2014 and 2023). We compared knowledge-based authentication, physical biometrics, behavioral biometrics, and multi-model methods in terms of accuracy, security, and usability. We also highlighted the benefits and drawbacks of those methods. These highlights will direct future Human–computer Interaction (HCI) and security research to develop secure, reliable, and practical authentication systems.

(Retracted) Research on computer network security evaluation based on image recognition and neural network

In today’s social development, the level of informatization has been greatly improved. Computer networks are now used in all aspects of society, especially with the popularity of mobile phones and computers. Basically, a mobile phone is a computer that stores all the information of a person, so it is indispensable for carrying out research on computer network security evaluation. The purpose of this article is to examine the growing state of information security threats in computer networks. Neural network technology, which is considered secure, has high flexibility, fast access to information, strong logic, and low failure. Toward creating a low-cost network topology, we used a low-cost network risk assessment method to assess the security of computer networks based on neural networks, and we evaluated existing risks that are appropriate for future computer security research. The results of the study show that neural networks using the Bayesian network method have a significant impact on network security. Considering the problems that can occur with information security risks, computer security systems based on neural networks have a 30% reduction in information error rate compared with traditional methods, and computer network systems based on neural networks have better learning performance to safeguard network security. Improving the security of information requires further research and evaluation of computer network security based on neural networks.

Multiresolution dendritic cell algorithm for network anomaly detection.

Anomaly detection in computer networks is a complex task that requires the distinction of normality and anomaly. Network attack detection in information systems is a constant challenge in computer security research, as information systems provide essential services for enterprises and individuals. The consequences of these attacks could be the access, disclosure, or modification of information, as well as denial of computer services and resources. Intrusion Detection Systems (IDS) are developed as solutions to detect anomalous behavior, such as denial of service, and backdoors. The proposed model was inspired by the behavior of dendritic cells and their interactions with the human immune system, known as Dendritic Cell Algorithm (DCA), and combines the use of Multiresolution Analysis (MRA) Maximal Overlap Discrete Wavelet Transform (MODWT), as well as the segmented deterministic DCA approach (S-dDCA). The proposed approach is a binary classifier that aims to analyze a time-frequency representation of time-series data obtained from high-level network features, in order to classify data as normal or anomalous. The MODWT was used to extract the approximations of two input signal categories at different levels of decomposition, and are used as processing elements for the multi resolution DCA. The model was evaluated using the NSL-KDD, UNSW-NB15, CIC-IDS2017 and CSE-CIC-IDS2018 datasets, containing contemporary network traffic and attacks. The proposed MRA S-dDCA model achieved an accuracy of 97.37%, 99.97%, 99.56%, and 99.75% for the tested datasets, respectively. Comparisons with the DCA and state-of-the-art approaches for network anomaly detection are presented. The proposed approach was able to surpass state-of-the-art approaches with UNSW-NB15 and CSECIC-IDS2018 datasets, whereas the results obtained with the NSL-KDD and CIC-IDS2017 datasets are competitive with machine learning approaches.

Lessons Learnt on Reproducibility in Machine Learning Based Android Malware Detection

A well-known curse of computer security research is that it often produces systems that, while technically sound, fail operationally. To overcome this curse, the community generally seeks to assess proposed systems under a variety of settings in order to make explicit every potential bias. In this respect, recently, research achievements on machine learning based malware detection are being considered for thorough evaluation by the community. Such an effort of comprehensive evaluation supposes first and foremost the possibility to perform an independent reproduction study in order to sharpen evaluations presented by approaches’ authors. The question Can published approaches actually be reproduced? thus becomes paramount despite the little interest such mundane and practical aspects seem to attract in the malware detection field. In this paper, we attempt a complete reproduction of five Android Malware Detectors from the literature and discuss to what extent they are “reproducible”. Notably, we provide insights on the implications around the guesswork that may be required to finalise a working implementation. Finally, we discuss how barriers to reproduction could be lifted, and how the malware detection field would benefit from stronger reproducibility standards—like many various fields already have.

