1,891 research outputs found
Security Toolbox for Detecting Novel and Sophisticated Android Malware
This paper presents a demo of our Security Toolbox to detect novel malware in
Android apps. This Toolbox is developed through our recent research project
funded by the DARPA Automated Program Analysis for Cybersecurity (APAC)
project. The adversarial challenge ("Red") teams in the DARPA APAC program are
tasked with designing sophisticated malware to test the bounds of malware
detection technology being developed by the research and development ("Blue")
teams. Our research group, a Blue team in the DARPA APAC program, proposed a
"human-in-the-loop program analysis" approach to detect malware given the
source or Java bytecode for an Android app. Our malware detection apparatus
consists of two components: a general-purpose program analysis platform called
Atlas, and a Security Toolbox built on the Atlas platform. This paper describes
the major design goals, the Toolbox components to achieve the goals, and the
workflow for auditing Android apps. The accompanying video
(http://youtu.be/WhcoAX3HiNU) illustrates features of the Toolbox through a
live audit.Comment: 4 pages, 1 listing, 2 figure
SDN as Active Measurement Infrastructure
Active measurements are integral to the operation and management of networks,
and invaluable to supporting empirical network research. Unfortunately, it is
often cost-prohibitive and logistically difficult to widely deploy measurement
nodes, especially in the core. In this work, we consider the feasibility of
tightly integrating measurement within the infrastructure by using Software
Defined Networks (SDNs). We introduce "SDN as Active Measurement
Infrastructure" (SAAMI) to enable measurements to originate from any location
where SDN is deployed, removing the need for dedicated measurement nodes and
increasing vantage point diversity. We implement ping and traceroute using
SAAMI, as well as a proof-of-concept custom measurement protocol to demonstrate
the power and ease of SAAMI's open framework. Via a large-scale measurement
campaign using SDN switches as vantage points, we show that SAAMI is accurate,
scalable, and extensible
SODALITE@RT: Orchestrating Applications on Cloud-Edge Infrastructures
AbstractIoT-based applications need to be dynamically orchestrated on cloud-edge infrastructures for reasons such as performance, regulations, or cost. In this context, a crucial problem is facilitating the work of DevOps teams in deploying, monitoring, and managing such applications by providing necessary tools and platforms. The SODALITE@RT open-source framework aims at addressing this scenario. In this paper, we present the main features of the SODALITE@RT: modeling of cloud-edge resources and applications using open standards and infrastructural code, and automated deployment, monitoring, and management of the applications in the target infrastructures based on such models. The capabilities of the SODALITE@RT are demonstrated through a relevant case study
Active Learning of Discriminative Subgraph Patterns for API Misuse Detection
A common cause of bugs and vulnerabilities are the violations of usage
constraints associated with Application Programming Interfaces (APIs). API
misuses are common in software projects, and while there have been techniques
proposed to detect such misuses, studies have shown that they fail to reliably
detect misuses while reporting many false positives. One limitation of prior
work is the inability to reliably identify correct patterns of usage. Many
approaches confuse a usage pattern's frequency for correctness. Due to the
variety of alternative usage patterns that may be uncommon but correct, anomaly
detection-based techniques have limited success in identifying misuses. We
address these challenges and propose ALP (Actively Learned Patterns),
reformulating API misuse detection as a classification problem. After
representing programs as graphs, ALP mines discriminative subgraphs. While
still incorporating frequency information, through limited human supervision,
we reduce the reliance on the assumption relating frequency and correctness.
The principles of active learning are incorporated to shift human attention
away from the most frequent patterns. Instead, ALP samples informative and
representative examples while minimizing labeling effort. In our empirical
evaluation, ALP substantially outperforms prior approaches on both MUBench, an
API Misuse benchmark, and a new dataset that we constructed from real-world
software projects
- …