Toward Both Privacy and Efficiency of Homomorphic MACs for Polynomial Functions and Its Applications

Abstract Homomorphic message authentication codes (MACs) allow a user to outsource data to an untrusted server and verify the correctness of returned computation results over the outsourced data. Many cloud applications need delegation computations over outsourced data with dual capabilities. On one hand, they need to keep the outsourced data secret such that the server cannot trace and infer any sensitive information from the computation results. On the other hand, the user should be able to efficiently verify the computation results. Unfortunately, the state-of-the-art homomorphic MAC schemes are not so desirable due to either poor privacy or low verification efficiency. In this paper, we first put forward a new cryptographic primitive called privacy-preserving homomorphic MACs (PHMAC) that simultaneously provides data privacy and efficient verification. Then, we present a PHMAC construction capable for the evaluation of polynomials of fixed degree $d\geq 1$, in which the tag does not reveal any information of underlying authenticated data while being verifiable in constant time (in an amortized sense). As an application, we give a generic construction of homomorphic authenticated encryption (HAE) from proposed PHMAC and homomorphic encryption. Benefited from the functionalities of underlying PHMAC scheme, the derived HAE enjoys stronger authenticity and supports larger classes of functions than that of Lai et al. (Verifiable Computation on Outsourced Encrypted Data. In Computer Security—ESORICS 2014—19th European Symposium on Research in Computer Security, Wroclaw, Poland, September 7–11, Part I, pp. 273–291. Springer, Berlin). Such HAE enables verifiable delegation computations over growing outsourced encrypted data in an efficient way.

SECURITY ANALYSIS BETWEEN STATIC AND DYNAMIC S-BOXES IN BLOCK CIPHERS

The development of block ciphers has resulted in a number of cryptographic algorithms such as AES, aria, blowfish256, desl, and 3d-aes. AES is one of the best cryptographic algorithms that can be used to protect electronic data. However, the principal weakness in AES is the linearity in the s-box. The objective of this research is to investigate and evaluate the existing work related to the dynamic s-box. Other than that, the aim of this research is to design a dynamic s-box using affine transformation in order to increase the security of the encryption. The method to design is using java with the NetBeans software. The proposed block cipher will be tested using NIST statistical test suite to test the randomness of the algorithm. Besides, the strength of the s-box will be analyzed using the s-box evaluation tool (set). The cryptographic strength depends strongly on the choice of s-box. Therefore, this new proposed block cipher can be used by countries, organizations, stakeholders, or interested parties as one of the secure algorithms to increase the protection of the information and also will contribute as an alternative to other cryptographic algorithms in computer security research.

Analysis Performance BCRYPT Algorithm to Improve Password Security from Brute Force

The Bcrypt algorithm is a hashing function created from the Blowfish Algorithm by two computer security researchers, Niels Provos and David Mazieres. This hashing function has several advantages, using the original random salt (the salt is the order in which it is added to the password to make it harder to bruteforce). Random salts also prevent lookup table creation. On this basis, the authors try to do a Brute Force experiment on plaintext that has been encrypted by the Bcrypt Algorithm based on 3 characters, namely alphabetic characters, numeric characters and mixed characters to see the security results of the Bcrypt Algorithm. From the results of tests conducted, the alphabetic character with a total of 4 characters can be returned to the original plaintext within 4 days while if the number of 5 characters cannot be found the original plaintext. Then the numeric characters with a total of 7 characters can be found in the original plaintext within 10 hours. Meanwhile, for mixed characters with a total of 7 characters, the original plaintext cannot be found within 5 days. The results of this study indicate that the security performance of the Bcrypt Algorithm is very good in warding off Brute Force attacks for mixed characters while the numeric and alphabetic characters are not good enough.

A Systematic State-of-the-Art Analysis of Multi-Agent Intrusion Detection

Multi-agent architectures have been successful in attaining considerable attention among computer security researchers. This is so, because of their demonstrated capabilities such as autonomy, embedded intelligence, learning and self-growing knowledge-base, high scalability, fault tolerance, and automatic parallelism. These characteristics have made this technology a de facto standard for developing ambient security systems to meet the open and dynamic nature of today’s online communities. Although multi-agent architectures are increasingly studied in the area of computer security, there is still not enough empirical evidence on their performance in intrusions and attacks detection. The aim of this paper is to report the systematic literature review conducted in the context of specific research questions, to investigate multi-agent IDS architectures to highlight the issues that affect their performance in terms of detection accuracy and response time. We used pertinent keywords and terms to search and retrieve the most recent research studies, on multi-agent IDS architectures, from the major research databases and digital libraries such as SCOPUS, Springer, and IEEE Explore. The search processes resulted in a number of studies; among them, there were journal articles, book chapters, conference papers, dissertations, and theses. The obtained studies were assessed and filtered out, and finally, there were over 71 studies chosen to answer the research questions. The results of this study have shown that multi-agent architectures include several advantages that can help in the development of ambient IDS. However, it has been found that there are several issues in the current multi-agent IDS architectures that may degrade the accuracy and response time of intrusions and attacks detection. Based on our findings, the issues of multi-agent IDS architectures include limitations in the techniques, mechanisms, and schemes used for multi-agent IDS adaptation and learning, load balancing, scalability, fault-tolerance, and high communication overhead. It has also been found that new measurement metrics are required for evaluating multi-agent IDS architectures.

Emerging Education Challenges for Resilient Cyber Physical Systems

AbstractEngineering resilient cyber physical systems (CPS) is viewed as a systems engineering (SE) challenge. The research and education programs in computer and software security and resilience were advanced through the 1990's with many formal approaches to system reliability, security, dependability, and safety. Since that time, the internet and the information security needs in information technology (IT) systems has had a large education focus. Meanwhile, the scale and complexity of today's critical computing systems used in engineering domains has increased immensely. There has not been a related increased focus on research, knowledge, and education specifically addressing dependable and secure computing in domains such as infrastructure, industrial control, defense, and emerging commercial autonomous systems and the Internet of Things (IoT). While security education in the U.S. has greatly expanded in the domain of IT systems and related computer science and engineering fields, there exists a lack of engineering education programs and opportunities for engineering graduates to gain knowledge and skills related to design of secure, safe, and dependable CPS, what we call resilient CPS. There is also a lack of investment in laboratory facilities that can simulate large scale CPS, which are costlier to develop than IT related facilities. Formal research or studies in CPS and resilient computing related curricula are also difficult to find, although the domain is well researched. This paper discusses the primary foundations and characteristics of resilient CPS as a step toward a general taxonomy, the emerging needs and gaps in engineering education related to these systems, and the knowledge areas and bodies of knowledge that are already established or need to be developed in the education system. The goal is to bring broad attention in the systems engineering community to these needs.

Automatic translation of assembly shellcodes to printable byte codes

The generation of printable shellcode is an important computer security research area. The original idea of the printable shellcode generation was to write a binary, executable code in a way that the generated byte code contains only bytes that are represented by the English letters, numbers and punctuation characters. In this way unfortunately only a limited number of CPU instructions can be used. In the originally published paper a small decoder is written with instructions represented by printable characters and the shellcode is decoded on the stack to be executed later. This paper, however describes a proof of concept project, which converts the source code of a full assembly program or shellcode to a new source code, whose compiled binary code contains only printable characters. The paper also presents new, printable character implementation of some CPU instructions.

Computer security for data collection technologies

Many organizations in the developing world (e.g., NGOs), include digital data collection in their workflow. Data collected can include information that may be considered sensitive, such as medical or socioeconomic data, and which could be affected by computer security attacks or unintentional mishandling. The attitudes and practices of organizations collecting data have implications for confidentiality, availability, and integrity of data. This work, a collaboration between computer security and ICTD researchers, explores security and privacy attitudes, practices, and needs within organizations that use Open Data Kit (ODK), a prominent digital data collection platform. We conduct a detailed threat modeling exercise to inform our view on potential security threats, and then conduct and analyze a survey and interviews with technology experts in these organizations to ground this analysis in real deployment experiences. We then reflect upon our results, drawing lessons for both organizations collecting data and for tool developers.

Artificial superintelligence: a futuristic approach

A day does not go by without a news article reporting some amazing breakthrough in artificial intelligence (AI). Many philosophers, futurists, and AI researchers have conjectured that human-level AI will be developed in the next 20 to 200 years. If these predictions are correct, it raises new and sinister issues related to our future in the age of intelligent machines. Artificial Superintelligence: A Futuristic Approach directly addresses these issues and consolidates research aimed at making sure that emerging superintelligence is beneficial to humanity. While specific predictions regarding the consequences of superintelligent AI vary from potential economic hardship to the complete extinction of humankind, many researchers agree that the issue is of utmost importance and needs to be seriously addressed. Artificial Superintelligence: A Futuristic Approach discusses key topics such as: AI-Completeness theory and how it can be used to see if an artificial intelligent agent has attained human level intelligence Methods for safeguarding the invention of a superintelligent system that could theoretically be worth trillions of dollars Self-improving AI systems: definition, types, and limits The science of AI safety engineering, including machine ethics and robot rights Solutions for ensuring safe and secure confinement of superintelligent systems The future of superintelligence and why long-term prospects for humanity to remain as the dominant species on Earth are not great Artificial Superintelligence: A Futuristic Approach is designed to become a foundational text for the new science of AI safety engineering. AI researchers and students, computer security researchers, futurists, and philosophers should find this an invaluable resource.

The ethics of social honeypots

This paper considers some of the ethical issues surrounding the study of malicious activity in social networks, specifically using a technique known as social honeypots combined with the use of deception. This is a potentially touchy area of study that is common to social and behavioral research that is well understood to fall within the boundaries of human subjects research that is regulated in the United States and reviewed by institutional review boards, but is not well understood by computer security researchers or those in the private sector. The firestorm of controversy over the 2014 “emotional contagion” study of Facebook users shows that learning about being deceived may itself be the harm, to both those users involved and their trust in researchers and research in general. Should researchers have an obligation to try to find research methods that do not involve deception to achieve the same research results?

The Birth and Death of the Orange Book

This article traces the origins of US government-sponsored computer security research and the path that led from a focus on government-funded research and system development to a focus on the evaluation of commercial products. That path led to the creation of the Trusted Computer System Evaluation Criteria (TCSEC), or Orange Book. The TCSEC placed great emphasis on requirements for mandatory security controls and high assurance, and the resulting TCSEC evaluation process was time-consuming and costly for commercial vendors and emphasized product features not valued by customers. As a result, vendor commitment to evaluations waned. The TCSEC was eventually supplanted by the international Common Criteria, which after almost 15 years, have moved to a model based on more straightforward requirements and a more deterministic evaluation process.

Detecting Intrusion Using Recursive Clustering and Sum of Log Distance to Sub-centroid

Network security is becoming a focus in computer security research. One way to maintain the security of computer networks is using network-based Intrusion Detection System (N-IDS). Here, machine learning-based IDS has been gaining more attention than other methods for decades. In more details, feature representation is one of the methods which is used to classify data in machine learning. A small amount of good features is able to increase the accuracy of detection process and also to decrease the cost of computation; and for some cases, it gives the network administrator some idea what needs to do. Some research has been done in order to find good features. Nevertheless, it is relatively not good as represented by its accuracy. This paper proposes a new method to generate a representative feature to classify normal and anomalous connections. In this approach, two types of distance are measured and summed to generate a new feature. The first is the distance whose value is the sum of data item to cluster centers; while the second is the distance whose value is sum of log distance from data to its cluster sub-centroids. This new one-dimensional data is used to classify new data using k-nearest neighbor classifier. The experimental results, which are obtained by using a subset of KDD99 and Kyoto2006++, are relatively good in terms of accuracy and specificity, those are (99.57%, 99.75%) and (94.84%, 93.53%), respectively.

Virtual machine introspection: towards bridging the semantic gap

Virtual machine introspection is a technique used to inspect and analyse the code running on a given virtual machine. Virtual machine introspection has gained considerable attention in the field of computer security research. In recent years, it has been applied in various areas, ranging from intrusion detection and malware analysis to complete cloud monitoring platforms. A survey of existing virtual machine introspection tools is necessary to address various possible research gaps and to focus on key features required for wide application of virtual machine introspection techniques. In this paper, we focus on the evolution of virtual machine introspection tools and their ability to address the semantic gap problem.

Can We Sniff Wi-Fi?: Implications of Joffe v. Google

On 27 December 2013, the US Court of Appeals for the Ninth Circuit issued an opinion that intercepting data from unencrypted wireless local area networks--Wi-Fi sniffing--can violate the US Wiretap Act. The case centers on a Wi-Fi sniffer that was present in Google Street View vehicles that roamed the US between 2008 and 2010 and that were permanently recording every unencrypted Wi-Fi frame that they intercepted. Although the Wiretap Act has a broad exemption for intercepting radio communications that are generally accessible to the public, the Court ruled that Wi-Fi is not a radio communication. The ruling, if it stands, will significantly impact computer security education, in which Wi-Fi sniffing is a common student exercise; security practitioners, who frequently sniff for security assessments; and computer security research, which has traditionally used collection in the wild as a way of finding vulnerabilities.

The Menlo Report: Ethical Principles Guiding Information and Communication Technology Research

This report proposes a framework for ethical guidelines for computer and information security research, based on the principles set forth in the 1979 Belmont Report, a seminal guide for ethical research in the biomedical and behavioral sciences. Despite its age, the Belmont Report’s insightful abstraction renders it a valuable cornerstone for other domains. We describe how the three principles in the Belmont report can be usefully applied in fields related to research about or involving information and communication technology.

The IEEE Symposium on Security and Privacy, in Retrospect

nullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnull